From ec1ab43ca2ba22fbe7db5ad5bf2ba3800c31262a Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 17 Nov 2020 17:27:37 +0000 Subject: [PATCH 001/103] Migrate /var/run to /run, an exercise in pointlessness Resolves: #1898410 --- kadmin.service | 4 ++-- krb5-krb5kdc.conf | 2 +- krb5.spec | 16 +++++----------- krb5kdc.service | 4 ++-- 4 files changed, 10 insertions(+), 16 deletions(-) diff --git a/kadmin.service b/kadmin.service index f1677c6..daa08b1 100644 --- a/kadmin.service +++ b/kadmin.service @@ -6,9 +6,9 @@ AssertPathExists=!/var/kerberos/krb5kdc/kpropd.acl [Service] Type=forking -PIDFile=/var/run/kadmind.pid +PIDFile=/run/kadmind.pid EnvironmentFile=-/etc/sysconfig/kadmin -ExecStart=/usr/sbin/kadmind -P /var/run/kadmind.pid $KADMIND_ARGS +ExecStart=/usr/sbin/kadmind -P /run/kadmind.pid $KADMIND_ARGS ExecReload=/bin/kill -HUP $MAINPID [Install] diff --git a/krb5-krb5kdc.conf b/krb5-krb5kdc.conf index eadeb51..5160b28 100644 --- a/krb5-krb5kdc.conf +++ b/krb5-krb5kdc.conf @@ -1 +1 @@ -d /var/run/krb5kdc 0755 root root +d /run/krb5kdc 0755 root root diff --git a/krb5.spec b/krb5.spec index dd4152d..e133875 100644 --- a/krb5.spec +++ b/krb5.spec @@ -18,7 +18,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.18.2 # for prerelease, should be e.g., 0.% {prerelease}.1% { ?dist } (without spaces) -Release: 29%{?dist} +Release: 30%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/1.18/krb5-%{version}%{prerelease}.tar.gz @@ -258,9 +258,6 @@ sed -i -e s,7778,`expr "$PORT" + 1`,g $cfg source %{_libdir}/tclConfig.sh pushd src -# Set this so that configure will have a value even if the current version of -# autoconf doesn't set one. -export runstatedir=%{_localstatedir}/run # Work out the CFLAGS and CPPFLAGS which we intend to use. INCLUDES=-I%{_includedir}/et CFLAGS="`echo $RPM_OPT_FLAGS $DEFINES $INCLUDES -fPIC -fno-strict-aliasing -fstack-protector-all`" @@ -296,13 +293,6 @@ CPPFLAGS="`echo $DEFINES $INCLUDES`" make popd -# Sanity check the KDC_RUN_DIR. -configured_kdcrundir=`grep KDC_RUN_DIR src/include/osconf.h | awk '{print $NF}'` -configured_kdcrundir=`eval echo $configured_kdcrundir` -if test "$configured_kdcrundir" != %{_localstatedir}/run/krb5kdc ; then - exit 1 -fi - # Build the docs. make -C src/doc paths.py version.py cp src/doc/paths.py doc/ @@ -642,6 +632,10 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Thu Nov 17 2020 Robbie Harwood - 1.18.2-30 +- Migrate /var/run to /run, an exercise in pointlessness +- Resolves: #1898410 + * Thu Nov 05 2020 Robbie Harwood - 1.18.2-29 - Add recursion limit for ASN.1 indefinite lengths (CVE-2020-28196) diff --git a/krb5kdc.service b/krb5kdc.service index 806b062..40e23d6 100644 --- a/krb5kdc.service +++ b/krb5kdc.service @@ -5,9 +5,9 @@ After=syslog.target network.target network-online.target [Service] Type=forking -PIDFile=/var/run/krb5kdc.pid +PIDFile=/run/krb5kdc.pid EnvironmentFile=-/etc/sysconfig/krb5kdc -ExecStart=/usr/sbin/krb5kdc -P /var/run/krb5kdc.pid $KRB5KDC_ARGS +ExecStart=/usr/sbin/krb5kdc -P /run/krb5kdc.pid $KRB5KDC_ARGS ExecReload=/bin/kill -HUP $MAINPID [Install] From 015255764a8b2e22bcb29b8abd0813344c423da1 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 17 Nov 2020 12:50:36 -0500 Subject: [PATCH 002/103] Sigh, date fix --- krb5.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/krb5.spec b/krb5.spec index e133875..6223d52 100644 --- a/krb5.spec +++ b/krb5.spec @@ -632,7 +632,7 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog -* Thu Nov 17 2020 Robbie Harwood - 1.18.2-30 +* Tue Nov 17 2020 Robbie Harwood - 1.18.2-30 - Migrate /var/run to /run, an exercise in pointlessness - Resolves: #1898410 From 5facc9df4d7293dfdfe2767f46cdcdbdf51a0977 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Wed, 18 Nov 2020 18:16:20 +0000 Subject: [PATCH 003/103] New upstream version (1.18.3) --- .gitignore | 2 + Add-channel-bindings-tests.patch | 68 ++++--- ...client_aware_channel_bindings-option.patch | 2 +- ...finalization-safety-check-to-com_err.patch | 2 +- ...n-limit-for-ASN.1-indefinite-lengths.patch | 97 --------- ...e-kvno-options-from-Heimdal-kgetcred.patch | 54 ++--- ...t-KDC-alias-helper-function-contract.patch | 2 +- ...ases-when-matching-U2U-second-ticket.patch | 2 +- ...tauth-modules-to-set-hw-authent-flag.patch | 2 +- ...ss_unwrap_iov-of-unpadded-RC4-tokens.patch | 49 ----- ...d-passing-DB-entry-structures-in-KDC.patch | 2 +- ...y-import-service-GSS-host-based-name.patch | 2 +- ...ns_canonicalize_hostname-to-fallback.patch | 2 +- ...ion-warnings-for-all-init_creds-APIs.patch | 2 +- ...edundant-PKINIT-responder-invocation.patch | 93 --------- ...ngth-checking-in-SPNEGO-DER-decoding.patch | 58 ------ ...n-KERB_AP_OPTIONS_CBT-server-support.patch | 2 +- Fix-minor-static-analysis-defects.patch | 2 +- Fix-typo-in-in-in-the-ksu-man-page.patch | 4 +- ...-enctypes-in-krb5_string_to_keysalts.patch | 2 +- Implement-GSS_C_CHANNEL_BOUND_FLAG.patch | 2 +- ...ment-KERB_AP_OPTIONS_CBT-server-side.patch | 2 +- ...-KDC-alias-checking-for-S4U-requests.patch | 2 +- Improve-negoex_parse_token-code-hygiene.patch | 2 +- Minimize-usage-of-tgs_server-in-KDC.patch | 2 +- ...ndicator-check-for-S4U2Self-requests.patch | 2 +- ...SER-if-we-can-t-compute-its-checksum.patch | 2 +- Pass-channel-bindings-through-SPNEGO.patch | 22 +-- Pass-gss_localname-through-SPNEGO.patch | 6 +- ...KDC-authdata-list-management-helpers.patch | 2 +- Refactor-krb5-GSS-checksum-handling.patch | 2 +- ...ly-acquired-creds-from-client-keytab.patch | 2 +- Remove-resolver-test-utility.patch | 2 +- ...ce-gssrpc-tests-with-a-Python-script.patch | 2 +- Unify-kvno-option-documentation.patch | 185 ------------------ ...eues-for-concurrent-t_otp.py-daemons.patch | 2 +- downstream-Adjust-build-configuration.patch | 2 +- ...am-FIPS-with-PRNG-and-RADIUS-and-MD4.patch | 2 +- downstream-Remove-3des-support.patch | 4 +- downstream-SELinux-integration.patch | 12 +- ...ackported-version-of-OpenSSL-3-KDF-i.patch | 2 +- downstream-fix-debuginfo-with-y.tab.c.patch | 2 +- downstream-ksu-pam-integration.patch | 6 +- downstream-netlib-and-dns.patch | 6 +- krb5.spec | 12 +- sources | 4 +- 46 files changed, 133 insertions(+), 607 deletions(-) delete mode 100644 Add-recursion-limit-for-ASN.1-indefinite-lengths.patch delete mode 100644 Allow-gss_unwrap_iov-of-unpadded-RC4-tokens.patch delete mode 100644 Eliminate-redundant-PKINIT-responder-invocation.patch delete mode 100644 Fix-input-length-checking-in-SPNEGO-DER-decoding.patch delete mode 100644 Unify-kvno-option-documentation.patch diff --git a/.gitignore b/.gitignore index ecff9ea..35b6d60 100644 --- a/.gitignore +++ b/.gitignore @@ -187,3 +187,5 @@ krb5-1.8.3-pdf.tar.gz /krb5-1.18.1.tar.gz.asc /krb5-1.18.2.tar.gz /krb5-1.18.2.tar.gz.asc +/krb5-1.18.3.tar.gz +/krb5-1.18.3.tar.gz.asc diff --git a/Add-channel-bindings-tests.patch b/Add-channel-bindings-tests.patch index 2eb0f1c..99c2da2 100644 --- a/Add-channel-bindings-tests.patch +++ b/Add-channel-bindings-tests.patch @@ -1,4 +1,4 @@ -From 6d36ea6fcfe281a8ce73fc5aa5c133f435d93fa4 Mon Sep 17 00:00:00 2001 +From 2c8494a1b89d69da9de46ca2cb17f9e8f12eb9b5 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 20 Mar 2020 00:17:28 +0100 Subject: [PATCH] Add channel bindings tests @@ -10,17 +10,18 @@ changes] ticket: 8900 (cherry picked from commit b0b21b6d25b06f3e2b365dfe9dd4c99b3d43bf57) -[rharwood@redhat.com: .gitignore] +[rharwood@redhat.com: slush around upstream not backporting reload, +gitignore] --- src/plugins/gssapi/negoextest/main.c | 18 +++++ - src/tests/gssapi/Makefile.in | 49 ++++++------ + src/tests/gssapi/Makefile.in | 57 +++++++------- src/tests/gssapi/common.c | 25 ++++-- src/tests/gssapi/common.h | 9 +++ src/tests/gssapi/deps | 4 + src/tests/gssapi/t_bindings.c | 111 +++++++++++++++++++++++++++ src/tests/gssapi/t_bindings.py | 43 +++++++++++ src/tests/gssapi/t_negoex.py | 7 ++ - 8 files changed, 237 insertions(+), 29 deletions(-) + 8 files changed, 242 insertions(+), 32 deletions(-) create mode 100644 src/tests/gssapi/t_bindings.c create mode 100644 src/tests/gssapi/t_bindings.py @@ -61,23 +62,25 @@ index 6c340f41b..72fc5273a 100644 * The unwrapped token sits at the end and is just one byte giving the * remaining number of hops. The final octet of the mech encoding should diff --git a/src/tests/gssapi/Makefile.in b/src/tests/gssapi/Makefile.in -index 5cc1e0f58..68c132b79 100644 +index 22a2f9480..cf7bcf451 100644 --- a/src/tests/gssapi/Makefile.in +++ b/src/tests/gssapi/Makefile.in -@@ -9,33 +9,33 @@ LOCALINCLUDES = -I$(srcdir)/../../lib/gssapi/mechglue \ +@@ -8,34 +8,36 @@ LOCALINCLUDES = -I$(srcdir)/../../lib/gssapi/mechglue \ + -I$(srcdir)/../../lib/gssapi/generic -I../../lib/gssapi/krb5 \ -I../../lib/gssapi/generic - SRCS= $(srcdir)/ccinit.c $(srcdir)/ccrefresh.c $(srcdir)/common.c \ +-SRCS= $(srcdir)/ccinit.c $(srcdir)/ccrefresh.c $(srcdir)/common.c $(srcdir)/reload.c \ - $(srcdir)/t_accname.c $(srcdir)/t_add_cred.c $(srcdir)/t_ccselect.c \ - $(srcdir)/t_ciflags.c $(srcdir)/t_context.c $(srcdir)/t_credstore.c \ - $(srcdir)/t_enctypes.c $(srcdir)/t_err.c $(srcdir)/t_export_cred.c \ - $(srcdir)/t_export_name.c $(srcdir)/t_gssexts.c \ - $(srcdir)/t_imp_cred.c $(srcdir)/t_imp_name.c $(srcdir)/t_invalid.c \ - $(srcdir)/t_inq_cred.c $(srcdir)/t_inq_ctx.c \ -+ $(srcdir)/t_accname.c $(srcdir)/t_add_cred.c $(srcdir)/t_bindings.c \ -+ $(srcdir)/t_ccselect.c $(srcdir)/t_ciflags.c $(srcdir)/t_context.c \ -+ $(srcdir)/t_credstore.c $(srcdir)/t_enctypes.c $(srcdir)/t_err.c \ -+ $(srcdir)/t_export_cred.c $(srcdir)/t_export_name.c \ ++SRCS= $(srcdir)/ccinit.c $(srcdir)/ccrefresh.c $(srcdir)/common.c \ ++ $(srcdir)/reload.c $(srcdir)/t_accname.c $(srcdir)/t_add_cred.c \ ++ $(srcdir)/t_bindings.c $(srcdir)/t_ccselect.c $(srcdir)/t_ciflags.c \ ++ $(srcdir)/t_context.c $(srcdir)/t_credstore.c $(srcdir)/t_enctypes.c \ ++ $(srcdir)/t_err.c $(srcdir)/t_export_cred.c $(srcdir)/t_export_name.c \ + $(srcdir)/t_gssexts.c $(srcdir)/t_imp_cred.c $(srcdir)/t_imp_name.c \ + $(srcdir)/t_invalid.c $(srcdir)/t_inq_cred.c $(srcdir)/t_inq_ctx.c \ $(srcdir)/t_inq_mechs_name.c $(srcdir)/t_iov.c \ @@ -86,18 +89,20 @@ index 5cc1e0f58..68c132b79 100644 $(srcdir)/t_s4u2proxy_krb5.c $(srcdir)/t_saslname.c \ $(srcdir)/t_spnego.c $(srcdir)/t_srcattrs.c --OBJS= ccinit.o ccrefresh.o common.o t_accname.o t_add_cred.o t_ccselect.o \ +-OBJS= ccinit.o ccrefresh.o common.o reload.o t_accname.o t_add_cred.o t_ccselect.o \ - t_ciflags.o t_context.o t_credstore.o t_enctypes.o t_err.o \ - t_export_cred.o t_export_name.o t_gssexts.o t_imp_cred.o t_imp_name.o \ - t_invalid.o t_inq_cred.o t_inq_ctx.o t_inq_mechs_name.o t_iov.o \ - t_lifetime.o t_namingexts.o t_oid.o t_pcontok.o t_prf.o t_s4u.o \ - t_s4u2proxy_krb5.o t_saslname.o t_spnego.o t_srcattrs.o -+OBJS= ccinit.o ccrefresh.o common.o t_accname.o t_add_cred.o t_bindings.o \ -+ t_ccselect.o t_ciflags.o t_context.o t_credstore.o t_enctypes.o \ -+ t_err.o t_export_cred.o t_export_name.o t_gssexts.o t_imp_cred.o \ -+ t_imp_name.o t_invalid.o t_inq_cred.o t_inq_ctx.o t_inq_mechs_name.o \ -+ t_iov.o t_lifetime.o t_namingexts.o t_oid.o t_pcontok.o t_prf.o \ -+ t_s4u.o t_s4u2proxy_krb5.o t_saslname.o t_spnego.o t_srcattrs.o ++ ++OBJS= ccinit.o ccrefresh.o common.o reload.o t_accname.o t_add_cred.o \ ++ t_bindings.o t_ccselect.o t_ciflags.o t_context.o t_credstore.o \ ++ t_enctypes.o t_err.o t_export_cred.o t_export_name.o t_gssexts.o \ ++ t_imp_cred.o t_imp_name.o t_invalid.o t_inq_cred.o t_inq_ctx.o \ ++ t_inq_mechs_name.o t_iov.o t_lifetime.o t_namingexts.o t_oid.o \ ++ t_pcontok.o t_prf.o t_s4u.o t_s4u2proxy_krb5.o t_saslname.o \ ++ t_spnego.o t_srcattrs.o COMMON_DEPS= common.o $(GSS_DEPLIBS) $(KRB5_BASE_DEPLIBS) COMMON_LIBS= common.o $(GSS_LIBS) $(KRB5_BASE_LIBS) @@ -113,11 +118,11 @@ index 5cc1e0f58..68c132b79 100644 + t_inq_mechs_name t_iov t_lifetime t_namingexts t_oid t_pcontok t_prf \ + t_s4u t_s4u2proxy_krb5 t_saslname t_spnego t_srcattrs - check-unix: t_oid + check-unix: t_oid reload $(RUN_TEST) ./t_invalid -@@ -43,11 +43,12 @@ check-unix: t_oid - $(RUN_TEST) ./t_prf +@@ -44,11 +46,12 @@ check-unix: t_oid reload $(RUN_TEST) ./t_imp_name + if [ -r $(TOPLIBD)/libgssapi_krb5.so ]; then $(RUN_TEST) ./reload; fi -check-pytests: ccinit ccrefresh t_accname t_add_cred t_ccselect t_ciflags \ - t_context t_credstore t_enctypes t_err t_export_cred t_export_name \ @@ -132,7 +137,7 @@ index 5cc1e0f58..68c132b79 100644 $(RUNPYTEST) $(srcdir)/t_ccselect.py $(PYTESTFLAGS) $(RUNPYTEST) $(srcdir)/t_client_keytab.py $(PYTESTFLAGS) $(RUNPYTEST) $(srcdir)/t_enctypes.py $(PYTESTFLAGS) -@@ -64,6 +65,8 @@ t_accname: t_accname.o $(COMMON_DEPS) +@@ -67,6 +70,8 @@ t_accname: t_accname.o $(COMMON_DEPS) $(CC_LINK) -o $@ t_accname.o $(COMMON_LIBS) t_add_cred: t_add_cred.o $(COMMON_DEPS) $(CC_LINK) -o $@ t_add_cred.o $(COMMON_LIBS) @@ -141,17 +146,20 @@ index 5cc1e0f58..68c132b79 100644 t_ccselect: t_ccselect.o $(COMMON_DEPS) $(CC_LINK) -o $@ t_ccselect.o $(COMMON_LIBS) t_ciflags: t_ciflags.o $(COMMON_DEPS) -@@ -118,8 +121,8 @@ t_srcattrs: t_srcattrs.o $(COMMON_DEPS) +@@ -121,9 +126,9 @@ t_srcattrs: t_srcattrs.o $(COMMON_DEPS) $(CC_LINK) -o $@ t_srcattrs.o $(COMMON_LIBS) clean: -- $(RM) ccinit ccrefresh t_accname t_add_cred t_ccselect t_ciflags +- $(RM) ccinit ccrefresh reload t_accname t_add_cred t_ccselect t_ciflags - $(RM) t_context t_credstore t_enctypes t_err t_export_cred -+ $(RM) ccinit ccrefresh t_accname t_add_cred t_bindings t_ccselect -+ $(RM) t_ciflags t_context t_credstore t_enctypes t_err t_export_cred - $(RM) t_export_name t_gssexts t_imp_cred t_imp_name t_invalid - $(RM) t_inq_cred t_inq_ctx t_inq_mechs_name t_iov t_lifetime +- $(RM) t_export_name t_gssexts t_imp_cred t_imp_name t_invalid +- $(RM) t_inq_cred t_inq_ctx t_inq_mechs_name t_iov t_lifetime ++ $(RM) ccinit ccrefresh reload t_accname t_add_cred t_bindings ++ $(RM) t_ccselect t_ciflags t_context t_credstore t_enctypes t_err ++ $(RM) t_export_cred t_export_name t_gssexts t_imp_cred t_imp_name ++ $(RM) t_invalid t_inq_cred t_inq_ctx t_inq_mechs_name t_iov t_lifetime $(RM) t_namingexts t_oid t_pcontok t_prf t_s4u t_s4u2proxy_krb5 + $(RM) t_saslname t_spnego t_srcattrs diff --git a/src/tests/gssapi/common.c b/src/tests/gssapi/common.c index 83e9d9bb8..7ba72f7b2 100644 --- a/src/tests/gssapi/common.c @@ -221,10 +229,10 @@ index ae11b51d4..a5c8f87e6 100644 * the token. */ void export_import_cred(gss_cred_id_t *cred); diff --git a/src/tests/gssapi/deps b/src/tests/gssapi/deps -index acd0e96f8..73e4d9a74 100644 +index 55586de53..ca1d6e22a 100644 --- a/src/tests/gssapi/deps +++ b/src/tests/gssapi/deps -@@ -33,6 +33,10 @@ $(OUTPRE)t_add_cred.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \ +@@ -35,6 +35,10 @@ $(OUTPRE)t_add_cred.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \ $(BUILDTOP)/include/gssapi/gssapi_ext.h $(BUILDTOP)/include/gssapi/gssapi_krb5.h \ $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/krb5.h \ common.h t_add_cred.c diff --git a/Add-client_aware_channel_bindings-option.patch b/Add-client_aware_channel_bindings-option.patch index bd3bcba..142e1d9 100644 --- a/Add-client_aware_channel_bindings-option.patch +++ b/Add-client_aware_channel_bindings-option.patch @@ -1,4 +1,4 @@ -From 46ec975eb8f33b6d42c440758fc0deb826f87313 Mon Sep 17 00:00:00 2001 +From 849bb23d0044b2ff315608784c0f96b81feb472f Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Tue, 10 Mar 2020 13:13:17 +0100 Subject: [PATCH] Add client_aware_channel_bindings option diff --git a/Add-finalization-safety-check-to-com_err.patch b/Add-finalization-safety-check-to-com_err.patch index a7ebd53..9411b15 100644 --- a/Add-finalization-safety-check-to-com_err.patch +++ b/Add-finalization-safety-check-to-com_err.patch @@ -1,4 +1,4 @@ -From 96a36ef54aecb48b71c1ae0cc85b83ef644c3bd0 Mon Sep 17 00:00:00 2001 +From 73f1db69f99462b5109a5dd4e1a9476667bd3715 Mon Sep 17 00:00:00 2001 From: Jiri Sasek Date: Fri, 13 Mar 2020 19:02:58 +0100 Subject: [PATCH] Add finalization safety check to com_err diff --git a/Add-recursion-limit-for-ASN.1-indefinite-lengths.patch b/Add-recursion-limit-for-ASN.1-indefinite-lengths.patch deleted file mode 100644 index bc1229c..0000000 --- a/Add-recursion-limit-for-ASN.1-indefinite-lengths.patch +++ /dev/null @@ -1,97 +0,0 @@ -From b7aca8b57422cdc67a2d2bff385f09646ca037bc Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Sat, 31 Oct 2020 17:07:05 -0400 -Subject: [PATCH] Add recursion limit for ASN.1 indefinite lengths - -The libkrb5 ASN.1 decoder supports BER indefinite lengths. It -computes the tag length using recursion; the lack of a recursion limit -allows an attacker to overrun the stack and cause the process to -crash. Reported by Demi Obenour. - -CVE-2020-28196: - -In MIT krb5 releases 1.11 and later, an unauthenticated attacker can -cause a denial of service for any client or server to which it can -send an ASN.1-encoded Kerberos message of sufficient length. - -ticket: 8959 (new) -tags: pullup -target_version: 1.18-next -target_version: 1.17-next - -(cherry picked from commit 57415dda6cf04e73ffc3723be518eddfae599bfd) ---- - src/lib/krb5/asn.1/asn1_encode.c | 16 +++++++++------- - 1 file changed, 9 insertions(+), 7 deletions(-) - -diff --git a/src/lib/krb5/asn.1/asn1_encode.c b/src/lib/krb5/asn.1/asn1_encode.c -index a160cf4fe..cd6b879f7 100644 ---- a/src/lib/krb5/asn.1/asn1_encode.c -+++ b/src/lib/krb5/asn.1/asn1_encode.c -@@ -356,7 +356,7 @@ make_tag(asn1buf *buf, const taginfo *t, size_t len) - static krb5_error_code - get_tag(const uint8_t *asn1, size_t len, taginfo *tag_out, - const uint8_t **contents_out, size_t *clen_out, -- const uint8_t **remainder_out, size_t *rlen_out) -+ const uint8_t **remainder_out, size_t *rlen_out, int recursion) - { - krb5_error_code ret; - uint8_t o; -@@ -394,9 +394,11 @@ get_tag(const uint8_t *asn1, size_t len, taginfo *tag_out, - /* Indefinite form (should not be present in DER, but we accept it). */ - if (tag_out->construction != CONSTRUCTED) - return ASN1_MISMATCH_INDEF; -+ if (recursion >= 32) -+ return ASN1_OVERFLOW; - p = asn1; - while (!(len >= 2 && p[0] == 0 && p[1] == 0)) { -- ret = get_tag(p, len, &t, &c, &clen, &p, &len); -+ ret = get_tag(p, len, &t, &c, &clen, &p, &len, recursion + 1); - if (ret) - return ret; - } -@@ -613,7 +615,7 @@ split_der(asn1buf *buf, uint8_t *const *der, size_t len, taginfo *tag_out) - const uint8_t *contents, *remainder; - size_t clen, rlen; - -- ret = get_tag(*der, len, tag_out, &contents, &clen, &remainder, &rlen); -+ ret = get_tag(*der, len, tag_out, &contents, &clen, &remainder, &rlen, 0); - if (ret) - return ret; - if (rlen != 0) -@@ -1199,7 +1201,7 @@ decode_atype(const taginfo *t, const uint8_t *asn1, size_t len, - const uint8_t *rem; - size_t rlen; - if (!tag->implicit) { -- ret = get_tag(asn1, len, &inner_tag, &asn1, &len, &rem, &rlen); -+ ret = get_tag(asn1, len, &inner_tag, &asn1, &len, &rem, &rlen, 0); - if (ret) - return ret; - /* Note: we don't check rlen (it should be 0). */ -@@ -1420,7 +1422,7 @@ decode_sequence(const uint8_t *asn1, size_t len, const struct seq_info *seq, - for (i = 0; i < seq->n_fields; i++) { - if (len == 0) - break; -- ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len); -+ ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len, 0); - if (ret) - goto error; - /* -@@ -1478,7 +1480,7 @@ decode_sequence_of(const uint8_t *asn1, size_t len, - *seq_out = NULL; - *count_out = 0; - while (len > 0) { -- ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len); -+ ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len, 0); - if (ret) - goto error; - if (!check_atype_tag(elemtype, &t)) { -@@ -1584,7 +1586,7 @@ k5_asn1_full_decode(const krb5_data *code, const struct atype_info *a, - - *retrep = NULL; - ret = get_tag((uint8_t *)code->data, code->length, &t, &contents, -- &clen, &remainder, &rlen); -+ &clen, &remainder, &rlen, 0); - if (ret) - return ret; - /* rlen should be 0, but we don't check it (and due to padding in diff --git a/Add-three-kvno-options-from-Heimdal-kgetcred.patch b/Add-three-kvno-options-from-Heimdal-kgetcred.patch index 40a6318..9cb1386 100644 --- a/Add-three-kvno-options-from-Heimdal-kgetcred.patch +++ b/Add-three-kvno-options-from-Heimdal-kgetcred.patch @@ -1,4 +1,4 @@ -From 538d787aa7c10894cc0426f54db0d8248efcf7c9 Mon Sep 17 00:00:00 2001 +From ba21ad84f7c8317a595ded1e657c7985fa4b90e1 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Wed, 17 Jun 2020 20:48:38 -0400 Subject: [PATCH] Add three kvno options from Heimdal kgetcred @@ -13,20 +13,21 @@ tests for the new options. ticket: 8917 (new) (cherry picked from commit 876bab8418d7dd134c9d9db812ee2118d5ad58f0) +[rharwood@redhat.com: slush around option unification] --- doc/user/user_commands/kvno.rst | 13 ++++ src/clients/kvno/Makefile.in | 3 + - src/clients/kvno/kvno.c | 115 +++++++++++++++++++++++--------- + src/clients/kvno/kvno.c | 113 +++++++++++++++++++++++--------- src/clients/kvno/t_kvno.py | 75 +++++++++++++++++++++ src/man/kvno.man | 13 ++++ - 5 files changed, 187 insertions(+), 32 deletions(-) + 5 files changed, 185 insertions(+), 32 deletions(-) create mode 100644 src/clients/kvno/t_kvno.py diff --git a/doc/user/user_commands/kvno.rst b/doc/user/user_commands/kvno.rst -index 3892f0ca5..718313576 100644 +index 53e569651..6fd8577a5 100644 --- a/doc/user/user_commands/kvno.rst +++ b/doc/user/user_commands/kvno.rst -@@ -74,6 +74,19 @@ OPTIONS +@@ -75,6 +75,19 @@ OPTIONS client principal with the X.509 certificate in *cert_file*. The certificate file must be in PEM format. @@ -61,17 +62,16 @@ index 1c3f79392..5ba877271 100644 $(RM) kvno.o kvno diff --git a/src/clients/kvno/kvno.c b/src/clients/kvno/kvno.c -index 2472c0cfe..9d85864f6 100644 +index 8edd97361..55e7dd0ce 100644 --- a/src/clients/kvno/kvno.c +++ b/src/clients/kvno/kvno.c -@@ -44,14 +44,17 @@ xusage() - fprintf(stderr, _("usage: %s [-C] [-u] [-c ccache] [-e etype]\n"), prog); - fprintf(stderr, _("\t[-k keytab] [-S sname] [{-I | -U} for_user | " - "[-F cert_file] [-P]]\n")); -- fprintf(stderr, _("\t[--u2u ccache] service1 service2 ...\n")); -+ fprintf(stderr, _("\t[--cached-only] [--no-store] [--out-cache ccache] " -+ "[--u2u ccache]\n")); -+ fprintf(stderr, _("\tservice1 service2 ...\n")); +@@ -47,15 +47,16 @@ xusage() + "[-u | -S sname]" XUSAGE_BREAK + "[[{-F cert_file | {-I | -U} for_user} [-P]] | " + "--u2u ccache]" XUSAGE_BREAK ++ "[--cached-only] [--no-store] [--out-cache] " + "service1 service2 ...\n"), +- prog); exit(1); } @@ -86,7 +86,7 @@ index 2472c0cfe..9d85864f6 100644 const char *u2u_ccname); #include -@@ -61,18 +64,21 @@ static void extended_com_err_fn(const char *myprog, errcode_t code, +@@ -65,18 +66,21 @@ static void extended_com_err_fn(const char *myprog, errcode_t code, int main(int argc, char *argv[]) { @@ -115,7 +115,7 @@ index 2472c0cfe..9d85864f6 100644 setlocale(LC_ALL, ""); set_com_err_hook(extended_com_err_fn); -@@ -135,6 +141,12 @@ main(int argc, char *argv[]) +@@ -139,6 +143,12 @@ main(int argc, char *argv[]) case OPTION_U2U: u2u_ccname = optarg; break; @@ -128,7 +128,7 @@ index 2472c0cfe..9d85864f6 100644 default: xusage(); break; -@@ -159,8 +171,9 @@ main(int argc, char *argv[]) +@@ -163,8 +173,9 @@ main(int argc, char *argv[]) xusage(); do_v5_kvno(argc - optind, argv + optind, ccachestr, etypestr, keytab_name, @@ -140,7 +140,7 @@ index 2472c0cfe..9d85864f6 100644 return 0; } -@@ -274,14 +287,16 @@ static krb5_error_code +@@ -278,14 +289,16 @@ static krb5_error_code kvno(const char *name, krb5_ccache ccache, krb5_principal me, krb5_enctype etype, krb5_keytab keytab, const char *sname, krb5_flags options, int unknown, krb5_principal for_user_princ, @@ -159,7 +159,7 @@ index 2472c0cfe..9d85864f6 100644 memset(&in_creds, 0, sizeof(in_creds)); if (sname != NULL) { -@@ -321,13 +336,12 @@ kvno(const char *name, krb5_ccache ccache, krb5_principal me, +@@ -325,13 +338,12 @@ kvno(const char *name, krb5_ccache ccache, krb5_principal me, in_creds.client = for_user_princ; in_creds.server = me; ret = krb5_get_credentials_for_user(context, options, ccache, @@ -175,7 +175,7 @@ index 2472c0cfe..9d85864f6 100644 } if (ret) { -@@ -336,7 +350,7 @@ kvno(const char *name, krb5_ccache ccache, krb5_principal me, +@@ -340,7 +352,7 @@ kvno(const char *name, krb5_ccache ccache, krb5_principal me, } /* We need a native ticket. */ @@ -184,7 +184,7 @@ index 2472c0cfe..9d85864f6 100644 if (ret) { com_err(prog, ret, _("while decoding ticket for %s"), princ); goto cleanup; -@@ -362,15 +376,15 @@ kvno(const char *name, krb5_ccache ccache, krb5_principal me, +@@ -366,15 +378,15 @@ kvno(const char *name, krb5_ccache ccache, krb5_principal me, } if (proxy) { @@ -205,7 +205,7 @@ index 2472c0cfe..9d85864f6 100644 krb5_free_principal(context, in_creds.client); if (ret) { com_err(prog, ret, _("%s: constrained delegation failed"), -@@ -379,10 +393,13 @@ kvno(const char *name, krb5_ccache ccache, krb5_principal me, +@@ -383,10 +395,13 @@ kvno(const char *name, krb5_ccache ccache, krb5_principal me, } } @@ -220,7 +220,7 @@ index 2472c0cfe..9d85864f6 100644 krb5_free_unparsed_name(context, princ); return ret; } -@@ -428,19 +445,28 @@ cleanup: +@@ -432,19 +447,28 @@ cleanup: static void do_v5_kvno(int count, char *names[], char * ccachestr, char *etypestr, @@ -255,7 +255,7 @@ index 2472c0cfe..9d85864f6 100644 ret = krb5_init_context(&context); if (ret) { -@@ -467,6 +493,14 @@ do_v5_kvno(int count, char *names[], char * ccachestr, char *etypestr, +@@ -471,6 +495,14 @@ do_v5_kvno(int count, char *names[], char * ccachestr, char *etypestr, exit(1); } @@ -270,7 +270,7 @@ index 2472c0cfe..9d85864f6 100644 if (keytab_name != NULL) { ret = krb5_kt_resolve(context, keytab_name, &keytab); if (ret) { -@@ -513,8 +547,25 @@ do_v5_kvno(int count, char *names[], char * ccachestr, char *etypestr, +@@ -517,8 +549,25 @@ do_v5_kvno(int count, char *names[], char * ccachestr, char *etypestr, errors = 0; for (i = 0; i < count; i++) { if (kvno(names[i], ccache, me, etype, keytab, sname, options, unknown, @@ -379,10 +379,10 @@ index 000000000..e98b90e8a + +success('kvno tests') diff --git a/src/man/kvno.man b/src/man/kvno.man -index 005a2ec97..b9f6739eb 100644 +index 9eb9e1852..7c9565bdb 100644 --- a/src/man/kvno.man +++ b/src/man/kvno.man -@@ -95,6 +95,19 @@ Specifies that protocol transition is to be used, identifying the +@@ -96,6 +96,19 @@ Specifies that protocol transition is to be used, identifying the client principal with the X.509 certificate in \fIcert_file\fP\&. The certificate file must be in PEM format. .TP diff --git a/Adjust-KDC-alias-helper-function-contract.patch b/Adjust-KDC-alias-helper-function-contract.patch index 7b7c62b..0046bb4 100644 --- a/Adjust-KDC-alias-helper-function-contract.patch +++ b/Adjust-KDC-alias-helper-function-contract.patch @@ -1,4 +1,4 @@ -From 758f5031fe9d6c1e3eb33818bc6d57cf8b4a3a72 Mon Sep 17 00:00:00 2001 +From cf853d10b13dca77acd08d1387e94527994f9ef5 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Tue, 22 Sep 2020 01:11:39 +0300 Subject: [PATCH] Adjust KDC alias helper function contract diff --git a/Allow-aliases-when-matching-U2U-second-ticket.patch b/Allow-aliases-when-matching-U2U-second-ticket.patch index 8622ff8..07519e1 100644 --- a/Allow-aliases-when-matching-U2U-second-ticket.patch +++ b/Allow-aliases-when-matching-U2U-second-ticket.patch @@ -1,4 +1,4 @@ -From ccc5b9663e229f20421c01836aa5ecb06f1f2a48 Mon Sep 17 00:00:00 2001 +From 5a9b4d190906a8b11a7e1f707d1ea1930ce2fd31 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Tue, 22 Sep 2020 01:17:11 +0300 Subject: [PATCH] Allow aliases when matching U2U second ticket diff --git a/Allow-certauth-modules-to-set-hw-authent-flag.patch b/Allow-certauth-modules-to-set-hw-authent-flag.patch index 94ff5dd..0c155e7 100644 --- a/Allow-certauth-modules-to-set-hw-authent-flag.patch +++ b/Allow-certauth-modules-to-set-hw-authent-flag.patch @@ -1,4 +1,4 @@ -From 5b62f6f6a960e5a428a39a3e83e0a16dba5a914a Mon Sep 17 00:00:00 2001 +From c18034484eadb0f32cef384197d1185aa50c3adb Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Mon, 24 Feb 2020 15:58:59 -0500 Subject: [PATCH] Allow certauth modules to set hw-authent flag diff --git a/Allow-gss_unwrap_iov-of-unpadded-RC4-tokens.patch b/Allow-gss_unwrap_iov-of-unpadded-RC4-tokens.patch deleted file mode 100644 index 3824646..0000000 --- a/Allow-gss_unwrap_iov-of-unpadded-RC4-tokens.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 594c9d225f470e73a46dd2a85c5e50571e90598c Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Sat, 11 Jul 2020 21:57:30 -0400 -Subject: [PATCH] Allow gss_unwrap_iov() of unpadded RC4 tokens - -Windows Remote Management, when used with an RC4 session key, appears -to generate GSS wrap tokens with no padding instead of the expected -one byte (RFC 4757 section 7.3). These tokens cannot be decoded with -gss_unwrap() or a STREAM buffer (even with Microsoft SSPI), but SSPI -allows them to be decoded using explicit IOVs with either a -zero-length padding buffer or no padding buffer. Allow these cases to -work in kg_fixup_padding_iov(). (It is already possible to make this -work with HEADER | DATA | DATA, but only by -accident--kg_fixup_padding_iov() doesn't find a data buffer because -kg_locate_iov() only looks for singleton buffers, so it exits early.) - -ticket: 8926 (new) -tags: pullup -target_version: 1.18-next - -(cherry picked from commit 3f204ddd567715ef360b4bb0b32961b6a9877f9d) ---- - src/lib/gssapi/krb5/util_crypt.c | 9 +++------ - 1 file changed, 3 insertions(+), 6 deletions(-) - -diff --git a/src/lib/gssapi/krb5/util_crypt.c b/src/lib/gssapi/krb5/util_crypt.c -index f7d3e92c4..d6c71aeb8 100644 ---- a/src/lib/gssapi/krb5/util_crypt.c -+++ b/src/lib/gssapi/krb5/util_crypt.c -@@ -638,16 +638,13 @@ kg_fixup_padding_iov(OM_uint32 *minor_status, gss_iov_buffer_desc *iov, - data = kg_locate_iov(iov, iov_count, GSS_IOV_BUFFER_TYPE_DATA); - padding = kg_locate_iov(iov, iov_count, GSS_IOV_BUFFER_TYPE_PADDING); - -- if (data == NULL) { -+ /* Do nothing if padding is absent or empty, to allow unwrapping of WinRM -+ * unpadded RC4 tokens using an explicit IOV array. */ -+ if (data == NULL || padding == NULL || padding->buffer.length == 0) { - *minor_status = 0; - return GSS_S_COMPLETE; - } - -- if (padding == NULL || padding->buffer.length == 0) { -- *minor_status = EINVAL; -- return GSS_S_FAILURE; -- } -- - p = (unsigned char *)padding->buffer.value; - padlength = p[padding->buffer.length - 1]; - diff --git a/Avoid-passing-DB-entry-structures-in-KDC.patch b/Avoid-passing-DB-entry-structures-in-KDC.patch index e5cff1a..aeb20ad 100644 --- a/Avoid-passing-DB-entry-structures-in-KDC.patch +++ b/Avoid-passing-DB-entry-structures-in-KDC.patch @@ -1,4 +1,4 @@ -From dd8b146093d4bdf8a7d0c0eb8156b62d090448d7 Mon Sep 17 00:00:00 2001 +From f5987c71188138626030eef62145a126a84b62fb Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Wed, 30 Sep 2020 02:12:00 -0400 Subject: [PATCH] Avoid passing DB entry structures in KDC diff --git a/Correctly-import-service-GSS-host-based-name.patch b/Correctly-import-service-GSS-host-based-name.patch index f56aed4..e56648b 100644 --- a/Correctly-import-service-GSS-host-based-name.patch +++ b/Correctly-import-service-GSS-host-based-name.patch @@ -1,4 +1,4 @@ -From f56afbeb7848322f3208edd55f2c12a9e32127f0 Mon Sep 17 00:00:00 2001 +From 24c5e1ad937505a03628547ed7a5c6060a2b0ff2 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Mon, 30 Mar 2020 15:26:02 -0400 Subject: [PATCH] Correctly import "service@" GSS host-based name diff --git a/Default-dns_canonicalize_hostname-to-fallback.patch b/Default-dns_canonicalize_hostname-to-fallback.patch index 1c46562..3669432 100644 --- a/Default-dns_canonicalize_hostname-to-fallback.patch +++ b/Default-dns_canonicalize_hostname-to-fallback.patch @@ -1,4 +1,4 @@ -From c3d2c3bcafe0ac87d9cbbf37f1488ad642627fc3 Mon Sep 17 00:00:00 2001 +From 6bdab27ef3dfcefb8426f2ea4e06bbdbd1141b16 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Wed, 27 May 2020 18:48:35 -0400 Subject: [PATCH] Default dns_canonicalize_hostname to "fallback" diff --git a/Do-expiration-warnings-for-all-init_creds-APIs.patch b/Do-expiration-warnings-for-all-init_creds-APIs.patch index 4f642f4..374068f 100644 --- a/Do-expiration-warnings-for-all-init_creds-APIs.patch +++ b/Do-expiration-warnings-for-all-init_creds-APIs.patch @@ -1,4 +1,4 @@ -From 51a9f8e7498591b22558a7a61d42a821030f9c4e Mon Sep 17 00:00:00 2001 +From c7abf942c66b2ba543cf412f12562e9bb8ee260a Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Fri, 28 Feb 2020 10:11:49 +0100 Subject: [PATCH] Do expiration warnings for all init_creds APIs diff --git a/Eliminate-redundant-PKINIT-responder-invocation.patch b/Eliminate-redundant-PKINIT-responder-invocation.patch deleted file mode 100644 index 48e6e89..0000000 --- a/Eliminate-redundant-PKINIT-responder-invocation.patch +++ /dev/null @@ -1,93 +0,0 @@ -From b27a2f1f330afed53b034a66031f9a801b4568b7 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Mon, 23 Mar 2020 19:10:03 -0400 -Subject: [PATCH] Eliminate redundant PKINIT responder invocation - -In pkinit_client_prep_questions(), only act if the input padata type -is KRB5_PADATA_PK_AS_REQ. Otherwise we will ask questions again when -the KDC issues a ticket. - -Commit 7621d2f9a87214327ca3b2594e34dc7cea84596b (ticket 8242) -unintentionally changed the behavior of pkinit_load_fs_cert_and_key(), -causing pkinit_client_prep_questions() to do nothing on its first -call. Restore the original behavior of returning 0 when prompting is -deferred. - -Modify the existing "FILE identity, password on key (responder)" -PKINIT test to check that the responder is only invoked once. - -ticket: 8885 -(cherry picked from commit f1286842ce7b9e507a4ce0a47f44ab361a98be63) ---- - src/plugins/preauth/pkinit/pkinit_clnt.c | 5 +++++ - src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 13 +++++++------ - src/tests/t_pkinit.py | 11 +++++++---- - 3 files changed, 19 insertions(+), 10 deletions(-) - -diff --git a/src/plugins/preauth/pkinit/pkinit_clnt.c b/src/plugins/preauth/pkinit/pkinit_clnt.c -index 2f0431991..9b991ffe0 100644 ---- a/src/plugins/preauth/pkinit/pkinit_clnt.c -+++ b/src/plugins/preauth/pkinit/pkinit_clnt.c -@@ -897,6 +897,11 @@ pkinit_client_prep_questions(krb5_context context, - k5_json_object jval = NULL; - k5_json_number jflag = NULL; - -+ /* Don't ask questions for the informational padata items or when the -+ * ticket is issued. */ -+ if (pa_data->pa_type != KRB5_PADATA_PK_AS_REQ) -+ return 0; -+ - if (!reqctx->identity_initialized) { - pkinit_client_profile(context, plgctx, reqctx, cb, rock, - &request->server->realm); -diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -index dd718c2be..dbb054378 100644 ---- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -@@ -4362,17 +4362,18 @@ pkinit_load_fs_cert_and_key(krb5_context context, - - /* Load the certificate. */ - retval = get_cert(certname, &x); -- if (retval != 0 || x == NULL) { -- retval = oerr(context, 0, _("Cannot read certificate file '%s'"), -+ if (retval) { -+ retval = oerr(context, retval, _("Cannot read certificate file '%s'"), - certname); -- goto cleanup; - } -+ if (retval || x == NULL) -+ goto cleanup; - /* Load the key. */ - retval = get_key(context, id_cryptoctx, keyname, fsname, &y, password); -- if (retval != 0 || y == NULL) { -- retval = oerr(context, 0, _("Cannot read key file '%s'"), fsname); -+ if (retval) -+ retval = oerr(context, retval, _("Cannot read key file '%s'"), fsname); -+ if (retval || y == NULL) - goto cleanup; -- } - - id_cryptoctx->creds[cindex] = malloc(sizeof(struct _pkinit_cred_info)); - if (id_cryptoctx->creds[cindex] == NULL) { -diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py -index 69daf4987..ecd450e8a 100755 ---- a/src/tests/t_pkinit.py -+++ b/src/tests/t_pkinit.py -@@ -248,10 +248,13 @@ realm.run(['./adata', realm.host_princ], - # supplied by the responder. - # Supply the response in raw form. - mark('FILE identity, password on key (responder)') --realm.run(['./responder', '-x', 'pkinit={"%s": 0}' % file_enc_identity, -- '-r', 'pkinit={"%s": "encrypted"}' % file_enc_identity, -- '-X', 'X509_user_identity=%s' % file_enc_identity, -- realm.user_princ]) -+out = realm.run(['./responder', '-x', 'pkinit={"%s": 0}' % file_enc_identity, -+ '-r', 'pkinit={"%s": "encrypted"}' % file_enc_identity, -+ '-X', 'X509_user_identity=%s' % file_enc_identity, -+ realm.user_princ]) -+# Regression test for #8885 (password question asked twice). -+if out.count('OK: ') != 1: -+ fail('Wrong number of responder calls') - # Supply the response through the convenience API. - realm.run(['./responder', '-X', 'X509_user_identity=%s' % file_enc_identity, - '-p', '%s=%s' % (file_enc_identity, 'encrypted'), realm.user_princ]) diff --git a/Fix-input-length-checking-in-SPNEGO-DER-decoding.patch b/Fix-input-length-checking-in-SPNEGO-DER-decoding.patch deleted file mode 100644 index ae01c8d..0000000 --- a/Fix-input-length-checking-in-SPNEGO-DER-decoding.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 5b42970afea248889fd3350448a40045d467ff3f Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Tue, 28 Jul 2020 12:58:26 -0400 -Subject: [PATCH] Fix input length checking in SPNEGO DER decoding - -In get_mech_set(), check the length before reading the first byte, and -decrease the length by the tag byte when reading and verifying the -sequence length. - -In get_req_flags(), check the length before reading the first byte, -and check the context tag length after decoding it. - -ticket: 8933 (new) -tags: pullup -target_version: 1.18-next -target_version: 1.17-next - -(cherry picked from commit 64f4b75a22212681ca293f8f09ddd24b0244d5b4) ---- - src/lib/gssapi/spnego/spnego_mech.c | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - -diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c -index 4cf011143..13c351620 100644 ---- a/src/lib/gssapi/spnego/spnego_mech.c -+++ b/src/lib/gssapi/spnego/spnego_mech.c -@@ -3462,14 +3462,14 @@ get_mech_set(OM_uint32 *minor_status, unsigned char **buff_in, - unsigned char *start; - int i; - -- if (**buff_in != SEQUENCE_OF) -+ if (buff_length < 1 || **buff_in != SEQUENCE_OF) - return (NULL); - - start = *buff_in; - (*buff_in)++; - -- length = gssint_get_der_length(buff_in, buff_length, &bytes); -- if (length < 0 || buff_length - bytes < (unsigned int)length) -+ length = gssint_get_der_length(buff_in, buff_length - 1, &bytes); -+ if (length < 0 || buff_length - 1 - bytes < (unsigned int)length) - return NULL; - - major_status = gss_create_empty_oid_set(minor_status, -@@ -3549,11 +3549,11 @@ get_req_flags(unsigned char **buff_in, OM_uint32 bodysize, - { - unsigned int len; - -- if (**buff_in != (CONTEXT | 0x01)) -+ if (bodysize < 1 || **buff_in != (CONTEXT | 0x01)) - return (0); - - if (g_get_tag_and_length(buff_in, (CONTEXT | 0x01), -- bodysize, &len) < 0) -+ bodysize, &len) < 0 || len != 4) - return GSS_S_DEFECTIVE_TOKEN; - - if (*(*buff_in)++ != BIT_STRING) diff --git a/Fix-leak-in-KERB_AP_OPTIONS_CBT-server-support.patch b/Fix-leak-in-KERB_AP_OPTIONS_CBT-server-support.patch index c5ec79a..90bbcab 100644 --- a/Fix-leak-in-KERB_AP_OPTIONS_CBT-server-support.patch +++ b/Fix-leak-in-KERB_AP_OPTIONS_CBT-server-support.patch @@ -1,4 +1,4 @@ -From ff47523d7d812fba24106f416aafa5d1f2c433a2 Mon Sep 17 00:00:00 2001 +From 4b2176eaad00630890abe4b458cbc31f05b2b9c0 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Fri, 24 Jul 2020 16:05:24 -0400 Subject: [PATCH] Fix leak in KERB_AP_OPTIONS_CBT server support diff --git a/Fix-minor-static-analysis-defects.patch b/Fix-minor-static-analysis-defects.patch index 653bce1..644df97 100644 --- a/Fix-minor-static-analysis-defects.patch +++ b/Fix-minor-static-analysis-defects.patch @@ -1,4 +1,4 @@ -From c3d96fca46cb2cc3ee9f4c2e2a4ed98bad3e310a Mon Sep 17 00:00:00 2001 +From ae153c1dbb91782e1c8d5e80be9e133766eb81fd Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Thu, 15 Oct 2020 18:15:29 -0400 Subject: [PATCH] Fix minor static analysis defects diff --git a/Fix-typo-in-in-in-the-ksu-man-page.patch b/Fix-typo-in-in-in-the-ksu-man-page.patch index 040355c..a6c1f5c 100644 --- a/Fix-typo-in-in-in-the-ksu-man-page.patch +++ b/Fix-typo-in-in-in-the-ksu-man-page.patch @@ -1,4 +1,4 @@ -From bf8567ed95991628f198e88403e30f78e2d74e15 Mon Sep 17 00:00:00 2001 +From 5399eaea6c5e00c4e96fa5507aa50dd643337194 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Thu, 14 May 2020 15:01:18 -0400 Subject: [PATCH] Fix typo ("in in") in the ksu man page @@ -23,7 +23,7 @@ index 8d6c7ef79..933738229 100644 diff --git a/src/man/ksu.man b/src/man/ksu.man -index 81e34815d..8d4c6a359 100644 +index a1972518c..b07a4b05d 100644 --- a/src/man/ksu.man +++ b/src/man/ksu.man @@ -176,7 +176,7 @@ wrong password is typed in, ksu fails. diff --git a/Ignore-bad-enctypes-in-krb5_string_to_keysalts.patch b/Ignore-bad-enctypes-in-krb5_string_to_keysalts.patch index 14e27a9..01edf16 100644 --- a/Ignore-bad-enctypes-in-krb5_string_to_keysalts.patch +++ b/Ignore-bad-enctypes-in-krb5_string_to_keysalts.patch @@ -1,4 +1,4 @@ -From e74f9424e47ab914c46e549fc5a2cbdf2615ef93 Mon Sep 17 00:00:00 2001 +From 6931f8ed0fd8c9f634e1e48f1e8926022610fc3f Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Wed, 15 Jul 2020 15:42:20 -0400 Subject: [PATCH] Ignore bad enctypes in krb5_string_to_keysalts() diff --git a/Implement-GSS_C_CHANNEL_BOUND_FLAG.patch b/Implement-GSS_C_CHANNEL_BOUND_FLAG.patch index 2b41b6b..d93a3f8 100644 --- a/Implement-GSS_C_CHANNEL_BOUND_FLAG.patch +++ b/Implement-GSS_C_CHANNEL_BOUND_FLAG.patch @@ -1,4 +1,4 @@ -From 651b9b8084ecff5553b7ef6ee723ce7c4438a9d8 Mon Sep 17 00:00:00 2001 +From 40093f65c58ab78a050860ce41560595aa8ecf7e Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 5 Jul 2017 11:38:30 -0400 Subject: [PATCH] Implement GSS_C_CHANNEL_BOUND_FLAG diff --git a/Implement-KERB_AP_OPTIONS_CBT-server-side.patch b/Implement-KERB_AP_OPTIONS_CBT-server-side.patch index eadc695..a43ae8b 100644 --- a/Implement-KERB_AP_OPTIONS_CBT-server-side.patch +++ b/Implement-KERB_AP_OPTIONS_CBT-server-side.patch @@ -1,4 +1,4 @@ -From bc89c6c720c4170d43010fead23550b80499c32a Mon Sep 17 00:00:00 2001 +From 2250babfa6fc6590d50fc9c9beb267ba280ff685 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Mon, 9 Mar 2020 16:04:21 +0100 Subject: [PATCH] Implement KERB_AP_OPTIONS_CBT (server side) diff --git a/Improve-KDC-alias-checking-for-S4U-requests.patch b/Improve-KDC-alias-checking-for-S4U-requests.patch index 3dbb119..d58ffa5 100644 --- a/Improve-KDC-alias-checking-for-S4U-requests.patch +++ b/Improve-KDC-alias-checking-for-S4U-requests.patch @@ -1,4 +1,4 @@ -From ed87237cdd70f72b309960a294a2bed26cef1579 Mon Sep 17 00:00:00 2001 +From ec23f914a4be4f4ce5a8960ea72f0f45f7c8cf59 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 4 Sep 2020 14:05:50 +0300 Subject: [PATCH] Improve KDC alias checking for S4U requests diff --git a/Improve-negoex_parse_token-code-hygiene.patch b/Improve-negoex_parse_token-code-hygiene.patch index a58c2e6..ef9bf2b 100644 --- a/Improve-negoex_parse_token-code-hygiene.patch +++ b/Improve-negoex_parse_token-code-hygiene.patch @@ -1,4 +1,4 @@ -From 4c96c8fef146337b7d3c0ebb4118a18818dd1f4e Mon Sep 17 00:00:00 2001 +From d604359e2f0bce65f08d0d805e0795e29287109c Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 9 Jun 2020 16:23:37 -0400 Subject: [PATCH] Improve negoex_parse_token() code hygiene diff --git a/Minimize-usage-of-tgs_server-in-KDC.patch b/Minimize-usage-of-tgs_server-in-KDC.patch index f08458e..3e3c740 100644 --- a/Minimize-usage-of-tgs_server-in-KDC.patch +++ b/Minimize-usage-of-tgs_server-in-KDC.patch @@ -1,4 +1,4 @@ -From 5e79319edf3836d12dbc710ec1e2dd4405c9df35 Mon Sep 17 00:00:00 2001 +From 62f5a8c4ef97f0f0f3ceddff8e0a768c5f3b544e Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Fri, 25 Sep 2020 11:12:34 -0400 Subject: [PATCH] Minimize usage of tgs_server in KDC diff --git a/Omit-KDC-indicator-check-for-S4U2Self-requests.patch b/Omit-KDC-indicator-check-for-S4U2Self-requests.patch index d5eacc1..782974b 100644 --- a/Omit-KDC-indicator-check-for-S4U2Self-requests.patch +++ b/Omit-KDC-indicator-check-for-S4U2Self-requests.patch @@ -1,4 +1,4 @@ -From f0ac5c1efef5401f669dc176e62c09b0b01fa2d0 Mon Sep 17 00:00:00 2001 +From a9144f5238b91949f32355f5ab88e2ade734eb06 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Wed, 6 May 2020 16:03:13 -0400 Subject: [PATCH] Omit KDC indicator check for S4U2Self requests diff --git a/Omit-PA_FOR_USER-if-we-can-t-compute-its-checksum.patch b/Omit-PA_FOR_USER-if-we-can-t-compute-its-checksum.patch index 8e1c248..bc4ed52 100644 --- a/Omit-PA_FOR_USER-if-we-can-t-compute-its-checksum.patch +++ b/Omit-PA_FOR_USER-if-we-can-t-compute-its-checksum.patch @@ -1,4 +1,4 @@ -From 5251097c927f476fe83ffe544b73fd2d785aaf2a Mon Sep 17 00:00:00 2001 +From 8fc932c8f75e4332aa7dc6c4862cb881308b6813 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Sat, 6 Jun 2020 11:03:37 +0200 Subject: [PATCH] Omit PA_FOR_USER if we can't compute its checksum diff --git a/Pass-channel-bindings-through-SPNEGO.patch b/Pass-channel-bindings-through-SPNEGO.patch index 0e307c3..e376472 100644 --- a/Pass-channel-bindings-through-SPNEGO.patch +++ b/Pass-channel-bindings-through-SPNEGO.patch @@ -1,4 +1,4 @@ -From 17d9b74328f247de5f9d820ae008726632d11d2a Mon Sep 17 00:00:00 2001 +From 19ef4a378a8fe483e82b1b4f979a7ffcb264325e Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Tue, 28 Apr 2020 18:15:55 +0200 Subject: [PATCH] Pass channel bindings through SPNEGO @@ -125,7 +125,7 @@ index 18d9d4147..8848ee4db 100644 if (major != GSS_S_COMPLETE && mech_output_token.length == 0) goto cleanup; diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c -index 594fc5894..4cf011143 100644 +index f4a042478..2327cd927 100644 --- a/src/lib/gssapi/spnego/spnego_mech.c +++ b/src/lib/gssapi/spnego/spnego_mech.c @@ -130,6 +130,7 @@ init_ctx_reselect(OM_uint32 *, spnego_gss_ctx_id_t, OM_uint32, @@ -147,7 +147,7 @@ index 594fc5894..4cf011143 100644 static gss_OID negotiate_mech(spnego_gss_ctx_id_t, gss_OID_set, OM_uint32 *); -@@ -905,6 +906,7 @@ init_ctx_call_init(OM_uint32 *minor_status, +@@ -906,6 +907,7 @@ init_ctx_call_init(OM_uint32 *minor_status, OM_uint32 req_flags, OM_uint32 time_req, gss_buffer_t mechtok_in, @@ -155,7 +155,7 @@ index 594fc5894..4cf011143 100644 gss_buffer_t mechtok_out, OM_uint32 *time_rec, send_token_flag *send_token) -@@ -921,15 +923,14 @@ init_ctx_call_init(OM_uint32 *minor_status, +@@ -922,15 +924,14 @@ init_ctx_call_init(OM_uint32 *minor_status, if (gss_oid_equal(sc->internal_mech, &negoex_mech)) { ret = negoex_init(minor_status, sc, mcred, target_name, mech_req_flags, time_req, mechtok_in, @@ -175,7 +175,7 @@ index 594fc5894..4cf011143 100644 } /* Bail out if the acceptor gave us an error token but the mech didn't -@@ -981,8 +982,8 @@ init_ctx_call_init(OM_uint32 *minor_status, +@@ -982,8 +983,8 @@ init_ctx_call_init(OM_uint32 *minor_status, gss_delete_sec_context(&tmpmin, &sc->ctx_handle, GSS_C_NO_BUFFER); tmpret = init_ctx_call_init(&tmpmin, sc, spcred, acc_negState, target_name, req_flags, time_req, @@ -186,7 +186,7 @@ index 594fc5894..4cf011143 100644 if (HARD_ERROR(tmpret)) goto fail; *minor_status = tmpmin; -@@ -1004,7 +1005,7 @@ spnego_gss_init_sec_context( +@@ -1005,7 +1006,7 @@ spnego_gss_init_sec_context( gss_OID mech_type, OM_uint32 req_flags, OM_uint32 time_req, @@ -195,7 +195,7 @@ index 594fc5894..4cf011143 100644 gss_buffer_t input_token, gss_OID *actual_mech, gss_buffer_t output_token, -@@ -1084,8 +1085,8 @@ spnego_gss_init_sec_context( +@@ -1085,8 +1086,8 @@ spnego_gss_init_sec_context( if (!spnego_ctx->mech_complete) { ret = init_ctx_call_init(minor_status, spnego_ctx, spcred, acc_negState, target_name, req_flags, @@ -206,7 +206,7 @@ index 594fc5894..4cf011143 100644 if (ret != GSS_S_COMPLETE) goto cleanup; -@@ -1542,8 +1543,9 @@ cleanup: +@@ -1543,8 +1544,9 @@ cleanup: static OM_uint32 acc_ctx_call_acc(OM_uint32 *minor_status, spnego_gss_ctx_id_t sc, spnego_gss_cred_id_t spcred, gss_buffer_t mechtok_in, @@ -218,7 +218,7 @@ index 594fc5894..4cf011143 100644 { OM_uint32 ret, tmpmin; gss_OID_desc mechoid; -@@ -1568,13 +1570,12 @@ acc_ctx_call_acc(OM_uint32 *minor_status, spnego_gss_ctx_id_t sc, +@@ -1569,13 +1571,12 @@ acc_ctx_call_acc(OM_uint32 *minor_status, spnego_gss_ctx_id_t sc, mcred = (spcred == NULL) ? GSS_C_NO_CREDENTIAL : spcred->mcred; if (negoex) { ret = negoex_accept(minor_status, sc, mcred, mechtok_in, @@ -234,7 +234,7 @@ index 594fc5894..4cf011143 100644 &sc->internal_name, &sc->actual_mech, mechtok_out, &sc->ctx_flags, time_rec, -@@ -1620,7 +1621,7 @@ spnego_gss_accept_sec_context( +@@ -1621,7 +1622,7 @@ spnego_gss_accept_sec_context( gss_ctx_id_t *context_handle, gss_cred_id_t verifier_cred_handle, gss_buffer_t input_token, @@ -243,7 +243,7 @@ index 594fc5894..4cf011143 100644 gss_name_t *src_name, gss_OID *mech_type, gss_buffer_t output_token, -@@ -1734,8 +1735,8 @@ spnego_gss_accept_sec_context( +@@ -1735,8 +1736,8 @@ spnego_gss_accept_sec_context( */ if (negState != REQUEST_MIC && mechtok_in != GSS_C_NO_BUFFER) { ret = acc_ctx_call_acc(minor_status, sc, spcred, mechtok_in, diff --git a/Pass-gss_localname-through-SPNEGO.patch b/Pass-gss_localname-through-SPNEGO.patch index e641a91..bbf703c 100644 --- a/Pass-gss_localname-through-SPNEGO.patch +++ b/Pass-gss_localname-through-SPNEGO.patch @@ -1,4 +1,4 @@ -From cec820485e8b854fe3ee42d0a67a77e7ad20595e Mon Sep 17 00:00:00 2001 +From fb89e83451519aed051bb129f3cf9cc34cde702f Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Sun, 26 Apr 2020 19:55:54 -0400 Subject: [PATCH] Pass gss_localname() through SPNEGO @@ -30,7 +30,7 @@ index a93763314..066ec736f 100644 ( OM_uint32 *minor_status, diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c -index ec0bae6a4..594fc5894 100644 +index b3010c201..f4a042478 100644 --- a/src/lib/gssapi/spnego/spnego_mech.c +++ b/src/lib/gssapi/spnego/spnego_mech.c @@ -237,7 +237,7 @@ static struct gss_config spnego_mechanism = @@ -42,7 +42,7 @@ index ec0bae6a4..594fc5894 100644 NULL, /* gss_userok */ NULL, /* gss_export_name */ spnego_gss_duplicate_name, /* gss_duplicate_name */ -@@ -2371,6 +2371,13 @@ spnego_gss_wrap_size_limit( +@@ -2372,6 +2372,13 @@ spnego_gss_wrap_size_limit( return (ret); } diff --git a/Refactor-KDC-authdata-list-management-helpers.patch b/Refactor-KDC-authdata-list-management-helpers.patch index 00aed49..f60e0af 100644 --- a/Refactor-KDC-authdata-list-management-helpers.patch +++ b/Refactor-KDC-authdata-list-management-helpers.patch @@ -1,4 +1,4 @@ -From 9335481c00cd15170adec244ccff0a00a014bbab Mon Sep 17 00:00:00 2001 +From 227828eb22ff0383f76b918899a03e1c7c97a7c0 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Wed, 5 Feb 2020 18:46:11 -0500 Subject: [PATCH] Refactor KDC authdata list management helpers diff --git a/Refactor-krb5-GSS-checksum-handling.patch b/Refactor-krb5-GSS-checksum-handling.patch index c80426b..a0bb217 100644 --- a/Refactor-krb5-GSS-checksum-handling.patch +++ b/Refactor-krb5-GSS-checksum-handling.patch @@ -1,4 +1,4 @@ -From c90cef2ebfbefc595798dd5dbb805575e1be0fbf Mon Sep 17 00:00:00 2001 +From 544c37e2928f2585708e36f77a6b0baa52c3c541 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Fri, 30 Jun 2017 16:03:01 -0400 Subject: [PATCH] Refactor krb5 GSS checksum handling diff --git a/Refresh-manually-acquired-creds-from-client-keytab.patch b/Refresh-manually-acquired-creds-from-client-keytab.patch index ff28434..dc50194 100644 --- a/Refresh-manually-acquired-creds-from-client-keytab.patch +++ b/Refresh-manually-acquired-creds-from-client-keytab.patch @@ -1,4 +1,4 @@ -From 7316aaa0e9249a88e919f2596d881f78970548bc Mon Sep 17 00:00:00 2001 +From e1762f16fe4d900903c5395cc3268f9b78835100 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Wed, 26 Feb 2020 18:27:17 -0500 Subject: [PATCH] Refresh manually acquired creds from client keytab diff --git a/Remove-resolver-test-utility.patch b/Remove-resolver-test-utility.patch index e5dd78d..e765069 100644 --- a/Remove-resolver-test-utility.patch +++ b/Remove-resolver-test-utility.patch @@ -1,4 +1,4 @@ -From 3e75969e0c0a52ec3ca8195200fcdadaa63b324f Mon Sep 17 00:00:00 2001 +From 8a2cd84c047ef7500dc8149ed6ace8e9fa631cad Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Thu, 28 May 2020 18:41:02 -0400 Subject: [PATCH] Remove resolver test utility diff --git a/Replace-gssrpc-tests-with-a-Python-script.patch b/Replace-gssrpc-tests-with-a-Python-script.patch index ced6543..fc8fe87 100644 --- a/Replace-gssrpc-tests-with-a-Python-script.patch +++ b/Replace-gssrpc-tests-with-a-Python-script.patch @@ -1,4 +1,4 @@ -From 404cc1152880a567fc27bb7c691a1a732692bbf9 Mon Sep 17 00:00:00 2001 +From e2ad633616a3f4db91bbd332d778df93e4bdb652 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Sat, 15 Feb 2020 20:34:23 -0500 Subject: [PATCH] Replace gssrpc tests with a Python script diff --git a/Unify-kvno-option-documentation.patch b/Unify-kvno-option-documentation.patch deleted file mode 100644 index b6f5e01..0000000 --- a/Unify-kvno-option-documentation.patch +++ /dev/null @@ -1,185 +0,0 @@ -From 52e3695cc5ef00766e12adfe8ed276c2885e71bb Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Thu, 20 Aug 2020 17:49:29 -0400 -Subject: [PATCH] Unify kvno option documentation - -Add missing kvno options to the kvno.rst synopsis and option -descriptions, and to the kvno usage message. Remove mention of '-h' -(help text), from kvno.rst as it is an implicit option. Note that the -three new caching options were added in release 1.19. - -Indicate the two exclusions (-u/-S and --u2u with the S4U2Self options) -and dependency (-P on S4U2Self) where they are missing. - -Switch xusage() to print only a single localized string, rather than -running each line of output through localization separately. - -Leave kvno -C undocumented for now, as the semantics of -KRB5_GC_CANONICALIZE are minimally useful and likely to change. - -[ghudson@mit.edu: edited documentation and commit message] - -ticket: 7476 -tags: pullup -target_version: 1.18-next - -(cherry picked from commit becd1ad6830b526d08ddaf5b2b6f213154c6446c) ---- - doc/user/user_commands/kvno.rst | 24 +++++++++++++----------- - src/clients/kvno/kvno.c | 15 +++++++++------ - src/man/kvno.man | 24 +++++++++++++----------- - 3 files changed, 35 insertions(+), 28 deletions(-) - -diff --git a/doc/user/user_commands/kvno.rst b/doc/user/user_commands/kvno.rst -index 718313576..65c44e1c0 100644 ---- a/doc/user/user_commands/kvno.rst -+++ b/doc/user/user_commands/kvno.rst -@@ -10,13 +10,9 @@ SYNOPSIS - [**-c** *ccache*] - [**-e** *etype*] - [**-q**] --[**-h**] -+[**-u** | **-S** *sname*] - [**-P**] --[**-S** *sname*] --[**-I** *for_user*] --[**-U** *for_user*] --[**-F** *cert_file*] --[**--u2u** *ccache*] -+[[{**-F** *cert_file* | {**-I** | **-U**} *for_user*} [**-P**]] | **--u2u** *ccache*] - *service1 service2* ... - - -@@ -39,13 +35,18 @@ OPTIONS - of all the services named on the command line. This is useful in - certain backward compatibility situations. - -+**-k** *keytab* -+ Decrypt the acquired tickets using *keytab* to confirm their -+ validity. -+ - **-q** - Suppress printing output when successful. If a service ticket - cannot be obtained, an error message will still be printed and - kvno will exit with nonzero status. - --**-h** -- Prints a usage statement and exits. -+**-u** -+ Use the unknown name type in requested service principal names. -+ This option Cannot be used with *-S*. - - **-P** - Specifies that the *service1 service2* ... arguments are to be -@@ -76,16 +77,17 @@ OPTIONS - - **--cached-only** - Only retrieve credentials already present in the cache, not from -- the KDC. -+ the KDC. (Added in release 1.19.) - - **--no-store** - Do not store retrieved credentials in the cache. If - **--out-cache** is also specified, credentials will still be -- stored into the output credential cache. -+ stored into the output credential cache. (Added in release 1.19.) - - **--out-cache** *ccache* - Initialize *ccache* and store all retrieved credentials into it. -- Do not store acquired credentials in the input cache. -+ Do not store acquired credentials in the input cache. (Added in -+ release 1.19.) - - **--u2u** *ccache* - Requests a user-to-user ticket. *ccache* must contain a local -diff --git a/src/clients/kvno/kvno.c b/src/clients/kvno/kvno.c -index 9d85864f6..c5f6bf700 100644 ---- a/src/clients/kvno/kvno.c -+++ b/src/clients/kvno/kvno.c -@@ -38,15 +38,18 @@ - static char *prog; - static int quiet = 0; - -+#define XUSAGE_BREAK "\n\t" -+ - static void - xusage() - { -- fprintf(stderr, _("usage: %s [-C] [-u] [-c ccache] [-e etype]\n"), prog); -- fprintf(stderr, _("\t[-k keytab] [-S sname] [{-I | -U} for_user | " -- "[-F cert_file] [-P]]\n")); -- fprintf(stderr, _("\t[--cached-only] [--no-store] [--out-cache ccache] " -- "[--u2u ccache]\n")); -- fprintf(stderr, _("\tservice1 service2 ...\n")); -+ fprintf(stderr, _("usage: %s [-c ccache] [-e etype] [-k keytab] [-q] " -+ "[-u | -S sname]" XUSAGE_BREAK -+ "[[{-F cert_file | {-I | -U} for_user} [-P]] | " -+ "--u2u ccache]" XUSAGE_BREAK -+ "[--cached-only] [--no-store] [--out-cache] " -+ "service1 service2 ...\n"), -+ prog); - exit(1); - } - -diff --git a/src/man/kvno.man b/src/man/kvno.man -index b9f6739eb..22318324d 100644 ---- a/src/man/kvno.man -+++ b/src/man/kvno.man -@@ -36,13 +36,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]] - [\fB\-c\fP \fIccache\fP] - [\fB\-e\fP \fIetype\fP] - [\fB\-q\fP] --[\fB\-h\fP] -+[\fB\-u\fP | \fB\-S\fP \fIsname\fP] - [\fB\-P\fP] --[\fB\-S\fP \fIsname\fP] --[\fB\-I\fP \fIfor_user\fP] --[\fB\-U\fP \fIfor_user\fP] --[\fB\-F\fP \fIcert_file\fP] --[\fB\-\-u2u\fP \fIccache\fP] -+[[{\fB\-F\fP \fIcert_file\fP | {\fB\-I\fP | \fB\-U\fP} \fIfor_user\fP} [\fB\-P\fP]] | \fB\-\-u2u\fP \fIccache\fP] - \fIservice1 service2\fP ... - .SH DESCRIPTION - .sp -@@ -60,13 +56,18 @@ Specifies the enctype which will be requested for the session key - of all the services named on the command line. This is useful in - certain backward compatibility situations. - .TP -+\fB\-k\fP \fIkeytab\fP -+Decrypt the acquired tickets using \fIkeytab\fP to confirm their -+validity. -+.TP - \fB\-q\fP - Suppress printing output when successful. If a service ticket - cannot be obtained, an error message will still be printed and - kvno will exit with nonzero status. - .TP --\fB\-h\fP --Prints a usage statement and exits. -+\fB\-u\fP -+Use the unknown name type in requested service principal names. -+This option Cannot be used with \fI\-S\fP\&. - .TP - \fB\-P\fP - Specifies that the \fIservice1 service2\fP ... arguments are to be -@@ -97,16 +98,17 @@ certificate file must be in PEM format. - .TP - \fB\-\-cached\-only\fP - Only retrieve credentials already present in the cache, not from --the KDC. -+the KDC. (Added in release 1.19.) - .TP - \fB\-\-no\-store\fP - Do not store retrieved credentials in the cache. If - \fB\-\-out\-cache\fP is also specified, credentials will still be --stored into the output credential cache. -+stored into the output credential cache. (Added in release 1.19.) - .TP - \fB\-\-out\-cache\fP \fIccache\fP - Initialize \fIccache\fP and store all retrieved credentials into it. --Do not store acquired credentials in the input cache. -+Do not store acquired credentials in the input cache. (Added in -+release 1.19.) - .TP - \fB\-\-u2u\fP \fIccache\fP - Requests a user\-to\-user ticket. \fIccache\fP must contain a local diff --git a/Use-two-queues-for-concurrent-t_otp.py-daemons.patch b/Use-two-queues-for-concurrent-t_otp.py-daemons.patch index 4e81cd0..88c2364 100644 --- a/Use-two-queues-for-concurrent-t_otp.py-daemons.patch +++ b/Use-two-queues-for-concurrent-t_otp.py-daemons.patch @@ -1,4 +1,4 @@ -From 3e0d464f55320b393e32285f31710c24758a9101 Mon Sep 17 00:00:00 2001 +From e12c670bceb08413f797ecd643675a4a80dac824 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Wed, 4 Mar 2020 17:18:51 -0500 Subject: [PATCH] Use two queues for concurrent t_otp.py daemons diff --git a/downstream-Adjust-build-configuration.patch b/downstream-Adjust-build-configuration.patch index 47f6c31..62000c1 100644 --- a/downstream-Adjust-build-configuration.patch +++ b/downstream-Adjust-build-configuration.patch @@ -1,4 +1,4 @@ -From 30ece66508c8e10f704cd2860dfd421ebee15897 Mon Sep 17 00:00:00 2001 +From c06693e5a17daf0fd585e608e8bfd1eb3eef447c Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:45:26 -0400 Subject: [PATCH] [downstream] Adjust build configuration diff --git a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch b/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch index 08b78b1..310e1ac 100644 --- a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch +++ b/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch @@ -1,4 +1,4 @@ -From bf8521bfaa4a4d54f6eb94f785c68942f4afa055 Mon Sep 17 00:00:00 2001 +From a983f32cfd2ec3f0571db347426835e8fc7c8464 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 9 Nov 2018 15:12:21 -0500 Subject: [PATCH] [downstream] FIPS with PRNG and RADIUS and MD4 diff --git a/downstream-Remove-3des-support.patch b/downstream-Remove-3des-support.patch index 570762d..e060f4e 100644 --- a/downstream-Remove-3des-support.patch +++ b/downstream-Remove-3des-support.patch @@ -1,4 +1,4 @@ -From c920b585b8400ef44684c673c54264657195f3ce Mon Sep 17 00:00:00 2001 +From 603a735ba52b50541520e53b031be47817de2fd5 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 26 Mar 2019 18:51:10 -0400 Subject: [PATCH] [downstream] Remove 3des support @@ -5552,7 +5552,7 @@ index 85a9574f3..3ce2a90ce 100644 code = 0; retval = GSS_S_BAD_SIG; diff --git a/src/lib/gssapi/krb5/util_crypt.c b/src/lib/gssapi/krb5/util_crypt.c -index 80954aff7..f7d3e92c4 100644 +index ddb0af8fc..d6c71aeb8 100644 --- a/src/lib/gssapi/krb5/util_crypt.c +++ b/src/lib/gssapi/krb5/util_crypt.c @@ -97,17 +97,6 @@ kg_setup_keys(krb5_context context, krb5_gss_ctx_id_rec *ctx, krb5_key subkey, diff --git a/downstream-SELinux-integration.patch b/downstream-SELinux-integration.patch index e5322af..4574a19 100644 --- a/downstream-SELinux-integration.patch +++ b/downstream-SELinux-integration.patch @@ -1,4 +1,4 @@ -From f8c70f6190a0573e2aca0b40964cf3b1a73ca8bb Mon Sep 17 00:00:00 2001 +From 2c4d04d1da4dbb1a312db965f3392d7d0bc67a17 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:30:53 -0400 Subject: [PATCH] [downstream] SELinux integration @@ -67,10 +67,10 @@ Last-updated: krb5-1.18-beta1 create mode 100644 src/util/support/selinux.c diff --git a/src/aclocal.m4 b/src/aclocal.m4 -index 830203683..6796fec53 100644 +index 59621e3e7..398eca7e4 100644 --- a/src/aclocal.m4 +++ b/src/aclocal.m4 -@@ -89,6 +89,7 @@ AC_SUBST_FILE(libnodeps_frag) +@@ -85,6 +85,7 @@ AC_SUBST_FILE(libnodeps_frag) dnl KRB5_AC_PRAGMA_WEAK_REF WITH_LDAP @@ -78,7 +78,7 @@ index 830203683..6796fec53 100644 KRB5_LIB_PARAMS KRB5_AC_INITFINI KRB5_AC_ENABLE_THREADS -@@ -1743,4 +1744,51 @@ AC_SUBST(PAM_LIBS) +@@ -1739,4 +1740,51 @@ AC_SUBST(PAM_LIBS) AC_SUBST(PAM_MAN) AC_SUBST(NON_PAM_MAN) ])dnl @@ -253,7 +253,7 @@ index 79761f6d2..e9435c693 100644 #include diff --git a/src/kadmin/dbutil/dump.c b/src/kadmin/dbutil/dump.c -index 301e3476d..19f2cc230 100644 +index ff2f25050..e3457622a 100644 --- a/src/kadmin/dbutil/dump.c +++ b/src/kadmin/dbutil/dump.c @@ -148,12 +148,21 @@ create_ofile(char *ofile, char **tmpname) @@ -288,7 +288,7 @@ index 301e3476d..19f2cc230 100644 com_err(progname, errno, _("while creating 'ok' file, '%s'"), file_ok); goto cleanup; diff --git a/src/kdc/main.c b/src/kdc/main.c -index fdcd694d7..1ede4bf2f 100644 +index 38d76b3b1..eb6966f2d 100644 --- a/src/kdc/main.c +++ b/src/kdc/main.c @@ -872,7 +872,7 @@ write_pid_file(const char *path) diff --git a/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch b/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch index 56565b1..2e41026 100644 --- a/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch +++ b/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch @@ -1,4 +1,4 @@ -From 040dd62418b918adc993b9cc3e1e80fc232286c4 Mon Sep 17 00:00:00 2001 +From b1eeb9caf1e1fec23d92f163086ec168fbaf74e5 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 15 Nov 2019 20:05:16 +0000 Subject: [PATCH] [downstream] Use backported version of OpenSSL-3 KDF diff --git a/downstream-fix-debuginfo-with-y.tab.c.patch b/downstream-fix-debuginfo-with-y.tab.c.patch index 33f61c5..7600f5d 100644 --- a/downstream-fix-debuginfo-with-y.tab.c.patch +++ b/downstream-fix-debuginfo-with-y.tab.c.patch @@ -1,4 +1,4 @@ -From c6e103db0eb02c31a13b8cbcbae296c473074991 Mon Sep 17 00:00:00 2001 +From 126569bf428c546b938b9fec5b12851f09d61c94 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:49:25 -0400 Subject: [PATCH] [downstream] fix debuginfo with y.tab.c diff --git a/downstream-ksu-pam-integration.patch b/downstream-ksu-pam-integration.patch index e81f2c1..be0e02f 100644 --- a/downstream-ksu-pam-integration.patch +++ b/downstream-ksu-pam-integration.patch @@ -1,4 +1,4 @@ -From 9feb7298b90d3e6a34821fce7315757c0bf81c9e Mon Sep 17 00:00:00 2001 +From a5a642c33a2f57d24c1cfa8ca3e286418206ab55 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:29:58 -0400 Subject: [PATCH] [downstream] ksu pam integration @@ -30,10 +30,10 @@ Last-updated: krb5-1.18-beta1 create mode 100644 src/clients/ksu/pam.h diff --git a/src/aclocal.m4 b/src/aclocal.m4 -index 2394f7e33..830203683 100644 +index 8709a7f5d..59621e3e7 100644 --- a/src/aclocal.m4 +++ b/src/aclocal.m4 -@@ -1675,3 +1675,72 @@ if test "$with_ldap" = yes; then +@@ -1671,3 +1671,72 @@ if test "$with_ldap" = yes; then OPENLDAP_PLUGIN=yes fi ])dnl diff --git a/downstream-netlib-and-dns.patch b/downstream-netlib-and-dns.patch index 05bddc4..156870b 100644 --- a/downstream-netlib-and-dns.patch +++ b/downstream-netlib-and-dns.patch @@ -1,4 +1,4 @@ -From 4254bee1b97edeb0848efce635bcf1b56306f968 Mon Sep 17 00:00:00 2001 +From 23bce0aef64454bf808b9885967b04abafcf7917 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:46:21 -0400 Subject: [PATCH] [downstream] netlib and dns @@ -11,10 +11,10 @@ Last-updated: krb5-1.3.1 1 file changed, 1 insertion(+) diff --git a/src/aclocal.m4 b/src/aclocal.m4 -index 6796fec53..c4358988a 100644 +index 398eca7e4..7ef2db56b 100644 --- a/src/aclocal.m4 +++ b/src/aclocal.m4 -@@ -724,6 +724,7 @@ AC_HELP_STRING([--with-netlib=LIBS], use user defined resolver library), +@@ -720,6 +720,7 @@ AC_HELP_STRING([--with-netlib=LIBS], use user defined resolver library), LIBS="$LIBS $withval" AC_MSG_RESULT("netlib will use \'$withval\'") fi diff --git a/krb5.spec b/krb5.spec index 6223d52..6d2244a 100644 --- a/krb5.spec +++ b/krb5.spec @@ -16,9 +16,9 @@ Summary: The Kerberos network authentication system Name: krb5 -Version: 1.18.2 +Version: 1.18.3 # for prerelease, should be e.g., 0.% {prerelease}.1% { ?dist } (without spaces) -Release: 30%{?dist} +Release: 1%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/1.18/krb5-%{version}%{prerelease}.tar.gz @@ -50,7 +50,6 @@ Patch7: downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch Patch9: Allow-certauth-modules-to-set-hw-authent-flag.patch Patch11: Refresh-manually-acquired-creds-from-client-keytab.patch Patch13: Add-finalization-safety-check-to-com_err.patch -Patch14: Eliminate-redundant-PKINIT-responder-invocation.patch Patch15: Correctly-import-service-GSS-host-based-name.patch Patch16: Do-expiration-warnings-for-all-init_creds-APIs.patch Patch17: Pass-gss_localname-through-SPNEGO.patch @@ -68,12 +67,9 @@ Patch29: Add-client_aware_channel_bindings-option.patch Patch30: Pass-channel-bindings-through-SPNEGO.patch Patch31: Add-channel-bindings-tests.patch Patch32: Use-two-queues-for-concurrent-t_otp.py-daemons.patch -Patch33: Allow-gss_unwrap_iov-of-unpadded-RC4-tokens.patch Patch34: Ignore-bad-enctypes-in-krb5_string_to_keysalts.patch Patch35: Fix-leak-in-KERB_AP_OPTIONS_CBT-server-support.patch -Patch36: Fix-input-length-checking-in-SPNEGO-DER-decoding.patch Patch37: Add-three-kvno-options-from-Heimdal-kgetcred.patch -Patch38: Unify-kvno-option-documentation.patch Patch39: Improve-KDC-alias-checking-for-S4U-requests.patch Patch40: Adjust-KDC-alias-helper-function-contract.patch Patch41: Allow-aliases-when-matching-U2U-second-ticket.patch @@ -81,7 +77,6 @@ Patch42: Refactor-KDC-authdata-list-management-helpers.patch Patch43: Avoid-passing-DB-entry-structures-in-KDC.patch Patch44: Minimize-usage-of-tgs_server-in-KDC.patch Patch45: Fix-minor-static-analysis-defects.patch -Patch46: Add-recursion-limit-for-ASN.1-indefinite-lengths.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -632,6 +627,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Wed Nov 18 2020 Robbie Harwood - 1.18.3-1 +- New upstream version (1.18.3) + * Tue Nov 17 2020 Robbie Harwood - 1.18.2-30 - Migrate /var/run to /run, an exercise in pointlessness - Resolves: #1898410 diff --git a/sources b/sources index c61d805..6ed904d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (krb5-1.18.2.tar.gz) = 7cbb1b28e677fea3e0794e93951f3caaa2c49bb1175dd187951e72a466cc69d96c3b833d838000fe911c1a437d96a558e550f27c53a8b332fb9dfc7cbb7ec44c -SHA512 (krb5-1.18.2.tar.gz.asc) = 70775a06104b4d792d278da2efa92e94ddacb4ea319bfe2b253f5afcfec27f3bc5ddd12560294a265e3cf3d4fc74bcbfc3f5eeff8634d66c00d67e18dc93a74a +SHA512 (krb5-1.18.3.tar.gz) = cf0bf6cf8f622fa085954e6da998d952cf64dc7ccc319972ed81ea0542089cabf2d0e8243df84da01ad6f40584768ca2f02d108630c6741fa7b3d7d98c887c01 +SHA512 (krb5-1.18.3.tar.gz.asc) = 7c5a83e13d00910d895d545ed63310ebec48c90c29846dd54e48048f710360e8306778729b636baa091a4e9048998ff6d4dfe37f88dd6292540d55678c961a30 From dc8775d11d7134f84024545f21b4561a6bd8dccf Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Wed, 18 Nov 2020 13:33:37 -0500 Subject: [PATCH 004/103] Fix build failure in -1 --- ...e-kvno-options-from-Heimdal-kgetcred.patch | 34 +++++++++---------- ...t-KDC-alias-helper-function-contract.patch | 2 +- ...ases-when-matching-U2U-second-ticket.patch | 2 +- ...d-passing-DB-entry-structures-in-KDC.patch | 2 +- Fix-minor-static-analysis-defects.patch | 2 +- ...-KDC-alias-checking-for-S4U-requests.patch | 2 +- Minimize-usage-of-tgs_server-in-KDC.patch | 2 +- ...KDC-authdata-list-management-helpers.patch | 2 +- krb5.spec | 5 ++- 9 files changed, 28 insertions(+), 25 deletions(-) diff --git a/Add-three-kvno-options-from-Heimdal-kgetcred.patch b/Add-three-kvno-options-from-Heimdal-kgetcred.patch index 9cb1386..1f6452f 100644 --- a/Add-three-kvno-options-from-Heimdal-kgetcred.patch +++ b/Add-three-kvno-options-from-Heimdal-kgetcred.patch @@ -1,4 +1,4 @@ -From ba21ad84f7c8317a595ded1e657c7985fa4b90e1 Mon Sep 17 00:00:00 2001 +From 4da87d7fe288f3f7087dca8396d42abfd958b8e4 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Wed, 17 Jun 2020 20:48:38 -0400 Subject: [PATCH] Add three kvno options from Heimdal kgetcred @@ -17,10 +17,10 @@ ticket: 8917 (new) --- doc/user/user_commands/kvno.rst | 13 ++++ src/clients/kvno/Makefile.in | 3 + - src/clients/kvno/kvno.c | 113 +++++++++++++++++++++++--------- + src/clients/kvno/kvno.c | 112 +++++++++++++++++++++++--------- src/clients/kvno/t_kvno.py | 75 +++++++++++++++++++++ src/man/kvno.man | 13 ++++ - 5 files changed, 185 insertions(+), 32 deletions(-) + 5 files changed, 185 insertions(+), 31 deletions(-) create mode 100644 src/clients/kvno/t_kvno.py diff --git a/doc/user/user_commands/kvno.rst b/doc/user/user_commands/kvno.rst @@ -62,16 +62,16 @@ index 1c3f79392..5ba877271 100644 $(RM) kvno.o kvno diff --git a/src/clients/kvno/kvno.c b/src/clients/kvno/kvno.c -index 8edd97361..55e7dd0ce 100644 +index 8edd97361..c5f6bf700 100644 --- a/src/clients/kvno/kvno.c +++ b/src/clients/kvno/kvno.c -@@ -47,15 +47,16 @@ xusage() +@@ -47,15 +47,17 @@ xusage() "[-u | -S sname]" XUSAGE_BREAK "[[{-F cert_file | {-I | -U} for_user} [-P]] | " "--u2u ccache]" XUSAGE_BREAK + "[--cached-only] [--no-store] [--out-cache] " "service1 service2 ...\n"), -- prog); + prog); exit(1); } @@ -86,7 +86,7 @@ index 8edd97361..55e7dd0ce 100644 const char *u2u_ccname); #include -@@ -65,18 +66,21 @@ static void extended_com_err_fn(const char *myprog, errcode_t code, +@@ -65,18 +67,21 @@ static void extended_com_err_fn(const char *myprog, errcode_t code, int main(int argc, char *argv[]) { @@ -115,7 +115,7 @@ index 8edd97361..55e7dd0ce 100644 setlocale(LC_ALL, ""); set_com_err_hook(extended_com_err_fn); -@@ -139,6 +143,12 @@ main(int argc, char *argv[]) +@@ -139,6 +144,12 @@ main(int argc, char *argv[]) case OPTION_U2U: u2u_ccname = optarg; break; @@ -128,7 +128,7 @@ index 8edd97361..55e7dd0ce 100644 default: xusage(); break; -@@ -163,8 +173,9 @@ main(int argc, char *argv[]) +@@ -163,8 +174,9 @@ main(int argc, char *argv[]) xusage(); do_v5_kvno(argc - optind, argv + optind, ccachestr, etypestr, keytab_name, @@ -140,7 +140,7 @@ index 8edd97361..55e7dd0ce 100644 return 0; } -@@ -278,14 +289,16 @@ static krb5_error_code +@@ -278,14 +290,16 @@ static krb5_error_code kvno(const char *name, krb5_ccache ccache, krb5_principal me, krb5_enctype etype, krb5_keytab keytab, const char *sname, krb5_flags options, int unknown, krb5_principal for_user_princ, @@ -159,7 +159,7 @@ index 8edd97361..55e7dd0ce 100644 memset(&in_creds, 0, sizeof(in_creds)); if (sname != NULL) { -@@ -325,13 +338,12 @@ kvno(const char *name, krb5_ccache ccache, krb5_principal me, +@@ -325,13 +339,12 @@ kvno(const char *name, krb5_ccache ccache, krb5_principal me, in_creds.client = for_user_princ; in_creds.server = me; ret = krb5_get_credentials_for_user(context, options, ccache, @@ -175,7 +175,7 @@ index 8edd97361..55e7dd0ce 100644 } if (ret) { -@@ -340,7 +352,7 @@ kvno(const char *name, krb5_ccache ccache, krb5_principal me, +@@ -340,7 +353,7 @@ kvno(const char *name, krb5_ccache ccache, krb5_principal me, } /* We need a native ticket. */ @@ -184,7 +184,7 @@ index 8edd97361..55e7dd0ce 100644 if (ret) { com_err(prog, ret, _("while decoding ticket for %s"), princ); goto cleanup; -@@ -366,15 +378,15 @@ kvno(const char *name, krb5_ccache ccache, krb5_principal me, +@@ -366,15 +379,15 @@ kvno(const char *name, krb5_ccache ccache, krb5_principal me, } if (proxy) { @@ -205,7 +205,7 @@ index 8edd97361..55e7dd0ce 100644 krb5_free_principal(context, in_creds.client); if (ret) { com_err(prog, ret, _("%s: constrained delegation failed"), -@@ -383,10 +395,13 @@ kvno(const char *name, krb5_ccache ccache, krb5_principal me, +@@ -383,10 +396,13 @@ kvno(const char *name, krb5_ccache ccache, krb5_principal me, } } @@ -220,7 +220,7 @@ index 8edd97361..55e7dd0ce 100644 krb5_free_unparsed_name(context, princ); return ret; } -@@ -432,19 +447,28 @@ cleanup: +@@ -432,19 +448,28 @@ cleanup: static void do_v5_kvno(int count, char *names[], char * ccachestr, char *etypestr, @@ -255,7 +255,7 @@ index 8edd97361..55e7dd0ce 100644 ret = krb5_init_context(&context); if (ret) { -@@ -471,6 +495,14 @@ do_v5_kvno(int count, char *names[], char * ccachestr, char *etypestr, +@@ -471,6 +496,14 @@ do_v5_kvno(int count, char *names[], char * ccachestr, char *etypestr, exit(1); } @@ -270,7 +270,7 @@ index 8edd97361..55e7dd0ce 100644 if (keytab_name != NULL) { ret = krb5_kt_resolve(context, keytab_name, &keytab); if (ret) { -@@ -517,8 +549,25 @@ do_v5_kvno(int count, char *names[], char * ccachestr, char *etypestr, +@@ -517,8 +550,25 @@ do_v5_kvno(int count, char *names[], char * ccachestr, char *etypestr, errors = 0; for (i = 0; i < count; i++) { if (kvno(names[i], ccache, me, etype, keytab, sname, options, unknown, diff --git a/Adjust-KDC-alias-helper-function-contract.patch b/Adjust-KDC-alias-helper-function-contract.patch index 0046bb4..13f4cb7 100644 --- a/Adjust-KDC-alias-helper-function-contract.patch +++ b/Adjust-KDC-alias-helper-function-contract.patch @@ -1,4 +1,4 @@ -From cf853d10b13dca77acd08d1387e94527994f9ef5 Mon Sep 17 00:00:00 2001 +From 833dfff1a11da3b1b9cf45a2bb09f17efa49cdba Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Tue, 22 Sep 2020 01:11:39 +0300 Subject: [PATCH] Adjust KDC alias helper function contract diff --git a/Allow-aliases-when-matching-U2U-second-ticket.patch b/Allow-aliases-when-matching-U2U-second-ticket.patch index 07519e1..523402f 100644 --- a/Allow-aliases-when-matching-U2U-second-ticket.patch +++ b/Allow-aliases-when-matching-U2U-second-ticket.patch @@ -1,4 +1,4 @@ -From 5a9b4d190906a8b11a7e1f707d1ea1930ce2fd31 Mon Sep 17 00:00:00 2001 +From e976a70ff23e600a76d1c3134f9c2f80753b6679 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Tue, 22 Sep 2020 01:17:11 +0300 Subject: [PATCH] Allow aliases when matching U2U second ticket diff --git a/Avoid-passing-DB-entry-structures-in-KDC.patch b/Avoid-passing-DB-entry-structures-in-KDC.patch index aeb20ad..23f96e3 100644 --- a/Avoid-passing-DB-entry-structures-in-KDC.patch +++ b/Avoid-passing-DB-entry-structures-in-KDC.patch @@ -1,4 +1,4 @@ -From f5987c71188138626030eef62145a126a84b62fb Mon Sep 17 00:00:00 2001 +From e0fc680b2fb51513993c4cdaa2c25b292f57a073 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Wed, 30 Sep 2020 02:12:00 -0400 Subject: [PATCH] Avoid passing DB entry structures in KDC diff --git a/Fix-minor-static-analysis-defects.patch b/Fix-minor-static-analysis-defects.patch index 644df97..b94b48c 100644 --- a/Fix-minor-static-analysis-defects.patch +++ b/Fix-minor-static-analysis-defects.patch @@ -1,4 +1,4 @@ -From ae153c1dbb91782e1c8d5e80be9e133766eb81fd Mon Sep 17 00:00:00 2001 +From 0de060366a1b75df47189f5cc0a7a92685cbe1d7 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Thu, 15 Oct 2020 18:15:29 -0400 Subject: [PATCH] Fix minor static analysis defects diff --git a/Improve-KDC-alias-checking-for-S4U-requests.patch b/Improve-KDC-alias-checking-for-S4U-requests.patch index d58ffa5..76b0bf9 100644 --- a/Improve-KDC-alias-checking-for-S4U-requests.patch +++ b/Improve-KDC-alias-checking-for-S4U-requests.patch @@ -1,4 +1,4 @@ -From ec23f914a4be4f4ce5a8960ea72f0f45f7c8cf59 Mon Sep 17 00:00:00 2001 +From dc03b33af17f2014baaa29412a1787cbcb140a62 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 4 Sep 2020 14:05:50 +0300 Subject: [PATCH] Improve KDC alias checking for S4U requests diff --git a/Minimize-usage-of-tgs_server-in-KDC.patch b/Minimize-usage-of-tgs_server-in-KDC.patch index 3e3c740..5199395 100644 --- a/Minimize-usage-of-tgs_server-in-KDC.patch +++ b/Minimize-usage-of-tgs_server-in-KDC.patch @@ -1,4 +1,4 @@ -From 62f5a8c4ef97f0f0f3ceddff8e0a768c5f3b544e Mon Sep 17 00:00:00 2001 +From ce60c549887a7732a6079d6e7111eb645f279781 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Fri, 25 Sep 2020 11:12:34 -0400 Subject: [PATCH] Minimize usage of tgs_server in KDC diff --git a/Refactor-KDC-authdata-list-management-helpers.patch b/Refactor-KDC-authdata-list-management-helpers.patch index f60e0af..495dbda 100644 --- a/Refactor-KDC-authdata-list-management-helpers.patch +++ b/Refactor-KDC-authdata-list-management-helpers.patch @@ -1,4 +1,4 @@ -From 227828eb22ff0383f76b918899a03e1c7c97a7c0 Mon Sep 17 00:00:00 2001 +From 00245d789edc6cf6263540d7c9d7ee45bbac58ce Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Wed, 5 Feb 2020 18:46:11 -0500 Subject: [PATCH] Refactor KDC authdata list management helpers diff --git a/krb5.spec b/krb5.spec index 6d2244a..8372f70 100644 --- a/krb5.spec +++ b/krb5.spec @@ -18,7 +18,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.18.3 # for prerelease, should be e.g., 0.% {prerelease}.1% { ?dist } (without spaces) -Release: 1%{?dist} +Release: 2%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/1.18/krb5-%{version}%{prerelease}.tar.gz @@ -627,6 +627,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Wed Nov 18 2020 Robbie Harwood - 1.18.3-2 +- Fix build failure in -1 + * Wed Nov 18 2020 Robbie Harwood - 1.18.3-1 - New upstream version (1.18.3) From ab7a2a35c2846faa89c58d48498208f495b1f6be Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 20 Nov 2020 11:43:18 -0500 Subject: [PATCH 005/103] Upstream executable shared libraries patch --- Add-channel-bindings-tests.patch | 2 +- ...client_aware_channel_bindings-option.patch | 2 +- ...finalization-safety-check-to-com_err.patch | 2 +- ...e-kvno-options-from-Heimdal-kgetcred.patch | 2 +- ...t-KDC-alias-helper-function-contract.patch | 2 +- ...ases-when-matching-U2U-second-ticket.patch | 2 +- ...tauth-modules-to-set-hw-authent-flag.patch | 2 +- ...d-passing-DB-entry-structures-in-KDC.patch | 2 +- ...y-import-service-GSS-host-based-name.patch | 2 +- ...ns_canonicalize_hostname-to-fallback.patch | 2 +- ...ion-warnings-for-all-init_creds-APIs.patch | 2 +- ...n-KERB_AP_OPTIONS_CBT-server-support.patch | 2 +- Fix-minor-static-analysis-defects.patch | 2 +- Fix-typo-in-in-in-the-ksu-man-page.patch | 2 +- ...-enctypes-in-krb5_string_to_keysalts.patch | 2 +- Implement-GSS_C_CHANNEL_BOUND_FLAG.patch | 2 +- ...ment-KERB_AP_OPTIONS_CBT-server-side.patch | 2 +- ...-KDC-alias-checking-for-S4U-requests.patch | 2 +- Improve-negoex_parse_token-code-hygiene.patch | 2 +- Install-shared-libraries-as-executable.patch | 42 +++++++++++ Minimize-usage-of-tgs_server-in-KDC.patch | 2 +- ...ndicator-check-for-S4U2Self-requests.patch | 2 +- ...SER-if-we-can-t-compute-its-checksum.patch | 2 +- Pass-channel-bindings-through-SPNEGO.patch | 2 +- Pass-gss_localname-through-SPNEGO.patch | 2 +- ...KDC-authdata-list-management-helpers.patch | 2 +- Refactor-krb5-GSS-checksum-handling.patch | 2 +- ...ly-acquired-creds-from-client-keytab.patch | 2 +- Remove-resolver-test-utility.patch | 2 +- ...ce-gssrpc-tests-with-a-Python-script.patch | 2 +- ...eues-for-concurrent-t_otp.py-daemons.patch | 2 +- downstream-Adjust-build-configuration.patch | 72 ------------------- ...am-FIPS-with-PRNG-and-RADIUS-and-MD4.patch | 2 +- downstream-Remove-3des-support.patch | 2 +- ...ackported-version-of-OpenSSL-3-KDF-i.patch | 2 +- downstream-fix-debuginfo-with-y.tab.c.patch | 2 +- downstream-netlib-and-dns.patch | 2 +- krb5.spec | 7 +- 38 files changed, 82 insertions(+), 109 deletions(-) create mode 100644 Install-shared-libraries-as-executable.patch delete mode 100644 downstream-Adjust-build-configuration.patch diff --git a/Add-channel-bindings-tests.patch b/Add-channel-bindings-tests.patch index 99c2da2..caf14f6 100644 --- a/Add-channel-bindings-tests.patch +++ b/Add-channel-bindings-tests.patch @@ -1,4 +1,4 @@ -From 2c8494a1b89d69da9de46ca2cb17f9e8f12eb9b5 Mon Sep 17 00:00:00 2001 +From b9ca222798a52ef3a28185ed44f3dfe19579d8fc Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 20 Mar 2020 00:17:28 +0100 Subject: [PATCH] Add channel bindings tests diff --git a/Add-client_aware_channel_bindings-option.patch b/Add-client_aware_channel_bindings-option.patch index 142e1d9..20ecd30 100644 --- a/Add-client_aware_channel_bindings-option.patch +++ b/Add-client_aware_channel_bindings-option.patch @@ -1,4 +1,4 @@ -From 849bb23d0044b2ff315608784c0f96b81feb472f Mon Sep 17 00:00:00 2001 +From 032c7f496c9b327752dda33bf85e74c66d3a93cf Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Tue, 10 Mar 2020 13:13:17 +0100 Subject: [PATCH] Add client_aware_channel_bindings option diff --git a/Add-finalization-safety-check-to-com_err.patch b/Add-finalization-safety-check-to-com_err.patch index 9411b15..d717bcc 100644 --- a/Add-finalization-safety-check-to-com_err.patch +++ b/Add-finalization-safety-check-to-com_err.patch @@ -1,4 +1,4 @@ -From 73f1db69f99462b5109a5dd4e1a9476667bd3715 Mon Sep 17 00:00:00 2001 +From 903fc418db4f5819c507cb0d42c0d4a12217c22f Mon Sep 17 00:00:00 2001 From: Jiri Sasek Date: Fri, 13 Mar 2020 19:02:58 +0100 Subject: [PATCH] Add finalization safety check to com_err diff --git a/Add-three-kvno-options-from-Heimdal-kgetcred.patch b/Add-three-kvno-options-from-Heimdal-kgetcred.patch index 1f6452f..a68394c 100644 --- a/Add-three-kvno-options-from-Heimdal-kgetcred.patch +++ b/Add-three-kvno-options-from-Heimdal-kgetcred.patch @@ -1,4 +1,4 @@ -From 4da87d7fe288f3f7087dca8396d42abfd958b8e4 Mon Sep 17 00:00:00 2001 +From ea2ad3330aa39ef4e62d8856ea7e8eed2843b3f2 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Wed, 17 Jun 2020 20:48:38 -0400 Subject: [PATCH] Add three kvno options from Heimdal kgetcred diff --git a/Adjust-KDC-alias-helper-function-contract.patch b/Adjust-KDC-alias-helper-function-contract.patch index 13f4cb7..b7ce64e 100644 --- a/Adjust-KDC-alias-helper-function-contract.patch +++ b/Adjust-KDC-alias-helper-function-contract.patch @@ -1,4 +1,4 @@ -From 833dfff1a11da3b1b9cf45a2bb09f17efa49cdba Mon Sep 17 00:00:00 2001 +From d27cef7eb6f099fb1ec4e2d49625aee0d8dc1007 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Tue, 22 Sep 2020 01:11:39 +0300 Subject: [PATCH] Adjust KDC alias helper function contract diff --git a/Allow-aliases-when-matching-U2U-second-ticket.patch b/Allow-aliases-when-matching-U2U-second-ticket.patch index 523402f..38ed3cc 100644 --- a/Allow-aliases-when-matching-U2U-second-ticket.patch +++ b/Allow-aliases-when-matching-U2U-second-ticket.patch @@ -1,4 +1,4 @@ -From e976a70ff23e600a76d1c3134f9c2f80753b6679 Mon Sep 17 00:00:00 2001 +From 69e45f51b466219bde15b11c8539ea3841281f2b Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Tue, 22 Sep 2020 01:17:11 +0300 Subject: [PATCH] Allow aliases when matching U2U second ticket diff --git a/Allow-certauth-modules-to-set-hw-authent-flag.patch b/Allow-certauth-modules-to-set-hw-authent-flag.patch index 0c155e7..3be71e7 100644 --- a/Allow-certauth-modules-to-set-hw-authent-flag.patch +++ b/Allow-certauth-modules-to-set-hw-authent-flag.patch @@ -1,4 +1,4 @@ -From c18034484eadb0f32cef384197d1185aa50c3adb Mon Sep 17 00:00:00 2001 +From b581e106c65957f48ee088d9243b985d3e9a0be8 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Mon, 24 Feb 2020 15:58:59 -0500 Subject: [PATCH] Allow certauth modules to set hw-authent flag diff --git a/Avoid-passing-DB-entry-structures-in-KDC.patch b/Avoid-passing-DB-entry-structures-in-KDC.patch index 23f96e3..0d6a8be 100644 --- a/Avoid-passing-DB-entry-structures-in-KDC.patch +++ b/Avoid-passing-DB-entry-structures-in-KDC.patch @@ -1,4 +1,4 @@ -From e0fc680b2fb51513993c4cdaa2c25b292f57a073 Mon Sep 17 00:00:00 2001 +From aad7ffc2cdc5b1c55a5967612730daa2f493fa6e Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Wed, 30 Sep 2020 02:12:00 -0400 Subject: [PATCH] Avoid passing DB entry structures in KDC diff --git a/Correctly-import-service-GSS-host-based-name.patch b/Correctly-import-service-GSS-host-based-name.patch index e56648b..0c6d0e7 100644 --- a/Correctly-import-service-GSS-host-based-name.patch +++ b/Correctly-import-service-GSS-host-based-name.patch @@ -1,4 +1,4 @@ -From 24c5e1ad937505a03628547ed7a5c6060a2b0ff2 Mon Sep 17 00:00:00 2001 +From 5a0900dc3f0ce7569db2ed6d14da3f97b47bd120 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Mon, 30 Mar 2020 15:26:02 -0400 Subject: [PATCH] Correctly import "service@" GSS host-based name diff --git a/Default-dns_canonicalize_hostname-to-fallback.patch b/Default-dns_canonicalize_hostname-to-fallback.patch index 3669432..99b9bbb 100644 --- a/Default-dns_canonicalize_hostname-to-fallback.patch +++ b/Default-dns_canonicalize_hostname-to-fallback.patch @@ -1,4 +1,4 @@ -From 6bdab27ef3dfcefb8426f2ea4e06bbdbd1141b16 Mon Sep 17 00:00:00 2001 +From bec1b3601b15397df07b3464959da92915eb45b5 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Wed, 27 May 2020 18:48:35 -0400 Subject: [PATCH] Default dns_canonicalize_hostname to "fallback" diff --git a/Do-expiration-warnings-for-all-init_creds-APIs.patch b/Do-expiration-warnings-for-all-init_creds-APIs.patch index 374068f..0dc7528 100644 --- a/Do-expiration-warnings-for-all-init_creds-APIs.patch +++ b/Do-expiration-warnings-for-all-init_creds-APIs.patch @@ -1,4 +1,4 @@ -From c7abf942c66b2ba543cf412f12562e9bb8ee260a Mon Sep 17 00:00:00 2001 +From 4369b03968131b005acbafd043465899da50e1dc Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Fri, 28 Feb 2020 10:11:49 +0100 Subject: [PATCH] Do expiration warnings for all init_creds APIs diff --git a/Fix-leak-in-KERB_AP_OPTIONS_CBT-server-support.patch b/Fix-leak-in-KERB_AP_OPTIONS_CBT-server-support.patch index 90bbcab..ad0dd7a 100644 --- a/Fix-leak-in-KERB_AP_OPTIONS_CBT-server-support.patch +++ b/Fix-leak-in-KERB_AP_OPTIONS_CBT-server-support.patch @@ -1,4 +1,4 @@ -From 4b2176eaad00630890abe4b458cbc31f05b2b9c0 Mon Sep 17 00:00:00 2001 +From 5106d0b7ea10d1faa21f6dfb542a46eb74e78d40 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Fri, 24 Jul 2020 16:05:24 -0400 Subject: [PATCH] Fix leak in KERB_AP_OPTIONS_CBT server support diff --git a/Fix-minor-static-analysis-defects.patch b/Fix-minor-static-analysis-defects.patch index b94b48c..c136b7f 100644 --- a/Fix-minor-static-analysis-defects.patch +++ b/Fix-minor-static-analysis-defects.patch @@ -1,4 +1,4 @@ -From 0de060366a1b75df47189f5cc0a7a92685cbe1d7 Mon Sep 17 00:00:00 2001 +From a33dc1cfb0ebecb67cc7f38258303492a552cb73 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Thu, 15 Oct 2020 18:15:29 -0400 Subject: [PATCH] Fix minor static analysis defects diff --git a/Fix-typo-in-in-in-the-ksu-man-page.patch b/Fix-typo-in-in-in-the-ksu-man-page.patch index a6c1f5c..922aa29 100644 --- a/Fix-typo-in-in-in-the-ksu-man-page.patch +++ b/Fix-typo-in-in-in-the-ksu-man-page.patch @@ -1,4 +1,4 @@ -From 5399eaea6c5e00c4e96fa5507aa50dd643337194 Mon Sep 17 00:00:00 2001 +From 5952a06a594c4dc0f20f7ba2854b25f76734aa27 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Thu, 14 May 2020 15:01:18 -0400 Subject: [PATCH] Fix typo ("in in") in the ksu man page diff --git a/Ignore-bad-enctypes-in-krb5_string_to_keysalts.patch b/Ignore-bad-enctypes-in-krb5_string_to_keysalts.patch index 01edf16..aaab2d3 100644 --- a/Ignore-bad-enctypes-in-krb5_string_to_keysalts.patch +++ b/Ignore-bad-enctypes-in-krb5_string_to_keysalts.patch @@ -1,4 +1,4 @@ -From 6931f8ed0fd8c9f634e1e48f1e8926022610fc3f Mon Sep 17 00:00:00 2001 +From cc572c5b6f8a3269c24c0f21f5799e60014635fb Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Wed, 15 Jul 2020 15:42:20 -0400 Subject: [PATCH] Ignore bad enctypes in krb5_string_to_keysalts() diff --git a/Implement-GSS_C_CHANNEL_BOUND_FLAG.patch b/Implement-GSS_C_CHANNEL_BOUND_FLAG.patch index d93a3f8..b5180b2 100644 --- a/Implement-GSS_C_CHANNEL_BOUND_FLAG.patch +++ b/Implement-GSS_C_CHANNEL_BOUND_FLAG.patch @@ -1,4 +1,4 @@ -From 40093f65c58ab78a050860ce41560595aa8ecf7e Mon Sep 17 00:00:00 2001 +From e0a702b6e5f0665cca88723f7b17ff90ea218e45 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 5 Jul 2017 11:38:30 -0400 Subject: [PATCH] Implement GSS_C_CHANNEL_BOUND_FLAG diff --git a/Implement-KERB_AP_OPTIONS_CBT-server-side.patch b/Implement-KERB_AP_OPTIONS_CBT-server-side.patch index a43ae8b..458901d 100644 --- a/Implement-KERB_AP_OPTIONS_CBT-server-side.patch +++ b/Implement-KERB_AP_OPTIONS_CBT-server-side.patch @@ -1,4 +1,4 @@ -From 2250babfa6fc6590d50fc9c9beb267ba280ff685 Mon Sep 17 00:00:00 2001 +From 323329d9033f32f49266921910124fe4f2a9124c Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Mon, 9 Mar 2020 16:04:21 +0100 Subject: [PATCH] Implement KERB_AP_OPTIONS_CBT (server side) diff --git a/Improve-KDC-alias-checking-for-S4U-requests.patch b/Improve-KDC-alias-checking-for-S4U-requests.patch index 76b0bf9..69745de 100644 --- a/Improve-KDC-alias-checking-for-S4U-requests.patch +++ b/Improve-KDC-alias-checking-for-S4U-requests.patch @@ -1,4 +1,4 @@ -From dc03b33af17f2014baaa29412a1787cbcb140a62 Mon Sep 17 00:00:00 2001 +From d80afa1396c3a6605338e4eaaf5bc44f8ad3eacc Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 4 Sep 2020 14:05:50 +0300 Subject: [PATCH] Improve KDC alias checking for S4U requests diff --git a/Improve-negoex_parse_token-code-hygiene.patch b/Improve-negoex_parse_token-code-hygiene.patch index ef9bf2b..d2b94aa 100644 --- a/Improve-negoex_parse_token-code-hygiene.patch +++ b/Improve-negoex_parse_token-code-hygiene.patch @@ -1,4 +1,4 @@ -From d604359e2f0bce65f08d0d805e0795e29287109c Mon Sep 17 00:00:00 2001 +From 9596a341d99e3af1438ad215ed0fb5496cb59ff0 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 9 Jun 2020 16:23:37 -0400 Subject: [PATCH] Improve negoex_parse_token() code hygiene diff --git a/Install-shared-libraries-as-executable.patch b/Install-shared-libraries-as-executable.patch new file mode 100644 index 0000000..b8adf3d --- /dev/null +++ b/Install-shared-libraries-as-executable.patch @@ -0,0 +1,42 @@ +From b3c6667d7f98cf0347642c7927618fd40cd6f904 Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Tue, 23 Aug 2016 16:45:26 -0400 +Subject: [PATCH] Install shared libraries as executable + +RPM expects this behavior, and systems with contrary policies (like +Debian) address permissions at the packaging layer. Most other build +systems appear to install shared libraries as executable. + +[ghudson@mit.edu: edited commit message] + +ticket: 8965 (new) +(cherry picked from commit 1bc5f76d2e7013b8771e3bd9960c82642ba0b467) +--- + src/config/shlib.conf | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/src/config/shlib.conf b/src/config/shlib.conf +index 3e4af6c02..75b7cc3af 100644 +--- a/src/config/shlib.conf ++++ b/src/config/shlib.conf +@@ -22,8 +22,10 @@ SHLIBVEXT=.so.v-nobuild + SHLIBSEXT=.so.s-nobuild + # Most systems support profiled libraries. + PFLIBEXT=_p.a +-# Most systems install shared libs as mode 644, etc. while hpux wants 755 +-INSTALL_SHLIB='$(INSTALL_DATA)' ++# Install libraries executable. Some systems (e.g., RPM-based ones) require ++# this for package dependency generation, while others are ambivalent or will ++# strip it during packaging. ++INSTALL_SHLIB='$(INSTALL)' + # Most systems use the same objects for shared libraries and dynamically + # loadable objects. + DYNOBJEXT='$(SHLIBEXT)' +@@ -118,7 +120,6 @@ alpha*-dec-osf*) + # -O +dpv should display any routines eliminated as unused, but -b + # apparently turns that off + *-*-hpux*) +- INSTALL_SHLIB='$(INSTALL)' + case $host_cpu in + hppa*) + SHLIBEXT=.sl diff --git a/Minimize-usage-of-tgs_server-in-KDC.patch b/Minimize-usage-of-tgs_server-in-KDC.patch index 5199395..01608e8 100644 --- a/Minimize-usage-of-tgs_server-in-KDC.patch +++ b/Minimize-usage-of-tgs_server-in-KDC.patch @@ -1,4 +1,4 @@ -From ce60c549887a7732a6079d6e7111eb645f279781 Mon Sep 17 00:00:00 2001 +From 6e82fd67034eef7f99b901f417782a3786a02069 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Fri, 25 Sep 2020 11:12:34 -0400 Subject: [PATCH] Minimize usage of tgs_server in KDC diff --git a/Omit-KDC-indicator-check-for-S4U2Self-requests.patch b/Omit-KDC-indicator-check-for-S4U2Self-requests.patch index 782974b..9e25d54 100644 --- a/Omit-KDC-indicator-check-for-S4U2Self-requests.patch +++ b/Omit-KDC-indicator-check-for-S4U2Self-requests.patch @@ -1,4 +1,4 @@ -From a9144f5238b91949f32355f5ab88e2ade734eb06 Mon Sep 17 00:00:00 2001 +From cd99c7829a43074cec8afe5c7021778a5a2ebd31 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Wed, 6 May 2020 16:03:13 -0400 Subject: [PATCH] Omit KDC indicator check for S4U2Self requests diff --git a/Omit-PA_FOR_USER-if-we-can-t-compute-its-checksum.patch b/Omit-PA_FOR_USER-if-we-can-t-compute-its-checksum.patch index bc4ed52..5fd221e 100644 --- a/Omit-PA_FOR_USER-if-we-can-t-compute-its-checksum.patch +++ b/Omit-PA_FOR_USER-if-we-can-t-compute-its-checksum.patch @@ -1,4 +1,4 @@ -From 8fc932c8f75e4332aa7dc6c4862cb881308b6813 Mon Sep 17 00:00:00 2001 +From 6b81d2d9913d91a4cc48d04f123fc71cc1022432 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Sat, 6 Jun 2020 11:03:37 +0200 Subject: [PATCH] Omit PA_FOR_USER if we can't compute its checksum diff --git a/Pass-channel-bindings-through-SPNEGO.patch b/Pass-channel-bindings-through-SPNEGO.patch index e376472..1b3c130 100644 --- a/Pass-channel-bindings-through-SPNEGO.patch +++ b/Pass-channel-bindings-through-SPNEGO.patch @@ -1,4 +1,4 @@ -From 19ef4a378a8fe483e82b1b4f979a7ffcb264325e Mon Sep 17 00:00:00 2001 +From a5588aae21d44f5a6eed4bdfeae992a709b92959 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Tue, 28 Apr 2020 18:15:55 +0200 Subject: [PATCH] Pass channel bindings through SPNEGO diff --git a/Pass-gss_localname-through-SPNEGO.patch b/Pass-gss_localname-through-SPNEGO.patch index bbf703c..1aad597 100644 --- a/Pass-gss_localname-through-SPNEGO.patch +++ b/Pass-gss_localname-through-SPNEGO.patch @@ -1,4 +1,4 @@ -From fb89e83451519aed051bb129f3cf9cc34cde702f Mon Sep 17 00:00:00 2001 +From 723f4c746293f064a32961ad77b57f901dd54a67 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Sun, 26 Apr 2020 19:55:54 -0400 Subject: [PATCH] Pass gss_localname() through SPNEGO diff --git a/Refactor-KDC-authdata-list-management-helpers.patch b/Refactor-KDC-authdata-list-management-helpers.patch index 495dbda..69ef109 100644 --- a/Refactor-KDC-authdata-list-management-helpers.patch +++ b/Refactor-KDC-authdata-list-management-helpers.patch @@ -1,4 +1,4 @@ -From 00245d789edc6cf6263540d7c9d7ee45bbac58ce Mon Sep 17 00:00:00 2001 +From 17093468190706e241d2a6ef2bb5607be7021640 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Wed, 5 Feb 2020 18:46:11 -0500 Subject: [PATCH] Refactor KDC authdata list management helpers diff --git a/Refactor-krb5-GSS-checksum-handling.patch b/Refactor-krb5-GSS-checksum-handling.patch index a0bb217..62f36c3 100644 --- a/Refactor-krb5-GSS-checksum-handling.patch +++ b/Refactor-krb5-GSS-checksum-handling.patch @@ -1,4 +1,4 @@ -From 544c37e2928f2585708e36f77a6b0baa52c3c541 Mon Sep 17 00:00:00 2001 +From 8412a1611290da9705730c9e473a5b122c55e9fd Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Fri, 30 Jun 2017 16:03:01 -0400 Subject: [PATCH] Refactor krb5 GSS checksum handling diff --git a/Refresh-manually-acquired-creds-from-client-keytab.patch b/Refresh-manually-acquired-creds-from-client-keytab.patch index dc50194..61e1fa4 100644 --- a/Refresh-manually-acquired-creds-from-client-keytab.patch +++ b/Refresh-manually-acquired-creds-from-client-keytab.patch @@ -1,4 +1,4 @@ -From e1762f16fe4d900903c5395cc3268f9b78835100 Mon Sep 17 00:00:00 2001 +From 43fe1f948059ad79d95dbf41f2206de65238d892 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Wed, 26 Feb 2020 18:27:17 -0500 Subject: [PATCH] Refresh manually acquired creds from client keytab diff --git a/Remove-resolver-test-utility.patch b/Remove-resolver-test-utility.patch index e765069..77fea7a 100644 --- a/Remove-resolver-test-utility.patch +++ b/Remove-resolver-test-utility.patch @@ -1,4 +1,4 @@ -From 8a2cd84c047ef7500dc8149ed6ace8e9fa631cad Mon Sep 17 00:00:00 2001 +From 6d2dbd0378c92ea13363f2536ab0062bdfda076e Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Thu, 28 May 2020 18:41:02 -0400 Subject: [PATCH] Remove resolver test utility diff --git a/Replace-gssrpc-tests-with-a-Python-script.patch b/Replace-gssrpc-tests-with-a-Python-script.patch index fc8fe87..3481a87 100644 --- a/Replace-gssrpc-tests-with-a-Python-script.patch +++ b/Replace-gssrpc-tests-with-a-Python-script.patch @@ -1,4 +1,4 @@ -From e2ad633616a3f4db91bbd332d778df93e4bdb652 Mon Sep 17 00:00:00 2001 +From 1de586b414104a447a50ffb6f81c2f57ed3d3a34 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Sat, 15 Feb 2020 20:34:23 -0500 Subject: [PATCH] Replace gssrpc tests with a Python script diff --git a/Use-two-queues-for-concurrent-t_otp.py-daemons.patch b/Use-two-queues-for-concurrent-t_otp.py-daemons.patch index 88c2364..80093f3 100644 --- a/Use-two-queues-for-concurrent-t_otp.py-daemons.patch +++ b/Use-two-queues-for-concurrent-t_otp.py-daemons.patch @@ -1,4 +1,4 @@ -From e12c670bceb08413f797ecd643675a4a80dac824 Mon Sep 17 00:00:00 2001 +From 35d041e432ea6d4611b232cc9bb72a36552eda27 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Wed, 4 Mar 2020 17:18:51 -0500 Subject: [PATCH] Use two queues for concurrent t_otp.py daemons diff --git a/downstream-Adjust-build-configuration.patch b/downstream-Adjust-build-configuration.patch deleted file mode 100644 index 62000c1..0000000 --- a/downstream-Adjust-build-configuration.patch +++ /dev/null @@ -1,72 +0,0 @@ -From c06693e5a17daf0fd585e608e8bfd1eb3eef447c Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Tue, 23 Aug 2016 16:45:26 -0400 -Subject: [PATCH] [downstream] Adjust build configuration - -Build binaries in this package as RELRO PIEs, libraries as partial RELRO, -and install shared libraries with the execute bit set on them. Prune out -the -L/usr/lib* and PIE flags where they might leak out and affect -apps which just want to link with the libraries. FIXME: needs to check and -not just assume that the compiler supports using these flags. - -Last-updated: krb5-1.15-beta1 ---- - src/build-tools/krb5-config.in | 7 +++++++ - src/config/pre.in | 2 +- - src/config/shlib.conf | 5 +++-- - 3 files changed, 11 insertions(+), 3 deletions(-) - -diff --git a/src/build-tools/krb5-config.in b/src/build-tools/krb5-config.in -index c17cb5eb5..1891dea99 100755 ---- a/src/build-tools/krb5-config.in -+++ b/src/build-tools/krb5-config.in -@@ -226,6 +226,13 @@ if test -n "$do_libs"; then - -e 's#\$(PTHREAD_CFLAGS)#'"$PTHREAD_CFLAGS"'#' \ - -e 's#\$(CFLAGS)##'` - -+ if test `dirname $libdir` = /usr ; then -+ lib_flags=`echo $lib_flags | sed -e "s#-L$libdir##" -e "s#$RPATH_FLAG$libdir##"` -+ fi -+ lib_flags=`echo $lib_flags | sed -e "s#-fPIE##g" -e "s#-pie##g"` -+ lib_flags=`echo $lib_flags | sed -e "s#-Wl,-z,relro##g"` -+ lib_flags=`echo $lib_flags | sed -e "s#-Wl,-z,now##g"` -+ - if test $library = 'kdb'; then - lib_flags="$lib_flags -lkdb5 $KDB5_DB_LIB" - library=krb5 -diff --git a/src/config/pre.in b/src/config/pre.in -index 917357df9..a8540ae2a 100644 ---- a/src/config/pre.in -+++ b/src/config/pre.in -@@ -185,7 +185,7 @@ INSTALL_PROGRAM=@INSTALL_PROGRAM@ $(INSTALL_STRIP) - INSTALL_SCRIPT=@INSTALL_PROGRAM@ - INSTALL_DATA=@INSTALL_DATA@ - INSTALL_SHLIB=@INSTALL_SHLIB@ --INSTALL_SETUID=$(INSTALL) $(INSTALL_STRIP) -m 4755 -o root -+INSTALL_SETUID=$(INSTALL) $(INSTALL_STRIP) -m 4755 - ## This is needed because autoconf will sometimes define @exec_prefix@ to be - ## ${prefix}. - prefix=@prefix@ -diff --git a/src/config/shlib.conf b/src/config/shlib.conf -index 3e4af6c02..2b20c3fda 100644 ---- a/src/config/shlib.conf -+++ b/src/config/shlib.conf -@@ -423,7 +423,7 @@ mips-*-netbsd*) - # Linux ld doesn't default to stuffing the SONAME field... - # Use objdump -x to examine the fields of the library - # UNDEF_CHECK is suppressed by --enable-asan -- LDCOMBINE='$(CC) -shared -fPIC -Wl,-h,$(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT) $(UNDEF_CHECK)' -+ LDCOMBINE='$(CC) -shared -fPIC -Wl,-h,$(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT) $(UNDEF_CHECK) -Wl,-z,relro -Wl,--warn-shared-textrel' - UNDEF_CHECK='-Wl,--no-undefined' - # $(EXPORT_CHECK) runs export-check.pl when in maintainer mode. - LDCOMBINE_TAIL='-Wl,--version-script binutils.versions $(EXPORT_CHECK)' -@@ -435,7 +435,8 @@ mips-*-netbsd*) - SHLIB_EXPFLAGS='$(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)' - PROFFLAGS=-pg - PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH)' -- CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) $(LDFLAGS)' -+ CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) -pie -Wl,-z,relro -Wl,-z,now $(LDFLAGS)' -+ INSTALL_SHLIB='${INSTALL} -m755' - CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)' - CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CXXFLAGS) $(LDFLAGS)' - CXX_LINK_STATIC='$(CXX) $(PROG_LIBPATH) $(CXXFLAGS) $(LDFLAGS)' diff --git a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch b/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch index 310e1ac..3d0cd46 100644 --- a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch +++ b/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch @@ -1,4 +1,4 @@ -From a983f32cfd2ec3f0571db347426835e8fc7c8464 Mon Sep 17 00:00:00 2001 +From 3a83d2b4c2a3eea5dde8de883ee9b41630a6a487 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 9 Nov 2018 15:12:21 -0500 Subject: [PATCH] [downstream] FIPS with PRNG and RADIUS and MD4 diff --git a/downstream-Remove-3des-support.patch b/downstream-Remove-3des-support.patch index e060f4e..ae4124f 100644 --- a/downstream-Remove-3des-support.patch +++ b/downstream-Remove-3des-support.patch @@ -1,4 +1,4 @@ -From 603a735ba52b50541520e53b031be47817de2fd5 Mon Sep 17 00:00:00 2001 +From 0ef71d2bef3efcb38b20fc8b3050944286ada726 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 26 Mar 2019 18:51:10 -0400 Subject: [PATCH] [downstream] Remove 3des support diff --git a/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch b/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch index 2e41026..149bb0a 100644 --- a/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch +++ b/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch @@ -1,4 +1,4 @@ -From b1eeb9caf1e1fec23d92f163086ec168fbaf74e5 Mon Sep 17 00:00:00 2001 +From a89e833a2ae26197a0edf864bb9274d776003c60 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 15 Nov 2019 20:05:16 +0000 Subject: [PATCH] [downstream] Use backported version of OpenSSL-3 KDF diff --git a/downstream-fix-debuginfo-with-y.tab.c.patch b/downstream-fix-debuginfo-with-y.tab.c.patch index 7600f5d..13072cf 100644 --- a/downstream-fix-debuginfo-with-y.tab.c.patch +++ b/downstream-fix-debuginfo-with-y.tab.c.patch @@ -1,4 +1,4 @@ -From 126569bf428c546b938b9fec5b12851f09d61c94 Mon Sep 17 00:00:00 2001 +From 0f98db9b00fa2ce685f841db18fff641f8eaa904 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:49:25 -0400 Subject: [PATCH] [downstream] fix debuginfo with y.tab.c diff --git a/downstream-netlib-and-dns.patch b/downstream-netlib-and-dns.patch index 156870b..682e3df 100644 --- a/downstream-netlib-and-dns.patch +++ b/downstream-netlib-and-dns.patch @@ -1,4 +1,4 @@ -From 23bce0aef64454bf808b9885967b04abafcf7917 Mon Sep 17 00:00:00 2001 +From 29f58a8059cb73ca586514b57458b2b17e091f36 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:46:21 -0400 Subject: [PATCH] [downstream] netlib and dns diff --git a/krb5.spec b/krb5.spec index 8372f70..fbd52c3 100644 --- a/krb5.spec +++ b/krb5.spec @@ -18,7 +18,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.18.3 # for prerelease, should be e.g., 0.% {prerelease}.1% { ?dist } (without spaces) -Release: 2%{?dist} +Release: 3%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/1.18/krb5-%{version}%{prerelease}.tar.gz @@ -41,7 +41,6 @@ Source39: krb5-krb5kdc.conf Patch0: downstream-ksu-pam-integration.patch Patch1: downstream-SELinux-integration.patch -Patch2: downstream-Adjust-build-configuration.patch Patch3: downstream-netlib-and-dns.patch Patch4: downstream-fix-debuginfo-with-y.tab.c.patch Patch5: downstream-Remove-3des-support.patch @@ -77,6 +76,7 @@ Patch42: Refactor-KDC-authdata-list-management-helpers.patch Patch43: Avoid-passing-DB-entry-structures-in-KDC.patch Patch44: Minimize-usage-of-tgs_server-in-KDC.patch Patch45: Fix-minor-static-analysis-defects.patch +Patch46: Install-shared-libraries-as-executable.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -627,6 +627,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Fri Nov 20 2020 Robbie Harwood - 1.18.3-3 +- Upstream executable shared libraries patch + * Wed Nov 18 2020 Robbie Harwood - 1.18.3-2 - Fix build failure in -1 From b783a5421cf5820f19f2e3aeb999ad24de39747e Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 24 Nov 2020 12:55:33 -0500 Subject: [PATCH 006/103] Document -k option in kvno(1) synopsis --- Document-k-option-in-kvno-1-synopsis.patch | 38 ++++++++++++++++++++++ krb5.spec | 6 +++- 2 files changed, 43 insertions(+), 1 deletion(-) create mode 100644 Document-k-option-in-kvno-1-synopsis.patch diff --git a/Document-k-option-in-kvno-1-synopsis.patch b/Document-k-option-in-kvno-1-synopsis.patch new file mode 100644 index 0000000..21f8100 --- /dev/null +++ b/Document-k-option-in-kvno-1-synopsis.patch @@ -0,0 +1,38 @@ +From 588d964f59356373353dfd31d4fdcba95e508385 Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Tue, 24 Nov 2020 12:52:02 -0500 +Subject: [PATCH] Document -k option in kvno(1) synopsis + +becd1ad6830b526d08ddaf5b2b6f213154c6446c attempted to unify the +synopsis, option descriptions, and xusage(), but missed one option. + +(cherry picked from commit d81e76d9ddab9e880bcf54eabf07119af91d28c7) +--- + doc/user/user_commands/kvno.rst | 1 + + src/man/kvno.man | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/doc/user/user_commands/kvno.rst b/doc/user/user_commands/kvno.rst +index 6fd8577a5..1e273e26e 100644 +--- a/doc/user/user_commands/kvno.rst ++++ b/doc/user/user_commands/kvno.rst +@@ -9,6 +9,7 @@ SYNOPSIS + **kvno** + [**-c** *ccache*] + [**-e** *etype*] ++[**-k** *keytab*] + [**-q**] + [**-u** | **-S** *sname*] + [**-P**] +diff --git a/src/man/kvno.man b/src/man/kvno.man +index 7c9565bdb..dc9847e99 100644 +--- a/src/man/kvno.man ++++ b/src/man/kvno.man +@@ -35,6 +35,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]] + \fBkvno\fP + [\fB\-c\fP \fIccache\fP] + [\fB\-e\fP \fIetype\fP] ++[\fB\-k\fP \fIkeytab\fP] + [\fB\-q\fP] + [\fB\-u\fP | \fB\-S\fP \fIsname\fP] + [\fB\-P\fP] diff --git a/krb5.spec b/krb5.spec index fbd52c3..2248930 100644 --- a/krb5.spec +++ b/krb5.spec @@ -18,7 +18,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.18.3 # for prerelease, should be e.g., 0.% {prerelease}.1% { ?dist } (without spaces) -Release: 3%{?dist} +Release: 4%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/1.18/krb5-%{version}%{prerelease}.tar.gz @@ -77,6 +77,7 @@ Patch43: Avoid-passing-DB-entry-structures-in-KDC.patch Patch44: Minimize-usage-of-tgs_server-in-KDC.patch Patch45: Fix-minor-static-analysis-defects.patch Patch46: Install-shared-libraries-as-executable.patch +Patch47: Document-k-option-in-kvno-1-synopsis.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -627,6 +628,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Tue Nov 24 2020 Robbie Harwood - 1.18.3-4 +- Document -k option in kvno(1) synopsis + * Fri Nov 20 2020 Robbie Harwood - 1.18.3-3 - Upstream executable shared libraries patch From ed80b0806210e307f19d26668b0de154927b48a4 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 1 Dec 2020 14:37:26 -0500 Subject: [PATCH 007/103] Add make to BuildRequires Drop cmake since we don't use it for anything --- krb5.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/krb5.spec b/krb5.spec index 2248930..5ec582b 100644 --- a/krb5.spec +++ b/krb5.spec @@ -81,7 +81,7 @@ Patch47: Document-k-option-in-kvno-1-synopsis.patch License: MIT URL: https://web.mit.edu/kerberos/www/ -BuildRequires: autoconf, bison, cmake, flex, gawk, gettext, pkgconfig, sed +BuildRequires: autoconf, bison, make, flex, gawk, gettext, pkgconfig, sed BuildRequires: gcc, gcc-c++ BuildRequires: libcom_err-devel, libedit-devel, libss-devel BuildRequires: gzip, ncurses-devel From 58924baeb41832d67570d81c009af6723ef62cc2 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Wed, 16 Dec 2020 11:12:22 -0500 Subject: [PATCH 008/103] Fix runstatedir configuration Why couldn't systemd just leave it alone? Partially reverts ec1ab43ca2ba22fbe7db5ad5bf2ba3800c31262a . --- krb5.spec | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/krb5.spec b/krb5.spec index 5ec582b..a465681 100644 --- a/krb5.spec +++ b/krb5.spec @@ -18,7 +18,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.18.3 # for prerelease, should be e.g., 0.% {prerelease}.1% { ?dist } (without spaces) -Release: 4%{?dist} +Release: 5%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/1.18/krb5-%{version}%{prerelease}.tar.gz @@ -254,6 +254,9 @@ sed -i -e s,7778,`expr "$PORT" + 1`,g $cfg source %{_libdir}/tclConfig.sh pushd src +# Set this so that configure will have a value - upstream defaults it from +# localstatedir, which is wrong for us. +export runstatedir=/run # Work out the CFLAGS and CPPFLAGS which we intend to use. INCLUDES=-I%{_includedir}/et CFLAGS="`echo $RPM_OPT_FLAGS $DEFINES $INCLUDES -fPIC -fno-strict-aliasing -fstack-protector-all`" @@ -289,6 +292,14 @@ CPPFLAGS="`echo $DEFINES $INCLUDES`" make popd +# Sanity check the KDC_RUN_DIR. +configured_dir=`grep KDC_RUN_DIR src/include/osconf.h | awk '{print $NF}'` +configured_dir=`eval echo $configured_dir` +if test "$configured_dir" != /run/krb5kdc ; then + echo Failed to configure KDC_RUN_DIR. + exit 1 +fi + # Build the docs. make -C src/doc paths.py version.py cp src/doc/paths.py doc/ @@ -628,6 +639,10 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Wed Dec 16 2020 Robbie Harwood - 1.18.3-5 +- Fix runstatedir configuration +- Why couldn't systemd just leave it alone? + * Tue Nov 24 2020 Robbie Harwood - 1.18.3-4 - Document -k option in kvno(1) synopsis From 0da55d61754318f0a4bbf6903b86314706892ff8 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Wed, 16 Dec 2020 16:06:50 +0000 Subject: [PATCH 009/103] New upstream version (1.19-beta1) --- .gitignore | 2 + Add-channel-bindings-tests.patch | 427 --------- ...client_aware_channel_bindings-option.patch | 264 ------ ...finalization-safety-check-to-com_err.patch | 53 -- ...e-kvno-options-from-Heimdal-kgetcred.patch | 404 -------- ...t-KDC-alias-helper-function-contract.patch | 80 -- ...ases-when-matching-U2U-second-ticket.patch | 65 -- ...tauth-modules-to-set-hw-authent-flag.patch | 241 ----- ...d-passing-DB-entry-structures-in-KDC.patch | 298 ------ ...y-import-service-GSS-host-based-name.patch | 52 -- ...ns_canonicalize_hostname-to-fallback.patch | 371 -------- ...ion-warnings-for-all-init_creds-APIs.patch | 425 --------- Document-k-option-in-kvno-1-synopsis.patch | 6 +- ...n-KERB_AP_OPTIONS_CBT-server-support.patch | 59 -- Fix-minor-static-analysis-defects.patch | 106 --- Fix-typo-in-in-in-the-ksu-man-page.patch | 37 - ...-enctypes-in-krb5_string_to_keysalts.patch | 37 - Implement-GSS_C_CHANNEL_BOUND_FLAG.patch | 91 -- ...ment-KERB_AP_OPTIONS_CBT-server-side.patch | 102 --- ...-KDC-alias-checking-for-S4U-requests.patch | 124 --- Improve-negoex_parse_token-code-hygiene.patch | 30 - Install-shared-libraries-as-executable.patch | 42 - Minimize-usage-of-tgs_server-in-KDC.patch | 316 ------- ...ndicator-check-for-S4U2Self-requests.patch | 48 - ...SER-if-we-can-t-compute-its-checksum.patch | 34 - Pass-channel-bindings-through-SPNEGO.patch | 256 ------ Pass-gss_localname-through-SPNEGO.patch | 58 -- ...KDC-authdata-list-management-helpers.patch | 335 ------- Refactor-krb5-GSS-checksum-handling.patch | 479 ---------- ...ly-acquired-creds-from-client-keytab.patch | 78 -- Remove-resolver-test-utility.patch | 547 ----------- ...ce-gssrpc-tests-with-a-Python-script.patch | 861 ------------------ ...eues-for-concurrent-t_otp.py-daemons.patch | 41 - ...am-FIPS-with-PRNG-and-RADIUS-and-MD4.patch | 12 +- downstream-Remove-3des-support.patch | 209 ++--- downstream-SELinux-integration.patch | 28 +- ...ackported-version-of-OpenSSL-3-KDF-i.patch | 6 +- downstream-fix-debuginfo-with-y.tab.c.patch | 2 +- downstream-ksu-pam-integration.patch | 14 +- downstream-netlib-and-dns.patch | 6 +- krb5.spec | 69 +- sources | 4 +- 42 files changed, 162 insertions(+), 6557 deletions(-) delete mode 100644 Add-channel-bindings-tests.patch delete mode 100644 Add-client_aware_channel_bindings-option.patch delete mode 100644 Add-finalization-safety-check-to-com_err.patch delete mode 100644 Add-three-kvno-options-from-Heimdal-kgetcred.patch delete mode 100644 Adjust-KDC-alias-helper-function-contract.patch delete mode 100644 Allow-aliases-when-matching-U2U-second-ticket.patch delete mode 100644 Allow-certauth-modules-to-set-hw-authent-flag.patch delete mode 100644 Avoid-passing-DB-entry-structures-in-KDC.patch delete mode 100644 Correctly-import-service-GSS-host-based-name.patch delete mode 100644 Default-dns_canonicalize_hostname-to-fallback.patch delete mode 100644 Do-expiration-warnings-for-all-init_creds-APIs.patch delete mode 100644 Fix-leak-in-KERB_AP_OPTIONS_CBT-server-support.patch delete mode 100644 Fix-minor-static-analysis-defects.patch delete mode 100644 Fix-typo-in-in-in-the-ksu-man-page.patch delete mode 100644 Ignore-bad-enctypes-in-krb5_string_to_keysalts.patch delete mode 100644 Implement-GSS_C_CHANNEL_BOUND_FLAG.patch delete mode 100644 Implement-KERB_AP_OPTIONS_CBT-server-side.patch delete mode 100644 Improve-KDC-alias-checking-for-S4U-requests.patch delete mode 100644 Improve-negoex_parse_token-code-hygiene.patch delete mode 100644 Install-shared-libraries-as-executable.patch delete mode 100644 Minimize-usage-of-tgs_server-in-KDC.patch delete mode 100644 Omit-KDC-indicator-check-for-S4U2Self-requests.patch delete mode 100644 Omit-PA_FOR_USER-if-we-can-t-compute-its-checksum.patch delete mode 100644 Pass-channel-bindings-through-SPNEGO.patch delete mode 100644 Pass-gss_localname-through-SPNEGO.patch delete mode 100644 Refactor-KDC-authdata-list-management-helpers.patch delete mode 100644 Refactor-krb5-GSS-checksum-handling.patch delete mode 100644 Refresh-manually-acquired-creds-from-client-keytab.patch delete mode 100644 Remove-resolver-test-utility.patch delete mode 100644 Replace-gssrpc-tests-with-a-Python-script.patch delete mode 100644 Use-two-queues-for-concurrent-t_otp.py-daemons.patch diff --git a/.gitignore b/.gitignore index 35b6d60..258cd98 100644 --- a/.gitignore +++ b/.gitignore @@ -189,3 +189,5 @@ krb5-1.8.3-pdf.tar.gz /krb5-1.18.2.tar.gz.asc /krb5-1.18.3.tar.gz /krb5-1.18.3.tar.gz.asc +/krb5-1.19-beta1.tar.gz +/krb5-1.19-beta1.tar.gz.asc diff --git a/Add-channel-bindings-tests.patch b/Add-channel-bindings-tests.patch deleted file mode 100644 index caf14f6..0000000 --- a/Add-channel-bindings-tests.patch +++ /dev/null @@ -1,427 +0,0 @@ -From b9ca222798a52ef3a28185ed44f3dfe19579d8fc Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Fri, 20 Mar 2020 00:17:28 +0100 -Subject: [PATCH] Add channel bindings tests - -[ghudson@mit.edu: adjusted test program to output channel-bound state -instead of optionally enforcing it; adjusted tests to check program -output; split out tests into separate Python script; made cosmetic -changes] - -ticket: 8900 -(cherry picked from commit b0b21b6d25b06f3e2b365dfe9dd4c99b3d43bf57) -[rharwood@redhat.com: slush around upstream not backporting reload, -gitignore] ---- - src/plugins/gssapi/negoextest/main.c | 18 +++++ - src/tests/gssapi/Makefile.in | 57 +++++++------- - src/tests/gssapi/common.c | 25 ++++-- - src/tests/gssapi/common.h | 9 +++ - src/tests/gssapi/deps | 4 + - src/tests/gssapi/t_bindings.c | 111 +++++++++++++++++++++++++++ - src/tests/gssapi/t_bindings.py | 43 +++++++++++ - src/tests/gssapi/t_negoex.py | 7 ++ - 8 files changed, 242 insertions(+), 32 deletions(-) - create mode 100644 src/tests/gssapi/t_bindings.c - create mode 100644 src/tests/gssapi/t_bindings.py - -diff --git a/src/plugins/gssapi/negoextest/main.c b/src/plugins/gssapi/negoextest/main.c -index 6c340f41b..72fc5273a 100644 ---- a/src/plugins/gssapi/negoextest/main.c -+++ b/src/plugins/gssapi/negoextest/main.c -@@ -57,6 +57,15 @@ gss_init_sec_context(OM_uint32 *minor_status, - const char *envstr; - uint8_t hops, mech_last_octet; - -+ envstr = getenv("GSS_INIT_BINDING"); -+ if (envstr != NULL) { -+ assert(strlen(envstr) > 0); -+ assert(input_chan_bindings != GSS_C_NO_CHANNEL_BINDINGS); -+ assert(strlen(envstr) == input_chan_bindings->application_data.length); -+ assert(strcmp((char *)input_chan_bindings->application_data.value, -+ envstr) == 0); -+ } -+ - if (input_token == GSS_C_NO_BUFFER || input_token->length == 0) { - envstr = getenv("HOPS"); - hops = (envstr != NULL) ? atoi(envstr) : 1; -@@ -112,6 +121,15 @@ gss_accept_sec_context(OM_uint32 *minor_status, gss_ctx_id_t *context_handle, - uint8_t hops, mech_last_octet; - const char *envstr; - -+ envstr = getenv("GSS_ACCEPT_BINDING"); -+ if (envstr != NULL) { -+ assert(strlen(envstr) > 0); -+ assert(input_chan_bindings != GSS_C_NO_CHANNEL_BINDINGS); -+ assert(strlen(envstr) == input_chan_bindings->application_data.length); -+ assert(strcmp((char *)input_chan_bindings->application_data.value, -+ envstr) == 0); -+ } -+ - /* - * The unwrapped token sits at the end and is just one byte giving the - * remaining number of hops. The final octet of the mech encoding should -diff --git a/src/tests/gssapi/Makefile.in b/src/tests/gssapi/Makefile.in -index 22a2f9480..cf7bcf451 100644 ---- a/src/tests/gssapi/Makefile.in -+++ b/src/tests/gssapi/Makefile.in -@@ -8,34 +8,36 @@ LOCALINCLUDES = -I$(srcdir)/../../lib/gssapi/mechglue \ - -I$(srcdir)/../../lib/gssapi/generic -I../../lib/gssapi/krb5 \ - -I../../lib/gssapi/generic - --SRCS= $(srcdir)/ccinit.c $(srcdir)/ccrefresh.c $(srcdir)/common.c $(srcdir)/reload.c \ -- $(srcdir)/t_accname.c $(srcdir)/t_add_cred.c $(srcdir)/t_ccselect.c \ -- $(srcdir)/t_ciflags.c $(srcdir)/t_context.c $(srcdir)/t_credstore.c \ -- $(srcdir)/t_enctypes.c $(srcdir)/t_err.c $(srcdir)/t_export_cred.c \ -- $(srcdir)/t_export_name.c $(srcdir)/t_gssexts.c \ -- $(srcdir)/t_imp_cred.c $(srcdir)/t_imp_name.c $(srcdir)/t_invalid.c \ -- $(srcdir)/t_inq_cred.c $(srcdir)/t_inq_ctx.c \ -+SRCS= $(srcdir)/ccinit.c $(srcdir)/ccrefresh.c $(srcdir)/common.c \ -+ $(srcdir)/reload.c $(srcdir)/t_accname.c $(srcdir)/t_add_cred.c \ -+ $(srcdir)/t_bindings.c $(srcdir)/t_ccselect.c $(srcdir)/t_ciflags.c \ -+ $(srcdir)/t_context.c $(srcdir)/t_credstore.c $(srcdir)/t_enctypes.c \ -+ $(srcdir)/t_err.c $(srcdir)/t_export_cred.c $(srcdir)/t_export_name.c \ -+ $(srcdir)/t_gssexts.c $(srcdir)/t_imp_cred.c $(srcdir)/t_imp_name.c \ -+ $(srcdir)/t_invalid.c $(srcdir)/t_inq_cred.c $(srcdir)/t_inq_ctx.c \ - $(srcdir)/t_inq_mechs_name.c $(srcdir)/t_iov.c \ - $(srcdir)/t_lifetime.c $(srcdir)/t_namingexts.c $(srcdir)/t_oid.c \ - $(srcdir)/t_pcontok.c $(srcdir)/t_prf.c $(srcdir)/t_s4u.c \ - $(srcdir)/t_s4u2proxy_krb5.c $(srcdir)/t_saslname.c \ - $(srcdir)/t_spnego.c $(srcdir)/t_srcattrs.c - --OBJS= ccinit.o ccrefresh.o common.o reload.o t_accname.o t_add_cred.o t_ccselect.o \ -- t_ciflags.o t_context.o t_credstore.o t_enctypes.o t_err.o \ -- t_export_cred.o t_export_name.o t_gssexts.o t_imp_cred.o t_imp_name.o \ -- t_invalid.o t_inq_cred.o t_inq_ctx.o t_inq_mechs_name.o t_iov.o \ -- t_lifetime.o t_namingexts.o t_oid.o t_pcontok.o t_prf.o t_s4u.o \ -- t_s4u2proxy_krb5.o t_saslname.o t_spnego.o t_srcattrs.o -+ -+OBJS= ccinit.o ccrefresh.o common.o reload.o t_accname.o t_add_cred.o \ -+ t_bindings.o t_ccselect.o t_ciflags.o t_context.o t_credstore.o \ -+ t_enctypes.o t_err.o t_export_cred.o t_export_name.o t_gssexts.o \ -+ t_imp_cred.o t_imp_name.o t_invalid.o t_inq_cred.o t_inq_ctx.o \ -+ t_inq_mechs_name.o t_iov.o t_lifetime.o t_namingexts.o t_oid.o \ -+ t_pcontok.o t_prf.o t_s4u.o t_s4u2proxy_krb5.o t_saslname.o \ -+ t_spnego.o t_srcattrs.o - - COMMON_DEPS= common.o $(GSS_DEPLIBS) $(KRB5_BASE_DEPLIBS) - COMMON_LIBS= common.o $(GSS_LIBS) $(KRB5_BASE_LIBS) - --all: ccinit ccrefresh t_accname t_add_cred t_ccselect t_ciflags t_context \ -- t_credstore t_enctypes t_err t_export_cred t_export_name t_gssexts \ -- t_imp_cred t_imp_name t_invalid t_inq_cred t_inq_ctx t_inq_mechs_name \ -- t_iov t_lifetime t_namingexts t_oid t_pcontok t_prf t_s4u \ -- t_s4u2proxy_krb5 t_saslname t_spnego t_srcattrs -+all: ccinit ccrefresh t_accname t_add_cred t_bindings t_ccselect t_ciflags \ -+ t_context t_credstore t_enctypes t_err t_export_cred t_export_name \ -+ t_gssexts t_imp_cred t_imp_name t_invalid t_inq_cred t_inq_ctx \ -+ t_inq_mechs_name t_iov t_lifetime t_namingexts t_oid t_pcontok t_prf \ -+ t_s4u t_s4u2proxy_krb5 t_saslname t_spnego t_srcattrs - - check-unix: t_oid reload - $(RUN_TEST) ./t_invalid -@@ -44,11 +46,12 @@ check-unix: t_oid reload - $(RUN_TEST) ./t_imp_name - if [ -r $(TOPLIBD)/libgssapi_krb5.so ]; then $(RUN_TEST) ./reload; fi - --check-pytests: ccinit ccrefresh t_accname t_add_cred t_ccselect t_ciflags \ -- t_context t_credstore t_enctypes t_err t_export_cred t_export_name \ -- t_imp_cred t_inq_cred t_inq_ctx t_inq_mechs_name t_iov t_lifetime \ -- t_pcontok t_s4u t_s4u2proxy_krb5 t_spnego t_srcattrs -+check-pytests: ccinit ccrefresh t_accname t_add_cred t_bindings t_ccselect \ -+ t_ciflags t_context t_credstore t_enctypes t_err t_export_cred \ -+ t_export_name t_imp_cred t_inq_cred t_inq_ctx t_inq_mechs_name t_iov \ -+ t_lifetime t_pcontok t_s4u t_s4u2proxy_krb5 t_spnego t_srcattrs - $(RUNPYTEST) $(srcdir)/t_gssapi.py $(PYTESTFLAGS) -+ $(RUNPYTEST) $(srcdir)/t_bindings.py $(PYTESTFLAGS) - $(RUNPYTEST) $(srcdir)/t_ccselect.py $(PYTESTFLAGS) - $(RUNPYTEST) $(srcdir)/t_client_keytab.py $(PYTESTFLAGS) - $(RUNPYTEST) $(srcdir)/t_enctypes.py $(PYTESTFLAGS) -@@ -67,6 +70,8 @@ t_accname: t_accname.o $(COMMON_DEPS) - $(CC_LINK) -o $@ t_accname.o $(COMMON_LIBS) - t_add_cred: t_add_cred.o $(COMMON_DEPS) - $(CC_LINK) -o $@ t_add_cred.o $(COMMON_LIBS) -+t_bindings: t_bindings.o $(COMMON_DEPS) -+ $(CC_LINK) -o $@ t_bindings.o $(COMMON_LIBS) - t_ccselect: t_ccselect.o $(COMMON_DEPS) - $(CC_LINK) -o $@ t_ccselect.o $(COMMON_LIBS) - t_ciflags: t_ciflags.o $(COMMON_DEPS) -@@ -121,9 +126,9 @@ t_srcattrs: t_srcattrs.o $(COMMON_DEPS) - $(CC_LINK) -o $@ t_srcattrs.o $(COMMON_LIBS) - - clean: -- $(RM) ccinit ccrefresh reload t_accname t_add_cred t_ccselect t_ciflags -- $(RM) t_context t_credstore t_enctypes t_err t_export_cred -- $(RM) t_export_name t_gssexts t_imp_cred t_imp_name t_invalid -- $(RM) t_inq_cred t_inq_ctx t_inq_mechs_name t_iov t_lifetime -+ $(RM) ccinit ccrefresh reload t_accname t_add_cred t_bindings -+ $(RM) t_ccselect t_ciflags t_context t_credstore t_enctypes t_err -+ $(RM) t_export_cred t_export_name t_gssexts t_imp_cred t_imp_name -+ $(RM) t_invalid t_inq_cred t_inq_ctx t_inq_mechs_name t_iov t_lifetime - $(RM) t_namingexts t_oid t_pcontok t_prf t_s4u t_s4u2proxy_krb5 - $(RM) t_saslname t_spnego t_srcattrs -diff --git a/src/tests/gssapi/common.c b/src/tests/gssapi/common.c -index 83e9d9bb8..7ba72f7b2 100644 ---- a/src/tests/gssapi/common.c -+++ b/src/tests/gssapi/common.c -@@ -115,6 +115,20 @@ establish_contexts(gss_OID imech, gss_cred_id_t icred, gss_cred_id_t acred, - gss_name_t tname, OM_uint32 flags, gss_ctx_id_t *ictx, - gss_ctx_id_t *actx, gss_name_t *src_name, gss_OID *amech, - gss_cred_id_t *deleg_cred) -+{ -+ return establish_contexts_ex(imech, icred, acred, tname, flags, ictx, actx, -+ GSS_C_NO_CHANNEL_BINDINGS, -+ GSS_C_NO_CHANNEL_BINDINGS, NULL, src_name, -+ amech, deleg_cred); -+} -+ -+void -+establish_contexts_ex(gss_OID imech, gss_cred_id_t icred, gss_cred_id_t acred, -+ gss_name_t tname, OM_uint32 flags, gss_ctx_id_t *ictx, -+ gss_ctx_id_t *actx, gss_channel_bindings_t icb, -+ gss_channel_bindings_t acb, OM_uint32 *aret_flags, -+ gss_name_t *src_name, gss_OID *amech, -+ gss_cred_id_t *deleg_cred) - { - OM_uint32 minor, imaj, amaj; - gss_buffer_desc itok, atok; -@@ -126,17 +140,16 @@ establish_contexts(gss_OID imech, gss_cred_id_t icred, gss_cred_id_t acred, - for (;;) { - (void)gss_release_buffer(&minor, &itok); - imaj = gss_init_sec_context(&minor, icred, ictx, tname, imech, flags, -- GSS_C_INDEFINITE, -- GSS_C_NO_CHANNEL_BINDINGS, &atok, NULL, -- &itok, NULL, NULL); -+ GSS_C_INDEFINITE, icb, &atok, NULL, &itok, -+ NULL, NULL); - check_gsserr("gss_init_sec_context", imaj, minor); - if (amaj == GSS_S_COMPLETE) - break; - - (void)gss_release_buffer(&minor, &atok); -- amaj = gss_accept_sec_context(&minor, actx, acred, &itok, -- GSS_C_NO_CHANNEL_BINDINGS, src_name, -- amech, &atok, NULL, NULL, deleg_cred); -+ amaj = gss_accept_sec_context(&minor, actx, acred, &itok, acb, -+ src_name, amech, &atok, aret_flags, NULL, -+ deleg_cred); - check_gsserr("gss_accept_sec_context", amaj, minor); - (void)gss_release_buffer(&minor, &itok); - if (imaj == GSS_S_COMPLETE) -diff --git a/src/tests/gssapi/common.h b/src/tests/gssapi/common.h -index ae11b51d4..a5c8f87e6 100644 ---- a/src/tests/gssapi/common.h -+++ b/src/tests/gssapi/common.h -@@ -62,6 +62,15 @@ void establish_contexts(gss_OID imech, gss_cred_id_t icred, - gss_name_t *src_name, gss_OID *amech, - gss_cred_id_t *deleg_cred); - -+/* Establish contexts with channel bindings. */ -+void establish_contexts_ex(gss_OID imech, gss_cred_id_t icred, -+ gss_cred_id_t acred, gss_name_t tname, -+ OM_uint32 flags, gss_ctx_id_t *ictx, -+ gss_ctx_id_t *actx, gss_channel_bindings_t icb, -+ gss_channel_bindings_t acb, OM_uint32 *aret_flags, -+ gss_name_t *src_name, gss_OID *amech, -+ gss_cred_id_t *deleg_cred); -+ - /* Export *cred to a token, then release *cred and replace it by re-importing - * the token. */ - void export_import_cred(gss_cred_id_t *cred); -diff --git a/src/tests/gssapi/deps b/src/tests/gssapi/deps -index 55586de53..ca1d6e22a 100644 ---- a/src/tests/gssapi/deps -+++ b/src/tests/gssapi/deps -@@ -35,6 +35,10 @@ $(OUTPRE)t_add_cred.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \ - $(BUILDTOP)/include/gssapi/gssapi_ext.h $(BUILDTOP)/include/gssapi/gssapi_krb5.h \ - $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/krb5.h \ - common.h t_add_cred.c -+$(OUTPRE)t_bindings.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \ -+ $(BUILDTOP)/include/gssapi/gssapi_ext.h $(BUILDTOP)/include/gssapi/gssapi_krb5.h \ -+ $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/krb5.h \ -+ common.h t_bindings.c - $(OUTPRE)t_ccselect.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \ - $(BUILDTOP)/include/gssapi/gssapi_ext.h $(BUILDTOP)/include/gssapi/gssapi_krb5.h \ - $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/krb5.h \ -diff --git a/src/tests/gssapi/t_bindings.c b/src/tests/gssapi/t_bindings.c -new file mode 100644 -index 000000000..e8906715b ---- /dev/null -+++ b/src/tests/gssapi/t_bindings.c -@@ -0,0 +1,111 @@ -+/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -+/* -+ * Copyright (C) 2020 by Red Hat, Inc. -+ * All rights reserved. -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * -+ * * Redistributions of source code must retain the above copyright -+ * notice, this list of conditions and the following disclaimer. -+ * -+ * * Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in -+ * the documentation and/or other materials provided with the -+ * distribution. -+ * -+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS -+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE -+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, -+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, -+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) -+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED -+ * OF THE POSSIBILITY OF SUCH DAMAGE. -+ */ -+ -+#include -+#include -+#include -+ -+#include "common.h" -+ -+/* -+ * Establish contexts (without and with GSS_C_DCE_STYLE) with the default -+ * initiator name, a specified principal name as target name, initiator -+ * bindings, and acceptor bindings. If any call is unsuccessful, display an -+ * error message. Output "yes" or "no" to indicate whether the contexts were -+ * reported as channel-bound on the acceptor. Exit with status 0 if all -+ * operations are successful, or 1 if not. -+ * -+ * Usage: ./t_bindings [-s] targetname icb acb -+ * -+ * An icb or abc value of "-" will not specify channel bindings. -+ */ -+ -+int -+main(int argc, char *argv[]) -+{ -+ OM_uint32 minor, flags1, flags2; -+ gss_name_t target_name; -+ gss_ctx_id_t ictx, actx; -+ struct gss_channel_bindings_struct icb_data = {0}, acb_data = {0}; -+ gss_channel_bindings_t icb = GSS_C_NO_CHANNEL_BINDINGS; -+ gss_channel_bindings_t acb = GSS_C_NO_CHANNEL_BINDINGS; -+ gss_OID_desc *mech; -+ -+ argv++; -+ argc--; -+ if (*argv != NULL && strcmp(*argv, "-s") == 0) { -+ mech = &mech_spnego; -+ argv++; -+ argc--; -+ } else { -+ mech = &mech_krb5; -+ } -+ -+ if (argc != 3) { -+ fprintf(stderr, "Usage: t_bindings [-s] targetname icb acb\n"); -+ return 1; -+ } -+ -+ target_name = import_name(argv[0]); -+ -+ if (strcmp(argv[1], "-") != 0) { -+ icb_data.application_data.length = strlen(argv[1]); -+ icb_data.application_data.value = argv[1]; -+ icb = &icb_data; -+ } -+ -+ if (strcmp(argv[2], "-") != 0) { -+ acb_data.application_data.length = strlen(argv[2]); -+ acb_data.application_data.value = argv[2]; -+ acb = &acb_data; -+ } -+ -+ establish_contexts_ex(mech, GSS_C_NO_CREDENTIAL, GSS_C_NO_CREDENTIAL, -+ target_name, 0, &ictx, &actx, icb, acb, &flags1, -+ NULL, NULL, NULL); -+ -+ /* Try again with GSS_C_DCE_STYLE */ -+ (void)gss_delete_sec_context(&minor, &ictx, NULL); -+ (void)gss_delete_sec_context(&minor, &actx, NULL); -+ -+ establish_contexts_ex(mech, GSS_C_NO_CREDENTIAL, GSS_C_NO_CREDENTIAL, -+ target_name, GSS_C_DCE_STYLE, &ictx, &actx, icb, acb, -+ &flags2, NULL, NULL, NULL); -+ assert((flags1 & GSS_C_CHANNEL_BOUND_FLAG) == -+ (flags2 & GSS_C_CHANNEL_BOUND_FLAG)); -+ printf("%s\n", (flags1 & GSS_C_CHANNEL_BOUND_FLAG) ? "yes" : "no"); -+ -+ (void)gss_delete_sec_context(&minor, &ictx, NULL); -+ (void)gss_delete_sec_context(&minor, &actx, NULL); -+ (void)gss_release_name(&minor, &target_name); -+ -+ return 0; -+} -diff --git a/src/tests/gssapi/t_bindings.py b/src/tests/gssapi/t_bindings.py -new file mode 100644 -index 000000000..f377977b6 ---- /dev/null -+++ b/src/tests/gssapi/t_bindings.py -@@ -0,0 +1,43 @@ -+from k5test import * -+ -+realm = K5Realm() -+server = 'p:' + realm.host_princ -+ -+mark('krb5 channel bindings') -+realm.run(['./t_bindings', server, '-', '-'], expected_msg='no') -+realm.run(['./t_bindings', server, 'a', '-'], expected_msg='no') -+realm.run(['./t_bindings', server, 'a', 'a'], expected_msg='yes') -+realm.run(['./t_bindings', server, '-', 'a'], expected_msg='no') -+realm.run(['./t_bindings', server, 'a', 'x'], -+ expected_code=1, expected_msg='Incorrect channel bindings') -+ -+mark('SPNEGO channel bindings') -+realm.run(['./t_bindings', '-s', server, '-', '-'], expected_msg='no') -+realm.run(['./t_bindings', '-s', server, 'a', '-'], expected_msg='no') -+realm.run(['./t_bindings', '-s', server, 'a', 'a'], expected_msg='yes') -+realm.run(['./t_bindings', '-s', server, '-', 'a'], expected_msg='no') -+realm.run(['./t_bindings', '-s', server, 'a', 'x'], -+ expected_code=1, expected_msg='Incorrect channel bindings') -+ -+client_aware_conf = {'libdefaults': {'client_aware_channel_bindings': 'true'}} -+e = realm.special_env('cb_aware', False, krb5_conf=client_aware_conf) -+ -+mark('krb5 client_aware_channel_bindings') -+realm.run(['./t_bindings', server, '-', '-'], env=e, expected_msg='no') -+realm.run(['./t_bindings', server, 'a', '-'], env=e, expected_msg='no') -+realm.run(['./t_bindings', server, 'a', 'a'], env=e, expected_msg='yes') -+realm.run(['./t_bindings', server, '-', 'a'], env=e, -+ expected_code=1, expected_msg='Incorrect channel bindings') -+realm.run(['./t_bindings', server, 'a', 'x'], env=e, -+ expected_code=1, expected_msg='Incorrect channel bindings') -+ -+mark('SPNEGO client_aware_channel_bindings') -+realm.run(['./t_bindings', '-s', server, '-', '-'], env=e, expected_msg='no') -+realm.run(['./t_bindings', '-s', server, 'a', '-'], env=e, expected_msg='no') -+realm.run(['./t_bindings', '-s', server, 'a', 'a'], env=e, expected_msg='yes') -+realm.run(['./t_bindings', '-s', server, '-', 'a'], env=e, -+ expected_code=1, expected_msg='Incorrect channel bindings') -+realm.run(['./t_bindings', '-s', server, 'a', 'x'], env=e, -+ expected_code=1, expected_msg='Incorrect channel bindings') -+ -+success('channel bindings tests') -diff --git a/src/tests/gssapi/t_negoex.py b/src/tests/gssapi/t_negoex.py -index 88470d2fa..a218899c4 100644 ---- a/src/tests/gssapi/t_negoex.py -+++ b/src/tests/gssapi/t_negoex.py -@@ -139,4 +139,11 @@ msgs = ('sending [3]AP_REQUEST', 'sending [7]CHALLENGE', 'sending [8]VERIFY', - 'sending [11]CHALLENGE', 'sending [12]VERIFY', 'sending [13]VERIFY') - test({'HOPS': '4', 'KEY': 'accept-always'}, expected_trace=()) - -+mark('channel bindings') -+e = realm.env.copy() -+e.update({'HOPS': '1', 'GSS_INIT_BINDING': 'a', 'GSS_ACCEPT_BINDING': 'b'}) -+# The test mech will verify that the bindings are communicated to the -+# mech, but does not set the channel-bound flag. -+realm.run(['./t_bindings', '-s', 'h:host', 'a', 'b'], env=e, expected_msg='no') -+ - success('NegoEx tests') diff --git a/Add-client_aware_channel_bindings-option.patch b/Add-client_aware_channel_bindings-option.patch deleted file mode 100644 index 20ecd30..0000000 --- a/Add-client_aware_channel_bindings-option.patch +++ /dev/null @@ -1,264 +0,0 @@ -From 032c7f496c9b327752dda33bf85e74c66d3a93cf Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Tue, 10 Mar 2020 13:13:17 +0100 -Subject: [PATCH] Add client_aware_channel_bindings option - -Add client support for KERB_AP_OPTIONS_CBT in the form of a profile -option "client_aware_gss_bindings". Adjust the make_etype_list() -helper so that enctype negotiation and AP_OPTIONS can be included in -the same IF-RELEVANT wrapper. - -[ghudson@mit.edu: refactored; edited documentation; wrote commit -message] - -ticket: 8900 -(cherry picked from commit 225e6ef7f021cd1a8ef2a054af0ca58b7288fd81) ---- - doc/admin/conf_files/krb5_conf.rst | 6 + - src/include/k5-int.h | 1 + - src/lib/krb5/krb/mk_req_ext.c | 177 +++++++++++++++-------------- - 3 files changed, 98 insertions(+), 86 deletions(-) - -diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst -index 38f450367..da5ad00f2 100644 ---- a/doc/admin/conf_files/krb5_conf.rst -+++ b/doc/admin/conf_files/krb5_conf.rst -@@ -388,6 +388,12 @@ The libdefaults section may contain any of the following relations: - credentials will fail if the client machine does not have a - keytab. The default value is false. - -+**client_aware_channel_bindings** -+ If this flag is true, then all application protocol authentication -+ requests will be flagged to indicate that the application supports -+ channel bindings when operating over a secure channel. The -+ default value is false. -+ - .. _realms: - - [realms] -diff --git a/src/include/k5-int.h b/src/include/k5-int.h -index 0d9af3d95..eb18a4cd6 100644 ---- a/src/include/k5-int.h -+++ b/src/include/k5-int.h -@@ -299,6 +299,7 @@ typedef unsigned char u_char; - #define KRB5_CONF_V4_INSTANCE_CONVERT "v4_instance_convert" - #define KRB5_CONF_V4_REALM "v4_realm" - #define KRB5_CONF_VERIFY_AP_REQ_NOFAIL "verify_ap_req_nofail" -+#define KRB5_CONF_CLIENT_AWARE_GSS_BINDINGS "client_aware_channel_bindings" - - /* Cache configuration variables */ - #define KRB5_CC_CONF_FAST_AVAIL "fast_avail" -diff --git a/src/lib/krb5/krb/mk_req_ext.c b/src/lib/krb5/krb/mk_req_ext.c -index 9fc6a0e52..08504860c 100644 ---- a/src/lib/krb5/krb/mk_req_ext.c -+++ b/src/lib/krb5/krb/mk_req_ext.c -@@ -68,10 +68,9 @@ - */ - - static krb5_error_code --make_etype_list(krb5_context context, -- krb5_enctype *desired_etypes, -- krb5_enctype tkt_enctype, -- krb5_authdata ***authdata); -+make_ap_authdata(krb5_context context, krb5_enctype *desired_enctypes, -+ krb5_enctype tkt_enctype, krb5_boolean client_aware_cb, -+ krb5_authdata ***authdata_out); - - static krb5_error_code - generate_authenticator(krb5_context, -@@ -263,7 +262,8 @@ generate_authenticator(krb5_context context, krb5_authenticator *authent, - krb5_enctype tkt_enctype) - { - krb5_error_code retval; -- krb5_authdata **ext_authdata = NULL; -+ krb5_authdata **ext_authdata = NULL, **ap_authdata, **combined; -+ int client_aware_cb; - - authent->client = client; - authent->checksum = cksum; -@@ -297,99 +297,104 @@ generate_authenticator(krb5_context context, krb5_authenticator *authent, - krb5_free_authdata(context, ext_authdata); - } - -- /* Only send EtypeList if we prefer another enctype to tkt_enctype */ -- if (desired_etypes != NULL && desired_etypes[0] != tkt_enctype) { -- TRACE_MK_REQ_ETYPES(context, desired_etypes); -- retval = make_etype_list(context, desired_etypes, tkt_enctype, -- &authent->authorization_data); -+ retval = profile_get_boolean(context->profile, KRB5_CONF_LIBDEFAULTS, -+ KRB5_CONF_CLIENT_AWARE_GSS_BINDINGS, NULL, -+ FALSE, &client_aware_cb); -+ if (retval) -+ return retval; -+ -+ /* Add etype negotiation or channel-binding awareness authdata to the -+ * front, if appropriate. */ -+ retval = make_ap_authdata(context, desired_etypes, tkt_enctype, -+ client_aware_cb, &ap_authdata); -+ if (retval) -+ return retval; -+ if (ap_authdata != NULL) { -+ retval = krb5_merge_authdata(context, ap_authdata, -+ authent->authorization_data, &combined); -+ krb5_free_authdata(context, ap_authdata); - if (retval) - return retval; -+ krb5_free_authdata(context, authent->authorization_data); -+ authent->authorization_data = combined; - } - - return(krb5_us_timeofday(context, &authent->ctime, &authent->cusec)); - } - --/* RFC 4537 */ -+/* Set *out to a DER-encoded RFC 4537 etype list, or to NULL if no etype list -+ * should be sent. */ - static krb5_error_code --make_etype_list(krb5_context context, -- krb5_enctype *desired_etypes, -- krb5_enctype tkt_enctype, -- krb5_authdata ***authdata) -+make_etype_list(krb5_context context, krb5_enctype *desired_enctypes, -+ krb5_enctype tkt_enctype, krb5_data **out) - { -- krb5_error_code code; -- krb5_etype_list etypes; -- krb5_data *enc_etype_list; -- krb5_data *ad_if_relevant; -- krb5_authdata *etype_adata[2], etype_adatum, **adata; -- int i; -+ krb5_etype_list etlist; -+ int count; - -- etypes.etypes = desired_etypes; -+ *out = NULL; - -- for (etypes.length = 0; -- etypes.etypes[etypes.length] != ENCTYPE_NULL; -- etypes.length++) -- { -- /* -- * RFC 4537: -- * -- * If the enctype of the ticket session key is included in the enctype -- * list sent by the client, it SHOULD be the last on the list; -- */ -- if (etypes.length && etypes.etypes[etypes.length - 1] == tkt_enctype) -+ /* Only send a list if we prefer another enctype to tkt_enctype. */ -+ if (desired_enctypes == NULL || desired_enctypes[0] == tkt_enctype) -+ return 0; -+ -+ /* Count elements of desired_etypes, stopping at tkt_enctypes if present. -+ * (Per RFC 4537, it must be the last option if it is included.) */ -+ for (count = 0; desired_enctypes[count] != ENCTYPE_NULL; count++) { -+ if (count > 0 && desired_enctypes[count - 1] == tkt_enctype) - break; - } - -- code = encode_krb5_etype_list(&etypes, &enc_etype_list); -- if (code) { -- return code; -- } -- -- etype_adatum.magic = KV5M_AUTHDATA; -- etype_adatum.ad_type = KRB5_AUTHDATA_ETYPE_NEGOTIATION; -- etype_adatum.length = enc_etype_list->length; -- etype_adatum.contents = (krb5_octet *)enc_etype_list->data; -- -- etype_adata[0] = &etype_adatum; -- etype_adata[1] = NULL; -- -- /* Wrap in AD-IF-RELEVANT container */ -- code = encode_krb5_authdata(etype_adata, &ad_if_relevant); -- if (code) { -- krb5_free_data(context, enc_etype_list); -- return code; -- } -- -- krb5_free_data(context, enc_etype_list); -- -- adata = *authdata; -- if (adata == NULL) { -- adata = (krb5_authdata **)calloc(2, sizeof(krb5_authdata *)); -- i = 0; -- } else { -- for (i = 0; adata[i] != NULL; i++) -- ; -- -- adata = (krb5_authdata **)realloc(*authdata, -- (i + 2) * sizeof(krb5_authdata *)); -- } -- if (adata == NULL) { -- krb5_free_data(context, ad_if_relevant); -- return ENOMEM; -- } -- *authdata = adata; -- -- adata[i] = (krb5_authdata *)malloc(sizeof(krb5_authdata)); -- if (adata[i] == NULL) { -- krb5_free_data(context, ad_if_relevant); -- return ENOMEM; -- } -- adata[i]->magic = KV5M_AUTHDATA; -- adata[i]->ad_type = KRB5_AUTHDATA_IF_RELEVANT; -- adata[i]->length = ad_if_relevant->length; -- adata[i]->contents = (krb5_octet *)ad_if_relevant->data; -- free(ad_if_relevant); /* contents owned by adata[i] */ -- -- adata[i + 1] = NULL; -- -- return 0; -+ etlist.etypes = desired_enctypes; -+ etlist.length = count; -+ return encode_krb5_etype_list(&etlist, out); -+} -+ -+/* Set *authdata_out to appropriate authenticator authdata for the request, -+ * encoded in a single AD_IF_RELEVANT element. */ -+static krb5_error_code -+make_ap_authdata(krb5_context context, krb5_enctype *desired_enctypes, -+ krb5_enctype tkt_enctype, krb5_boolean client_aware_cb, -+ krb5_authdata ***authdata_out) -+{ -+ krb5_error_code ret; -+ krb5_authdata etypes_ad, flags_ad, *list[3]; -+ krb5_data *der_etypes = NULL; -+ size_t count = 0; -+ uint8_t flagbuf[4]; -+ const uint32_t KERB_AP_OPTIONS_CBT = 0x4000; -+ -+ *authdata_out = NULL; -+ -+ /* Include an ETYPE_NEGOTIATION element if appropriate. */ -+ ret = make_etype_list(context, desired_enctypes, tkt_enctype, &der_etypes); -+ if (ret) -+ goto cleanup; -+ if (der_etypes != NULL) { -+ etypes_ad.magic = KV5M_AUTHDATA; -+ etypes_ad.ad_type = KRB5_AUTHDATA_ETYPE_NEGOTIATION; -+ etypes_ad.length = der_etypes->length; -+ etypes_ad.contents = (uint8_t *)der_etypes->data; -+ list[count++] = &etypes_ad; -+ } -+ -+ /* Include an AP_OPTIONS element if the CBT flag is configured. */ -+ if (client_aware_cb != 0) { -+ store_32_le(KERB_AP_OPTIONS_CBT, flagbuf); -+ flags_ad.magic = KV5M_AUTHDATA; -+ flags_ad.ad_type = KRB5_AUTHDATA_AP_OPTIONS; -+ flags_ad.length = 4; -+ flags_ad.contents = flagbuf; -+ list[count++] = &flags_ad; -+ } -+ -+ if (count > 0) { -+ list[count] = NULL; -+ ret = krb5_encode_authdata_container(context, -+ KRB5_AUTHDATA_IF_RELEVANT, -+ list, authdata_out); -+ } -+ -+cleanup: -+ krb5_free_data(context, der_etypes); -+ return ret; - } diff --git a/Add-finalization-safety-check-to-com_err.patch b/Add-finalization-safety-check-to-com_err.patch deleted file mode 100644 index d717bcc..0000000 --- a/Add-finalization-safety-check-to-com_err.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 903fc418db4f5819c507cb0d42c0d4a12217c22f Mon Sep 17 00:00:00 2001 -From: Jiri Sasek -Date: Fri, 13 Mar 2020 19:02:58 +0100 -Subject: [PATCH] Add finalization safety check to com_err - -If the linker erroneously runs the libkrb5 finalizer after the -libcom_err finalizer, the consequent remove_error_table() calls could -crash due to accessing a destroyed mutex or an invalid et_list -pointer. Add an unsynchronized check on finalized in -remove_error_table(), and set et_list to null in com_err_terminate() -after destroying the list. - -[ghudson@mit.edu: minimized code hanges; rewrote comment and commit -message] - -ticket: 8890 (new) -(cherry picked from commit 9d654aa05e26bbf22f140abde3436afeff2fdf8d) ---- - src/util/et/error_message.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/src/util/et/error_message.c b/src/util/et/error_message.c -index d7069a9df..7dc02a34e 100644 ---- a/src/util/et/error_message.c -+++ b/src/util/et/error_message.c -@@ -26,7 +26,7 @@ - - static struct et_list *et_list; - static k5_mutex_t et_list_lock = K5_MUTEX_PARTIAL_INITIALIZER; --static int terminated = 0; /* for debugging shlib fini sequence errors */ -+static int terminated = 0; /* for safety and finalization debugging */ - - MAKE_INIT_FUNCTION(com_err_initialize); - MAKE_FINI_FUNCTION(com_err_terminate); -@@ -69,6 +69,7 @@ void com_err_terminate(void) - enext = e->next; - free(e); - } -+ et_list = NULL; - k5_mutex_unlock(&et_list_lock); - k5_mutex_destroy(&et_list_lock); - terminated = 1; -@@ -280,6 +281,10 @@ remove_error_table(const struct error_table *et) - { - struct et_list **ep, *e; - -+ /* Safety check in case libraries are finalized in the wrong order. */ -+ if (terminated) -+ return ENOENT; -+ - if (CALL_INIT_FUNCTION(com_err_initialize)) - return 0; - k5_mutex_lock(&et_list_lock); diff --git a/Add-three-kvno-options-from-Heimdal-kgetcred.patch b/Add-three-kvno-options-from-Heimdal-kgetcred.patch deleted file mode 100644 index a68394c..0000000 --- a/Add-three-kvno-options-from-Heimdal-kgetcred.patch +++ /dev/null @@ -1,404 +0,0 @@ -From ea2ad3330aa39ef4e62d8856ea7e8eed2843b3f2 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Wed, 17 Jun 2020 20:48:38 -0400 -Subject: [PATCH] Add three kvno options from Heimdal kgetcred - -Add the flags --cached-only and --no-store, which pass the -corresponding options to krb5_get_credentials(). Add the option ---out-cache to write the retrieved credentials to a specified output -cache. - -Add a Python test script for kvno command-line options, including -tests for the new options. - -ticket: 8917 (new) -(cherry picked from commit 876bab8418d7dd134c9d9db812ee2118d5ad58f0) -[rharwood@redhat.com: slush around option unification] ---- - doc/user/user_commands/kvno.rst | 13 ++++ - src/clients/kvno/Makefile.in | 3 + - src/clients/kvno/kvno.c | 112 +++++++++++++++++++++++--------- - src/clients/kvno/t_kvno.py | 75 +++++++++++++++++++++ - src/man/kvno.man | 13 ++++ - 5 files changed, 185 insertions(+), 31 deletions(-) - create mode 100644 src/clients/kvno/t_kvno.py - -diff --git a/doc/user/user_commands/kvno.rst b/doc/user/user_commands/kvno.rst -index 53e569651..6fd8577a5 100644 ---- a/doc/user/user_commands/kvno.rst -+++ b/doc/user/user_commands/kvno.rst -@@ -75,6 +75,19 @@ OPTIONS - client principal with the X.509 certificate in *cert_file*. The - certificate file must be in PEM format. - -+**--cached-only** -+ Only retrieve credentials already present in the cache, not from -+ the KDC. -+ -+**--no-store** -+ Do not store retrieved credentials in the cache. If -+ **--out-cache** is also specified, credentials will still be -+ stored into the output credential cache. -+ -+**--out-cache** *ccache* -+ Initialize *ccache* and store all retrieved credentials into it. -+ Do not store acquired credentials in the input cache. -+ - **--u2u** *ccache* - Requests a user-to-user ticket. *ccache* must contain a local - krbtgt ticket for the server principal. The reported version -diff --git a/src/clients/kvno/Makefile.in b/src/clients/kvno/Makefile.in -index 1c3f79392..5ba877271 100644 ---- a/src/clients/kvno/Makefile.in -+++ b/src/clients/kvno/Makefile.in -@@ -26,6 +26,9 @@ kvno: kvno.o $(KRB5_BASE_DEPLIBS) - ##WIN32## link $(EXE_LINKOPTS) /out:$@ $** - ##WIN32## $(_VC_MANIFEST_EMBED_EXE) - -+check-pytests: kvno -+ $(RUNPYTEST) $(srcdir)/t_kvno.py $(PYTESTFLAGS) -+ - clean-unix:: - $(RM) kvno.o kvno - -diff --git a/src/clients/kvno/kvno.c b/src/clients/kvno/kvno.c -index 8edd97361..c5f6bf700 100644 ---- a/src/clients/kvno/kvno.c -+++ b/src/clients/kvno/kvno.c -@@ -47,15 +47,17 @@ xusage() - "[-u | -S sname]" XUSAGE_BREAK - "[[{-F cert_file | {-I | -U} for_user} [-P]] | " - "--u2u ccache]" XUSAGE_BREAK -+ "[--cached-only] [--no-store] [--out-cache] " - "service1 service2 ...\n"), - prog); - exit(1); - } - - static void do_v5_kvno(int argc, char *argv[], char *ccachestr, char *etypestr, -- char *keytab_name, char *sname, int canon, int unknown, -- char *for_user, int for_user_enterprise, -- char *for_user_cert_file, int proxy, -+ char *keytab_name, char *sname, int cached_only, -+ int canon, int no_store, int unknown, char *for_user, -+ int for_user_enterprise, char *for_user_cert_file, -+ int proxy, const char *out_ccname, - const char *u2u_ccname); - - #include -@@ -65,18 +67,21 @@ static void extended_com_err_fn(const char *myprog, errcode_t code, - int - main(int argc, char *argv[]) - { -- enum { OPTION_U2U = 256 }; -- struct option lopts[] = { -- { "u2u", 1, NULL, OPTION_U2U }, -- { NULL, 0, NULL, 0 } -- }; -+ enum { OPTION_U2U = 256, OPTION_OUT_CACHE = 257 }; - const char *shopts = "uCc:e:hk:qPS:I:U:F:"; - int option; - char *etypestr = NULL, *ccachestr = NULL, *keytab_name = NULL; - char *sname = NULL, *for_user = NULL, *u2u_ccname = NULL; -- char *for_user_cert_file = NULL; -+ char *for_user_cert_file = NULL, *out_ccname = NULL; - int canon = 0, unknown = 0, proxy = 0, for_user_enterprise = 0; -- int impersonate = 0; -+ int impersonate = 0, cached_only = 0, no_store = 0; -+ struct option lopts[] = { -+ { "cached-only", 0, &cached_only, 1 }, -+ { "no-store", 0, &no_store, 1 }, -+ { "out-cache", 1, NULL, OPTION_OUT_CACHE }, -+ { "u2u", 1, NULL, OPTION_U2U }, -+ { NULL, 0, NULL, 0 } -+ }; - - setlocale(LC_ALL, ""); - set_com_err_hook(extended_com_err_fn); -@@ -139,6 +144,12 @@ main(int argc, char *argv[]) - case OPTION_U2U: - u2u_ccname = optarg; - break; -+ case OPTION_OUT_CACHE: -+ out_ccname = optarg; -+ break; -+ case 0: -+ /* If this option set a flag, do nothing else now. */ -+ break; - default: - xusage(); - break; -@@ -163,8 +174,9 @@ main(int argc, char *argv[]) - xusage(); - - do_v5_kvno(argc - optind, argv + optind, ccachestr, etypestr, keytab_name, -- sname, canon, unknown, for_user, for_user_enterprise, -- for_user_cert_file, proxy, u2u_ccname); -+ sname, cached_only, canon, no_store, unknown, for_user, -+ for_user_enterprise, for_user_cert_file, proxy, out_ccname, -+ u2u_ccname); - return 0; - } - -@@ -278,14 +290,16 @@ static krb5_error_code - kvno(const char *name, krb5_ccache ccache, krb5_principal me, - krb5_enctype etype, krb5_keytab keytab, const char *sname, - krb5_flags options, int unknown, krb5_principal for_user_princ, -- krb5_data *for_user_cert, int proxy, krb5_data *u2u_ticket) -+ krb5_data *for_user_cert, int proxy, krb5_data *u2u_ticket, -+ krb5_creds **creds_out) - { - krb5_error_code ret; - krb5_principal server = NULL; - krb5_ticket *ticket = NULL; -- krb5_creds in_creds, *out_creds = NULL; -+ krb5_creds in_creds, *creds = NULL; - char *princ = NULL; - -+ *creds_out = NULL; - memset(&in_creds, 0, sizeof(in_creds)); - - if (sname != NULL) { -@@ -325,13 +339,12 @@ kvno(const char *name, krb5_ccache ccache, krb5_principal me, - in_creds.client = for_user_princ; - in_creds.server = me; - ret = krb5_get_credentials_for_user(context, options, ccache, -- &in_creds, for_user_cert, -- &out_creds); -+ &in_creds, for_user_cert, &creds); - } else { - in_creds.client = me; - in_creds.server = server; - ret = krb5_get_credentials(context, options, ccache, &in_creds, -- &out_creds); -+ &creds); - } - - if (ret) { -@@ -340,7 +353,7 @@ kvno(const char *name, krb5_ccache ccache, krb5_principal me, - } - - /* We need a native ticket. */ -- ret = krb5_decode_ticket(&out_creds->ticket, &ticket); -+ ret = krb5_decode_ticket(&creds->ticket, &ticket); - if (ret) { - com_err(prog, ret, _("while decoding ticket for %s"), princ); - goto cleanup; -@@ -366,15 +379,15 @@ kvno(const char *name, krb5_ccache ccache, krb5_principal me, - } - - if (proxy) { -- in_creds.client = out_creds->client; -- out_creds->client = NULL; -- krb5_free_creds(context, out_creds); -- out_creds = NULL; -+ in_creds.client = creds->client; -+ creds->client = NULL; -+ krb5_free_creds(context, creds); -+ creds = NULL; - in_creds.server = server; - - ret = krb5_get_credentials_for_proxy(context, KRB5_GC_CANONICALIZE, - ccache, &in_creds, ticket, -- &out_creds); -+ &creds); - krb5_free_principal(context, in_creds.client); - if (ret) { - com_err(prog, ret, _("%s: constrained delegation failed"), -@@ -383,10 +396,13 @@ kvno(const char *name, krb5_ccache ccache, krb5_principal me, - } - } - -+ *creds_out = creds; -+ creds = NULL; -+ - cleanup: - krb5_free_principal(context, server); - krb5_free_ticket(context, ticket); -- krb5_free_creds(context, out_creds); -+ krb5_free_creds(context, creds); - krb5_free_unparsed_name(context, princ); - return ret; - } -@@ -432,19 +448,28 @@ cleanup: - - static void - do_v5_kvno(int count, char *names[], char * ccachestr, char *etypestr, -- char *keytab_name, char *sname, int canon, int unknown, -- char *for_user, int for_user_enterprise, -- char *for_user_cert_file, int proxy, const char *u2u_ccname) -+ char *keytab_name, char *sname, int cached_only, int canon, -+ int no_store, int unknown, char *for_user, int for_user_enterprise, -+ char *for_user_cert_file, int proxy, const char *out_ccname, -+ const char *u2u_ccname) - { - krb5_error_code ret; -- int i, errors, flags; -+ int i, errors, flags, initialized = 0; - krb5_enctype etype; -- krb5_ccache ccache; -+ krb5_ccache ccache, out_ccache = NULL; - krb5_principal me; - krb5_keytab keytab = NULL; - krb5_principal for_user_princ = NULL; -- krb5_flags options = canon ? KRB5_GC_CANONICALIZE : 0; -+ krb5_flags options = 0; - krb5_data cert_data = empty_data(), *user_cert = NULL, *u2u_ticket = NULL; -+ krb5_creds *creds; -+ -+ if (canon) -+ options |= KRB5_GC_CANONICALIZE; -+ if (cached_only) -+ options |= KRB5_GC_CACHED; -+ if (no_store || out_ccname != NULL) -+ options |= KRB5_GC_NO_STORE; - - ret = krb5_init_context(&context); - if (ret) { -@@ -471,6 +496,14 @@ do_v5_kvno(int count, char *names[], char * ccachestr, char *etypestr, - exit(1); - } - -+ if (out_ccname != NULL) { -+ ret = krb5_cc_resolve(context, out_ccname, &out_ccache); -+ if (ret) { -+ com_err(prog, ret, _("while resolving output ccache")); -+ exit(1); -+ } -+ } -+ - if (keytab_name != NULL) { - ret = krb5_kt_resolve(context, keytab_name, &keytab); - if (ret) { -@@ -517,8 +550,25 @@ do_v5_kvno(int count, char *names[], char * ccachestr, char *etypestr, - errors = 0; - for (i = 0; i < count; i++) { - if (kvno(names[i], ccache, me, etype, keytab, sname, options, unknown, -- for_user_princ, user_cert, proxy, u2u_ticket) != 0) -+ for_user_princ, user_cert, proxy, u2u_ticket, &creds) != 0) { - errors++; -+ } else if (out_ccache != NULL) { -+ if (!initialized) { -+ ret = krb5_cc_initialize(context, out_ccache, creds->client); -+ if (ret) { -+ com_err(prog, ret, _("while initializing output ccache")); -+ exit(1); -+ } -+ initialized = 1; -+ } -+ ret = krb5_cc_store_cred(context, out_ccache, creds); -+ if (ret) { -+ com_err(prog, ret, _("while storing creds in output ccache")); -+ exit(1); -+ } -+ } -+ -+ krb5_free_creds(context, creds); - } - - if (keytab != NULL) -diff --git a/src/clients/kvno/t_kvno.py b/src/clients/kvno/t_kvno.py -new file mode 100644 -index 000000000..e98b90e8a ---- /dev/null -+++ b/src/clients/kvno/t_kvno.py -@@ -0,0 +1,75 @@ -+from k5test import * -+ -+realm = K5Realm() -+ -+def check_cache(ccache, expected_services): -+ # Fetch the klist output and skip past the header. -+ lines = realm.run([klist, '-c', ccache]).splitlines() -+ lines = lines[4:] -+ -+ # For each line not beginning with an indent, match against the -+ # expected service principals. -+ svcs = {x: True for x in expected_services} -+ for l in lines: -+ if not l.startswith('\t'): -+ svcprinc = l.split()[4] -+ if svcprinc in svcs: -+ del svcs[svcprinc] -+ else: -+ fail('unexpected service princ ' + svcprinc) -+ -+ if svcs: -+ fail('services not found in klist output: ' + ' '.join(svcs.keys())) -+ -+ -+mark('no options') -+realm.run([kvno, realm.user_princ], expected_msg='user@KRBTEST.COM: kvno = 1') -+check_cache(realm.ccache, [realm.krbtgt_princ, realm.user_princ]) -+ -+mark('-e') -+msgs = ('etypes requested in TGS request: camellia128-cts', -+ '/KDC has no support for encryption type') -+realm.run([kvno, '-e', 'camellia128-cts', realm.host_princ], -+ expected_code=1, expected_trace=msgs) -+ -+mark('--cached-only') -+realm.run([kvno, '--cached-only', realm.user_princ], expected_msg='kvno = 1') -+realm.run([kvno, '--cached-only', realm.host_princ], -+ expected_code=1, expected_msg='Matching credential not found') -+check_cache(realm.ccache, [realm.krbtgt_princ, realm.user_princ]) -+ -+mark('--no-store') -+realm.run([kvno, '--no-store', realm.host_princ], expected_msg='kvno = 1') -+check_cache(realm.ccache, [realm.krbtgt_princ, realm.user_princ]) -+ -+mark('--out-cache') # and multiple services -+out_ccache = os.path.join(realm.testdir, 'ccache.out') -+realm.run([kvno, '--out-cache', out_ccache, -+ realm.host_princ, realm.admin_princ]) -+check_cache(realm.ccache, [realm.krbtgt_princ, realm.user_princ]) -+check_cache(out_ccache, [realm.host_princ, realm.admin_princ]) -+ -+mark('--out-cache --cached-only') # tests out-cache overwriting, and -q -+realm.run([kvno, '--out-cache', out_ccache, '--cached-only', realm.host_princ], -+ expected_code=1, expected_msg='Matching credential not found') -+out = realm.run([kvno, '-q', '--out-cache', out_ccache, '--cached-only', -+ realm.user_princ]) -+if out: -+ fail('unexpected kvno output with -q') -+check_cache(out_ccache, [realm.user_princ]) -+ -+mark('-U') # and -c -+svc_ccache = os.path.join(realm.testdir, 'ccache.svc') -+realm.run([kinit, '-k', '-c', svc_ccache, realm.host_princ]) -+realm.run([kvno, '-c', svc_ccache, '-U', 'user', realm.host_princ]) -+realm.run([klist, '-c', svc_ccache], expected_msg='for client user@') -+realm.run([kvno, '-c', svc_ccache, '-U', 'user', '--out-cache', out_ccache, -+ realm.host_princ]) -+out = realm.run([klist, '-c', out_ccache]) -+if ('Default principal: user@KRBTEST.COM' not in out): -+ fail('wrong default principal in klist output') -+ -+# More S4U options are tested in tests/gssapi/t_s4u.py. -+# --u2u is tested in tests/t_u2u.py. -+ -+success('kvno tests') -diff --git a/src/man/kvno.man b/src/man/kvno.man -index 9eb9e1852..7c9565bdb 100644 ---- a/src/man/kvno.man -+++ b/src/man/kvno.man -@@ -96,6 +96,19 @@ Specifies that protocol transition is to be used, identifying the - client principal with the X.509 certificate in \fIcert_file\fP\&. The - certificate file must be in PEM format. - .TP -+\fB\-\-cached\-only\fP -+Only retrieve credentials already present in the cache, not from -+the KDC. -+.TP -+\fB\-\-no\-store\fP -+Do not store retrieved credentials in the cache. If -+\fB\-\-out\-cache\fP is also specified, credentials will still be -+stored into the output credential cache. -+.TP -+\fB\-\-out\-cache\fP \fIccache\fP -+Initialize \fIccache\fP and store all retrieved credentials into it. -+Do not store acquired credentials in the input cache. -+.TP - \fB\-\-u2u\fP \fIccache\fP - Requests a user\-to\-user ticket. \fIccache\fP must contain a local - krbtgt ticket for the server principal. The reported version diff --git a/Adjust-KDC-alias-helper-function-contract.patch b/Adjust-KDC-alias-helper-function-contract.patch deleted file mode 100644 index b7ce64e..0000000 --- a/Adjust-KDC-alias-helper-function-contract.patch +++ /dev/null @@ -1,80 +0,0 @@ -From d27cef7eb6f099fb1ec4e2d49625aee0d8dc1007 Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Tue, 22 Sep 2020 01:11:39 +0300 -Subject: [PATCH] Adjust KDC alias helper function contract - -Change the name of is_client_alias() to is_client_db_alias(), and -change the contract so that the already-canonical principal name comes -from a DB entry (which is less flexible, but clearer since DB entries -always contain canonical principal names). Make the function -available outside of kdc_util.c. - -[ghudson@mit.edu: clarified commit message] - -(cherry picked from commit 9fb5f572dd6ce808b234cb60a573eac48136d7ca) ---- - src/kdc/kdc_util.c | 14 +++++++------- - src/kdc/kdc_util.h | 4 ++++ - 2 files changed, 11 insertions(+), 7 deletions(-) - -diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c -index dcb2df8dc..6330387d0 100644 ---- a/src/kdc/kdc_util.c -+++ b/src/kdc/kdc_util.c -@@ -1463,10 +1463,10 @@ cleanup: - return code; - } - --/* Return true if princ canonicalizes to the same principal as canon. */ --static krb5_boolean --is_client_alias(krb5_context context, krb5_const_principal canon, -- krb5_const_principal princ) -+/* Return true if princ canonicalizes to the same principal as entry's. */ -+krb5_boolean -+is_client_db_alias(krb5_context context, const krb5_db_entry *entry, -+ krb5_const_principal princ) - { - krb5_error_code ret; - krb5_db_entry *self; -@@ -1475,7 +1475,7 @@ is_client_alias(krb5_context context, krb5_const_principal canon, - ret = krb5_db_get_principal(context, princ, - KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY, &self); - if (!ret) { -- is_self = krb5_principal_compare(context, canon, self->princ); -+ is_self = krb5_principal_compare(context, entry->princ, self->princ); - krb5_db_free_principal(context, self); - } - -@@ -1535,7 +1535,7 @@ kdc_process_s4u2self_req(kdc_realm_t *kdc_active_realm, - - /* If the server is local, check that the request is for self. */ - if (!isflagset(c_flags, KRB5_KDB_FLAG_ISSUING_REFERRAL) && -- !is_client_alias(kdc_context, server->princ, client_princ)) { -+ !is_client_db_alias(kdc_context, server, client_princ)) { - *status = "INVALID_S4U2SELF_REQUEST_SERVER_MISMATCH"; - return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN; /* match Windows error */ - } -@@ -1728,7 +1728,7 @@ kdc_process_s4u2proxy_req(kdc_realm_t *kdc_active_realm, unsigned int flags, - } - - client_princ = *stkt_authdata_client; -- } else if (!is_client_alias(kdc_context, server->princ, server_princ)) { -+ } else if (!is_client_db_alias(kdc_context, server, server_princ)) { - *status = "EVIDENCE_TICKET_MISMATCH"; - return KRB5KDC_ERR_SERVER_NOMATCH; - } -diff --git a/src/kdc/kdc_util.h b/src/kdc/kdc_util.h -index 384b21ad2..2c9d8cf69 100644 ---- a/src/kdc/kdc_util.h -+++ b/src/kdc/kdc_util.h -@@ -344,6 +344,10 @@ log_tgs_badtrans(krb5_context ctx, krb5_principal cprinc, - void - log_tgs_alt_tgt(krb5_context context, krb5_principal p); - -+krb5_boolean -+is_client_db_alias(krb5_context context, const krb5_db_entry *entry, -+ krb5_const_principal princ); -+ - /* FAST*/ - enum krb5_fast_kdc_flags { - KRB5_FAST_REPLY_KEY_USED = 0x1, diff --git a/Allow-aliases-when-matching-U2U-second-ticket.patch b/Allow-aliases-when-matching-U2U-second-ticket.patch deleted file mode 100644 index 38ed3cc..0000000 --- a/Allow-aliases-when-matching-U2U-second-ticket.patch +++ /dev/null @@ -1,65 +0,0 @@ -From 69e45f51b466219bde15b11c8539ea3841281f2b Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Tue, 22 Sep 2020 01:17:11 +0300 -Subject: [PATCH] Allow aliases when matching U2U second ticket - -In process_tgs_req() when verifying the user-to-user second ticket, -compare the canonical names of the request server and the second -ticket client. - -[ghudson@mit.edu: expanded commit message; trimmed tests] - -ticket: 8951 (new) -(cherry picked from commit afc494ef9418e6be7fbb887364efa6606b10034a) ---- - src/kdc/do_tgs_req.c | 2 +- - src/tests/t_u2u.py | 25 +++++++++++++++++++++++++ - 2 files changed, 26 insertions(+), 1 deletion(-) - -diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c -index 463a9c0dd..74cd19e96 100644 ---- a/src/kdc/do_tgs_req.c -+++ b/src/kdc/do_tgs_req.c -@@ -666,7 +666,7 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt, - */ - krb5_enc_tkt_part *t2enc = request->second_ticket[st_idx]->enc_part2; - krb5_principal client2 = t2enc->client; -- if (!krb5_principal_compare(kdc_context, request->server, client2)) { -+ if (!is_client_db_alias(kdc_context, server, client2)) { - altcprinc = client2; - errcode = KRB5KDC_ERR_SERVER_NOMATCH; - status = "2ND_TKT_MISMATCH"; -diff --git a/src/tests/t_u2u.py b/src/tests/t_u2u.py -index 1ca6ac87e..4b8a82a2f 100644 ---- a/src/tests/t_u2u.py -+++ b/src/tests/t_u2u.py -@@ -32,4 +32,29 @@ realm.run([kvno, '--u2u', realm.ccache, realm.user_princ]) - - realm.run([klist]) - -+realm.stop() -+ -+# Load the test KDB module to test aliases -+testprincs = {'krbtgt/KRBTEST.COM': {'keys': 'aes128-cts'}, -+ 'user': {'keys': 'aes128-cts', 'flags': '+preauth'}, -+ 'WIN10': {'keys': 'aes128-cts'}} -+kdcconf = {'realms': {'$realm': {'database_module': 'test'}}, -+ 'dbmodules': {'test': {'db_library': 'test', -+ 'princs': testprincs, -+ 'alias': {'HOST/win10': 'WIN10'}}}} -+ -+realm = K5Realm(kdc_conf=kdcconf, create_kdb=False) -+realm.start_kdc() -+ -+# Create a second user principal and get tickets for it. -+u2u_ccache = 'FILE:' + os.path.join(realm.testdir, 'ccu2u') -+realm.extract_keytab('WIN10', realm.keytab) -+realm.kinit('WIN10', None, ['-k', '-c', u2u_ccache]) -+ -+realm.extract_keytab(realm.user_princ, realm.keytab) -+realm.kinit(realm.user_princ, None, ['-k']) -+ -+realm.run([kvno, '--u2u', u2u_ccache, 'HOST/win10'], expected_msg='kvno = 0') -+realm.run([kvno, '--u2u', u2u_ccache, 'WIN10'], expected_msg='kvno = 0') -+ - success('user-to-user tests') diff --git a/Allow-certauth-modules-to-set-hw-authent-flag.patch b/Allow-certauth-modules-to-set-hw-authent-flag.patch deleted file mode 100644 index 3be71e7..0000000 --- a/Allow-certauth-modules-to-set-hw-authent-flag.patch +++ /dev/null @@ -1,241 +0,0 @@ -From b581e106c65957f48ee088d9243b985d3e9a0be8 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Mon, 24 Feb 2020 15:58:59 -0500 -Subject: [PATCH] Allow certauth modules to set hw-authent flag - -In PKINIT, if a certauth module returns KRB5_CERTAUTH_HWAUTH from its -authorize method, set the hw-authent flag in the ticket. - -ticket: 8879 (new) -(cherry picked from commit 50fb43b4a2d97ce2cd53e1ced30e8e8224fede70) ---- - doc/plugindev/certauth.rst | 7 +++++-- - src/include/krb5/certauth_plugin.h | 9 ++++++--- - src/lib/krb5/error_tables/k5e1_err.et | 1 + - src/plugins/certauth/test/Makefile.in | 4 ++-- - src/plugins/certauth/test/main.c | 11 +++++++++-- - src/plugins/preauth/pkinit/pkinit_srv.c | 24 ++++++++++++++++-------- - src/tests/t_certauth.py | 13 +++++++++++++ - 7 files changed, 52 insertions(+), 17 deletions(-) - -diff --git a/doc/plugindev/certauth.rst b/doc/plugindev/certauth.rst -index 8a7f7c5eb..3b715f738 100644 ---- a/doc/plugindev/certauth.rst -+++ b/doc/plugindev/certauth.rst -@@ -15,8 +15,11 @@ principal. **authorize** receives the DER-encoded certificate, the - requested client principal, and a pointer to the client's - krb5_db_entry (for modules that link against libkdb5). It returns the - authorization status and optionally outputs a list of authentication --indicator strings to be added to the ticket. A module must use its --own internal or library-provided ASN.1 certificate decoder. -+indicator strings to be added to the ticket. Beginning in release -+1.19, the authorize method can request that the hardware -+authentication bit be set in the ticket by returning -+**KRB5_CERTAUTH_HWAUTH**. A module must use its own internal or -+library-provided ASN.1 certificate decoder. - - A module can optionally create and destroy module data with the - **init** and **fini** methods. Module data objects last for the -diff --git a/src/include/krb5/certauth_plugin.h b/src/include/krb5/certauth_plugin.h -index 3074790f8..3466cf345 100644 ---- a/src/include/krb5/certauth_plugin.h -+++ b/src/include/krb5/certauth_plugin.h -@@ -85,14 +85,17 @@ typedef void - (*krb5_certauth_fini_fn)(krb5_context context, krb5_certauth_moddata moddata); - - /* -- * Mandatory: -- * Return 0 if the DER-encoded cert is authorized for PKINIT authentication by -- * princ; otherwise return one of the following error codes: -+ * Mandatory: return 0 or KRB5_CERTAUTH_HWAUTH if the DER-encoded cert is -+ * authorized for PKINIT authentication by princ; otherwise return one of the -+ * following error codes: - * - KRB5KDC_ERR_CLIENT_NAME_MISMATCH - incorrect SAN value - * - KRB5KDC_ERR_INCONSISTENT_KEY_PURPOSE - incorrect EKU - * - KRB5KDC_ERR_CERTIFICATE_MISMATCH - other extension error - * - KRB5_PLUGIN_NO_HANDLE - the module has no opinion about cert - * -+ * Returning KRB5_CERTAUTH_HWAUTH will cause the hw-authent flag to be set in -+ * the issued ticket (new in release 1.19). -+ * - * - opts is used by built-in modules to receive internal data, and must be - * ignored by other modules. - * - db_entry receives the client principal database entry, and can be ignored -diff --git a/src/lib/krb5/error_tables/k5e1_err.et b/src/lib/krb5/error_tables/k5e1_err.et -index ade5caecf..abd9f3bfe 100644 ---- a/src/lib/krb5/error_tables/k5e1_err.et -+++ b/src/lib/krb5/error_tables/k5e1_err.et -@@ -42,4 +42,5 @@ error_code KRB5_KCM_MALFORMED_REPLY, "Malformed reply from KCM daemon" - error_code KRB5_KCM_RPC_ERROR, "Mach RPC error communicating with KCM daemon" - error_code KRB5_KCM_REPLY_TOO_BIG, "KCM daemon reply too big" - error_code KRB5_KCM_NO_SERVER, "No KCM server found" -+error_code KRB5_CERTAUTH_HWAUTH, "Authorize and set hw-authent ticket flag" - end -diff --git a/src/plugins/certauth/test/Makefile.in b/src/plugins/certauth/test/Makefile.in -index d3524084c..e94c13845 100644 ---- a/src/plugins/certauth/test/Makefile.in -+++ b/src/plugins/certauth/test/Makefile.in -@@ -5,8 +5,8 @@ LIBBASE=certauth_test - LIBMAJOR=0 - LIBMINOR=0 - RELDIR=../plugins/certauth/test --SHLIB_EXPDEPS=$(KRB5_BASE_DEPLIBS) --SHLIB_EXPLIBS=$(KRB5_BASE_LIBS) -+SHLIB_EXPDEPS=$(KDB5_DEPLIBS) $(KRB5_BASE_DEPLIBS) -+SHLIB_EXPLIBS=$(KDB5_LIBS) $(KRB5_BASE_LIBS) - - STLIBOBJS=main.o - -diff --git a/src/plugins/certauth/test/main.c b/src/plugins/certauth/test/main.c -index 77641230c..d4633b8cd 100644 ---- a/src/plugins/certauth/test/main.c -+++ b/src/plugins/certauth/test/main.c -@@ -31,6 +31,7 @@ - */ - - #include -+#include - #include "krb5/certauth_plugin.h" - - struct krb5_certauth_moddata_st { -@@ -131,7 +132,8 @@ has_cn(krb5_context context, const uint8_t *cert, size_t cert_len, - - /* - * Test module 2 returns OK if princ matches the CN part of the subject name, -- * and returns indicators of the module name and princ. -+ * and returns indicators of the module name and princ. If the "hwauth" string -+ * attribute is set on db_entry, it returns KRB5_CERTAUTH_HWAUTH. - */ - static krb5_error_code - test2_authorize(krb5_context context, krb5_certauth_moddata moddata, -@@ -141,7 +143,7 @@ test2_authorize(krb5_context context, krb5_certauth_moddata moddata, - char ***authinds_out) - { - krb5_error_code ret; -- char *name = NULL, **ais = NULL; -+ char *name = NULL, *strval = NULL, **ais = NULL; - - *authinds_out = NULL; - -@@ -167,6 +169,11 @@ test2_authorize(krb5_context context, krb5_certauth_moddata moddata, - - ais = NULL; - -+ ret = krb5_dbe_get_string(context, (krb5_db_entry *)db_entry, "hwauth", -+ &strval); -+ ret = (strval != NULL) ? KRB5_CERTAUTH_HWAUTH : 0; -+ krb5_dbe_free_string(context, strval); -+ - cleanup: - krb5_free_unparsed_name(context, name); - return ret; -diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c -index feca11806..3ae56c064 100644 ---- a/src/plugins/preauth/pkinit/pkinit_srv.c -+++ b/src/plugins/preauth/pkinit/pkinit_srv.c -@@ -320,12 +320,12 @@ static krb5_error_code - authorize_cert(krb5_context context, certauth_handle *certauth_modules, - pkinit_kdc_context plgctx, pkinit_kdc_req_context reqctx, - krb5_kdcpreauth_callbacks cb, krb5_kdcpreauth_rock rock, -- krb5_principal client) -+ krb5_principal client, krb5_boolean *hwauth_out) - { - krb5_error_code ret; - certauth_handle h; - struct certauth_req_opts opts; -- krb5_boolean accepted = FALSE; -+ krb5_boolean accepted = FALSE, hwauth = FALSE; - uint8_t *cert; - size_t i, cert_len; - void *db_ent = NULL; -@@ -347,9 +347,10 @@ authorize_cert(krb5_context context, certauth_handle *certauth_modules, - - /* - * Check the certificate against each certauth module. For the certificate -- * to be authorized at least one module must return 0, and no module can an -- * error code other than KRB5_PLUGIN_NO_HANDLE (pass). Add indicators from -- * modules that return 0 or pass. -+ * to be authorized at least one module must return 0 or -+ * KRB5_CERTAUTH_HWAUTH, and no module can return an error code other than -+ * KRB5_PLUGIN_NO_HANDLE (pass). Add indicators from modules that return 0 -+ * or pass. - */ - ret = KRB5_PLUGIN_NO_HANDLE; - for (i = 0; certauth_modules != NULL && certauth_modules[i] != NULL; i++) { -@@ -359,6 +360,8 @@ authorize_cert(krb5_context context, certauth_handle *certauth_modules, - &opts, db_ent, &ais); - if (ret == 0) - accepted = TRUE; -+ else if (ret == KRB5_CERTAUTH_HWAUTH) -+ accepted = hwauth = TRUE; - else if (ret != KRB5_PLUGIN_NO_HANDLE) - goto cleanup; - -@@ -374,6 +377,7 @@ authorize_cert(krb5_context context, certauth_handle *certauth_modules, - } - } - -+ *hwauth_out = hwauth; - ret = accepted ? 0 : KRB5KDC_ERR_CLIENT_NAME_MISMATCH; - - cleanup: -@@ -430,7 +434,7 @@ pkinit_server_verify_padata(krb5_context context, - int is_signed = 1; - krb5_pa_data **e_data = NULL; - krb5_kdcpreauth_modreq modreq = NULL; -- krb5_boolean valid_freshness_token = FALSE; -+ krb5_boolean valid_freshness_token = FALSE, hwauth = FALSE; - char **sp; - - pkiDebug("pkinit_verify_padata: entered!\n"); -@@ -494,7 +498,7 @@ pkinit_server_verify_padata(krb5_context context, - } - if (is_signed) { - retval = authorize_cert(context, moddata->certauth_modules, plgctx, -- reqctx, cb, rock, request->client); -+ reqctx, cb, rock, request->client, &hwauth); - if (retval) - goto cleanup; - -@@ -613,6 +617,8 @@ pkinit_server_verify_padata(krb5_context context, - - /* remember to set the PREAUTH flag in the reply */ - enc_tkt_reply->flags |= TKT_FLG_PRE_AUTH; -+ if (hwauth) -+ enc_tkt_reply->flags |= TKT_FLG_HW_AUTH; - modreq = (krb5_kdcpreauth_modreq)reqctx; - reqctx = NULL; - -@@ -1044,7 +1050,9 @@ pkinit_server_get_flags(krb5_context kcontext, krb5_preauthtype patype) - { - if (patype == KRB5_PADATA_PKINIT_KX) - return PA_INFO; -- return PA_SUFFICIENT | PA_REPLACES_KEY | PA_TYPED_E_DATA; -+ /* PKINIT does not normally set the hw-authent ticket flag, but a -+ * certauth module can cause it to do so. */ -+ return PA_SUFFICIENT | PA_REPLACES_KEY | PA_TYPED_E_DATA | PA_HARDWARE; - } - - static krb5_preauthtype supported_server_pa_types[] = { -diff --git a/src/tests/t_certauth.py b/src/tests/t_certauth.py -index 9c7094525..0fe0fdb4a 100644 ---- a/src/tests/t_certauth.py -+++ b/src/tests/t_certauth.py -@@ -43,4 +43,17 @@ out = realm.kinit("user2@KRBTEST.COM", - expected_code=1, - expected_msg='kinit: Certificate mismatch') - -+# Test the KRB5_CERTAUTH_HWAUTH return code. -+mark('hw-authent flag tests') -+# First test +requires_hwauth without causing the hw-authent ticket -+# flag to be set. This currently results in a preauth loop. -+realm.run([kadminl, 'modprinc', '+requires_hwauth', realm.user_princ]) -+realm.kinit(realm.user_princ, -+ flags=['-X', 'X509_user_identity=%s' % file_identity], -+ expected_code=1, expected_msg='Looping detected') -+# Cause the test2 module to return KRB5_CERTAUTH_HWAUTH and try again. -+realm.run([kadminl, 'setstr', realm.user_princ, 'hwauth', 'x']) -+realm.kinit(realm.user_princ, -+ flags=['-X', 'X509_user_identity=%s' % file_identity]) -+ - success("certauth tests") diff --git a/Avoid-passing-DB-entry-structures-in-KDC.patch b/Avoid-passing-DB-entry-structures-in-KDC.patch deleted file mode 100644 index 0d6a8be..0000000 --- a/Avoid-passing-DB-entry-structures-in-KDC.patch +++ /dev/null @@ -1,298 +0,0 @@ -From aad7ffc2cdc5b1c55a5967612730daa2f493fa6e Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Wed, 30 Sep 2020 02:12:00 -0400 -Subject: [PATCH] Avoid passing DB entry structures in KDC - -When validating AS or TGS requests, pass pointers to DB entry -structures, not the structures themselves. - -(cherry picked from commit 7ccc08a889b40693b2ce7f108f2cdda51bc04bff) ---- - src/kdc/do_as_req.c | 4 ++-- - src/kdc/do_tgs_req.c | 2 +- - src/kdc/kdc_util.c | 34 +++++++++++++++++----------------- - src/kdc/kdc_util.h | 6 +++--- - src/kdc/tgs_policy.c | 35 ++++++++++++++++++----------------- - 5 files changed, 41 insertions(+), 40 deletions(-) - -diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c -index 9ae7b0a5e..c2dfea9b8 100644 ---- a/src/kdc/do_as_req.c -+++ b/src/kdc/do_as_req.c -@@ -663,8 +663,8 @@ process_as_req(krb5_kdc_req *request, krb5_data *req_pkt, - au_state->stage = VALIDATE_POL; - - if ((errcode = validate_as_request(kdc_active_realm, -- state->request, *state->client, -- *state->server, state->kdc_time, -+ state->request, state->client, -+ state->server, state->kdc_time, - &state->status, &state->e_data))) { - errcode += ERROR_TABLE_BASE_krb5; - goto errout; -diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c -index 74cd19e96..d345797c4 100644 ---- a/src/kdc/do_tgs_req.c -+++ b/src/kdc/do_tgs_req.c -@@ -260,7 +260,7 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt, - goto cleanup; - - if ((retval = validate_tgs_request(kdc_active_realm, -- request, *server, header_ticket, -+ request, server, header_ticket, - kdc_time, &status, &e_data))) { - if (retval == KDC_ERR_POLICY || retval == KDC_ERR_BADOPTION) - au_state->violation = PROT_CONSTRAINT; -diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c -index a4a05b9fa..b2042862a 100644 ---- a/src/kdc/kdc_util.c -+++ b/src/kdc/kdc_util.c -@@ -612,8 +612,8 @@ check_anon(kdc_realm_t *kdc_active_realm, - KDC_OPT_ENC_TKT_IN_SKEY | KDC_OPT_CNAME_IN_ADDL_TKT) - int - validate_as_request(kdc_realm_t *kdc_active_realm, -- krb5_kdc_req *request, krb5_db_entry client, -- krb5_db_entry server, krb5_timestamp kdc_time, -+ krb5_kdc_req *request, krb5_db_entry *client, -+ krb5_db_entry *server, krb5_timestamp kdc_time, - const char **status, krb5_pa_data ***e_data) - { - krb5_error_code ret; -@@ -627,7 +627,7 @@ validate_as_request(kdc_realm_t *kdc_active_realm, - } - - /* The client must not be expired */ -- if (client.expiration && ts_after(kdc_time, client.expiration)) { -+ if (client->expiration && ts_after(kdc_time, client->expiration)) { - *status = "CLIENT EXPIRED"; - if (vague_errors) - return(KRB_ERR_GENERIC); -@@ -637,8 +637,8 @@ validate_as_request(kdc_realm_t *kdc_active_realm, - - /* The client's password must not be expired, unless the server is - a KRB5_KDC_PWCHANGE_SERVICE. */ -- if (client.pw_expiration && ts_after(kdc_time, client.pw_expiration) && -- !isflagset(server.attributes, KRB5_KDB_PWCHANGE_SERVICE)) { -+ if (client->pw_expiration && ts_after(kdc_time, client->pw_expiration) && -+ !isflagset(server->attributes, KRB5_KDB_PWCHANGE_SERVICE)) { - *status = "CLIENT KEY EXPIRED"; - if (vague_errors) - return(KRB_ERR_GENERIC); -@@ -647,7 +647,7 @@ validate_as_request(kdc_realm_t *kdc_active_realm, - } - - /* The server must not be expired */ -- if (server.expiration && ts_after(kdc_time, server.expiration)) { -+ if (server->expiration && ts_after(kdc_time, server->expiration)) { - *status = "SERVICE EXPIRED"; - return(KDC_ERR_SERVICE_EXP); - } -@@ -656,8 +656,8 @@ validate_as_request(kdc_realm_t *kdc_active_realm, - * If the client requires password changing, then only allow the - * pwchange service. - */ -- if (isflagset(client.attributes, KRB5_KDB_REQUIRES_PWCHANGE) && -- !isflagset(server.attributes, KRB5_KDB_PWCHANGE_SERVICE)) { -+ if (isflagset(client->attributes, KRB5_KDB_REQUIRES_PWCHANGE) && -+ !isflagset(server->attributes, KRB5_KDB_PWCHANGE_SERVICE)) { - *status = "REQUIRED PWCHANGE"; - return(KDC_ERR_KEY_EXP); - } -@@ -665,37 +665,37 @@ validate_as_request(kdc_realm_t *kdc_active_realm, - /* Client and server must allow postdating tickets */ - if ((isflagset(request->kdc_options, KDC_OPT_ALLOW_POSTDATE) || - isflagset(request->kdc_options, KDC_OPT_POSTDATED)) && -- (isflagset(client.attributes, KRB5_KDB_DISALLOW_POSTDATED) || -- isflagset(server.attributes, KRB5_KDB_DISALLOW_POSTDATED))) { -+ (isflagset(client->attributes, KRB5_KDB_DISALLOW_POSTDATED) || -+ isflagset(server->attributes, KRB5_KDB_DISALLOW_POSTDATED))) { - *status = "POSTDATE NOT ALLOWED"; - return(KDC_ERR_CANNOT_POSTDATE); - } - - /* Check to see if client is locked out */ -- if (isflagset(client.attributes, KRB5_KDB_DISALLOW_ALL_TIX)) { -+ if (isflagset(client->attributes, KRB5_KDB_DISALLOW_ALL_TIX)) { - *status = "CLIENT LOCKED OUT"; - return(KDC_ERR_CLIENT_REVOKED); - } - - /* Check to see if server is locked out */ -- if (isflagset(server.attributes, KRB5_KDB_DISALLOW_ALL_TIX)) { -+ if (isflagset(server->attributes, KRB5_KDB_DISALLOW_ALL_TIX)) { - *status = "SERVICE LOCKED OUT"; - return(KDC_ERR_S_PRINCIPAL_UNKNOWN); - } - - /* Check to see if server is allowed to be a service */ -- if (isflagset(server.attributes, KRB5_KDB_DISALLOW_SVR)) { -+ if (isflagset(server->attributes, KRB5_KDB_DISALLOW_SVR)) { - *status = "SERVICE NOT ALLOWED"; - return(KDC_ERR_MUST_USE_USER2USER); - } - -- if (check_anon(kdc_active_realm, client.princ, request->server) != 0) { -+ if (check_anon(kdc_active_realm, client->princ, request->server) != 0) { - *status = "ANONYMOUS NOT ALLOWED"; - return(KDC_ERR_POLICY); - } - - /* Perform KDB module policy checks. */ -- ret = krb5_db_check_policy_as(kdc_context, request, &client, &server, -+ ret = krb5_db_check_policy_as(kdc_context, request, client, server, - kdc_time, status, e_data); - if (ret && ret != KRB5_PLUGIN_OP_NOTSUPP) - return errcode_to_protocol(ret); -@@ -1568,8 +1568,8 @@ kdc_process_s4u2self_req(kdc_realm_t *kdc_active_realm, - princ->pw_expiration = 0; - clear(princ->attributes, KRB5_KDB_REQUIRES_PWCHANGE); - -- code = validate_as_request(kdc_active_realm, request, *princ, -- no_server, kdc_time, status, &e_data); -+ code = validate_as_request(kdc_active_realm, request, princ, -+ &no_server, kdc_time, status, &e_data); - if (code) { - krb5_db_free_principal(kdc_context, princ); - krb5_free_pa_data(kdc_context, e_data); -diff --git a/src/kdc/kdc_util.h b/src/kdc/kdc_util.h -index 42b7ee208..04007a8f5 100644 ---- a/src/kdc/kdc_util.h -+++ b/src/kdc/kdc_util.h -@@ -76,12 +76,12 @@ get_local_tgt(krb5_context context, const krb5_data *realm, - krb5_db_entry **storage_out, krb5_keyblock *kb_out); - - int --validate_as_request (kdc_realm_t *, krb5_kdc_req *, krb5_db_entry, -- krb5_db_entry, krb5_timestamp, -+validate_as_request (kdc_realm_t *, krb5_kdc_req *, krb5_db_entry *, -+ krb5_db_entry *, krb5_timestamp, - const char **, krb5_pa_data ***); - - int --validate_tgs_request (kdc_realm_t *, krb5_kdc_req *, krb5_db_entry, -+validate_tgs_request (kdc_realm_t *, krb5_kdc_req *, krb5_db_entry *, - krb5_ticket *, krb5_timestamp, - const char **, krb5_pa_data ***); - -diff --git a/src/kdc/tgs_policy.c b/src/kdc/tgs_policy.c -index 554345ba5..3f4fa8499 100644 ---- a/src/kdc/tgs_policy.c -+++ b/src/kdc/tgs_policy.c -@@ -48,7 +48,7 @@ struct tgsflagrule { - }; - - /* Service principal TGS policy checking functions */ --typedef int (check_tgs_svc_pol_fn)(krb5_kdc_req *, krb5_db_entry, -+typedef int (check_tgs_svc_pol_fn)(krb5_kdc_req *, krb5_db_entry *, - krb5_ticket *, krb5_timestamp, - const char **); - -@@ -110,7 +110,7 @@ static const struct tgsflagrule svcdenyrules[] = { - * A service principal can forbid some TGS-REQ options. - */ - static int --check_tgs_svc_deny_opts(krb5_kdc_req *req, krb5_db_entry server, -+check_tgs_svc_deny_opts(krb5_kdc_req *req, krb5_db_entry *server, - krb5_ticket *tkt, krb5_timestamp kdc_time, - const char **status) - { -@@ -122,7 +122,7 @@ check_tgs_svc_deny_opts(krb5_kdc_req *req, krb5_db_entry server, - r = &svcdenyrules[i]; - if (!(r->reqflags & req->kdc_options)) - continue; -- if (r->checkflag & server.attributes) { -+ if (r->checkflag & server->attributes) { - *status = r->status; - return r->err; - } -@@ -134,20 +134,20 @@ check_tgs_svc_deny_opts(krb5_kdc_req *req, krb5_db_entry server, - * A service principal can deny all TGS-REQs for it. - */ - static int --check_tgs_svc_deny_all(krb5_kdc_req *req, krb5_db_entry server, -+check_tgs_svc_deny_all(krb5_kdc_req *req, krb5_db_entry *server, - krb5_ticket *tkt, krb5_timestamp kdc_time, - const char **status) - { -- if (server.attributes & KRB5_KDB_DISALLOW_ALL_TIX) { -+ if (server->attributes & KRB5_KDB_DISALLOW_ALL_TIX) { - *status = "SERVER LOCKED OUT"; - return KDC_ERR_S_PRINCIPAL_UNKNOWN; - } -- if ((server.attributes & KRB5_KDB_DISALLOW_SVR) && -+ if ((server->attributes & KRB5_KDB_DISALLOW_SVR) && - !(req->kdc_options & KDC_OPT_ENC_TKT_IN_SKEY)) { - *status = "SERVER NOT ALLOWED"; - return KDC_ERR_MUST_USE_USER2USER; - } -- if (server.attributes & KRB5_KDB_DISALLOW_TGT_BASED) { -+ if (server->attributes & KRB5_KDB_DISALLOW_TGT_BASED) { - if (krb5_is_tgs_principal(tkt->server)) { - *status = "TGT BASED NOT ALLOWED"; - return KDC_ERR_POLICY; -@@ -160,17 +160,17 @@ check_tgs_svc_deny_all(krb5_kdc_req *req, krb5_db_entry server, - * A service principal can require certain TGT flags. - */ - static int --check_tgs_svc_reqd_flags(krb5_kdc_req *req, krb5_db_entry server, -+check_tgs_svc_reqd_flags(krb5_kdc_req *req, krb5_db_entry *server, - krb5_ticket *tkt, - krb5_timestamp kdc_time, const char **status) - { -- if (server.attributes & KRB5_KDB_REQUIRES_HW_AUTH) { -+ if (server->attributes & KRB5_KDB_REQUIRES_HW_AUTH) { - if (!(tkt->enc_part2->flags & TKT_FLG_HW_AUTH)) { - *status = "NO HW PREAUTH"; - return KRB_ERR_GENERIC; - } - } -- if (server.attributes & KRB5_KDB_REQUIRES_PRE_AUTH) { -+ if (server->attributes & KRB5_KDB_REQUIRES_PRE_AUTH) { - if (!(tkt->enc_part2->flags & TKT_FLG_PRE_AUTH)) { - *status = "NO PREAUTH"; - return KRB_ERR_GENERIC; -@@ -180,10 +180,10 @@ check_tgs_svc_reqd_flags(krb5_kdc_req *req, krb5_db_entry server, - } - - static int --check_tgs_svc_time(krb5_kdc_req *req, krb5_db_entry server, krb5_ticket *tkt, -+check_tgs_svc_time(krb5_kdc_req *req, krb5_db_entry *server, krb5_ticket *tkt, - krb5_timestamp kdc_time, const char **status) - { -- if (server.expiration && ts_after(kdc_time, server.expiration)) { -+ if (server->expiration && ts_after(kdc_time, server->expiration)) { - *status = "SERVICE EXPIRED"; - return KDC_ERR_SERVICE_EXP; - } -@@ -191,8 +191,9 @@ check_tgs_svc_time(krb5_kdc_req *req, krb5_db_entry server, krb5_ticket *tkt, - } - - static int --check_tgs_svc_policy(krb5_kdc_req *req, krb5_db_entry server, krb5_ticket *tkt, -- krb5_timestamp kdc_time, const char **status) -+check_tgs_svc_policy(krb5_kdc_req *req, krb5_db_entry *server, -+ krb5_ticket *tkt, krb5_timestamp kdc_time, -+ const char **status) - { - int errcode; - size_t i; -@@ -317,7 +318,7 @@ check_tgs_tgt(kdc_realm_t *kdc_active_realm, krb5_kdc_req *req, - - int - validate_tgs_request(kdc_realm_t *kdc_active_realm, -- krb5_kdc_req *request, krb5_db_entry server, -+ krb5_kdc_req *request, krb5_db_entry *server, - krb5_ticket *ticket, krb5_timestamp kdc_time, - const char **status, krb5_pa_data ***e_data) - { -@@ -367,8 +368,8 @@ validate_tgs_request(kdc_realm_t *kdc_active_realm, - } - - /* Perform KDB module policy checks. */ -- ret = krb5_db_check_policy_tgs(kdc_context, request, &server, -- ticket, status, e_data); -+ ret = krb5_db_check_policy_tgs(kdc_context, request, server, ticket, -+ status, e_data); - if (ret && ret != KRB5_PLUGIN_OP_NOTSUPP) - return errcode_to_protocol(ret); - diff --git a/Correctly-import-service-GSS-host-based-name.patch b/Correctly-import-service-GSS-host-based-name.patch deleted file mode 100644 index 0c6d0e7..0000000 --- a/Correctly-import-service-GSS-host-based-name.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 5a0900dc3f0ce7569db2ed6d14da3f97b47bd120 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Mon, 30 Mar 2020 15:26:02 -0400 -Subject: [PATCH] Correctly import "service@" GSS host-based name - -The intended way to specify only a service in a GSS host-based name is -to omit the "@" separator. Some applications include the separator -but no hostname, and this happened to yield wildcard hostname behavior -prior to commit 996353767fe8afa7f67a3b5b465e4d70e18bad7c when -shortname qualification was added. To restore this behavior, check in -parse_hostbased() that at least one character is present after the "@" -separator before copying the hostname. Add a test case to t_gssapi.py. - -ticket: 8892 -tags: pullup -target_version: 1.18-next - -(cherry picked from commit a2f047af0400ba8080dc26033fae2b17534501e2) ---- - src/lib/gssapi/krb5/import_name.c | 4 ++-- - src/tests/gssapi/t_gssapi.py | 3 +++ - 2 files changed, 5 insertions(+), 2 deletions(-) - -diff --git a/src/lib/gssapi/krb5/import_name.c b/src/lib/gssapi/krb5/import_name.c -index da2ab1423..21023dd76 100644 ---- a/src/lib/gssapi/krb5/import_name.c -+++ b/src/lib/gssapi/krb5/import_name.c -@@ -102,8 +102,8 @@ parse_hostbased(const char *str, size_t len, - memcpy(service, str, servicelen); - service[servicelen] = '\0'; - -- /* If present, copy the hostname. */ -- if (at != NULL) { -+ /* Copy the hostname if present (at least one character after '@'). */ -+ if (len - servicelen > 1) { - hostlen = len - servicelen - 1; - host = malloc(hostlen + 1); - if (host == NULL) { -diff --git a/src/tests/gssapi/t_gssapi.py b/src/tests/gssapi/t_gssapi.py -index 54d5cf549..ecf982604 100755 ---- a/src/tests/gssapi/t_gssapi.py -+++ b/src/tests/gssapi/t_gssapi.py -@@ -47,6 +47,9 @@ realm.run(['./t_accname', 'p:service2/calvin', 'h:service2'], - expected_msg='service2/calvin') - realm.run(['./t_accname', 'p:service2/calvin', 'h:service1'], expected_code=1, - expected_msg=' found in keytab but does not match server principal') -+# Regression test for #8892 (trailing @ in name). -+realm.run(['./t_accname', 'p:service1/andrew', 'h:service1@'], -+ expected_msg='service1/abraham') - - # Test with acceptor name containing service and host. Use the - # client's un-canonicalized hostname as acceptor input to mirror what diff --git a/Default-dns_canonicalize_hostname-to-fallback.patch b/Default-dns_canonicalize_hostname-to-fallback.patch deleted file mode 100644 index 99b9bbb..0000000 --- a/Default-dns_canonicalize_hostname-to-fallback.patch +++ /dev/null @@ -1,371 +0,0 @@ -From bec1b3601b15397df07b3464959da92915eb45b5 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Wed, 27 May 2020 18:48:35 -0400 -Subject: [PATCH] Default dns_canonicalize_hostname to "fallback" - -This change should mitigate some of the pain caused by the rdns=true -default (generally associated with unwanted PTR records that cannot -easily be changed), with a minimum of fallout. - -Update the documentation and tests accordingly. In test environments, -disable qualify_shortname and use the uncanonicalized system hostname -(lowercased) to match the initial sn2princ result. - -ticket: 8911 (new) ---- - doc/admin/appl_servers.rst | 14 +++--- - doc/admin/conf_files/krb5_conf.rst | 9 ++-- - doc/admin/princ_dns.rst | 44 +++++++++++-------- - src/kadmin/testing/proto/krb5.conf.proto | 8 ++-- - src/kadmin/testing/scripts/env-setup.shin | 4 +- - src/kadmin/testing/scripts/init_db | 3 +- - src/kadmin/testing/scripts/start_servers | 3 +- - .../testing/scripts/start_servers_local | 2 +- - .../kadm5/unit-test/api.current/init-v2.exp | 6 +-- - src/lib/krb5/krb/init_ctx.c | 2 +- - src/tests/dejagnu/config/default.exp | 5 +-- - src/tests/t_sn2princ.py | 5 ++- - src/util/k5test.py | 25 +++-------- - 13 files changed, 58 insertions(+), 72 deletions(-) - -diff --git a/doc/admin/appl_servers.rst b/doc/admin/appl_servers.rst -index 5232db9af..afdf30297 100644 ---- a/doc/admin/appl_servers.rst -+++ b/doc/admin/appl_servers.rst -@@ -115,14 +115,12 @@ Getting DNS information correct - ------------------------------- - - Several aspects of Kerberos rely on name service. When a hostname is --used to name a service, the Kerberos library canonicalizes the --hostname using forward and reverse name resolution. (The reverse name --resolution step can be turned off using the **rdns** variable in --:ref:`libdefaults`.) The result of this canonicalization must match --the principal entry in the host's keytab, or authentication will fail. -- --Each host's canonical name must be the fully-qualified host name --(including the domain), and each host's IP address must -+used to name a service, clients may canonicalize the hostname using -+forward and possibly reverse name resolution. The result of this -+canonicalization must match the principal entry in the host's keytab, -+or authentication will fail. To work with all client canonicalization -+configurations, each host's canonical name must be the fully-qualified -+host name (including the domain), and each host's IP address must - reverse-resolve to the canonical name. - - Configuration of hostnames varies by operating system. On the -diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst -index 3a8b9cf47..38f450367 100644 ---- a/doc/admin/conf_files/krb5_conf.rst -+++ b/doc/admin/conf_files/krb5_conf.rst -@@ -188,11 +188,10 @@ The libdefaults section may contain any of the following relations: - hostnames for use in service principal names. Setting this flag - to false can improve security by reducing reliance on DNS, but - means that short hostnames will not be canonicalized to -- fully-qualified hostnames. The default value is true. -- -- If this option is set to ``fallback`` (new in release 1.18), DNS -- canonicalization will only be performed the server hostname is not -- found with the original name when requesting credentials. -+ fully-qualified hostnames. If this option is set to ``fallback`` (new -+ in release 1.18), DNS canonicalization will only be performed the -+ server hostname is not found with the original name when -+ requesting credentials. The default value is ``fallback``. - - **dns_lookup_kdc** - Indicate whether DNS SRV records should be used to locate the KDCs -diff --git a/doc/admin/princ_dns.rst b/doc/admin/princ_dns.rst -index e1d823f27..32a269afc 100644 ---- a/doc/admin/princ_dns.rst -+++ b/doc/admin/princ_dns.rst -@@ -31,27 +31,35 @@ based on rotating ``CNAME`` records in DNS. - Service principal canonicalization - ---------------------------------- - --MIT Kerberos clients currently always do forward resolution (looking --up the IPv4 and possibly IPv6 addresses using ``getaddrinfo()``) of --the hostname part of a host-based service principal to canonicalize --the hostname. They obtain the "canonical" name of the host when doing --so. By default, MIT Kerberos clients will also then do reverse DNS --resolution (looking up the hostname associated with the IPv4 or IPv6 --address using ``getnameinfo()``) of the hostname. Using the --:ref:`krb5.conf(5)` setting:: -+In the MIT krb5 client library, canonicalization of host-based service -+principals is controlled by the **dns_canonicalize_hostname**, -+**rnds**, and **qualify_shortname** variables in :ref:`libdefaults`. - -- [libdefaults] -- rdns = false -+If **dns_canonicalize_hostname** is set to ``true`` (the default value -+before release 1.19), the client performs forward resolution by -+looking up the IPv4 and/or IPv6 addresses of the hostname using -+``getaddrinfo()``. This process will typically add a domain suffix to -+the hostname if needed, and follow CNAME records in the DNS. If -+**rdns** is also set to ``true`` (the default), the client will then -+perform a reverse lookup of the first returned Internet address using -+``getnameinfo()``, finding the name associated with the PTR record. - --will disable reverse DNS lookup on clients. The default setting is --"true". -+If **dns_canonicalize_hostname** is set to ``false``, the hostname is -+not canonicalized using DNS. If the hostname has only one component -+(i.e. it contains no "." characters), the host's primary DNS search -+domain will be appended, if there is one. The **qualify_shortname** -+variable can be used to override or disable this suffix. -+ -+If **dns_canonicalize_hostname** is set to ``fallback`` (the default -+value in release 1.19 and later), the hostname is initially treated -+according to the rules for ``dns_canonicalize_hostname=false``. If a -+ticket request fails because the service principal is unknown, it the -+hostname will be canonicalized according to the rules for -+``dns_canonicalize_hostname=true`` and the request will be retried. -+ -+In all cases, the hostname is converted to lowercase, and any trailing -+dot is removed. - --Operating system bugs may prevent a setting of ``rdns = false`` from --disabling reverse DNS lookup. Some versions of GNU libc have a bug in --``getaddrinfo()`` that cause them to look up ``PTR`` records even when --not required. MIT Kerberos releases krb5-1.10.2 and newer have a --workaround for this problem, as does the krb5-1.9.x series as of --release krb5-1.9.4. - - - Reverse DNS mismatches -diff --git a/src/kadmin/testing/proto/krb5.conf.proto b/src/kadmin/testing/proto/krb5.conf.proto -index e710852d4..c0af716a5 100644 ---- a/src/kadmin/testing/proto/krb5.conf.proto -+++ b/src/kadmin/testing/proto/krb5.conf.proto -@@ -2,19 +2,19 @@ - default_realm = __REALM__ - default_keytab_name = FILE:__K5ROOT__/keytab - dns_fallback = no -+ qualify_shortname = "" - plugin_base_dir = __PLUGIN_DIR__ - allow_weak_crypto = true - - [realms] - __REALM__ = { -- kdc = __KDCHOST__:1750 -- admin_server = __KDCHOST__:1751 -+ kdc = __HOSTNAME__:1750 -+ admin_server = __HOSTNAME__:1751 - database_module = foobar_db2_module_blah - } - - [domain_realm] -- __LOCALHOST__ = __REALM__ -- __KDCHOST__ = __REALM__ -+ __HOSTNAME__ = __REALM__ - - [logging] - admin_server = FILE:__K5ROOT__/syslog -diff --git a/src/kadmin/testing/scripts/env-setup.shin b/src/kadmin/testing/scripts/env-setup.shin -index 969c5340c..88f8ad1aa 100755 ---- a/src/kadmin/testing/scripts/env-setup.shin -+++ b/src/kadmin/testing/scripts/env-setup.shin -@@ -71,8 +71,8 @@ BSDDB_DUMP=$TESTDIR/util/bsddb_dump; export BSDDB_DUMP - CLNTTCL=$TESTDIR/util/kadm5_clnt_tcl; export CLNTTCL - SRVTCL=$TESTDIR/util/kadm5_srv_tcl; export SRVTCL - --QUALNAME=`$BUILDTOP/tests/resolve/resolve -q | tr '[A-Z]' '[a-z]'` --export QUALNAME -+HOSTNAME=`hostname | tr '[A-Z]' '[a-z]'` -+export HOSTNAME - - KRB5_CONFIG=$K5ROOT/krb5.conf; export KRB5_CONFIG - KRB5_KDC_PROFILE=$K5ROOT/kdc.conf; export KRB5_KDC_PROFILE -diff --git a/src/kadmin/testing/scripts/init_db b/src/kadmin/testing/scripts/init_db -index e65826c96..216f62793 100755 ---- a/src/kadmin/testing/scripts/init_db -+++ b/src/kadmin/testing/scripts/init_db -@@ -79,8 +79,7 @@ fi - # done - - sed -e "s/__REALM__/$REALM/g" -e "s#__K5ROOT__#$K5ROOT#g" \ -- -e "s/__KDCHOST__/$QUALNAME/g" \ -- -e "s/__LOCALHOST__/$QUALNAME/g" \ -+ -e "s/__HOSTNAME__/$HOSTNAME/g" \ - -e "s#__MODDIR__#$MODDIR#g" \ - < $STESTDIR/proto/krb5.conf.proto > $K5ROOT/krb5.conf - sed -e "s/__REALM__/$REALM/g" -e "s#__K5ROOT__#$K5ROOT#g" \ -diff --git a/src/kadmin/testing/scripts/start_servers b/src/kadmin/testing/scripts/start_servers -index f23df0682..05519e4ee 100755 ---- a/src/kadmin/testing/scripts/start_servers -+++ b/src/kadmin/testing/scripts/start_servers -@@ -36,8 +36,7 @@ if [ $local = 0 ]; then - - # Fix up the local krb5.conf to point to the remote - sed -e "s/__REALM__/$REALM/g" -e "s#__K5ROOT__#$K5ROOT#g" \ -- -e "s/__KDCHOST__/$hostname/g" \ -- -e "s/__LOCALHOST__/$QUALNAME/g" \ -+ -e "s/__HOSTNAME__/$HOSTNAME/g" \ - -e "s#__MODDIR__#$TOP/../plugins/kdb#g"\ - -e "s#__PLUGIN_DIR__#$TOP/../plugins#g"\ - < $STESTDIR/proto/krb5.conf.proto > $K5ROOT/krb5.conf -diff --git a/src/kadmin/testing/scripts/start_servers_local b/src/kadmin/testing/scripts/start_servers_local -index 998ef9164..858e88031 100755 ---- a/src/kadmin/testing/scripts/start_servers_local -+++ b/src/kadmin/testing/scripts/start_servers_local -@@ -79,7 +79,7 @@ cat - > /tmp/start_servers_local$$ <<\EOF - if { [catch { - source $env(STOP)/testing/tcl/util.t - set r $env(REALM) -- set q $env(QUALNAME) -+ set q $env(HOSTNAME) - puts stdout [kadm5_init $env(SRVTCL) mrroot null \ - [config_params {KADM5_CONFIG_REALM} $r] \ - $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 server_handle] -diff --git a/src/lib/kadm5/unit-test/api.current/init-v2.exp b/src/lib/kadm5/unit-test/api.current/init-v2.exp -index 7a353d4e9..47764c212 100644 ---- a/src/lib/kadm5/unit-test/api.current/init-v2.exp -+++ b/src/lib/kadm5/unit-test/api.current/init-v2.exp -@@ -3,18 +3,14 @@ load_lib lib.t - api_exit - api_start - --if ![info exists RESOLVE] { -- set RESOLVE [findfile $objdir/../../../tests/resolve/resolve] --} - proc get_hostname { } { -- global RESOLVE - global hostname - - if {[info exists hostname]} { - return 1 - } - -- catch "exec $RESOLVE -q >myname" exec_output -+ catch "exec hostname >myname" exec_output - if ![string match "" $exec_output] { - send_log "$exec_output\n" - verbose $exec_output -diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c -index 9a4741fa6..0b8ae6714 100644 ---- a/src/lib/krb5/krb/init_ctx.c -+++ b/src/lib/krb5/krb/init_ctx.c -@@ -237,7 +237,7 @@ krb5_init_context_profile(profile_t profile, krb5_flags flags, - ctx->enforce_ok_as_delegate = tmp; - - retval = get_tristate(ctx, KRB5_CONF_DNS_CANONICALIZE_HOSTNAME, "fallback", -- CANONHOST_FALLBACK, 1, &tmp); -+ CANONHOST_FALLBACK, CANONHOST_FALLBACK, &tmp); - if (retval) - goto cleanup; - ctx->dns_canonicalize_hostname = tmp; -diff --git a/src/tests/dejagnu/config/default.exp b/src/tests/dejagnu/config/default.exp -index 4d8c917cd..1e7777f1e 100644 ---- a/src/tests/dejagnu/config/default.exp -+++ b/src/tests/dejagnu/config/default.exp -@@ -268,7 +268,6 @@ foreach i { - {KTUTIL $objdir/../../kadmin/ktutil/ktutil} - {KLIST $objdir/../../clients/klist/klist} - {KDESTROY $objdir/../../clients/kdestroy/kdestroy} -- {RESOLVE $objdir/../resolve/resolve} - {T_INETD $objdir/t_inetd} - {KPROPLOG $objdir/../../kprop/kproplog} - {KPASSWD $objdir/../../clients/kpasswd/kpasswd} -@@ -462,7 +461,6 @@ proc setup_runtime_env { } { - # 0 on failure. - - proc get_hostname { } { -- global RESOLVE - global hostname - global tmppwd - -@@ -472,7 +470,7 @@ proc get_hostname { } { - - envstack_push - setup_runtime_env -- catch "exec $RESOLVE -q >$tmppwd/hostname" exec_output -+ catch "exec hostname >$tmppwd/hostname" exec_output - envstack_pop - if ![string match "" $exec_output] { - verbose -log $exec_output -@@ -710,6 +708,7 @@ proc setup_krb5_conf { {type client} } { - puts $conffile "\[libdefaults\]" - puts $conffile " default_realm = $REALMNAME" - puts $conffile " dns_lookup_kdc = false" -+ puts $conffile " qualify_shortname = \"\"" - if [info exists allow_weak_crypto($type)] { - puts $conffile " allow_weak_crypto = $allow_weak_crypto($type)" - } else { -diff --git a/src/tests/t_sn2princ.py b/src/tests/t_sn2princ.py -index 26dcb91c2..f3e187286 100755 ---- a/src/tests/t_sn2princ.py -+++ b/src/tests/t_sn2princ.py -@@ -2,7 +2,8 @@ from k5test import * - - offline = (len(args) > 0 and args[0] != "no") - --conf = {'domain_realm': {'kerberos.org': 'R1', -+conf = {'libdefaults': {'dns_canonicalize_hostname': 'true'}, -+ 'domain_realm': {'kerberos.org': 'R1', - 'example.com': 'R2', - 'mit.edu': 'R3'}} - no_rdns_conf = {'libdefaults': {'rdns': 'false'}} -@@ -28,7 +29,7 @@ def testbase(host, nametype, princhost, princrealm, env=None): - fail('Expected %s, got %s' % (expected, out)) - - def test(host, princhost, princrealm): -- # Test with the host-based name type in the default environment. -+ # Test with the host-based name type with canonicalization enabled. - testbase(host, 'srv-hst', princhost, princrealm) - - def testnc(host, princhost, princrealm): -diff --git a/src/util/k5test.py b/src/util/k5test.py -index eea92275d..5196cfa43 100644 ---- a/src/util/k5test.py -+++ b/src/util/k5test.py -@@ -193,7 +193,10 @@ Scripts may use the following functions and variables: - - * plugins: The plugin directory in the build tree (absolute path). - --* hostname: This machine's fully-qualified domain name. -+* hostname: The local hostname as it will initially appear in -+ krb5_sname_to_principal() results. (Shortname qualification is -+ turned off in the test environment to make this value easy to -+ discover from Python.) - - * null_input: A file opened to read /dev/null. - -@@ -525,23 +528,6 @@ def _find_srctop(): - return os.path.abspath(root) - - --# Return the local hostname as it will be canonicalized by --# krb5_sname_to_principal. We can't simply use socket.getfqdn() --# because it explicitly prefers results containing periods and --# krb5_sname_to_principal doesn't care. --def _get_hostname(): -- hostname = socket.gethostname() -- try: -- ai = socket.getaddrinfo(hostname, None, 0, 0, 0, socket.AI_CANONNAME) -- except socket.gaierror as e: -- fail('Local hostname "%s" does not resolve: %s.' % (hostname, e[1])) -- (family, socktype, proto, canonname, sockaddr) = ai[0] -- try: -- name = socket.getnameinfo(sockaddr, socket.NI_NAMEREQD) -- except socket.gaierror: -- return canonname.lower() -- return name[0].lower() -- - # Parse command line arguments, setting global option variables. Also - # sets the global variable args to the positional arguments, which may - # be used by the test script. -@@ -1263,6 +1249,7 @@ _default_krb5_conf = { - 'libdefaults': { - 'default_realm': '$realm', - 'dns_lookup_kdc': 'false', -+ 'qualify_shortname': '', - 'plugin_base_dir': '$plugins'}, - 'realms': {'$realm': { - 'kdc': '$hostname:$port0', -@@ -1356,7 +1343,7 @@ buildtop = _find_buildtop() - srctop = _find_srctop() - plugins = os.path.join(buildtop, 'plugins') - runenv = _import_runenv() --hostname = _get_hostname() -+hostname = socket.gethostname().lower() - null_input = open(os.devnull, 'r') - - # A DB pass is a tuple of: name, kdc_conf. diff --git a/Do-expiration-warnings-for-all-init_creds-APIs.patch b/Do-expiration-warnings-for-all-init_creds-APIs.patch deleted file mode 100644 index 0dc7528..0000000 --- a/Do-expiration-warnings-for-all-init_creds-APIs.patch +++ /dev/null @@ -1,425 +0,0 @@ -From 4369b03968131b005acbafd043465899da50e1dc Mon Sep 17 00:00:00 2001 -From: Sumit Bose -Date: Fri, 28 Feb 2020 10:11:49 +0100 -Subject: [PATCH] Do expiration warnings for all init_creds APIs - -Move the password expiration warning code from gic_pwd.c to -get_in_tkt.c. Call it from init_creds_step_reply() on successful -completion. - -[ghudson@mit.edu: added test case; simplified doc comment; moved call -site to init_creds_step_reply(); rewrote commit message] - -ticket: 8893 (new) -(cherry picked from commit e1efb890f7ac31b32c68ab816ef118dbfb5a8c7e) ---- - src/include/krb5/krb5.hin | 9 ++- - src/lib/krb5/krb/get_in_tkt.c | 112 ++++++++++++++++++++++++++++++ - src/lib/krb5/krb/gic_pwd.c | 110 ----------------------------- - src/lib/krb5/krb/t_expire_warn.c | 47 +++++++++---- - src/lib/krb5/krb/t_expire_warn.py | 22 ++++-- - 5 files changed, 165 insertions(+), 135 deletions(-) - -diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin -index 6355e6540..f8269fb17 100644 ---- a/src/include/krb5/krb5.hin -+++ b/src/include/krb5/krb5.hin -@@ -7174,11 +7174,10 @@ typedef void - * - * Set a callback to receive password and account expiration times. - * -- * This option only applies to krb5_get_init_creds_password(). @a cb will be -- * invoked if and only if credentials are successfully acquired. The callback -- * will receive the @a context from the krb5_get_init_creds_password() call and -- * the @a data argument supplied with this API. The remaining arguments should -- * be interpreted as follows: -+ * @a cb will be invoked if and only if credentials are successfully acquired. -+ * The callback will receive the @a context from the calling function and the -+ * @a data argument supplied with this API. The remaining arguments should be -+ * interpreted as follows: - * - * If @a is_last_req is true, then the KDC reply contained last-req entries - * which unambiguously indicated the password expiration, account expiration, -diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c -index 870df62a1..cc0f70e83 100644 ---- a/src/lib/krb5/krb/get_in_tkt.c -+++ b/src/lib/krb5/krb/get_in_tkt.c -@@ -1482,6 +1482,116 @@ accept_method_data(krb5_context context, krb5_init_creds_context ctx) - ctx->method_padata); - } - -+/* Return the password expiry time indicated by enc_part2. Set *is_last_req -+ * if the information came from a last_req value. */ -+static void -+get_expiry_times(krb5_enc_kdc_rep_part *enc_part2, krb5_timestamp *pw_exp, -+ krb5_timestamp *acct_exp, krb5_boolean *is_last_req) -+{ -+ krb5_last_req_entry **last_req; -+ krb5_int32 lr_type; -+ -+ *pw_exp = 0; -+ *acct_exp = 0; -+ *is_last_req = FALSE; -+ -+ /* Look for last-req entries for password or account expiration. */ -+ if (enc_part2->last_req) { -+ for (last_req = enc_part2->last_req; *last_req; last_req++) { -+ lr_type = (*last_req)->lr_type; -+ if (lr_type == KRB5_LRQ_ALL_PW_EXPTIME || -+ lr_type == KRB5_LRQ_ONE_PW_EXPTIME) { -+ *is_last_req = TRUE; -+ *pw_exp = (*last_req)->value; -+ } else if (lr_type == KRB5_LRQ_ALL_ACCT_EXPTIME || -+ lr_type == KRB5_LRQ_ONE_ACCT_EXPTIME) { -+ *is_last_req = TRUE; -+ *acct_exp = (*last_req)->value; -+ } -+ } -+ } -+ -+ /* If we didn't find any, use the ambiguous key_exp field. */ -+ if (*is_last_req == FALSE) -+ *pw_exp = enc_part2->key_exp; -+} -+ -+/* -+ * Send an appropriate warning prompter if as_reply indicates that the password -+ * is going to expire soon. If an expire callback was provided, use that -+ * instead. -+ */ -+static void -+warn_pw_expiry(krb5_context context, krb5_get_init_creds_opt *options, -+ krb5_prompter_fct prompter, void *data, -+ const char *in_tkt_service, krb5_kdc_rep *as_reply) -+{ -+ krb5_error_code ret; -+ krb5_expire_callback_func expire_cb; -+ void *expire_data; -+ krb5_timestamp pw_exp, acct_exp, now; -+ krb5_boolean is_last_req; -+ krb5_deltat delta; -+ char ts[256], banner[1024]; -+ -+ if (as_reply == NULL || as_reply->enc_part2 == NULL) -+ return; -+ -+ get_expiry_times(as_reply->enc_part2, &pw_exp, &acct_exp, &is_last_req); -+ -+ k5_gic_opt_get_expire_cb(options, &expire_cb, &expire_data); -+ if (expire_cb != NULL) { -+ /* Invoke the expire callback and don't send prompter warnings. */ -+ (*expire_cb)(context, expire_data, pw_exp, acct_exp, is_last_req); -+ return; -+ } -+ -+ /* Don't warn if no password expiry value was sent. */ -+ if (pw_exp == 0) -+ return; -+ -+ /* Don't warn if the password is being changed. */ -+ if (in_tkt_service && strcmp(in_tkt_service, "kadmin/changepw") == 0) -+ return; -+ -+ /* -+ * If the expiry time came from a last_req field, assume the KDC wants us -+ * to warn. Otherwise, warn only if the expiry time is less than a week -+ * from now. -+ */ -+ ret = krb5_timeofday(context, &now); -+ if (ret != 0) -+ return; -+ if (!is_last_req && -+ (ts_after(now, pw_exp) || ts_delta(pw_exp, now) > 7 * 24 * 60 * 60)) -+ return; -+ -+ if (!prompter) -+ return; -+ -+ ret = krb5_timestamp_to_string(pw_exp, ts, sizeof(ts)); -+ if (ret != 0) -+ return; -+ -+ delta = ts_delta(pw_exp, now); -+ if (delta < 3600) { -+ snprintf(banner, sizeof(banner), -+ _("Warning: Your password will expire in less than one hour " -+ "on %s"), ts); -+ } else if (delta < 86400 * 2) { -+ snprintf(banner, sizeof(banner), -+ _("Warning: Your password will expire in %d hour%s on %s"), -+ delta / 3600, delta < 7200 ? "" : "s", ts); -+ } else { -+ snprintf(banner, sizeof(banner), -+ _("Warning: Your password will expire in %d days on %s"), -+ delta / 86400, ts); -+ } -+ -+ /* PROMPTER_INVOCATION */ -+ (*prompter)(context, data, 0, banner, 0, 0); -+} -+ - static krb5_error_code - init_creds_step_reply(krb5_context context, - krb5_init_creds_context ctx, -@@ -1693,6 +1803,8 @@ init_creds_step_reply(krb5_context context, - - /* success */ - ctx->complete = TRUE; -+ warn_pw_expiry(context, ctx->opt, ctx->prompter, ctx->prompter_data, -+ ctx->in_tkt_service, ctx->reply); - - cleanup: - krb5_free_pa_data(context, kdc_padata); -diff --git a/src/lib/krb5/krb/gic_pwd.c b/src/lib/krb5/krb/gic_pwd.c -index 14ce23ba4..54e0a8ebe 100644 ---- a/src/lib/krb5/krb/gic_pwd.c -+++ b/src/lib/krb5/krb/gic_pwd.c -@@ -133,113 +133,6 @@ krb5_init_creds_set_password(krb5_context context, - return 0; - } - --/* Return the password expiry time indicated by enc_part2. Set *is_last_req -- * if the information came from a last_req value. */ --static void --get_expiry_times(krb5_enc_kdc_rep_part *enc_part2, krb5_timestamp *pw_exp, -- krb5_timestamp *acct_exp, krb5_boolean *is_last_req) --{ -- krb5_last_req_entry **last_req; -- krb5_int32 lr_type; -- -- *pw_exp = 0; -- *acct_exp = 0; -- *is_last_req = FALSE; -- -- /* Look for last-req entries for password or account expiration. */ -- if (enc_part2->last_req) { -- for (last_req = enc_part2->last_req; *last_req; last_req++) { -- lr_type = (*last_req)->lr_type; -- if (lr_type == KRB5_LRQ_ALL_PW_EXPTIME || -- lr_type == KRB5_LRQ_ONE_PW_EXPTIME) { -- *is_last_req = TRUE; -- *pw_exp = (*last_req)->value; -- } else if (lr_type == KRB5_LRQ_ALL_ACCT_EXPTIME || -- lr_type == KRB5_LRQ_ONE_ACCT_EXPTIME) { -- *is_last_req = TRUE; -- *acct_exp = (*last_req)->value; -- } -- } -- } -- -- /* If we didn't find any, use the ambiguous key_exp field. */ -- if (*is_last_req == FALSE) -- *pw_exp = enc_part2->key_exp; --} -- --/* -- * Send an appropriate warning prompter if as_reply indicates that the password -- * is going to expire soon. If an expire callback was provided, use that -- * instead. -- */ --static void --warn_pw_expiry(krb5_context context, krb5_get_init_creds_opt *options, -- krb5_prompter_fct prompter, void *data, -- const char *in_tkt_service, krb5_kdc_rep *as_reply) --{ -- krb5_error_code ret; -- krb5_expire_callback_func expire_cb; -- void *expire_data; -- krb5_timestamp pw_exp, acct_exp, now; -- krb5_boolean is_last_req; -- krb5_deltat delta; -- char ts[256], banner[1024]; -- -- get_expiry_times(as_reply->enc_part2, &pw_exp, &acct_exp, &is_last_req); -- -- k5_gic_opt_get_expire_cb(options, &expire_cb, &expire_data); -- if (expire_cb != NULL) { -- /* Invoke the expire callback and don't send prompter warnings. */ -- (*expire_cb)(context, expire_data, pw_exp, acct_exp, is_last_req); -- return; -- } -- -- /* Don't warn if no password expiry value was sent. */ -- if (pw_exp == 0) -- return; -- -- /* Don't warn if the password is being changed. */ -- if (in_tkt_service && strcmp(in_tkt_service, "kadmin/changepw") == 0) -- return; -- -- /* -- * If the expiry time came from a last_req field, assume the KDC wants us -- * to warn. Otherwise, warn only if the expiry time is less than a week -- * from now. -- */ -- ret = krb5_timeofday(context, &now); -- if (ret != 0) -- return; -- if (!is_last_req && -- (ts_after(now, pw_exp) || ts_delta(pw_exp, now) > 7 * 24 * 60 * 60)) -- return; -- -- if (!prompter) -- return; -- -- ret = krb5_timestamp_to_string(pw_exp, ts, sizeof(ts)); -- if (ret != 0) -- return; -- -- delta = ts_delta(pw_exp, now); -- if (delta < 3600) { -- snprintf(banner, sizeof(banner), -- _("Warning: Your password will expire in less than one hour " -- "on %s"), ts); -- } else if (delta < 86400*2) { -- snprintf(banner, sizeof(banner), -- _("Warning: Your password will expire in %d hour%s on %s"), -- delta / 3600, delta < 7200 ? "" : "s", ts); -- } else { -- snprintf(banner, sizeof(banner), -- _("Warning: Your password will expire in %d days on %s"), -- delta / 86400, ts); -- } -- -- /* PROMPTER_INVOCATION */ -- (*prompter)(context, data, 0, banner, 0, 0); --} -- - /* - * Create a temporary options structure for getting a kadmin/changepw ticket, - * based on the appplication-specified options. Propagate all application -@@ -496,9 +389,6 @@ krb5_get_init_creds_password(krb5_context context, - goto cleanup; - - cleanup: -- if (ret == 0) -- warn_pw_expiry(context, options, prompter, data, in_tkt_service, -- as_reply); - free(chpw_opts); - zapfree(gakpw.storage.data, gakpw.storage.length); - memset(pw0array, 0, sizeof(pw0array)); -diff --git a/src/lib/krb5/krb/t_expire_warn.c b/src/lib/krb5/krb/t_expire_warn.c -index 1e59acba1..dc8dc8fb3 100644 ---- a/src/lib/krb5/krb/t_expire_warn.c -+++ b/src/lib/krb5/krb/t_expire_warn.c -@@ -28,6 +28,13 @@ - - static int exp_dummy, prompt_dummy; - -+static void -+check(krb5_error_code code) -+{ -+ if (code != 0) -+ abort(); -+} -+ - static krb5_error_code - prompter_cb(krb5_context ctx, void *data, const char *name, - const char *banner, int num_prompts, krb5_prompt prompts[]) -@@ -52,36 +59,48 @@ int - main(int argc, char **argv) - { - krb5_context ctx; -+ krb5_init_creds_context icctx; - krb5_get_init_creds_opt *opt; - char *user, *password, *service = NULL; -- krb5_boolean use_cb; -+ krb5_boolean use_cb, stepwise; - krb5_principal client; - krb5_creds creds; - -- if (argc < 4) { -- fprintf(stderr, "Usage: %s username password {1|0} [service]\n", -+ if (argc < 5) { -+ fprintf(stderr, "Usage: %s username password {1|0} {1|0} [service]\n", - argv[0]); - return 1; - } - user = argv[1]; - password = argv[2]; - use_cb = atoi(argv[3]); -- if (argc >= 5) -- service = argv[4]; -+ stepwise = atoi(argv[4]); -+ if (argc >= 6) -+ service = argv[5]; - -- assert(krb5_init_context(&ctx) == 0); -- assert(krb5_get_init_creds_opt_alloc(ctx, &opt) == 0); -+ check(krb5_init_context(&ctx)); -+ check(krb5_get_init_creds_opt_alloc(ctx, &opt)); - if (use_cb) { -- assert(krb5_get_init_creds_opt_set_expire_callback(ctx, opt, expire_cb, -- &exp_dummy) == 0); -+ check(krb5_get_init_creds_opt_set_expire_callback(ctx, opt, expire_cb, -+ &exp_dummy)); -+ } -+ check(krb5_parse_name(ctx, user, &client)); -+ if (stepwise) { -+ check(krb5_init_creds_init(ctx, client, prompter_cb, &prompt_dummy, 0, -+ opt, &icctx)); -+ krb5_init_creds_set_password(ctx, icctx, password); -+ if (service != NULL) -+ check(krb5_init_creds_set_service(ctx, icctx, service)); -+ check(krb5_init_creds_get(ctx, icctx)); -+ krb5_init_creds_free(ctx, icctx); -+ } else { -+ check(krb5_get_init_creds_password(ctx, &creds, client, password, -+ prompter_cb, &prompt_dummy, 0, -+ service, opt)); -+ krb5_free_cred_contents(ctx, &creds); - } -- assert(krb5_parse_name(ctx, user, &client) == 0); -- assert(krb5_get_init_creds_password(ctx, &creds, client, password, -- prompter_cb, &prompt_dummy, 0, service, -- opt) == 0); - krb5_get_init_creds_opt_free(ctx, opt); - krb5_free_principal(ctx, client); -- krb5_free_cred_contents(ctx, &creds); - krb5_free_context(ctx); - return 0; - } -diff --git a/src/lib/krb5/krb/t_expire_warn.py b/src/lib/krb5/krb/t_expire_warn.py -index 781f2728a..e163cc7e4 100755 ---- a/src/lib/krb5/krb/t_expire_warn.py -+++ b/src/lib/krb5/krb/t_expire_warn.py -@@ -34,23 +34,33 @@ realm.run([kadminl, 'addprinc', '-pw', 'pass', '-pwexpire', '12 hours', - realm.run([kadminl, 'addprinc', '-pw', 'pass', '-pwexpire', '3 days', 'days']) - - # Check for expected prompter warnings when no expire callback is used. --output = realm.run(['./t_expire_warn', 'noexpire', 'pass', '0']) -+output = realm.run(['./t_expire_warn', 'noexpire', 'pass', '0', '0']) - if output: - fail('Unexpected output for noexpire') --realm.run(['./t_expire_warn', 'minutes', 'pass', '0'], -+realm.run(['./t_expire_warn', 'minutes', 'pass', '0', '0'], - expected_msg=' less than one hour on ') --realm.run(['./t_expire_warn', 'hours', 'pass', '0'], expected_msg=' hours on ') --realm.run(['./t_expire_warn', 'days', 'pass', '0'], expected_msg=' days on ') -+realm.run(['./t_expire_warn', 'hours', 'pass', '0', '0'], -+ expected_msg=' hours on ') -+realm.run(['./t_expire_warn', 'days', 'pass', '0', '0'], -+ expected_msg=' days on ') -+# Try one case with the stepwise interface. -+realm.run(['./t_expire_warn', 'days', 'pass', '0', '1'], -+ expected_msg=' days on ') - - # Check for expected expire callback behavior. These tests are - # carefully agnostic about whether the KDC supports last_req fields, - # and could be made more specific if last_req support is added. --output = realm.run(['./t_expire_warn', 'noexpire', 'pass', '1']) -+output = realm.run(['./t_expire_warn', 'noexpire', 'pass', '1', '0']) - if 'password_expiration = 0\n' not in output or \ - 'account_expiration = 0\n' not in output or \ - 'is_last_req = ' not in output: - fail('Expected callback output not seen for noexpire') --output = realm.run(['./t_expire_warn', 'days', 'pass', '1']) -+output = realm.run(['./t_expire_warn', 'days', 'pass', '1', '0']) -+if 'password_expiration = ' not in output or \ -+ 'password_expiration = 0\n' in output: -+ fail('Expected non-zero password expiration not seen for days') -+# Try one case with the stepwise interface. -+output = realm.run(['./t_expire_warn', 'days', 'pass', '1', '1']) - if 'password_expiration = ' not in output or \ - 'password_expiration = 0\n' in output: - fail('Expected non-zero password expiration not seen for days') diff --git a/Document-k-option-in-kvno-1-synopsis.patch b/Document-k-option-in-kvno-1-synopsis.patch index 21f8100..28323f4 100644 --- a/Document-k-option-in-kvno-1-synopsis.patch +++ b/Document-k-option-in-kvno-1-synopsis.patch @@ -1,4 +1,4 @@ -From 588d964f59356373353dfd31d4fdcba95e508385 Mon Sep 17 00:00:00 2001 +From b401a1127f27f8cd564e32411f799648a8fd5481 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 24 Nov 2020 12:52:02 -0500 Subject: [PATCH] Document -k option in kvno(1) synopsis @@ -13,7 +13,7 @@ synopsis, option descriptions, and xusage(), but missed one option. 2 files changed, 2 insertions(+) diff --git a/doc/user/user_commands/kvno.rst b/doc/user/user_commands/kvno.rst -index 6fd8577a5..1e273e26e 100644 +index 65c44e1c0..93a5132b2 100644 --- a/doc/user/user_commands/kvno.rst +++ b/doc/user/user_commands/kvno.rst @@ -9,6 +9,7 @@ SYNOPSIS @@ -25,7 +25,7 @@ index 6fd8577a5..1e273e26e 100644 [**-u** | **-S** *sname*] [**-P**] diff --git a/src/man/kvno.man b/src/man/kvno.man -index 7c9565bdb..dc9847e99 100644 +index 953d168e6..ebdd6e8ca 100644 --- a/src/man/kvno.man +++ b/src/man/kvno.man @@ -35,6 +35,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]] diff --git a/Fix-leak-in-KERB_AP_OPTIONS_CBT-server-support.patch b/Fix-leak-in-KERB_AP_OPTIONS_CBT-server-support.patch deleted file mode 100644 index ad0dd7a..0000000 --- a/Fix-leak-in-KERB_AP_OPTIONS_CBT-server-support.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 5106d0b7ea10d1faa21f6dfb542a46eb74e78d40 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Fri, 24 Jul 2020 16:05:24 -0400 -Subject: [PATCH] Fix leak in KERB_AP_OPTIONS_CBT server support - -In check_cbt(), use a local variable to hold the retrieved authdata -list, and free it before returning. - -ticket: 8900 -(cherry picked from commit bf2ddff13c178e0c291f8fb382b040080d159e4f) ---- - src/lib/gssapi/krb5/accept_sec_context.c | 23 +++++++++++++---------- - 1 file changed, 13 insertions(+), 10 deletions(-) - -diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c -index 175a24c4e..3d5b84b15 100644 ---- a/src/lib/gssapi/krb5/accept_sec_context.c -+++ b/src/lib/gssapi/krb5/accept_sec_context.c -@@ -433,27 +433,30 @@ static const uint8_t null_cb[CB_MD5_LEN]; - /* Look for AP_OPTIONS in authdata. If present and the options include - * KERB_AP_OPTIONS_CBT, set *cbt_out to true. */ - static krb5_error_code --check_cbt(krb5_context context, krb5_authdata **authdata, -+check_cbt(krb5_context context, krb5_authdata *const *authdata, - krb5_boolean *cbt_out) - { - krb5_error_code code; -+ krb5_authdata **ad; - uint32_t ad_ap_options; - const uint32_t KERB_AP_OPTIONS_CBT = 0x4000; - - *cbt_out = FALSE; - - code = krb5_find_authdata(context, NULL, authdata, -- KRB5_AUTHDATA_AP_OPTIONS, &authdata); -- if (code || authdata == NULL) -+ KRB5_AUTHDATA_AP_OPTIONS, &ad); -+ if (code || ad == NULL) - return code; -- if (authdata[1] != NULL || authdata[0]->length != 4) -- return KRB5KRB_AP_ERR_MSG_TYPE; -+ if (ad[1] != NULL || ad[0]->length != 4) { -+ code = KRB5KRB_AP_ERR_MSG_TYPE; -+ } else { -+ ad_ap_options = load_32_le(ad[0]->contents); -+ if (ad_ap_options & KERB_AP_OPTIONS_CBT) -+ *cbt_out = TRUE; -+ } - -- ad_ap_options = load_32_le(authdata[0]->contents); -- if (ad_ap_options & KERB_AP_OPTIONS_CBT) -- *cbt_out = TRUE; -- -- return 0; -+ krb5_free_authdata(context, ad); -+ return code; - } - - /* diff --git a/Fix-minor-static-analysis-defects.patch b/Fix-minor-static-analysis-defects.patch deleted file mode 100644 index c136b7f..0000000 --- a/Fix-minor-static-analysis-defects.patch +++ /dev/null @@ -1,106 +0,0 @@ -From a33dc1cfb0ebecb67cc7f38258303492a552cb73 Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Thu, 15 Oct 2020 18:15:29 -0400 -Subject: [PATCH] Fix minor static analysis defects - -Remove an unused variable in krb5_ldap_create(). Handle the return -value from krb5_dbe_get_string() in the certauth test plugin module. -Handle the return value from k5_expand_path_tokens() in -k5_rc_default(). Remove dead assignments in -krb5_get_credentials_for_user() and kg_accept_krb5(). - -[ghudson@mit.edu: squashed and edited commit message; simplified -k5_rc_default() change] - -(cherry picked from commit b27461141810fddd299764928649148c5d0e99f3) ---- - src/lib/gssapi/krb5/accept_sec_context.c | 4 +--- - src/lib/krb5/krb/s4u_creds.c | 1 - - src/lib/krb5/rcache/rc_base.c | 2 ++ - src/plugins/certauth/test/main.c | 3 +++ - src/plugins/kdb/ldap/libkdb_ldap/ldap_create.c | 4 ---- - 5 files changed, 6 insertions(+), 8 deletions(-) - -diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c -index 3d5b84b15..e2c5e2b59 100644 ---- a/src/lib/gssapi/krb5/accept_sec_context.c -+++ b/src/lib/gssapi/krb5/accept_sec_context.c -@@ -671,7 +671,7 @@ kg_accept_krb5(minor_status, context_handle, - krb5_auth_context auth_context = NULL; - krb5_ticket * ticket = NULL; - const gss_OID_desc *mech_used = NULL; -- OM_uint32 major_status = GSS_S_FAILURE; -+ OM_uint32 major_status; - OM_uint32 tmp_minor_status; - krb5_error krb_error_data; - krb5_data scratch; -@@ -878,8 +878,6 @@ kg_accept_krb5(minor_status, context_handle, - if (major_status != GSS_S_COMPLETE) - goto fail; - -- major_status = GSS_S_FAILURE; -- - if (exts->iakerb.conv && !exts->iakerb.verified) { - major_status = GSS_S_BAD_SIG; - goto fail; -diff --git a/src/lib/krb5/krb/s4u_creds.c b/src/lib/krb5/krb/s4u_creds.c -index d8f486dc6..35a8843e5 100644 ---- a/src/lib/krb5/krb/s4u_creds.c -+++ b/src/lib/krb5/krb/s4u_creds.c -@@ -714,7 +714,6 @@ krb5_get_credentials_for_user(krb5_context context, krb5_flags options, - } else if (code != KRB5_CC_NOTFOUND && code != KRB5_CC_NOT_KTYPE) { - goto cleanup; - } -- code = 0; - } - - /* Note the authdata we asked for in the output creds. */ -diff --git a/src/lib/krb5/rcache/rc_base.c b/src/lib/krb5/rcache/rc_base.c -index 5f456d1f3..f9a482318 100644 ---- a/src/lib/krb5/rcache/rc_base.c -+++ b/src/lib/krb5/rcache/rc_base.c -@@ -56,6 +56,8 @@ k5_rc_default(krb5_context context, krb5_rcache *rc_out) - &profstr) == 0 && profstr != NULL) { - ret = k5_expand_path_tokens(context, profstr, &rcname); - profile_release_string(profstr); -+ if (ret) -+ return ret; - ret = k5_rc_resolve(context, rcname, rc_out); - free(rcname); - return ret; -diff --git a/src/plugins/certauth/test/main.c b/src/plugins/certauth/test/main.c -index d4633b8cd..7e7a3ef4c 100644 ---- a/src/plugins/certauth/test/main.c -+++ b/src/plugins/certauth/test/main.c -@@ -171,6 +171,9 @@ test2_authorize(krb5_context context, krb5_certauth_moddata moddata, - - ret = krb5_dbe_get_string(context, (krb5_db_entry *)db_entry, "hwauth", - &strval); -+ if (ret) -+ goto cleanup; -+ - ret = (strval != NULL) ? KRB5_CERTAUTH_HWAUTH : 0; - krb5_dbe_free_string(context, strval); - -diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_create.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_create.c -index 5b57c799a..2d6605666 100644 ---- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_create.c -+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_create.c -@@ -55,7 +55,6 @@ krb5_ldap_create(krb5_context context, char *conf_section, char **db_args) - krb5_error_code status = 0; - krb5_ldap_realm_params *rparams = NULL; - krb5_ldap_context *ldap_context=NULL; -- krb5_boolean realm_obj_created = FALSE; - int mask = 0; - - /* Clear the global error string */ -@@ -109,9 +108,6 @@ krb5_ldap_create(krb5_context context, char *conf_section, char **db_args) - if ((status = krb5_ldap_create_realm(context, rparams, mask))) - goto cleanup; - -- /* We just created the Realm container. Here starts our transaction tracking */ -- realm_obj_created = TRUE; -- - /* verify realm object */ - if ((status = krb5_ldap_read_realm_params(context, - rparams->realm_name, diff --git a/Fix-typo-in-in-in-the-ksu-man-page.patch b/Fix-typo-in-in-in-the-ksu-man-page.patch deleted file mode 100644 index 922aa29..0000000 --- a/Fix-typo-in-in-in-the-ksu-man-page.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 5952a06a594c4dc0f20f7ba2854b25f76734aa27 Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Thu, 14 May 2020 15:01:18 -0400 -Subject: [PATCH] Fix typo ("in in") in the ksu man page - -(cherry picked from commit 1011841acdc1020f308ef4f569c6622f279d8c3f) ---- - doc/user/user_commands/ksu.rst | 2 +- - src/man/ksu.man | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/doc/user/user_commands/ksu.rst b/doc/user/user_commands/ksu.rst -index 8d6c7ef79..933738229 100644 ---- a/doc/user/user_commands/ksu.rst -+++ b/doc/user/user_commands/ksu.rst -@@ -155,7 +155,7 @@ wrong password is typed in, ksu fails. - .. note:: - - During authentication, only the tickets that could be -- obtained without providing a password are cached in in the -+ obtained without providing a password are cached in the - source cache. - - -diff --git a/src/man/ksu.man b/src/man/ksu.man -index a1972518c..b07a4b05d 100644 ---- a/src/man/ksu.man -+++ b/src/man/ksu.man -@@ -176,7 +176,7 @@ wrong password is typed in, ksu fails. - .INDENT 0.0 - .INDENT 3.5 - During authentication, only the tickets that could be --obtained without providing a password are cached in in the -+obtained without providing a password are cached in the - source cache. - .UNINDENT - .UNINDENT diff --git a/Ignore-bad-enctypes-in-krb5_string_to_keysalts.patch b/Ignore-bad-enctypes-in-krb5_string_to_keysalts.patch deleted file mode 100644 index aaab2d3..0000000 --- a/Ignore-bad-enctypes-in-krb5_string_to_keysalts.patch +++ /dev/null @@ -1,37 +0,0 @@ -From cc572c5b6f8a3269c24c0f21f5799e60014635fb Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Wed, 15 Jul 2020 15:42:20 -0400 -Subject: [PATCH] Ignore bad enctypes in krb5_string_to_keysalts() - -Fixes a problem where the presence of legacy/unrecognized keysalts in -supported_enctypes would prevent the kadmin programs from starting. - -[ghudson@mit.edu: ideally we would put a warning in the kadmind log, -but that is difficult to do when the parsing is done inside a library. -Even adding a trace log is difficult because the kadm5 str_conv -functions do not accept contexts.] - -ticket: 8929 (new) -(cherry picked from commit be5396ada0e8dabd68bd0aceb733cfca39a609bc) ---- - src/lib/kadm5/str_conv.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/src/lib/kadm5/str_conv.c b/src/lib/kadm5/str_conv.c -index 7cf51d316..798295606 100644 ---- a/src/lib/kadm5/str_conv.c -+++ b/src/lib/kadm5/str_conv.c -@@ -340,9 +340,10 @@ krb5_string_to_keysalts(const char *string, const char *tupleseps, - while ((ksp = strtok_r(p, tseps, &tlasts)) != NULL) { - /* Pass a null pointer to subsequent calls to strtok_r(). */ - p = NULL; -- ret = string_to_keysalt(ksp, ksaltseps, &etype, &stype); -- if (ret) -- goto cleanup; -+ -+ /* Discard unrecognized keysalts. */ -+ if (string_to_keysalt(ksp, ksaltseps, &etype, &stype) != 0) -+ continue; - - /* Ignore duplicate keysalts if caller asks. */ - if (!dups && krb5_keysalt_is_present(ksalts, nksalts, etype, stype)) diff --git a/Implement-GSS_C_CHANNEL_BOUND_FLAG.patch b/Implement-GSS_C_CHANNEL_BOUND_FLAG.patch deleted file mode 100644 index b5180b2..0000000 --- a/Implement-GSS_C_CHANNEL_BOUND_FLAG.patch +++ /dev/null @@ -1,91 +0,0 @@ -From e0a702b6e5f0665cca88723f7b17ff90ea218e45 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Wed, 5 Jul 2017 11:38:30 -0400 -Subject: [PATCH] Implement GSS_C_CHANNEL_BOUND_FLAG - -Define a new channel-bound GSS return flag, and set it in the krb5 -mech if the initiator sent channel bindings matching the acceptor's. -Do not error out if the acceptor specifies channel bindings and the -initiator does not send them. - -[ghudson@mit.edu: simplified code changes; fleshed out commit message] - -[iboukris: cherry-picked from another PR and reduced in scope] - -ticket: 8899 (new) -(cherry picked from commit 429a31146083fac21958631c2af572b08ec91022) ---- - src/lib/gssapi/generic/gssapi_ext.h | 2 ++ - src/lib/gssapi/krb5/accept_sec_context.c | 18 +++++++++++++----- - 2 files changed, 15 insertions(+), 5 deletions(-) - -diff --git a/src/lib/gssapi/generic/gssapi_ext.h b/src/lib/gssapi/generic/gssapi_ext.h -index 218456e44..c675e8ebb 100644 ---- a/src/lib/gssapi/generic/gssapi_ext.h -+++ b/src/lib/gssapi/generic/gssapi_ext.h -@@ -595,6 +595,8 @@ gss_store_cred_into( - * attribute (along with any applicable RFC 5587 attributes). - */ - -+#define GSS_C_CHANNEL_BOUND_FLAG 2048 /* 0x00000800 */ -+ - OM_uint32 KRB5_CALLCONV - gssspi_query_meta_data( - OM_uint32 *minor_status, -diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c -index 70dd7fc0c..9d3e2f4fe 100644 ---- a/src/lib/gssapi/krb5/accept_sec_context.c -+++ b/src/lib/gssapi/krb5/accept_sec_context.c -@@ -427,6 +427,9 @@ kg_process_extension(krb5_context context, - GSS_C_SEQUENCE_FLAG | GSS_C_DCE_STYLE | \ - GSS_C_IDENTIFY_FLAG | GSS_C_EXTENDED_ERROR_FLAG) - -+/* A zero-value channel binding, for comparison */ -+static const uint8_t null_cb[CB_MD5_LEN]; -+ - /* - * The krb5 GSS mech appropriates the authenticator checksum field from RFC - * 4120 to store structured data instead of a checksum, indicated with checksum -@@ -435,9 +438,10 @@ kg_process_extension(krb5_context context, - * - * Interpret the checksum. Read delegated creds into *deleg_out if it is not - * NULL. Set *flags_out to the allowed subset of token flags, plus -- * GSS_C_DELEG_FLAG if a delegated credential was present. Process any -- * extensions found using exts. On error, set *code_out to a krb5_error code -- * for use as a minor status value. -+ * GSS_C_DELEG_FLAG if a delegated credential was present and -+ * GSS_C_CHANNEL_BOUND_FLAG if matching channel bindings are present. Process -+ * any extensions found using exts. On error, set *code_out to a krb5_error -+ * code for use as a minor status value. - */ - static OM_uint32 - process_checksum(OM_uint32 *minor_status, krb5_context context, -@@ -450,7 +454,7 @@ process_checksum(OM_uint32 *minor_status, krb5_context context, - krb5_error_code code = 0; - OM_uint32 status, option_id, token_flags; - size_t cb_len, option_len; -- krb5_boolean valid; -+ krb5_boolean valid, token_cb_present = FALSE, cb_match = FALSE; - krb5_key subkey; - krb5_data option, empty = empty_data(); - krb5_checksum cb_cksum; -@@ -516,7 +520,9 @@ process_checksum(OM_uint32 *minor_status, krb5_context context, - goto fail; - } - assert(cb_cksum.length == cb_len); -- if (k5_bcmp(token_cb, cb_cksum.contents, cb_len) != 0) { -+ token_cb_present = (k5_bcmp(token_cb, null_cb, cb_len) != 0); -+ cb_match = (k5_bcmp(token_cb, cb_cksum.contents, cb_len) == 0); -+ if (token_cb_present && !cb_match) { - status = GSS_S_BAD_BINDINGS; - goto fail; - } -@@ -525,6 +531,8 @@ process_checksum(OM_uint32 *minor_status, krb5_context context, - /* Read the token flags and accept some of them as context flags. */ - token_flags = k5_input_get_uint32_le(&in); - *flags_out = token_flags & INITIATOR_FLAGS; -+ if (cb_match) -+ *flags_out |= GSS_C_CHANNEL_BOUND_FLAG; - - /* Read the delegated credential if present. */ - if (in.len >= 4 && (token_flags & GSS_C_DELEG_FLAG)) { diff --git a/Implement-KERB_AP_OPTIONS_CBT-server-side.patch b/Implement-KERB_AP_OPTIONS_CBT-server-side.patch deleted file mode 100644 index 458901d..0000000 --- a/Implement-KERB_AP_OPTIONS_CBT-server-side.patch +++ /dev/null @@ -1,102 +0,0 @@ -From 323329d9033f32f49266921910124fe4f2a9124c Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Mon, 9 Mar 2020 16:04:21 +0100 -Subject: [PATCH] Implement KERB_AP_OPTIONS_CBT (server side) - -Add server support for Microsoft's KERB_AP_OPTIONS_CBT as described in -MS-KILE. If the client includes the AP option in the authenticator -authdata and the server passed channel bindings, require the bindings -to match. - -[ghudson@mit.edu: refactored to put more logic in the helper function; -added a comment; clarified commit message] - -ticket: 8900 (new) -(cherry picked from commit 4f7c77b64a048ca5e3199b26b31493698c777a9c) ---- - src/include/krb5/krb5.hin | 1 + - src/lib/gssapi/krb5/accept_sec_context.c | 45 +++++++++++++++++++++++- - 2 files changed, 45 insertions(+), 1 deletion(-) - -diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin -index f8269fb17..9264bede1 100644 ---- a/src/include/krb5/krb5.hin -+++ b/src/include/krb5/krb5.hin -@@ -1915,6 +1915,7 @@ krb5_verify_checksum(krb5_context context, krb5_cksumtype ctype, - #define KRB5_AUTHDATA_SIGNTICKET 512 /**< formerly 142 in krb5 1.8 */ - #define KRB5_AUTHDATA_FX_ARMOR 71 - #define KRB5_AUTHDATA_AUTH_INDICATOR 97 -+#define KRB5_AUTHDATA_AP_OPTIONS 143 - /** @} */ /* end of KRB5_AUTHDATA group */ - - /* password change constants */ -diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c -index 9d3e2f4fe..175a24c4e 100644 ---- a/src/lib/gssapi/krb5/accept_sec_context.c -+++ b/src/lib/gssapi/krb5/accept_sec_context.c -@@ -430,6 +430,32 @@ kg_process_extension(krb5_context context, - /* A zero-value channel binding, for comparison */ - static const uint8_t null_cb[CB_MD5_LEN]; - -+/* Look for AP_OPTIONS in authdata. If present and the options include -+ * KERB_AP_OPTIONS_CBT, set *cbt_out to true. */ -+static krb5_error_code -+check_cbt(krb5_context context, krb5_authdata **authdata, -+ krb5_boolean *cbt_out) -+{ -+ krb5_error_code code; -+ uint32_t ad_ap_options; -+ const uint32_t KERB_AP_OPTIONS_CBT = 0x4000; -+ -+ *cbt_out = FALSE; -+ -+ code = krb5_find_authdata(context, NULL, authdata, -+ KRB5_AUTHDATA_AP_OPTIONS, &authdata); -+ if (code || authdata == NULL) -+ return code; -+ if (authdata[1] != NULL || authdata[0]->length != 4) -+ return KRB5KRB_AP_ERR_MSG_TYPE; -+ -+ ad_ap_options = load_32_le(authdata[0]->contents); -+ if (ad_ap_options & KERB_AP_OPTIONS_CBT) -+ *cbt_out = TRUE; -+ -+ return 0; -+} -+ - /* - * The krb5 GSS mech appropriates the authenticator checksum field from RFC - * 4120 to store structured data instead of a checksum, indicated with checksum -@@ -454,7 +480,7 @@ process_checksum(OM_uint32 *minor_status, krb5_context context, - krb5_error_code code = 0; - OM_uint32 status, option_id, token_flags; - size_t cb_len, option_len; -- krb5_boolean valid, token_cb_present = FALSE, cb_match = FALSE; -+ krb5_boolean valid, client_cbt, token_cb_present = FALSE, cb_match = FALSE; - krb5_key subkey; - krb5_data option, empty = empty_data(); - krb5_checksum cb_cksum; -@@ -582,6 +608,23 @@ process_checksum(OM_uint32 *minor_status, krb5_context context, - } - } - -+ /* -+ * If the client asserts the KERB_AP_OPTIONS_CBT flag (from MS-KILE) in the -+ * authenticator authdata, and the acceptor passed channel bindings, -+ * require matching channel bindings from the client. The intent is to -+ * prevent an authenticator generated for use outside of a TLS channel from -+ * being used inside of one. -+ */ -+ code = check_cbt(context, authenticator->authorization_data, &client_cbt); -+ if (code) { -+ status = GSS_S_FAILURE; -+ goto fail; -+ } -+ if (client_cbt && acceptor_cb != GSS_C_NO_CHANNEL_BINDINGS && !cb_match) { -+ status = GSS_S_BAD_BINDINGS; -+ goto fail; -+ } -+ - status = GSS_S_COMPLETE; - - fail: diff --git a/Improve-KDC-alias-checking-for-S4U-requests.patch b/Improve-KDC-alias-checking-for-S4U-requests.patch deleted file mode 100644 index 69745de..0000000 --- a/Improve-KDC-alias-checking-for-S4U-requests.patch +++ /dev/null @@ -1,124 +0,0 @@ -From d80afa1396c3a6605338e4eaaf5bc44f8ad3eacc Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Fri, 4 Sep 2020 14:05:50 +0300 -Subject: [PATCH] Improve KDC alias checking for S4U requests - -When processing an S4U2Self request, check for DB aliases when -matching the TGT client against the request server. When processing -an S4U2Proxy request, check for DB aliases when matching the TGT -client against the evidence ticket server. - -[ghudson@mit.edu: minor edits; rewrote commit message] - -ticket: 8946 (new) -(cherry picked from commit 05deeebfc096970b5d9aa67a48b14106cf1b9b56) ---- - src/kdc/kdc_util.c | 74 ++++++++++++++++------------------------------ - 1 file changed, 25 insertions(+), 49 deletions(-) - -diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c -index e3352f9cc..dcb2df8dc 100644 ---- a/src/kdc/kdc_util.c -+++ b/src/kdc/kdc_util.c -@@ -1463,6 +1463,25 @@ cleanup: - return code; - } - -+/* Return true if princ canonicalizes to the same principal as canon. */ -+static krb5_boolean -+is_client_alias(krb5_context context, krb5_const_principal canon, -+ krb5_const_principal princ) -+{ -+ krb5_error_code ret; -+ krb5_db_entry *self; -+ krb5_boolean is_self = FALSE; -+ -+ ret = krb5_db_get_principal(context, princ, -+ KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY, &self); -+ if (!ret) { -+ is_self = krb5_principal_compare(context, canon, self->princ); -+ krb5_db_free_principal(context, self); -+ } -+ -+ return is_self; -+} -+ - /* - * Protocol transition (S4U2Self) - */ -@@ -1481,7 +1500,6 @@ kdc_process_s4u2self_req(kdc_realm_t *kdc_active_realm, - { - krb5_error_code code; - krb5_pa_data *pa_data; -- int flags; - krb5_db_entry *princ; - krb5_s4u_userid *id; - -@@ -1515,51 +1533,11 @@ kdc_process_s4u2self_req(kdc_realm_t *kdc_active_realm, - } - id = &(*s4u_x509_user)->user_id; - -- /* -- * We need to compare the client name in the TGT with the requested -- * server name. Supporting server name aliases without assuming a -- * global name service makes this difficult to do. -- * -- * The comparison below handles the following cases (note that the -- * term "principal name" below excludes the realm). -- * -- * (1) The requested service is a host-based service with two name -- * components, in which case we assume the principal name to -- * contain sufficient qualifying information. The realm is -- * ignored for the purpose of comparison. -- * -- * (2) The requested service name is an enterprise principal name: -- * the service principal name is compared with the unparsed -- * form of the client name (including its realm). -- * -- * (3) The requested service is some other name type: an exact -- * match is required. -- * -- * An alternative would be to look up the server once again with -- * FLAG_CANONICALIZE | FLAG_CLIENT_REFERRALS_ONLY set, do an exact -- * match between the returned name and client_princ. However, this -- * assumes that the client set FLAG_CANONICALIZE when requesting -- * the TGT and that we have a global name service. -- */ -- flags = 0; -- switch (krb5_princ_type(kdc_context, request->server)) { -- case KRB5_NT_SRV_HST: /* (1) */ -- if (krb5_princ_size(kdc_context, request->server) == 2) -- flags |= KRB5_PRINCIPAL_COMPARE_IGNORE_REALM; -- break; -- case KRB5_NT_ENTERPRISE_PRINCIPAL: /* (2) */ -- flags |= KRB5_PRINCIPAL_COMPARE_ENTERPRISE; -- break; -- default: /* (3) */ -- break; -- } -- -- if (!krb5_principal_compare_flags(kdc_context, -- request->server, -- client_princ, -- flags)) { -- *status = "INVALID_S4U2SELF_REQUEST"; -- return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN; /* match Windows error code */ -+ /* If the server is local, check that the request is for self. */ -+ if (!isflagset(c_flags, KRB5_KDB_FLAG_ISSUING_REFERRAL) && -+ !is_client_alias(kdc_context, server->princ, client_princ)) { -+ *status = "INVALID_S4U2SELF_REQUEST_SERVER_MISMATCH"; -+ return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN; /* match Windows error */ - } - - /* -@@ -1750,9 +1728,7 @@ kdc_process_s4u2proxy_req(kdc_realm_t *kdc_active_realm, unsigned int flags, - } - - client_princ = *stkt_authdata_client; -- } else if (!krb5_principal_compare(kdc_context, -- server->princ, /* after canon */ -- server_princ)) { -+ } else if (!is_client_alias(kdc_context, server->princ, server_princ)) { - *status = "EVIDENCE_TICKET_MISMATCH"; - return KRB5KDC_ERR_SERVER_NOMATCH; - } diff --git a/Improve-negoex_parse_token-code-hygiene.patch b/Improve-negoex_parse_token-code-hygiene.patch deleted file mode 100644 index d2b94aa..0000000 --- a/Improve-negoex_parse_token-code-hygiene.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 9596a341d99e3af1438ad215ed0fb5496cb59ff0 Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Tue, 9 Jun 2020 16:23:37 -0400 -Subject: [PATCH] Improve negoex_parse_token() code hygiene - -If the while loop in negoex_parse_token() runs for zero iterations, -major will be used initialized. Currently this cannot happen, but -only because both of the call sites check for zero-length tokens. -Initialize major for safety. - -[ghudson@mit.edu: rewrote commit message] - -(cherry picked from commit 4f91b6f8fa6fe1de662b3fdac0d59b7758ec642a) ---- - src/lib/gssapi/spnego/negoex_util.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/lib/gssapi/spnego/negoex_util.c b/src/lib/gssapi/spnego/negoex_util.c -index 700368456..99580fd79 100644 ---- a/src/lib/gssapi/spnego/negoex_util.c -+++ b/src/lib/gssapi/spnego/negoex_util.c -@@ -454,7 +454,7 @@ negoex_parse_token(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, - gss_const_buffer_t token, - struct negoex_message **messages_out, size_t *count_out) - { -- OM_uint32 major; -+ OM_uint32 major = GSS_S_COMPLETE; - size_t count = 0; - struct k5input in; - struct negoex_message *messages = NULL, *newptr; diff --git a/Install-shared-libraries-as-executable.patch b/Install-shared-libraries-as-executable.patch deleted file mode 100644 index b8adf3d..0000000 --- a/Install-shared-libraries-as-executable.patch +++ /dev/null @@ -1,42 +0,0 @@ -From b3c6667d7f98cf0347642c7927618fd40cd6f904 Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Tue, 23 Aug 2016 16:45:26 -0400 -Subject: [PATCH] Install shared libraries as executable - -RPM expects this behavior, and systems with contrary policies (like -Debian) address permissions at the packaging layer. Most other build -systems appear to install shared libraries as executable. - -[ghudson@mit.edu: edited commit message] - -ticket: 8965 (new) -(cherry picked from commit 1bc5f76d2e7013b8771e3bd9960c82642ba0b467) ---- - src/config/shlib.conf | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/src/config/shlib.conf b/src/config/shlib.conf -index 3e4af6c02..75b7cc3af 100644 ---- a/src/config/shlib.conf -+++ b/src/config/shlib.conf -@@ -22,8 +22,10 @@ SHLIBVEXT=.so.v-nobuild - SHLIBSEXT=.so.s-nobuild - # Most systems support profiled libraries. - PFLIBEXT=_p.a --# Most systems install shared libs as mode 644, etc. while hpux wants 755 --INSTALL_SHLIB='$(INSTALL_DATA)' -+# Install libraries executable. Some systems (e.g., RPM-based ones) require -+# this for package dependency generation, while others are ambivalent or will -+# strip it during packaging. -+INSTALL_SHLIB='$(INSTALL)' - # Most systems use the same objects for shared libraries and dynamically - # loadable objects. - DYNOBJEXT='$(SHLIBEXT)' -@@ -118,7 +120,6 @@ alpha*-dec-osf*) - # -O +dpv should display any routines eliminated as unused, but -b - # apparently turns that off - *-*-hpux*) -- INSTALL_SHLIB='$(INSTALL)' - case $host_cpu in - hppa*) - SHLIBEXT=.sl diff --git a/Minimize-usage-of-tgs_server-in-KDC.patch b/Minimize-usage-of-tgs_server-in-KDC.patch deleted file mode 100644 index 01608e8..0000000 --- a/Minimize-usage-of-tgs_server-in-KDC.patch +++ /dev/null @@ -1,316 +0,0 @@ -From 6e82fd67034eef7f99b901f417782a3786a02069 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Fri, 25 Sep 2020 11:12:34 -0400 -Subject: [PATCH] Minimize usage of tgs_server in KDC - -Where possible, use the realm of the request server principal -(canonicalized via KDB lookup, if available) in preference to -tgs_server. This change facilitates alias realm support and potential -future support for serving multiple realms from the same KDB. - -S4U2Self local user testing currently uses the uncanonicalized request -realm after this change, which will require attention for alias realm -support. - -FAST armor ticket checking is unaffected by this change (it still -compares against tgs_server). This check poses no issue for realm -aliases, as both tgs_server and the armor ticket server should have -canonical realms, but it will require attention for multi-realm KDB -support. - -Remove is_local_principal() as it is no longer used. Add an -is_local_tgs_principal() helper and shorten is_cross_tgs_principal(). - -Move the header ticket lineage check from kdc_process_tgs_req() to -process_tgs_req(), where we have the canonical request server name and -a more natural indication of whether the request was an S4U2Self -request. - -(cherry picked from commit 90fedf8188fc47aa5a476a969af34671555df389) ---- - src/kdc/do_as_req.c | 21 ++++++-------- - src/kdc/do_tgs_req.c | 16 ++++++++--- - src/kdc/kdc_util.c | 68 ++++++++++---------------------------------- - src/kdc/kdc_util.h | 3 +- - src/kdc/tgs_policy.c | 16 ++++++----- - 5 files changed, 46 insertions(+), 78 deletions(-) - -diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c -index c2dfea9b8..e0ac33649 100644 ---- a/src/kdc/do_as_req.c -+++ b/src/kdc/do_as_req.c -@@ -620,18 +620,6 @@ process_as_req(krb5_kdc_req *request, krb5_data *req_pkt, - } - state->rock.client = state->client; - -- /* -- * If the backend returned a principal that is not in the local -- * realm, then we need to refer the client to that realm. -- */ -- if (!is_local_principal(kdc_active_realm, state->client->princ)) { -- /* Entry is a referral to another realm */ -- state->status = "REFERRAL"; -- au_state->cl_realm = &state->client->princ->realm; -- errcode = KRB5KDC_ERR_WRONG_REALM; -- goto errout; -- } -- - au_state->stage = SRVC_PRINC; - - s_flags = 0; -@@ -651,6 +639,15 @@ process_as_req(krb5_kdc_req *request, krb5_data *req_pkt, - goto errout; - } - -+ /* If the KDB module returned a different realm for the client and server, -+ * we need to issue a client realm referral. */ -+ if (!data_eq(state->server->princ->realm, state->client->princ->realm)) { -+ state->status = "REFERRAL"; -+ au_state->cl_realm = &state->client->princ->realm; -+ errcode = KRB5KDC_ERR_WRONG_REALM; -+ goto errout; -+ } -+ - errcode = get_local_tgt(kdc_context, &state->request->server->realm, - state->server, &state->local_tgt, - &state->local_tgt_storage, &state->local_tgt_key); -diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c -index d345797c4..8ea418e43 100644 ---- a/src/kdc/do_tgs_req.c -+++ b/src/kdc/do_tgs_req.c -@@ -268,7 +268,7 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt, - goto cleanup; - } - -- if (!is_local_principal(kdc_active_realm, header_ticket->server)) -+ if (!data_eq(header_server->princ->realm, sprinc->realm)) - setflag(c_flags, KRB5_KDB_FLAG_CROSS_REALM); - if (is_referral) - setflag(c_flags, KRB5_KDB_FLAG_ISSUING_REFERRAL); -@@ -295,6 +295,15 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt, - au_state->s4u2self_user = NULL; - } - -+ /* Aside from cross-realm S4U2Self requests, do not accept header tickets -+ * for local users issued by foreign realms. */ -+ if (s4u_x509_user == NULL && data_eq(cprinc->realm, sprinc->realm) && -+ isflagset(c_flags, KRB5_KDB_FLAG_CROSS_REALM)) { -+ krb5_klog_syslog(LOG_INFO, _("PROCESS_TGS: failed lineage check")); -+ retval = KRB5KDC_ERR_POLICY; -+ goto cleanup; -+ } -+ - if (errcode) - goto cleanup; - -@@ -583,13 +592,12 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt, - - /* - * Only add the realm of the presented tgt to the transited list if -- * it is different than the local realm (cross-realm) and it is different -+ * it is different than the server realm (cross-realm) and it is different - * than the realm of the client (since the realm of the client is already - * implicitly part of the transited list and should not be explicitly - * listed). - */ -- /* realm compare is like strcmp, but knows how to deal with these args */ -- if (krb5_realm_compare(kdc_context, header_ticket->server, tgs_server) || -+ if (!isflagset(c_flags, KRB5_KDB_FLAG_CROSS_REALM) || - krb5_realm_compare(kdc_context, header_ticket->server, - enc_tkt_reply.client)) { - /* tgt issued by local realm or issued by realm of client */ -diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c -index b2042862a..e0b65a87c 100644 ---- a/src/kdc/kdc_util.c -+++ b/src/kdc/kdc_util.c -@@ -78,12 +78,6 @@ static krb5_error_code find_server_key(krb5_context, - krb5_kvno, krb5_keyblock **, - krb5_kvno *); - --krb5_boolean --is_local_principal(kdc_realm_t *kdc_active_realm, krb5_const_principal princ1) --{ -- return krb5_realm_compare(kdc_context, princ1, tgs_server); --} -- - /* - * Returns TRUE if the kerberos principal is the name of a Kerberos ticket - * service. -@@ -104,13 +98,16 @@ krb5_is_tgs_principal(krb5_const_principal principal) - krb5_boolean - is_cross_tgs_principal(krb5_const_principal principal) - { -- if (!krb5_is_tgs_principal(principal)) -- return FALSE; -- if (!data_eq(*krb5_princ_component(kdc_context, principal, 1), -- *krb5_princ_realm(kdc_context, principal))) -- return TRUE; -- else -- return FALSE; -+ return krb5_is_tgs_principal(principal) && -+ !data_eq(principal->data[1], principal->realm); -+} -+ -+/* Return true if princ is the name of a local TGS for any realm. */ -+krb5_boolean -+is_local_tgs_principal(krb5_const_principal principal) -+{ -+ return krb5_is_tgs_principal(principal) && -+ data_eq(principal->data[1], principal->realm); - } - - /* -@@ -143,17 +140,6 @@ comp_cksum(krb5_context kcontext, krb5_data *source, krb5_ticket *ticket, - return(0); - } - --/* Return true if padata contains an entry of either S4U2Self type. */ --static inline krb5_boolean --has_s4u2self_padata(krb5_pa_data **padata) --{ -- if (krb5int_find_pa_data(NULL, padata, KRB5_PADATA_FOR_USER) != NULL) -- return TRUE; -- if (krb5int_find_pa_data(NULL, padata, KRB5_PADATA_S4U_X509_USER) != NULL) -- return TRUE; -- return FALSE; --} -- - /* If a header ticket is decrypted, *ticket_out is filled in even on error. */ - krb5_error_code - kdc_process_tgs_req(kdc_realm_t *kdc_active_realm, -@@ -170,7 +156,6 @@ kdc_process_tgs_req(kdc_realm_t *kdc_active_realm, - krb5_authdata **authdata = NULL; - krb5_data scratch1; - krb5_data * scratch = NULL; -- krb5_boolean foreign_server = FALSE; - krb5_auth_context auth_context = NULL; - krb5_authenticator * authenticator = NULL; - krb5_checksum * his_cksum = NULL; -@@ -199,19 +184,6 @@ kdc_process_tgs_req(kdc_realm_t *kdc_active_realm, - goto cleanup; - } - -- /* If the "server" principal in the ticket is not something -- in the local realm, then we must refuse to service the request -- if the client claims to be from the local realm. -- -- If we don't do this, then some other realm's nasty KDC can -- claim to be authenticating a client from our realm, and we'll -- give out tickets concurring with it! -- -- we set a flag here for checking below. -- */ -- foreign_server = !is_local_principal(kdc_active_realm, -- apreq->ticket->server); -- - if ((retval = krb5_auth_con_init(kdc_context, &auth_context))) - goto cleanup; - -@@ -265,15 +237,6 @@ kdc_process_tgs_req(kdc_realm_t *kdc_active_realm, - goto cleanup_authenticator; - } - -- /* make sure the client is of proper lineage (see above) */ -- if (foreign_server && !has_s4u2self_padata(request->padata) && -- is_local_principal(kdc_active_realm, ticket->enc_part2->client)) { -- /* someone in a foreign realm claiming to be local */ -- krb5_klog_syslog(LOG_INFO, _("PROCESS_TGS: failed lineage check")); -- retval = KRB5KDC_ERR_POLICY; -- goto cleanup_authenticator; -- } -- - /* - * Check application checksum vs. tgs request - * -@@ -591,12 +554,12 @@ int - check_anon(kdc_realm_t *kdc_active_realm, - krb5_principal client, krb5_principal server) - { -- /* If restrict_anon is set, reject requests from anonymous to principals -- * other than the local TGT. */ -+ /* If restrict_anon is set, reject requests from anonymous clients to -+ * server principals other than local TGTs. */ - if (kdc_active_realm->realm_restrict_anon && - krb5_principal_compare_any_realm(kdc_context, client, - krb5_anonymous_principal()) && -- !krb5_principal_compare(kdc_context, server, tgs_server)) -+ !is_local_tgs_principal(server)) - return -1; - return 0; - } -@@ -1527,7 +1490,7 @@ kdc_process_s4u2self_req(kdc_realm_t *kdc_active_realm, - /* - * Do not attempt to lookup principals in foreign realms. - */ -- if (is_local_principal(kdc_active_realm, id->user)) { -+ if (data_eq(server->princ->realm, id->user->realm)) { - krb5_db_entry no_server; - krb5_pa_data **e_data = NULL; - -@@ -1663,8 +1626,7 @@ kdc_process_s4u2proxy_req(kdc_realm_t *kdc_active_realm, unsigned int flags, - */ - if (isflagset(flags, KRB5_KDB_FLAG_ISSUING_REFERRAL) || - !is_cross_tgs_principal(server->princ) || -- !krb5_principal_compare_any_realm(kdc_context, server->princ, -- tgs_server) || -+ !data_eq(server->princ->data[1], proxy->princ->realm) || - !krb5_principal_compare(kdc_context, client_princ, server_princ)) { - *status = "XREALM_EVIDENCE_TICKET_MISMATCH"; - return KRB5KDC_ERR_BADOPTION; -diff --git a/src/kdc/kdc_util.h b/src/kdc/kdc_util.h -index 04007a8f5..a6bac4388 100644 ---- a/src/kdc/kdc_util.h -+++ b/src/kdc/kdc_util.h -@@ -37,10 +37,9 @@ - #include "reqstate.h" - - krb5_error_code check_hot_list (krb5_ticket *); --krb5_boolean is_local_principal(kdc_realm_t *kdc_active_realm, -- krb5_const_principal princ1); - krb5_boolean krb5_is_tgs_principal (krb5_const_principal); - krb5_boolean is_cross_tgs_principal(krb5_const_principal); -+krb5_boolean is_local_tgs_principal(krb5_const_principal); - krb5_error_code - add_to_transited (krb5_data *, - krb5_data *, -diff --git a/src/kdc/tgs_policy.c b/src/kdc/tgs_policy.c -index 3f4fa8499..a5a00f0cc 100644 ---- a/src/kdc/tgs_policy.c -+++ b/src/kdc/tgs_policy.c -@@ -252,19 +252,21 @@ check_tgs_s4u2proxy(kdc_realm_t *kdc_active_realm, - } - - static int --check_tgs_u2u(kdc_realm_t *kdc_active_realm, -- krb5_kdc_req *req, const char **status) -+check_tgs_u2u(kdc_realm_t *kdc_active_realm, krb5_kdc_req *req, -+ krb5_const_principal server_princ, const char **status) - { -+ krb5_const_principal second_server_princ; -+ - if (req->kdc_options & KDC_OPT_ENC_TKT_IN_SKEY) { - /* Check that second ticket is in request. */ - if (!req->second_ticket || !req->second_ticket[0]) { - *status = "NO_2ND_TKT"; - return KDC_ERR_BADOPTION; - } -- /* Check that second ticket is a TGT. */ -- if (!krb5_principal_compare(kdc_context, -- req->second_ticket[0]->server, -- tgs_server)) { -+ /* Check that second ticket is a TGT to the server realm. */ -+ second_server_princ = req->second_ticket[0]->server; -+ if (!is_local_tgs_principal(second_server_princ) || -+ !data_eq(second_server_princ->data[1], server_princ->realm)) { - *status = "2ND_TKT_NOT_TGS"; - return KDC_ERR_POLICY; - } -@@ -353,7 +355,7 @@ validate_tgs_request(kdc_realm_t *kdc_active_realm, - return(KRB_AP_ERR_REPEAT); - } - -- errcode = check_tgs_u2u(kdc_active_realm, request, status); -+ errcode = check_tgs_u2u(kdc_active_realm, request, server->princ, status); - if (errcode != 0) - return errcode; - diff --git a/Omit-KDC-indicator-check-for-S4U2Self-requests.patch b/Omit-KDC-indicator-check-for-S4U2Self-requests.patch deleted file mode 100644 index 9e25d54..0000000 --- a/Omit-KDC-indicator-check-for-S4U2Self-requests.patch +++ /dev/null @@ -1,48 +0,0 @@ -From cd99c7829a43074cec8afe5c7021778a5a2ebd31 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Wed, 6 May 2020 16:03:13 -0400 -Subject: [PATCH] Omit KDC indicator check for S4U2Self requests - -As there was no initial ticket exchange from the client for an -S4U2Self request, the auth indicator check is inapplicable (and would -always fail if any auth indicators are required). - -ticket: 8902 (new) -(cherry picked from commit 183631fbf72351c2d5fc7d60b2d9fc4d09fe7465) ---- - src/kdc/do_tgs_req.c | 14 +++++++------- - 1 file changed, 7 insertions(+), 7 deletions(-) - -diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c -index 241f34e2a..463a9c0dd 100644 ---- a/src/kdc/do_tgs_req.c -+++ b/src/kdc/do_tgs_req.c -@@ -392,8 +392,8 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt, - } - authtime = subject_tkt->times.authtime; - -- /* Extract auth indicators from the subject ticket, except for S4U2Self -- * requests (where the client didn't authenticate). */ -+ /* Extract and check auth indicators from the subject ticket, except for -+ * S4U2Self requests (where the client didn't authenticate). */ - if (s4u_x509_user == NULL) { - errcode = get_auth_indicators(kdc_context, subject_tkt, local_tgt, - &local_tgt_key, &auth_indicators); -@@ -401,12 +401,12 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt, - status = "GET_AUTH_INDICATORS"; - goto cleanup; - } -- } - -- errcode = check_indicators(kdc_context, server, auth_indicators); -- if (errcode) { -- status = "HIGHER_AUTHENTICATION_REQUIRED"; -- goto cleanup; -+ errcode = check_indicators(kdc_context, server, auth_indicators); -+ if (errcode) { -+ status = "HIGHER_AUTHENTICATION_REQUIRED"; -+ goto cleanup; -+ } - } - - if (is_referral) diff --git a/Omit-PA_FOR_USER-if-we-can-t-compute-its-checksum.patch b/Omit-PA_FOR_USER-if-we-can-t-compute-its-checksum.patch deleted file mode 100644 index 5fd221e..0000000 --- a/Omit-PA_FOR_USER-if-we-can-t-compute-its-checksum.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 6b81d2d9913d91a4cc48d04f123fc71cc1022432 Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Sat, 6 Jun 2020 11:03:37 +0200 -Subject: [PATCH] Omit PA_FOR_USER if we can't compute its checksum - -OpenSSL in FIPS mode will refuse to perform hmac-md5. Omit the legacy -PA_FOR_USER element in this case rather than failing out. - -[ghudson@mit.edu: minor code and comment edits; wrote commit message] - -ticket: 8912 (new) -(cherry picked from commit 03f122bdb22cfa53c7d855ed929c9541e56365e0) ---- - src/lib/krb5/krb/s4u_creds.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/src/lib/krb5/krb/s4u_creds.c b/src/lib/krb5/krb/s4u_creds.c -index fc5c886d6..d8f486dc6 100644 ---- a/src/lib/krb5/krb/s4u_creds.c -+++ b/src/lib/krb5/krb/s4u_creds.c -@@ -534,6 +534,13 @@ krb5_get_self_cred_from_kdc(krb5_context context, - if (s4u_user.user_id.user != NULL && s4u_user.user_id.user->length) { - code = build_pa_for_user(context, tgtptr, &s4u_user.user_id, - &in_padata[1]); -+ /* -+ * If we couldn't compute the hmac-md5 checksum, send only the -+ * KRB5_PADATA_S4U_X509_USER; this will still work against modern -+ * Windows and MIT KDCs. -+ */ -+ if (code == KRB5_CRYPTO_INTERNAL) -+ code = 0; - if (code != 0) { - krb5_free_pa_data(context, in_padata); - goto cleanup; diff --git a/Pass-channel-bindings-through-SPNEGO.patch b/Pass-channel-bindings-through-SPNEGO.patch deleted file mode 100644 index 1b3c130..0000000 --- a/Pass-channel-bindings-through-SPNEGO.patch +++ /dev/null @@ -1,256 +0,0 @@ -From a5588aae21d44f5a6eed4bdfeae992a709b92959 Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Tue, 28 Apr 2020 18:15:55 +0200 -Subject: [PATCH] Pass channel bindings through SPNEGO - -ticket: 8907 (new) -(cherry picked from commit d16325a24c34ec9a5f6fb4910987f162e0d4d9cd) ---- - src/lib/gssapi/spnego/gssapiP_negoex.h | 8 ++--- - src/lib/gssapi/spnego/negoex_ctx.c | 34 +++++++++++---------- - src/lib/gssapi/spnego/spnego_mech.c | 41 +++++++++++++------------- - 3 files changed, 43 insertions(+), 40 deletions(-) - -diff --git a/src/lib/gssapi/spnego/gssapiP_negoex.h b/src/lib/gssapi/spnego/gssapiP_negoex.h -index 44b08f523..489ab7c42 100644 ---- a/src/lib/gssapi/spnego/gssapiP_negoex.h -+++ b/src/lib/gssapi/spnego/gssapiP_negoex.h -@@ -201,10 +201,10 @@ negoex_restrict_auth_schemes(spnego_gss_ctx_id_t ctx, - OM_uint32 - negoex_init(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, gss_cred_id_t cred, - gss_name_t target_name, OM_uint32 req_flags, OM_uint32 time_req, -- gss_buffer_t input_token, gss_buffer_t output_token, -- OM_uint32 *time_rec); -+ gss_buffer_t input_token, gss_channel_bindings_t bindings, -+ gss_buffer_t output_token, OM_uint32 *time_rec); - - OM_uint32 - negoex_accept(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, gss_cred_id_t cred, -- gss_buffer_t input_token, gss_buffer_t output_token, -- OM_uint32 *time_rec); -+ gss_buffer_t input_token, gss_channel_bindings_t bindings, -+ gss_buffer_t output_token, OM_uint32 *time_rec); -diff --git a/src/lib/gssapi/spnego/negoex_ctx.c b/src/lib/gssapi/spnego/negoex_ctx.c -index 18d9d4147..8848ee4db 100644 ---- a/src/lib/gssapi/spnego/negoex_ctx.c -+++ b/src/lib/gssapi/spnego/negoex_ctx.c -@@ -276,7 +276,8 @@ static OM_uint32 - mech_init(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, gss_cred_id_t cred, - gss_name_t target, OM_uint32 req_flags, OM_uint32 time_req, - struct negoex_message *messages, size_t nmessages, -- gss_buffer_t output_token, OM_uint32 *time_rec) -+ gss_channel_bindings_t bindings, gss_buffer_t output_token, -+ OM_uint32 *time_rec) - { - OM_uint32 major, first_major = 0, first_minor = 0; - struct negoex_auth_mech *mech = NULL; -@@ -316,10 +317,9 @@ mech_init(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, gss_cred_id_t cred, - mech = K5_TAILQ_FIRST(&ctx->negoex_mechs); - - major = gss_init_sec_context(minor, cred, &mech->mech_context, target, -- mech->oid, req_flags, time_req, -- GSS_C_NO_CHANNEL_BINDINGS, input_token, -- &ctx->actual_mech, output_token, -- &ctx->ctx_flags, time_rec); -+ mech->oid, req_flags, time_req, bindings, -+ input_token, &ctx->actual_mech, -+ output_token, &ctx->ctx_flags, time_rec); - - if (major == GSS_S_COMPLETE) - mech->complete = 1; -@@ -351,7 +351,8 @@ mech_init(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, gss_cred_id_t cred, - static OM_uint32 - mech_accept(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, - gss_cred_id_t cred, struct negoex_message *messages, -- size_t nmessages, gss_buffer_t output_token, OM_uint32 *time_rec) -+ size_t nmessages, gss_channel_bindings_t bindings, -+ gss_buffer_t output_token, OM_uint32 *time_rec) - { - OM_uint32 major, tmpmin; - struct negoex_auth_mech *mech; -@@ -395,10 +396,10 @@ mech_accept(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, - gss_release_cred(&tmpmin, &ctx->deleg_cred); - - major = gss_accept_sec_context(minor, &mech->mech_context, cred, -- &msg->token, GSS_C_NO_CHANNEL_BINDINGS, -- &ctx->internal_name, &ctx->actual_mech, -- output_token, &ctx->ctx_flags, -- time_rec, &ctx->deleg_cred); -+ &msg->token, bindings, &ctx->internal_name, -+ &ctx->actual_mech, output_token, -+ &ctx->ctx_flags, time_rec, -+ &ctx->deleg_cred); - - if (major == GSS_S_COMPLETE) - mech->complete = 1; -@@ -609,8 +610,8 @@ make_output_token(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, - OM_uint32 - negoex_init(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, gss_cred_id_t cred, - gss_name_t target_name, OM_uint32 req_flags, OM_uint32 time_req, -- gss_buffer_t input_token, gss_buffer_t output_token, -- OM_uint32 *time_rec) -+ gss_buffer_t input_token, gss_channel_bindings_t bindings, -+ gss_buffer_t output_token, OM_uint32 *time_rec) - { - OM_uint32 major, tmpmin; - gss_buffer_desc mech_output_token = GSS_C_EMPTY_BUFFER; -@@ -663,7 +664,8 @@ negoex_init(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, gss_cred_id_t cred, - /* Process the input token and/or produce an output token. This may prune - * the mech list, but on success there will be at least one mech entry. */ - major = mech_init(minor, ctx, cred, target_name, req_flags, time_req, -- messages, nmessages, &mech_output_token, time_rec); -+ messages, nmessages, bindings, &mech_output_token, -+ time_rec); - if (major != GSS_S_COMPLETE) - goto cleanup; - assert(!K5_TAILQ_EMPTY(&ctx->negoex_mechs)); -@@ -701,8 +703,8 @@ cleanup: - - OM_uint32 - negoex_accept(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, gss_cred_id_t cred, -- gss_buffer_t input_token, gss_buffer_t output_token, -- OM_uint32 *time_rec) -+ gss_buffer_t input_token, gss_channel_bindings_t bindings, -+ gss_buffer_t output_token, OM_uint32 *time_rec) - { - OM_uint32 major, tmpmin; - gss_buffer_desc mech_output_token = GSS_C_EMPTY_BUFFER; -@@ -754,7 +756,7 @@ negoex_accept(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, gss_cred_id_t cred, - * prune the list to a single mech. Continue on error if an output token - * is generated, so that we send the token to the initiator. - */ -- major = mech_accept(minor, ctx, cred, messages, nmessages, -+ major = mech_accept(minor, ctx, cred, messages, nmessages, bindings, - &mech_output_token, time_rec); - if (major != GSS_S_COMPLETE && mech_output_token.length == 0) - goto cleanup; -diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c -index f4a042478..2327cd927 100644 ---- a/src/lib/gssapi/spnego/spnego_mech.c -+++ b/src/lib/gssapi/spnego/spnego_mech.c -@@ -130,6 +130,7 @@ init_ctx_reselect(OM_uint32 *, spnego_gss_ctx_id_t, OM_uint32, - static OM_uint32 - init_ctx_call_init(OM_uint32 *, spnego_gss_ctx_id_t, spnego_gss_cred_id_t, - OM_uint32, gss_name_t, OM_uint32, OM_uint32, gss_buffer_t, -+ gss_channel_bindings_t, - gss_buffer_t, OM_uint32 *, send_token_flag *); - - static OM_uint32 -@@ -144,8 +145,8 @@ acc_ctx_vfy_oid(OM_uint32 *, spnego_gss_ctx_id_t, gss_OID, - OM_uint32 *, send_token_flag *); - static OM_uint32 - acc_ctx_call_acc(OM_uint32 *, spnego_gss_ctx_id_t, spnego_gss_cred_id_t, -- gss_buffer_t, gss_buffer_t, OM_uint32 *, OM_uint32 *, -- send_token_flag *); -+ gss_buffer_t, gss_channel_bindings_t, gss_buffer_t, -+ OM_uint32 *, OM_uint32 *, send_token_flag *); - - static gss_OID - negotiate_mech(spnego_gss_ctx_id_t, gss_OID_set, OM_uint32 *); -@@ -906,6 +907,7 @@ init_ctx_call_init(OM_uint32 *minor_status, - OM_uint32 req_flags, - OM_uint32 time_req, - gss_buffer_t mechtok_in, -+ gss_channel_bindings_t bindings, - gss_buffer_t mechtok_out, - OM_uint32 *time_rec, - send_token_flag *send_token) -@@ -922,15 +924,14 @@ init_ctx_call_init(OM_uint32 *minor_status, - if (gss_oid_equal(sc->internal_mech, &negoex_mech)) { - ret = negoex_init(minor_status, sc, mcred, target_name, - mech_req_flags, time_req, mechtok_in, -- mechtok_out, time_rec); -+ bindings, mechtok_out, time_rec); - } else { - ret = gss_init_sec_context(minor_status, mcred, - &sc->ctx_handle, target_name, - sc->internal_mech, mech_req_flags, -- time_req, GSS_C_NO_CHANNEL_BINDINGS, -- mechtok_in, &sc->actual_mech, -- mechtok_out, &sc->ctx_flags, -- time_rec); -+ time_req, bindings, mechtok_in, -+ &sc->actual_mech, mechtok_out, -+ &sc->ctx_flags, time_rec); - } - - /* Bail out if the acceptor gave us an error token but the mech didn't -@@ -982,8 +983,8 @@ init_ctx_call_init(OM_uint32 *minor_status, - gss_delete_sec_context(&tmpmin, &sc->ctx_handle, GSS_C_NO_BUFFER); - tmpret = init_ctx_call_init(&tmpmin, sc, spcred, acc_negState, - target_name, req_flags, time_req, -- mechtok_in, mechtok_out, time_rec, -- send_token); -+ mechtok_in, bindings, mechtok_out, -+ time_rec, send_token); - if (HARD_ERROR(tmpret)) - goto fail; - *minor_status = tmpmin; -@@ -1005,7 +1006,7 @@ spnego_gss_init_sec_context( - gss_OID mech_type, - OM_uint32 req_flags, - OM_uint32 time_req, -- gss_channel_bindings_t input_chan_bindings, -+ gss_channel_bindings_t bindings, - gss_buffer_t input_token, - gss_OID *actual_mech, - gss_buffer_t output_token, -@@ -1085,8 +1086,8 @@ spnego_gss_init_sec_context( - if (!spnego_ctx->mech_complete) { - ret = init_ctx_call_init(minor_status, spnego_ctx, spcred, - acc_negState, target_name, req_flags, -- time_req, mechtok_in, &mechtok_out, -- time_rec, &send_token); -+ time_req, mechtok_in, bindings, -+ &mechtok_out, time_rec, &send_token); - if (ret != GSS_S_COMPLETE) - goto cleanup; - -@@ -1543,8 +1544,9 @@ cleanup: - static OM_uint32 - acc_ctx_call_acc(OM_uint32 *minor_status, spnego_gss_ctx_id_t sc, - spnego_gss_cred_id_t spcred, gss_buffer_t mechtok_in, -- gss_buffer_t mechtok_out, OM_uint32 *time_rec, -- OM_uint32 *negState, send_token_flag *tokflag) -+ gss_channel_bindings_t bindings, gss_buffer_t mechtok_out, -+ OM_uint32 *time_rec, OM_uint32 *negState, -+ send_token_flag *tokflag) - { - OM_uint32 ret, tmpmin; - gss_OID_desc mechoid; -@@ -1569,13 +1571,12 @@ acc_ctx_call_acc(OM_uint32 *minor_status, spnego_gss_ctx_id_t sc, - mcred = (spcred == NULL) ? GSS_C_NO_CREDENTIAL : spcred->mcred; - if (negoex) { - ret = negoex_accept(minor_status, sc, mcred, mechtok_in, -- mechtok_out, time_rec); -+ bindings, mechtok_out, time_rec); - } else { - (void) gss_release_name(&tmpmin, &sc->internal_name); - (void) gss_release_cred(&tmpmin, &sc->deleg_cred); - ret = gss_accept_sec_context(minor_status, &sc->ctx_handle, -- mcred, mechtok_in, -- GSS_C_NO_CHANNEL_BINDINGS, -+ mcred, mechtok_in, bindings, - &sc->internal_name, - &sc->actual_mech, mechtok_out, - &sc->ctx_flags, time_rec, -@@ -1621,7 +1622,7 @@ spnego_gss_accept_sec_context( - gss_ctx_id_t *context_handle, - gss_cred_id_t verifier_cred_handle, - gss_buffer_t input_token, -- gss_channel_bindings_t input_chan_bindings, -+ gss_channel_bindings_t bindings, - gss_name_t *src_name, - gss_OID *mech_type, - gss_buffer_t output_token, -@@ -1735,8 +1736,8 @@ spnego_gss_accept_sec_context( - */ - if (negState != REQUEST_MIC && mechtok_in != GSS_C_NO_BUFFER) { - ret = acc_ctx_call_acc(minor_status, sc, spcred, mechtok_in, -- &mechtok_out, time_rec, &negState, -- &return_token); -+ bindings, &mechtok_out, time_rec, -+ &negState, &return_token); - } - - /* Step 3: process or generate the MIC, if the negotiated mech is diff --git a/Pass-gss_localname-through-SPNEGO.patch b/Pass-gss_localname-through-SPNEGO.patch deleted file mode 100644 index 1aad597..0000000 --- a/Pass-gss_localname-through-SPNEGO.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 723f4c746293f064a32961ad77b57f901dd54a67 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Sun, 26 Apr 2020 19:55:54 -0400 -Subject: [PATCH] Pass gss_localname() through SPNEGO - -ticket: 8897 (new) -(cherry picked from commit f7b8a6432bd289bdc528017be122305f95b8e285) ---- - src/lib/gssapi/spnego/gssapiP_spnego.h | 8 ++++++++ - src/lib/gssapi/spnego/spnego_mech.c | 9 ++++++++- - 2 files changed, 16 insertions(+), 1 deletion(-) - -diff --git a/src/lib/gssapi/spnego/gssapiP_spnego.h b/src/lib/gssapi/spnego/gssapiP_spnego.h -index a93763314..066ec736f 100644 ---- a/src/lib/gssapi/spnego/gssapiP_spnego.h -+++ b/src/lib/gssapi/spnego/gssapiP_spnego.h -@@ -357,6 +357,14 @@ OM_uint32 KRB5_CALLCONV spnego_gss_wrap_size_limit - OM_uint32 *max_input_size - ); - -+OM_uint32 KRB5_CALLCONV spnego_gss_localname -+( -+ OM_uint32 *minor_status, -+ const gss_name_t pname, -+ const gss_const_OID mech_type, -+ gss_buffer_t localname -+); -+ - OM_uint32 KRB5_CALLCONV spnego_gss_get_mic - ( - OM_uint32 *minor_status, -diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c -index b3010c201..f4a042478 100644 ---- a/src/lib/gssapi/spnego/spnego_mech.c -+++ b/src/lib/gssapi/spnego/spnego_mech.c -@@ -237,7 +237,7 @@ static struct gss_config spnego_mechanism = - spnego_gss_inquire_context, /* gss_inquire_context */ - NULL, /* gss_internal_release_oid */ - spnego_gss_wrap_size_limit, /* gss_wrap_size_limit */ -- NULL, /* gssd_pname_to_uid */ -+ spnego_gss_localname, - NULL, /* gss_userok */ - NULL, /* gss_export_name */ - spnego_gss_duplicate_name, /* gss_duplicate_name */ -@@ -2372,6 +2372,13 @@ spnego_gss_wrap_size_limit( - return (ret); - } - -+OM_uint32 KRB5_CALLCONV -+spnego_gss_localname(OM_uint32 *minor_status, const gss_name_t pname, -+ const gss_const_OID mech_type, gss_buffer_t localname) -+{ -+ return gss_localname(minor_status, pname, GSS_C_NO_OID, localname); -+} -+ - OM_uint32 KRB5_CALLCONV - spnego_gss_get_mic( - OM_uint32 *minor_status, diff --git a/Refactor-KDC-authdata-list-management-helpers.patch b/Refactor-KDC-authdata-list-management-helpers.patch deleted file mode 100644 index 69ef109..0000000 --- a/Refactor-KDC-authdata-list-management-helpers.patch +++ /dev/null @@ -1,335 +0,0 @@ -From 17093468190706e241d2a6ef2bb5607be7021640 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Wed, 5 Feb 2020 18:46:11 -0500 -Subject: [PATCH] Refactor KDC authdata list management helpers - -Remove the unused concat_authorization_data(). Split merge_authdata() -into two helpers, one to destructively merge without filtering and one -to add copied elements while filtering out KDC-only authdata types. -Remove context parameters where they aren't needed (taking advantage -of knowledge that some libkrb5 functions don't use their context -parameters). - -(cherry picked from commit b2190fdc253de6024001e0f1ff9fe56c31042bb7) ---- - src/kdc/kdc_authdata.c | 138 +++++++++++++++++++---------------------- - src/kdc/kdc_util.c | 50 --------------- - src/kdc/kdc_util.h | 5 -- - 3 files changed, 64 insertions(+), 129 deletions(-) - -diff --git a/src/kdc/kdc_authdata.c b/src/kdc/kdc_authdata.c -index 1ebe87246..010922c27 100644 ---- a/src/kdc/kdc_authdata.c -+++ b/src/kdc/kdc_authdata.c -@@ -108,7 +108,7 @@ unload_authdata_plugins(krb5_context context) - /* Return true if authdata should be filtered when copying from untrusted - * authdata. If desired_type is non-zero, look only for that type. */ - static krb5_boolean --is_kdc_issued_authdatum(krb5_context context, krb5_authdata *authdata, -+is_kdc_issued_authdatum(krb5_authdata *authdata, - krb5_authdatatype desired_type) - { - krb5_boolean result = FALSE; -@@ -117,7 +117,7 @@ is_kdc_issued_authdatum(krb5_context context, krb5_authdata *authdata, - krb5_authdatatype *ad_types, *containee_types = NULL; - - if (authdata->ad_type == KRB5_AUTHDATA_IF_RELEVANT) { -- if (krb5int_get_authdata_containee_types(context, authdata, &count, -+ if (krb5int_get_authdata_containee_types(NULL, authdata, &count, - &containee_types) != 0) - goto cleanup; - ad_types = containee_types; -@@ -152,7 +152,7 @@ cleanup: - /* Return true if authdata contains any elements which should only come from - * the KDC. If desired_type is non-zero, look only for that type. */ - static krb5_boolean --has_kdc_issued_authdata(krb5_context context, krb5_authdata **authdata, -+has_kdc_issued_authdata(krb5_authdata **authdata, - krb5_authdatatype desired_type) - { - int i; -@@ -160,7 +160,7 @@ has_kdc_issued_authdata(krb5_context context, krb5_authdata **authdata, - if (authdata == NULL) - return FALSE; - for (i = 0; authdata[i] != NULL; i++) { -- if (is_kdc_issued_authdatum(context, authdata[i], desired_type)) -+ if (is_kdc_issued_authdatum(authdata[i], desired_type)) - return TRUE; - } - return FALSE; -@@ -181,66 +181,71 @@ has_mandatory_for_kdc_authdata(krb5_context context, krb5_authdata **authdata) - return FALSE; - } - --/* -- * Add the elements of in_authdata to out_authdata. If copy is false, -- * in_authdata is invalid on successful return. If ignore_kdc_issued is true, -- * KDC-issued authdata is not copied. -- */ -+/* Add elements from *new_elements to *existing_list, reallocating as -+ * necessary. On success, release *new_elements and set it to NULL. */ - static krb5_error_code --merge_authdata(krb5_context context, krb5_authdata **in_authdata, -- krb5_authdata ***out_authdata, krb5_boolean copy, -- krb5_boolean ignore_kdc_issued) -+merge_authdata(krb5_authdata ***existing_list, krb5_authdata ***new_elements) - { -- krb5_error_code ret; -- size_t i, j, nadata = 0; -- krb5_authdata **in_copy = NULL, **authdata = *out_authdata; -+ size_t count = 0, ncount = 0; -+ krb5_authdata **list = *existing_list, **nlist = *new_elements; - -- if (in_authdata == NULL || in_authdata[0] == NULL) -+ if (nlist == NULL) - return 0; - -- if (authdata != NULL) { -- for (nadata = 0; authdata[nadata] != NULL; nadata++) -- ; -- } -+ for (count = 0; list != NULL && list[count] != NULL; count++); -+ for (ncount = 0; nlist[ncount] != NULL; ncount++); - -- for (i = 0; in_authdata[i] != NULL; i++) -- ; -- -- if (copy) { -- ret = krb5_copy_authdata(context, in_authdata, &in_copy); -- if (ret) -- return ret; -- in_authdata = in_copy; -- } -- -- authdata = realloc(authdata, (nadata + i + 1) * sizeof(krb5_authdata *)); -- if (authdata == NULL) { -- krb5_free_authdata(context, in_copy); -+ list = realloc(list, (count + ncount + 1) * sizeof(*list)); -+ if (list == NULL) - return ENOMEM; -+ -+ memcpy(list + count, nlist, ncount * sizeof(*nlist)); -+ list[count + ncount] = NULL; -+ free(nlist); -+ -+ if (list[0] == NULL) { -+ free(list); -+ list = NULL; - } - -- for (i = 0, j = 0; in_authdata[i] != NULL; i++) { -- if (ignore_kdc_issued && -- is_kdc_issued_authdatum(context, in_authdata[i], 0)) { -- free(in_authdata[i]->contents); -- free(in_authdata[i]); -+ *new_elements = NULL; -+ *existing_list = list; -+ return 0; -+} -+ -+/* Add a copy of new_elements to *existing_list, omitting KDC-issued -+ * authdata. */ -+static krb5_error_code -+add_filtered_authdata(krb5_authdata ***existing_list, -+ krb5_authdata **new_elements) -+{ -+ krb5_error_code ret; -+ krb5_authdata **copy; -+ size_t i, j; -+ -+ if (new_elements == NULL) -+ return 0; -+ -+ ret = krb5_copy_authdata(NULL, new_elements, ©); -+ if (ret) -+ return ret; -+ -+ /* Remove KDC-issued elements from copy. */ -+ j = 0; -+ for (i = 0; copy[i] != NULL; i++) { -+ if (is_kdc_issued_authdatum(copy[i], 0)) { -+ free(copy[i]->contents); -+ free(copy[i]); - } else { -- authdata[nadata + j++] = in_authdata[i]; -+ copy[j++] = copy[i]; - } - } -+ copy[j] = NULL; - -- authdata[nadata + j] = NULL; -- -- free(in_authdata); -- -- if (authdata[0] == NULL) { -- free(authdata); -- authdata = NULL; -- } -- -- *out_authdata = authdata; -- -- return 0; -+ /* Destructively merge the filtered copy into existing_list. */ -+ ret = merge_authdata(existing_list, ©); -+ krb5_free_authdata(NULL, copy); -+ return ret; - } - - /* Copy TGS-REQ authorization data into the ticket authdata. */ -@@ -289,10 +294,7 @@ copy_request_authdata(krb5_context context, krb5_keyblock *client_key, - goto cleanup; - } - -- /* Add a copy of the requested authdata to the ticket, ignoring KDC-issued -- * types. */ -- ret = merge_authdata(context, req->unenc_authdata, tkt_authdata, TRUE, -- TRUE); -+ ret = add_filtered_authdata(tkt_authdata, req->unenc_authdata); - - cleanup: - free(plaintext.data); -@@ -307,9 +309,7 @@ copy_tgt_authdata(krb5_context context, krb5_kdc_req *request, - if (has_mandatory_for_kdc_authdata(context, tgt_authdata)) - return KRB5KDC_ERR_POLICY; - -- /* Add a copy of the TGT authdata to the ticket, ignoring KDC-issued -- * types. */ -- return merge_authdata(context, tgt_authdata, tkt_authdata, TRUE, TRUE); -+ return add_filtered_authdata(tkt_authdata, tgt_authdata); - } - - /* Fetch authorization data from KDB module. */ -@@ -374,8 +374,7 @@ fetch_kdb_authdata(krb5_context context, unsigned int flags, - - /* Put the KDB authdata first in the ticket. A successful merge places the - * combined list in db_authdata and releases the old ticket authdata. */ -- ret = merge_authdata(context, enc_tkt_reply->authorization_data, -- &db_authdata, FALSE, FALSE); -+ ret = merge_authdata(&db_authdata, &enc_tkt_reply->authorization_data); - if (ret) - krb5_free_authdata(context, db_authdata); - else -@@ -404,8 +403,7 @@ make_signedpath_data(krb5_context context, krb5_const_principal client, - return ret; - - for (i = 0, j = 0; authdata[i] != NULL; i++) { -- if (is_kdc_issued_authdatum(context, authdata[i], -- KRB5_AUTHDATA_SIGNTICKET)) -+ if (is_kdc_issued_authdatum(authdata[i], KRB5_AUTHDATA_SIGNTICKET)) - continue; - - sign_authdata[j++] = authdata[i]; -@@ -635,12 +633,8 @@ make_signedpath(krb5_context context, krb5_const_principal for_user_princ, - if (ret) - goto cleanup; - -- /* Add the authdata to the ticket, without copying or filtering. */ -- ret = merge_authdata(context, if_relevant, -- &enc_tkt_reply->authorization_data, FALSE, FALSE); -- if (ret) -- goto cleanup; -- if_relevant = NULL; /* merge_authdata() freed */ -+ /* Add the signedpath authdata to the ticket. */ -+ ret = merge_authdata(&enc_tkt_reply->authorization_data, &if_relevant); - - cleanup: - free(sp.delegated); -@@ -665,7 +659,7 @@ free_deleg_path(krb5_context context, krb5_principal *deleg_path) - static krb5_boolean - has_pac(krb5_context context, krb5_authdata **authdata) - { -- return has_kdc_issued_authdata(context, authdata, KRB5_AUTHDATA_WIN2K_PAC); -+ return has_kdc_issued_authdata(authdata, KRB5_AUTHDATA_WIN2K_PAC); - } - - /* Verify AD-SIGNTICKET authdata if we need to, and insert an AD-SIGNEDPATH -@@ -746,11 +740,7 @@ add_auth_indicators(krb5_context context, krb5_data *const *auth_indicators, - goto cleanup; - - /* Add the wrapped authdata to the ticket, without copying or filtering. */ -- ret = merge_authdata(context, cammac, &enc_tkt_reply->authorization_data, -- FALSE, FALSE); -- if (ret) -- goto cleanup; -- cammac = NULL; /* merge_authdata() freed */ -+ ret = merge_authdata(&enc_tkt_reply->authorization_data, &cammac); - - cleanup: - krb5_free_data(context, der_indicators); -diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c -index 6330387d0..a4a05b9fa 100644 ---- a/src/kdc/kdc_util.c -+++ b/src/kdc/kdc_util.c -@@ -78,56 +78,6 @@ static krb5_error_code find_server_key(krb5_context, - krb5_kvno, krb5_keyblock **, - krb5_kvno *); - --/* -- * concatenate first two authdata arrays, returning an allocated replacement. -- * The replacement should be freed with krb5_free_authdata(). -- */ --krb5_error_code --concat_authorization_data(krb5_context context, -- krb5_authdata **first, krb5_authdata **second, -- krb5_authdata ***output) --{ -- int i, j; -- krb5_authdata **ptr, **retdata; -- -- /* count up the entries */ -- i = 0; -- if (first) -- for (ptr = first; *ptr; ptr++) -- i++; -- if (second) -- for (ptr = second; *ptr; ptr++) -- i++; -- -- retdata = (krb5_authdata **)malloc((i+1)*sizeof(*retdata)); -- if (!retdata) -- return ENOMEM; -- retdata[i] = 0; /* null-terminated array */ -- for (i = 0, j = 0, ptr = first; j < 2 ; ptr = second, j++) -- while (ptr && *ptr) { -- /* now walk & copy */ -- retdata[i] = (krb5_authdata *)malloc(sizeof(*retdata[i])); -- if (!retdata[i]) { -- krb5_free_authdata(context, retdata); -- return ENOMEM; -- } -- *retdata[i] = **ptr; -- if (!(retdata[i]->contents = -- (krb5_octet *)malloc(retdata[i]->length))) { -- free(retdata[i]); -- retdata[i] = 0; -- krb5_free_authdata(context, retdata); -- return ENOMEM; -- } -- memcpy(retdata[i]->contents, (*ptr)->contents, retdata[i]->length); -- -- ptr++; -- i++; -- } -- *output = retdata; -- return 0; --} -- - krb5_boolean - is_local_principal(kdc_realm_t *kdc_active_realm, krb5_const_principal princ1) - { -diff --git a/src/kdc/kdc_util.h b/src/kdc/kdc_util.h -index 2c9d8cf69..42b7ee208 100644 ---- a/src/kdc/kdc_util.h -+++ b/src/kdc/kdc_util.h -@@ -52,11 +52,6 @@ compress_transited (krb5_data *, - krb5_principal, - krb5_data *); - krb5_error_code --concat_authorization_data (krb5_context, -- krb5_authdata **, -- krb5_authdata **, -- krb5_authdata ***); --krb5_error_code - fetch_last_req_info (krb5_db_entry *, krb5_last_req_entry ***); - - krb5_error_code diff --git a/Refactor-krb5-GSS-checksum-handling.patch b/Refactor-krb5-GSS-checksum-handling.patch deleted file mode 100644 index 62f36c3..0000000 --- a/Refactor-krb5-GSS-checksum-handling.patch +++ /dev/null @@ -1,479 +0,0 @@ -From 8412a1611290da9705730c9e473a5b122c55e9fd Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Fri, 30 Jun 2017 16:03:01 -0400 -Subject: [PATCH] Refactor krb5 GSS checksum handling - -Separate out checksum handling from kg_accept_krb5() into a new helper -process_checksum(). - -[ghudson@mit.edu: simplified checksum processing and made it use -k5-input.h instead of TREAD_ macros; moved more flag handling into -helper] - -[iboukris: adjusted helper function arguments, allowing access to the -full authenticator for subsequent changes] - -(cherry picked from commit 64d56233f9816a2a93f6e8d3030c8ed6ce397735) -[rharwood@redhat.com: problem with typo fix commit, I think] ---- - src/lib/gssapi/krb5/accept_sec_context.c | 383 +++++++++++------------ - 1 file changed, 179 insertions(+), 204 deletions(-) - -diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c -index c5bddb1e8..70dd7fc0c 100644 ---- a/src/lib/gssapi/krb5/accept_sec_context.c -+++ b/src/lib/gssapi/krb5/accept_sec_context.c -@@ -98,6 +98,7 @@ - */ - - #include "k5-int.h" -+#include "k5-input.h" - #include "gssapiP_krb5.h" - #ifdef HAVE_MEMORY_H - #include -@@ -413,6 +414,174 @@ kg_process_extension(krb5_context context, - return code; - } - -+/* The length of the MD5 channel bindings in an 0x8003 checksum */ -+#define CB_MD5_LEN 16 -+ -+/* The minimum length of an 0x8003 checksum value (4-byte channel bindings -+ * length, 16-byte channel bindings, 4-byte flags) */ -+#define MIN_8003_LEN (4 + CB_MD5_LEN + 4) -+ -+/* The flags we accept from the initiator's authenticator checksum. */ -+#define INITIATOR_FLAGS (GSS_C_INTEG_FLAG | GSS_C_CONF_FLAG | \ -+ GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG | \ -+ GSS_C_SEQUENCE_FLAG | GSS_C_DCE_STYLE | \ -+ GSS_C_IDENTIFY_FLAG | GSS_C_EXTENDED_ERROR_FLAG) -+ -+/* -+ * The krb5 GSS mech appropriates the authenticator checksum field from RFC -+ * 4120 to store structured data instead of a checksum, indicated with checksum -+ * type 0x8003 (see RFC 4121 section 4.1.1). Some implementations instead send -+ * no checksum, or a regular checksum over empty data. -+ * -+ * Interpret the checksum. Read delegated creds into *deleg_out if it is not -+ * NULL. Set *flags_out to the allowed subset of token flags, plus -+ * GSS_C_DELEG_FLAG if a delegated credential was present. Process any -+ * extensions found using exts. On error, set *code_out to a krb5_error code -+ * for use as a minor status value. -+ */ -+static OM_uint32 -+process_checksum(OM_uint32 *minor_status, krb5_context context, -+ gss_channel_bindings_t acceptor_cb, -+ krb5_auth_context auth_context, krb5_flags ap_req_options, -+ krb5_authenticator *authenticator, krb5_gss_ctx_ext_t exts, -+ krb5_gss_cred_id_t *deleg_out, krb5_ui_4 *flags_out, -+ krb5_error_code *code_out) -+{ -+ krb5_error_code code = 0; -+ OM_uint32 status, option_id, token_flags; -+ size_t cb_len, option_len; -+ krb5_boolean valid; -+ krb5_key subkey; -+ krb5_data option, empty = empty_data(); -+ krb5_checksum cb_cksum; -+ const uint8_t *token_cb, *option_bytes; -+ struct k5input in; -+ const krb5_checksum *cksum = authenticator->checksum; -+ -+ cb_cksum.contents = NULL; -+ -+ if (cksum == NULL) { -+ /* -+ * Some SMB client implementations use handcrafted GSSAPI code that -+ * does not provide a checksum. MS-KILE documents that the Microsoft -+ * implementation considers a missing checksum acceptable; the server -+ * assumes all flags are unset in this case, and does not check channel -+ * bindings. -+ */ -+ *flags_out = 0; -+ } else if (cksum->checksum_type != CKSUMTYPE_KG_CB) { -+ /* Samba sends a regular checksum. */ -+ code = krb5_auth_con_getkey_k(context, auth_context, &subkey); -+ if (code) { -+ status = GSS_S_FAILURE; -+ goto fail; -+ } -+ -+ /* Verifying the checksum ensures that this authenticator wasn't -+ * replayed from one with a checksum over actual data. */ -+ code = krb5_k_verify_checksum(context, subkey, -+ KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM, &empty, -+ cksum, &valid); -+ krb5_k_free_key(context, subkey); -+ if (code || !valid) { -+ status = GSS_S_BAD_SIG; -+ goto fail; -+ } -+ -+ /* Use ap_options from the request to guess the mutual flag. */ -+ *flags_out = GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG; -+ if (ap_req_options & AP_OPTS_MUTUAL_REQUIRED) -+ *flags_out |= GSS_C_MUTUAL_FLAG; -+ } else { -+ /* The checksum must contain at least a fixed 24-byte part. */ -+ if (cksum->length < MIN_8003_LEN) { -+ status = GSS_S_BAD_BINDINGS; -+ goto fail; -+ } -+ -+ k5_input_init(&in, cksum->contents, cksum->length); -+ cb_len = k5_input_get_uint32_le(&in); -+ if (cb_len != CB_MD5_LEN) { -+ code = KG_BAD_LENGTH; -+ status = GSS_S_FAILURE; -+ goto fail; -+ } -+ -+ token_cb = k5_input_get_bytes(&in, cb_len); -+ if (acceptor_cb != GSS_C_NO_CHANNEL_BINDINGS) { -+ code = kg_checksum_channel_bindings(context, acceptor_cb, -+ &cb_cksum); -+ if (code) { -+ status = GSS_S_BAD_BINDINGS; -+ goto fail; -+ } -+ assert(cb_cksum.length == cb_len); -+ if (k5_bcmp(token_cb, cb_cksum.contents, cb_len) != 0) { -+ status = GSS_S_BAD_BINDINGS; -+ goto fail; -+ } -+ } -+ -+ /* Read the token flags and accept some of them as context flags. */ -+ token_flags = k5_input_get_uint32_le(&in); -+ *flags_out = token_flags & INITIATOR_FLAGS; -+ -+ /* Read the delegated credential if present. */ -+ if (in.len >= 4 && (token_flags & GSS_C_DELEG_FLAG)) { -+ option_id = k5_input_get_uint16_le(&in); -+ option_len = k5_input_get_uint16_le(&in); -+ option_bytes = k5_input_get_bytes(&in, option_len); -+ option = make_data((uint8_t *)option_bytes, option_len); -+ if (in.status) { -+ code = KG_BAD_LENGTH; -+ status = GSS_S_FAILURE; -+ goto fail; -+ } -+ if (option_id != KRB5_GSS_FOR_CREDS_OPTION) { -+ status = GSS_S_FAILURE; -+ goto fail; -+ } -+ -+ /* Store the delegated credential. */ -+ code = rd_and_store_for_creds(context, auth_context, &option, -+ deleg_out); -+ if (code) { -+ status = GSS_S_FAILURE; -+ goto fail; -+ } -+ *flags_out |= GSS_C_DELEG_FLAG; -+ } -+ -+ /* Process any extensions at the end of the checksum. Extensions use -+ * 4-byte big-endian tag and length instead of 2-byte little-endian. */ -+ while (in.len > 0) { -+ option_id = k5_input_get_uint32_be(&in); -+ option_len = k5_input_get_uint32_be(&in); -+ option_bytes = k5_input_get_bytes(&in, option_len); -+ option = make_data((uint8_t *)option_bytes, option_len); -+ if (in.status) { -+ code = KG_BAD_LENGTH; -+ status = GSS_S_FAILURE; -+ goto fail; -+ } -+ -+ code = kg_process_extension(context, auth_context, option_id, -+ &option, exts); -+ if (code) { -+ status = GSS_S_FAILURE; -+ goto fail; -+ } -+ } -+ } -+ -+ status = GSS_S_COMPLETE; -+ -+fail: -+ free(cb_cksum.contents); -+ *code_out = code; -+ return status; -+} -+ - static OM_uint32 - kg_accept_krb5(minor_status, context_handle, - verifier_cred_handle, input_token, -@@ -433,17 +602,13 @@ kg_accept_krb5(minor_status, context_handle, - krb5_gss_ctx_ext_t exts; - { - krb5_context context; -- unsigned char *ptr, *ptr2; -+ unsigned char *ptr; - char *sptr; -- OM_uint32 tmp; -- size_t md5len; - krb5_gss_cred_id_t cred = 0; - krb5_data ap_rep, ap_req; -- unsigned int i; - krb5_error_code code; - krb5_address addr, *paddr; - krb5_authenticator *authdat = 0; -- krb5_checksum reqcksum; - krb5_gss_name_t name = NULL; - krb5_ui_4 gss_flags = 0; - krb5_gss_ctx_id_rec *ctx = NULL; -@@ -451,8 +616,6 @@ kg_accept_krb5(minor_status, context_handle, - gss_buffer_desc token; - krb5_auth_context auth_context = NULL; - krb5_ticket * ticket = NULL; -- int option_id; -- krb5_data option; - const gss_OID_desc *mech_used = NULL; - OM_uint32 major_status = GSS_S_FAILURE; - OM_uint32 tmp_minor_status; -@@ -463,7 +626,6 @@ kg_accept_krb5(minor_status, context_handle, - krb5int_access kaccess; - int cred_rcache = 0; - int no_encap = 0; -- int token_deleg_flag = 0; - krb5_flags ap_req_options = 0; - krb5_enctype negotiated_etype; - krb5_authdata_context ad_context = NULL; -@@ -489,7 +651,6 @@ kg_accept_krb5(minor_status, context_handle, - output_token->length = 0; - output_token->value = NULL; - token.value = 0; -- reqcksum.contents = 0; - ap_req.data = 0; - ap_rep.data = 0; - -@@ -654,195 +815,16 @@ kg_accept_krb5(minor_status, context_handle, - - krb5_auth_con_getauthenticator(context, auth_context, &authdat); - -- if (authdat->checksum == NULL) { -- /* -- * Some SMB client implementations use handcrafted GSSAPI code that -- * does not provide a checksum. MS-KILE documents that the Microsoft -- * implementation considers a missing checksum acceptable; the server -- * assumes all flags are unset in this case, and does not check channel -- * bindings. -- */ -- gss_flags = 0; -- } else if (authdat->checksum->checksum_type != CKSUMTYPE_KG_CB) { -- /* Samba does not send 0x8003 GSS-API checksums */ -- krb5_boolean valid; -- krb5_key subkey; -- krb5_data zero; -+ major_status = process_checksum(minor_status, context, input_chan_bindings, -+ auth_context, ap_req_options, -+ authdat, exts, -+ delegated_cred_handle ? &deleg_cred : NULL, -+ &gss_flags, &code); - -- code = krb5_auth_con_getkey_k(context, auth_context, &subkey); -- if (code) { -- major_status = GSS_S_FAILURE; -- goto fail; -- } -+ if (major_status != GSS_S_COMPLETE) -+ goto fail; - -- zero.length = 0; -- zero.data = ""; -- -- code = krb5_k_verify_checksum(context, -- subkey, -- KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM, -- &zero, -- authdat->checksum, -- &valid); -- krb5_k_free_key(context, subkey); -- if (code || !valid) { -- major_status = GSS_S_BAD_SIG; -- goto fail; -- } -- -- /* Use ap_options from the request to guess the mutual flag. */ -- gss_flags = GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG; -- if (ap_req_options & AP_OPTS_MUTUAL_REQUIRED) -- gss_flags |= GSS_C_MUTUAL_FLAG; -- } else { -- /* gss krb5 v1 */ -- -- /* stash this now, for later. */ -- code = krb5_c_checksum_length(context, CKSUMTYPE_RSA_MD5, &md5len); -- if (code) { -- major_status = GSS_S_FAILURE; -- goto fail; -- } -- -- /* verify that the checksum is correct */ -- -- /* -- The checksum may be either exactly 24 bytes, in which case -- no options are specified, or greater than 24 bytes, in which case -- one or more options are specified. Currently, the only valid -- option is KRB5_GSS_FOR_CREDS_OPTION ( = 1 ). -- */ -- -- if ((authdat->checksum->checksum_type != CKSUMTYPE_KG_CB) || -- (authdat->checksum->length < 24)) { -- code = 0; -- major_status = GSS_S_BAD_BINDINGS; -- goto fail; -- } -- -- ptr = (unsigned char *) authdat->checksum->contents; -- -- TREAD_INT(ptr, tmp, 0); -- -- if (tmp != md5len) { -- code = KG_BAD_LENGTH; -- major_status = GSS_S_FAILURE; -- goto fail; -- } -- -- /* -- The following section of code attempts to implement the -- optional channel binding facility as described in RFC2743. -- -- Since this facility is optional channel binding may or may -- not have been provided by either the client or the server. -- -- If the server has specified input_chan_bindings equal to -- GSS_C_NO_CHANNEL_BINDINGS then we skip the check. If -- the server does provide channel bindings then we compute -- a checksum and compare against those provided by the -- client. */ -- -- if ((code = kg_checksum_channel_bindings(context, -- input_chan_bindings, -- &reqcksum))) { -- major_status = GSS_S_BAD_BINDINGS; -- goto fail; -- } -- -- /* Always read the clients bindings - eventhough we might ignore them */ -- TREAD_STR(ptr, ptr2, reqcksum.length); -- -- if (input_chan_bindings != GSS_C_NO_CHANNEL_BINDINGS ) { -- if (memcmp(ptr2, reqcksum.contents, reqcksum.length) != 0) { -- xfree(reqcksum.contents); -- reqcksum.contents = 0; -- code = 0; -- major_status = GSS_S_BAD_BINDINGS; -- goto fail; -- } -- -- } -- -- xfree(reqcksum.contents); -- reqcksum.contents = 0; -- -- /* Read the token flags. Remember if GSS_C_DELEG_FLAG was set, but -- * mask it out until we actually read a delegated credential. */ -- TREAD_INT(ptr, gss_flags, 0); -- token_deleg_flag = (gss_flags & GSS_C_DELEG_FLAG); -- gss_flags &= ~GSS_C_DELEG_FLAG; -- -- /* if the checksum length > 24, there are options to process */ -- -- i = authdat->checksum->length - 24; -- if (i && token_deleg_flag) { -- if (i >= 4) { -- TREAD_INT16(ptr, option_id, 0); -- TREAD_INT16(ptr, option.length, 0); -- i -= 4; -- -- if (i < option.length) { -- code = KG_BAD_LENGTH; -- major_status = GSS_S_FAILURE; -- goto fail; -- } -- -- /* have to use ptr2, since option.data is wrong type and -- macro uses ptr as both lvalue and rvalue */ -- -- TREAD_STR(ptr, ptr2, option.length); -- option.data = (char *) ptr2; -- -- i -= option.length; -- -- if (option_id != KRB5_GSS_FOR_CREDS_OPTION) { -- major_status = GSS_S_FAILURE; -- goto fail; -- } -- -- /* store the delegated credential */ -- -- code = rd_and_store_for_creds(context, auth_context, &option, -- (delegated_cred_handle) ? -- &deleg_cred : NULL); -- if (code) { -- major_status = GSS_S_FAILURE; -- goto fail; -- } -- -- gss_flags |= GSS_C_DELEG_FLAG; -- } /* if i >= 4 */ -- /* ignore any additional trailing data, for now */ -- } -- while (i > 0) { -- /* Process Type-Length-Data options */ -- if (i < 8) { -- code = KG_BAD_LENGTH; -- major_status = GSS_S_FAILURE; -- goto fail; -- } -- TREAD_INT(ptr, option_id, 1); -- TREAD_INT(ptr, option.length, 1); -- i -= 8; -- if (i < option.length) { -- code = KG_BAD_LENGTH; -- major_status = GSS_S_FAILURE; -- goto fail; -- } -- TREAD_STR(ptr, ptr2, option.length); -- option.data = (char *)ptr2; -- -- i -= option.length; -- -- code = kg_process_extension(context, auth_context, -- option_id, &option, exts); -- if (code != 0) { -- major_status = GSS_S_FAILURE; -- goto fail; -- } -- } -- } -+ major_status = GSS_S_FAILURE; - - if (exts->iakerb.conv && !exts->iakerb.verified) { - major_status = GSS_S_BAD_SIG; -@@ -869,12 +851,7 @@ kg_accept_krb5(minor_status, context_handle, - ctx->mech_used = (gss_OID) mech_used; - ctx->auth_context = auth_context; - ctx->initiate = 0; -- ctx->gss_flags = (GSS_C_TRANS_FLAG | -- ((gss_flags) & (GSS_C_INTEG_FLAG | GSS_C_CONF_FLAG | -- GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG | -- GSS_C_SEQUENCE_FLAG | GSS_C_DELEG_FLAG | -- GSS_C_DCE_STYLE | GSS_C_IDENTIFY_FLAG | -- GSS_C_EXTENDED_ERROR_FLAG))); -+ ctx->gss_flags = gss_flags | GSS_C_TRANS_FLAG; - ctx->seed_init = 0; - ctx->cred_rcache = cred_rcache; - -@@ -1161,8 +1138,6 @@ fail: - - krb5_auth_con_free(context, auth_context); - } -- if (reqcksum.contents) -- xfree(reqcksum.contents); - if (ap_rep.data) - krb5_free_data_contents(context, &ap_rep); - if (major_status == GSS_S_COMPLETE || diff --git a/Refresh-manually-acquired-creds-from-client-keytab.patch b/Refresh-manually-acquired-creds-from-client-keytab.patch deleted file mode 100644 index 61e1fa4..0000000 --- a/Refresh-manually-acquired-creds-from-client-keytab.patch +++ /dev/null @@ -1,78 +0,0 @@ -From 43fe1f948059ad79d95dbf41f2206de65238d892 Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Wed, 26 Feb 2020 18:27:17 -0500 -Subject: [PATCH] Refresh manually acquired creds from client keytab - -If a client keytab is present but credentials are acquired manually, -the credentials would not be refreshed because no refresh_time config -var is set in the cache. Change kg_cred_time_to_refresh() to attempt -a refresh from the client keytab on any credentials which will expire -in the next 30 seconds. - -[ghudson@mit.edu: adjused code and added test case] - -ticket: 7976 -(cherry picked from commit 729896467e3c77904666019d6cbbda583ae49b95) ---- - src/lib/gssapi/krb5/acquire_cred.c | 14 +++++++++++--- - src/tests/gssapi/t_client_keytab.py | 18 ++++++++++++++++++ - 2 files changed, 29 insertions(+), 3 deletions(-) - -diff --git a/src/lib/gssapi/krb5/acquire_cred.c b/src/lib/gssapi/krb5/acquire_cred.c -index acc1868f8..4062f4741 100644 ---- a/src/lib/gssapi/krb5/acquire_cred.c -+++ b/src/lib/gssapi/krb5/acquire_cred.c -@@ -557,15 +557,23 @@ set_refresh_time(krb5_context context, krb5_ccache ccache, - krb5_boolean - kg_cred_time_to_refresh(krb5_context context, krb5_gss_cred_id_rec *cred) - { -- krb5_timestamp now; -+ krb5_timestamp now, soon; - - if (krb5_timeofday(context, &now)) - return FALSE; -+ soon = ts_incr(now, 30); - if (cred->refresh_time != 0 && !ts_after(cred->refresh_time, now)) { -- set_refresh_time(context, cred->ccache, -- ts_incr(cred->refresh_time, 30)); -+ set_refresh_time(context, cred->ccache, soon); - return TRUE; - } -+ -+ /* If the creds will expire soon, try to refresh even if they weren't -+ * acquired with a client keytab. */ -+ if (ts_after(soon, cred->expire)) { -+ set_refresh_time(context, cred->ccache, soon); -+ return TRUE; -+ } -+ - return FALSE; - } - -diff --git a/src/tests/gssapi/t_client_keytab.py b/src/tests/gssapi/t_client_keytab.py -index e474a27c7..7847b3ecd 100755 ---- a/src/tests/gssapi/t_client_keytab.py -+++ b/src/tests/gssapi/t_client_keytab.py -@@ -124,4 +124,22 @@ realm.kinit(realm.user_princ, password('user')) - realm.run(['./t_ccselect', phost], env=bad_cktname, - expected_msg=realm.user_princ) - -+mark('refresh of manually acquired creds') -+ -+# Test 17: no name/ccache specified, manually acquired creds which -+# will expire soon. Verify that creds are refreshed using the current -+# client name, with refresh_time set in the refreshed ccache. -+realm.kinit('bob', password('bob'), ['-l', '15s']) -+realm.run(['./t_ccselect', phost], expected_msg='bob') -+realm.run([klist, '-C'], expected_msg='refresh_time = ') -+ -+# Test 18: no name/ccache specified, manually acquired creds with a -+# client principal not present in the client keytab. A refresh is -+# attempted but fails, and an expired ticket error results. -+realm.kinit(realm.admin_princ, password('admin'), ['-l', '-1s']) -+msgs = ('Getting initial credentials for user/admin@KRBTEST.COM', -+ '/Matching credential not found') -+realm.run(['./t_ccselect', phost], expected_code=1, -+ expected_msg='Ticket expired', expected_trace=msgs) -+ - success('Client keytab tests') diff --git a/Remove-resolver-test-utility.patch b/Remove-resolver-test-utility.patch deleted file mode 100644 index 77fea7a..0000000 --- a/Remove-resolver-test-utility.patch +++ /dev/null @@ -1,547 +0,0 @@ -From 6d2dbd0378c92ea13363f2536ab0062bdfda076e Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Thu, 28 May 2020 18:41:02 -0400 -Subject: [PATCH] Remove resolver test utility - -tests/resolve is no longer used after the previous commit. - -[rharwood@redhat.com: .gitignore] ---- - src/configure.ac | 5 +- - src/tests/Makefile.in | 4 +- - src/tests/resolve/Makefile.in | 28 --- - src/tests/resolve/addrinfo-test.c | 306 ------------------------- - src/tests/resolve/deps | 14 -- - src/tests/resolve/fake-addrinfo-test.c | 3 - - src/tests/resolve/resolve.c | 115 ---------- - 7 files changed, 4 insertions(+), 471 deletions(-) - delete mode 100644 src/tests/resolve/Makefile.in - delete mode 100644 src/tests/resolve/addrinfo-test.c - delete mode 100644 src/tests/resolve/deps - delete mode 100644 src/tests/resolve/fake-addrinfo-test.c - delete mode 100644 src/tests/resolve/resolve.c - -diff --git a/src/configure.ac b/src/configure.ac -index aafc462f9..00b5ea4c5 100644 ---- a/src/configure.ac -+++ b/src/configure.ac -@@ -1540,7 +1540,6 @@ V5_AC_OUTPUT_MAKEFILE(. - appl/simple appl/simple/client appl/simple/server - appl/gss-sample appl/user_user - -- tests tests/resolve tests/asn.1 tests/create tests/hammer -- tests/verify tests/gssapi tests/dejagnu tests/threads tests/shlib -- tests/gss-threads tests/misc -+ tests tests/asn.1 tests/create tests/hammer tests/verify tests/gssapi -+ tests/dejagnu tests/threads tests/shlib tests/gss-threads tests/misc - ) -diff --git a/src/tests/Makefile.in b/src/tests/Makefile.in -index 3f88f1713..6b7749129 100644 ---- a/src/tests/Makefile.in -+++ b/src/tests/Makefile.in -@@ -1,7 +1,7 @@ - mydir=tests - BUILDTOP=$(REL).. --SUBDIRS = resolve asn.1 create hammer verify gssapi dejagnu shlib \ -- gss-threads misc threads softpkcs11 -+SUBDIRS = asn.1 create hammer verify gssapi dejagnu shlib gss-threads misc \ -+ threads softpkcs11 - - RUN_DB_TEST = $(RUN_SETUP) KRB5_KDC_PROFILE=kdc.conf KRB5_CONFIG=krb5.conf \ - GSS_MECH_CONFIG=mech.conf LC_ALL=C $(VALGRIND) -diff --git a/src/tests/resolve/Makefile.in b/src/tests/resolve/Makefile.in -deleted file mode 100644 -index 1f5954089..000000000 ---- a/src/tests/resolve/Makefile.in -+++ /dev/null -@@ -1,28 +0,0 @@ --mydir=tests$(S)resolve --BUILDTOP=$(REL)..$(S).. -- --OBJS=resolve.o addrinfo-test.o fake-addrinfo-test.o --SRCS=$(srcdir)/resolve.c $(srcdir)/addrinfo-test.c \ -- $(srcdir)/fake-addrinfo-test.c -- --all: resolve addrinfo-test fake-addrinfo-test -- --resolve: resolve.o -- $(CC_LINK) -o $@ resolve.o $(SUPPORT_LIB) $(LIBS) -- --addrinfo-test: addrinfo-test.o -- $(CC_LINK) -o $@ addrinfo-test.o $(SUPPORT_LIB) $(LIBS) -- --fake-addrinfo-test: fake-addrinfo-test.o -- $(CC_LINK) -o $@ fake-addrinfo-test.o $(SUPPORT_LIB) $(LIBS) -- --check: resolve addrinfo-test fake-addrinfo-test -- $(RUN_TEST) ./resolve -- $(RUN_TEST) ./addrinfo-test -p telnet -- $(RUN_TEST) ./fake-addrinfo-test -p telnet -- --install: -- --clean: -- $(RM) resolve addrinfo-test fake-addrinfo-test -- -diff --git a/src/tests/resolve/addrinfo-test.c b/src/tests/resolve/addrinfo-test.c -deleted file mode 100644 -index e77640b62..000000000 ---- a/src/tests/resolve/addrinfo-test.c -+++ /dev/null -@@ -1,306 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --/* tests/resolve/addrinfo-test.c */ --/* -- * Copyright 2004 by the Massachusetts Institute of Technology. -- * All Rights Reserved. -- * -- * Export of this software from the United States of America may -- * require a specific license from the United States Government. -- * It is the responsibility of any person or organization contemplating -- * export to obtain such a license before exporting. -- * -- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and -- * distribute this software and its documentation for any purpose and -- * without fee is hereby granted, provided that the above copyright -- * notice appear in all copies and that both that copyright notice and -- * this permission notice appear in supporting documentation, and that -- * the name of M.I.T. not be used in advertising or publicity pertaining -- * to distribution of the software without specific, written prior -- * permission. Furthermore if you modify this software you must label -- * your software as modified software and not distribute it in such a -- * fashion that it might be confused with the original M.I.T. software. -- * M.I.T. makes no representations about the suitability of -- * this software for any purpose. It is provided "as is" without express -- * or implied warranty. -- */ -- --/* -- * A simple program to test the functionality of the getaddrinfo function. -- * -- * Usage: -- * addrinfo-test [-t|-u|-R|-I] [-d|-s|-r] [-p port] [-P] [hostname] -- * -- * When invoked with no arguments, NULL is used for the node name, -- * which (at least with a non-null "port") means a socket address -- * is desired that can be used with connect() or bind() (depending -- * on whether "-P" is given). -- */ -- --#include --#include --#include --#include --#include /* needed for IPPROTO_* on NetBSD */ --#ifdef USE_FAKE_ADDRINFO --#include "fake-addrinfo.h" --#endif -- --static const char *protoname (int p) { -- static char buf[30]; -- --#define X(N) if (p == IPPROTO_ ## N) return #N -- -- X(TCP); -- X(UDP); -- X(ICMP); --#ifdef IPPROTO_IPV6 -- X(IPV6); --#endif --#ifdef IPPROTO_GRE -- X(GRE); --#endif --#ifdef IPPROTO_NONE -- X(NONE); --#endif -- X(RAW); --#ifdef IPPROTO_COMP -- X(COMP); --#endif -- -- snprintf(buf, sizeof(buf), " %-2d", p); -- return buf; --} -- --static const char *socktypename (int t) { -- static char buf[30]; -- switch (t) { -- case SOCK_DGRAM: return "DGRAM"; -- case SOCK_STREAM: return "STREAM"; -- case SOCK_RAW: return "RAW"; -- case SOCK_RDM: return "RDM"; -- case SOCK_SEQPACKET: return "SEQPACKET"; -- } -- snprintf(buf, sizeof(buf), " %-2d", t); -- return buf; --} -- --static char *whoami; -- --static void usage () { -- fprintf(stderr, -- "usage:\n" -- "\t%s [ options ] [host]\n" -- "options:\n" -- "\t-t\tspecify protocol IPPROTO_TCP\n" -- "\t-u\tspecify protocol IPPROTO_UDP\n" -- "\t-R\tspecify protocol IPPROTO_RAW\n" -- "\t-I\tspecify protocol IPPROTO_ICMP\n" -- "\n" -- "\t-d\tspecify socket type SOCK_DGRAM\n" -- "\t-s\tspecify socket type SOCK_STREAM\n" -- "\t-r\tspecify socket type SOCK_RAW\n" -- "\n" -- "\t-4\tspecify address family AF_INET\n" --#ifdef AF_INET6 -- "\t-6\tspecify address family AF_INET6\n" --#endif -- "\n" -- "\t-p P\tspecify port P (service name or port number)\n" -- "\t-N\thostname is numeric, skip DNS query\n" -- "\t-n\tservice/port is numeric (sets AI_NUMERICSERV)\n" -- "\t-P\tset AI_PASSIVE\n" -- "\n" -- "default: protocol 0, socket type 0, address family 0, null port\n" -- , -- whoami); -- /* [ -t | -u | -R | -I ] [ -d | -s | -r ] [ -p port ] */ -- exit (1); --} -- --static const char *familyname (int f) { -- static char buf[30]; -- switch (f) { -- default: -- snprintf(buf, sizeof(buf), "AF %d", f); -- return buf; -- case AF_INET: return "AF_INET"; --#ifdef AF_INET6 -- case AF_INET6: return "AF_INET6"; --#endif -- } --} -- --#define eaistr(X) (X == EAI_SYSTEM ? strerror(errno) : gai_strerror(X)) -- --int main (int argc, char *argv[]) --{ -- struct addrinfo *ap, *ap2; -- int err, numerichost = 0, numericserv = 0; -- char *hname, *port = 0, *sep; -- struct addrinfo hints; -- -- whoami = strrchr(argv[0], '/'); -- if (whoami == 0) -- whoami = argv[0]; -- else -- whoami = whoami+1; -- -- memset(&hints, 0, sizeof(hints)); -- hints.ai_flags = 0; -- hints.ai_socktype = 0; -- -- hname = 0; -- hints.ai_family = 0; -- -- if (argc == 1) -- usage (); -- -- while (++argv, --argc > 0) { -- char *arg; -- arg = *argv; -- -- if (*arg != '-') -- hname = arg; -- else if (arg[1] == 0 || arg[2] != 0) -- usage (); -- else -- switch (arg[1]) { -- case 'u': -- hints.ai_protocol = IPPROTO_UDP; -- break; -- case 't': -- hints.ai_protocol = IPPROTO_TCP; -- break; -- case 'R': -- hints.ai_protocol = IPPROTO_RAW; -- break; -- case 'I': -- hints.ai_protocol = IPPROTO_ICMP; -- break; -- case 'd': -- hints.ai_socktype = SOCK_DGRAM; -- break; -- case 's': -- hints.ai_socktype = SOCK_STREAM; -- break; -- case 'r': -- hints.ai_socktype = SOCK_RAW; -- break; -- case 'p': -- if (argv[1] == 0 || argv[1][0] == 0 || argv[1][0] == '-') -- usage (); -- port = argv[1]; -- argc--, argv++; -- break; -- case '4': -- hints.ai_family = AF_INET; -- break; --#ifdef AF_INET6 -- case '6': -- hints.ai_family = AF_INET6; -- break; --#endif -- case 'N': -- numerichost = 1; -- break; -- case 'n': -- numericserv = 1; -- break; -- case 'P': -- hints.ai_flags |= AI_PASSIVE; -- break; -- default: -- usage (); -- } -- } -- -- if (hname && !numerichost) -- hints.ai_flags |= AI_CANONNAME; -- if (numerichost) { --#ifdef AI_NUMERICHOST -- hints.ai_flags |= AI_NUMERICHOST; --#else -- fprintf(stderr, "AI_NUMERICHOST not defined on this platform\n"); -- exit(1); --#endif -- } -- if (numericserv) { --#ifdef AI_NUMERICSERV -- hints.ai_flags |= AI_NUMERICSERV; --#else -- fprintf(stderr, "AI_NUMERICSERV not defined on this platform\n"); -- exit(1); --#endif -- } -- -- printf("getaddrinfo(hostname %s, service %s,\n" -- " hints { ", -- hname ? hname : "(null)", port ? port : "(null)"); -- sep = ""; --#define Z(FLAG) if (hints.ai_flags & AI_##FLAG) printf("%s%s", sep, #FLAG), sep = "|" -- Z(CANONNAME); -- Z(PASSIVE); --#ifdef AI_NUMERICHOST -- Z(NUMERICHOST); --#endif --#ifdef AI_NUMERICSERV -- Z(NUMERICSERV); --#endif -- if (sep[0] == 0) -- printf ("no-flags"); -- if (hints.ai_family) -- printf(" %s", familyname(hints.ai_family)); -- if (hints.ai_socktype) -- printf(" SOCK_%s", socktypename(hints.ai_socktype)); -- if (hints.ai_protocol) -- printf(" IPPROTO_%s", protoname(hints.ai_protocol)); -- printf(" }):\n"); -- -- err = getaddrinfo(hname, port, &hints, &ap); -- if (err) { -- printf("\terror => %s\n", eaistr(err)); -- return 1; -- } -- -- for (ap2 = ap; ap2; ap2 = ap2->ai_next) { -- char hbuf[NI_MAXHOST], pbuf[NI_MAXSERV]; -- /* If we don't do this, even AIX's own getnameinfo will reject -- the sockaddr structures. The sa_len field doesn't get set -- either, on AIX, but getnameinfo won't complain. */ -- if (ap2->ai_addr->sa_family == 0) { -- printf("BAD: sa_family zero! fixing...\n"); -- ap2->ai_addr->sa_family = ap2->ai_family; -- } else if (ap2->ai_addr->sa_family != ap2->ai_family) { -- printf("BAD: sa_family != ai_family! fixing...\n"); -- ap2->ai_addr->sa_family = ap2->ai_family; -- } -- if (getnameinfo(ap2->ai_addr, ap2->ai_addrlen, hbuf, sizeof(hbuf), -- pbuf, sizeof(pbuf), NI_NUMERICHOST | NI_NUMERICSERV)) { -- strlcpy(hbuf, "...", sizeof(hbuf)); -- strlcpy(pbuf, "...", sizeof(pbuf)); -- } -- printf("%p:\n" -- "\tfamily = %s\tproto = %-4s\tsocktype = %s\n", -- (void *) ap2, familyname(ap2->ai_family), -- protoname (ap2->ai_protocol), -- socktypename (ap2->ai_socktype)); -- if (ap2->ai_canonname) { -- if (ap2->ai_canonname[0]) -- printf("\tcanonname = %s\n", ap2->ai_canonname); -- else -- printf("BAD: ai_canonname is set but empty!\n"); -- } else if (ap2 == ap && (hints.ai_flags & AI_CANONNAME)) { -- printf("BAD: first ai_canonname is null!\n"); -- } -- printf("\taddr = %-28s\tport = %s\n", hbuf, pbuf); -- -- err = getnameinfo(ap2->ai_addr, ap2->ai_addrlen, hbuf, sizeof (hbuf), -- pbuf, sizeof(pbuf), NI_NAMEREQD); -- if (err) -- printf("\tgetnameinfo(NI_NAMEREQD): %s\n", eaistr(err)); -- else -- printf("\tgetnameinfo => %s, %s\n", hbuf, pbuf); -- } -- freeaddrinfo(ap); -- return 0; --} -diff --git a/src/tests/resolve/deps b/src/tests/resolve/deps -deleted file mode 100644 -index 762d9adab..000000000 ---- a/src/tests/resolve/deps -+++ /dev/null -@@ -1,14 +0,0 @@ --# --# Generated makefile dependencies follow. --# --$(OUTPRE)resolve.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ -- $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-thread.h \ -- resolve.c --$(OUTPRE)addrinfo-test.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ -- $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-thread.h \ -- addrinfo-test.c --$(OUTPRE)fake-addrinfo-test.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ -- $(top_srcdir)/include/fake-addrinfo.h $(top_srcdir)/include/k5-platform.h \ -- $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/port-sockets.h \ -- $(top_srcdir)/include/socket-utils.h addrinfo-test.c \ -- fake-addrinfo-test.c -diff --git a/src/tests/resolve/fake-addrinfo-test.c b/src/tests/resolve/fake-addrinfo-test.c -deleted file mode 100644 -index 86365a5ba..000000000 ---- a/src/tests/resolve/fake-addrinfo-test.c -+++ /dev/null -@@ -1,3 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --#define USE_FAKE_ADDRINFO --#include "addrinfo-test.c" -diff --git a/src/tests/resolve/resolve.c b/src/tests/resolve/resolve.c -deleted file mode 100644 -index ea0239113..000000000 ---- a/src/tests/resolve/resolve.c -+++ /dev/null -@@ -1,115 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --/* tests/resolve/resolve.c */ --/* -- * Copyright 1995 by the Massachusetts Institute of Technology. -- * All Rights Reserved. -- * -- * Export of this software from the United States of America may -- * require a specific license from the United States Government. -- * It is the responsibility of any person or organization contemplating -- * export to obtain such a license before exporting. -- * -- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and -- * distribute this software and its documentation for any purpose and -- * without fee is hereby granted, provided that the above copyright -- * notice appear in all copies and that both that copyright notice and -- * this permission notice appear in supporting documentation, and that -- * the name of M.I.T. not be used in advertising or publicity pertaining -- * to distribution of the software without specific, written prior -- * permission. Furthermore if you modify this software you must label -- * your software as modified software and not distribute it in such a -- * fashion that it might be confused with the original M.I.T. software. -- * M.I.T. makes no representations about the suitability of -- * this software for any purpose. It is provided "as is" without express -- * or implied warranty. -- */ -- --/* -- * A simple program to test the functionality of the resolver library. -- * It simply will try to get the IP address of the host, and then look -- * up the name from the address. If the resulting name does not contain the -- * domain name, then the resolve library is broken. -- * -- * Warning: It is possible to fool this program into thinking everything is -- * alright by a clever use of /etc/hosts - but this is better than nothing. -- * -- * Usage: -- * resolve [hostname] -- * -- * When invoked with no arguments, gethostname is used for the local host. -- * -- */ -- --/* This program tests the resolve library and sees if it is broken... */ -- --#include "k5-platform.h" --#include --#include --#include --#include --#ifdef HAVE_SYS_PARAM_H --#include --#endif -- --int --main(int argc, char **argv) --{ -- struct addrinfo *ai = NULL, hint; -- char myname[MAXHOSTNAMELEN + 1], namebuf[NI_MAXHOST], abuf[256]; -- const char *addrstr; -- int err, quiet = 0; -- -- argc--; argv++; -- while (argc) { -- if ((strcmp(*argv, "--quiet") == 0) || -- (strcmp(*argv, "-q") == 0)) { -- quiet++; -- } else -- break; -- argc--; argv++; -- } -- -- if (argc >= 1) { -- strlcpy(myname, *argv, sizeof(myname)); -- } else { -- if(gethostname(myname, MAXHOSTNAMELEN)) { -- perror("gethostname failure"); -- exit(1); -- } -- } -- -- myname[MAXHOSTNAMELEN] = '\0'; /* for safety */ -- -- /* Look up the address... */ -- if (!quiet) -- printf("Hostname: %s\n", myname); -- -- memset(&hint, 0, sizeof(hint)); -- hint.ai_flags = AI_CANONNAME; -- err = getaddrinfo(myname, 0, &hint, &ai); -- if (err) { -- fprintf(stderr, -- "Could not look up address for hostname '%s' - fatal\n", -- myname); -- exit(2); -- } -- -- if (!quiet) { -- addrstr = inet_ntop(ai->ai_family, ai->ai_addr, abuf, sizeof(abuf)); -- if (addrstr != NULL) -- printf("Host address: %s\n", addrstr); -- } -- -- err = getnameinfo(ai->ai_addr, ai->ai_addrlen, namebuf, sizeof(namebuf), -- NULL, 0, NI_NAMEREQD); -- if (err && !quiet) -- fprintf(stderr, "Error looking up IP address\n"); -- -- printf("%s%s\n", quiet ? "" : "FQDN: ", err ? ai->ai_canonname : namebuf); -- -- if (!quiet) -- printf("Resolve library appears to have passed the test\n"); -- -- freeaddrinfo(ai); -- return 0; --} diff --git a/Replace-gssrpc-tests-with-a-Python-script.patch b/Replace-gssrpc-tests-with-a-Python-script.patch deleted file mode 100644 index 3481a87..0000000 --- a/Replace-gssrpc-tests-with-a-Python-script.patch +++ /dev/null @@ -1,861 +0,0 @@ -From 1de586b414104a447a50ffb6f81c2f57ed3d3a34 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Sat, 15 Feb 2020 20:34:23 -0500 -Subject: [PATCH] Replace gssrpc tests with a Python script - -Replace the dejagnu RPC test framework with a short Python script to -do the same tests as fullrun.exp and gsserr.exp. Modify the server -test program to facilitate use by k5test.py. - -expire.exp, together with a comment in the client test program, was -designed to test a libdb2 btree bug via the gssrpc server-side -authentication code. That code was subsequently changed not to use -libdb2, before it was merged into the main krb5 tree (in revision 1.23 -of svc_auth_gssapi.c, according to the changelog removed in commit -2a43d772be1e45faa8e488d436b6e867371563fb). Remove the comment and do -not replace that test sequence. - -[rharwood@redhat.com: .gitignore] ---- - src/configure.ac | 2 - - src/lib/rpc/unit-test/Makefile.in | 36 +-- - src/lib/rpc/unit-test/client.c | 26 --- - src/lib/rpc/unit-test/config/unix.exp | 176 -------------- - src/lib/rpc/unit-test/lib/helpers.exp | 234 ------------------- - src/lib/rpc/unit-test/rpc_test.0/expire.exp | 49 ---- - src/lib/rpc/unit-test/rpc_test.0/fullrun.exp | 91 -------- - src/lib/rpc/unit-test/rpc_test.0/gsserr.exp | 30 --- - src/lib/rpc/unit-test/server.c | 13 +- - src/lib/rpc/unit-test/t_rpc.py | 29 +++ - 10 files changed, 41 insertions(+), 645 deletions(-) - delete mode 100644 src/lib/rpc/unit-test/config/unix.exp - delete mode 100644 src/lib/rpc/unit-test/lib/helpers.exp - delete mode 100644 src/lib/rpc/unit-test/rpc_test.0/expire.exp - delete mode 100644 src/lib/rpc/unit-test/rpc_test.0/fullrun.exp - delete mode 100644 src/lib/rpc/unit-test/rpc_test.0/gsserr.exp - create mode 100644 src/lib/rpc/unit-test/t_rpc.py - -diff --git a/src/configure.ac b/src/configure.ac -index 29be532cb..aafc462f9 100644 ---- a/src/configure.ac -+++ b/src/configure.ac -@@ -1102,8 +1102,6 @@ extern void endrpcent();], - AC_MSG_RESULT($k5_cv_type_endrpcent) - AC_DEFINE_UNQUOTED(ENDRPCENT_TYPE, $k5_cv_type_endrpcent, [Define as return type of endrpcent]) - K5_GEN_FILE(include/gssrpc/types.h:include/gssrpc/types.hin) --PASS=tcp --AC_SUBST(PASS) - - # for pkinit - AC_ARG_ENABLE([pkinit], -diff --git a/src/lib/rpc/unit-test/Makefile.in b/src/lib/rpc/unit-test/Makefile.in -index 0b6e5203d..309ae2b21 100644 ---- a/src/lib/rpc/unit-test/Makefile.in -+++ b/src/lib/rpc/unit-test/Makefile.in -@@ -16,10 +16,6 @@ server: server.o rpc_test_svc.o $(GSSRPC_DEPLIBS) $(KRB5_BASE_DEPLIBS) - - client.o server.o: rpc_test.h - --runenv.exp: Makefile -- $(RUN_SETUP); for i in $(RUN_VARS); do \ -- eval echo "set env\($$i\) \$$$$i"; done > runenv.exp -- - # If rpc_test.h and rpc_test_*.c do not work on your system, you can - # try using rpcgen by uncommenting these lines (be sure to uncomment - # then in the generated not Makefile.in). -@@ -34,37 +30,9 @@ runenv.exp: Makefile - # rm -f rpc_test.h rpc_test_clnt.c rpc_test_svc.c - # - --check unit-test: unit-test-@DO_TEST@ -- --unit-test-: -- @echo "+++" -- @echo "+++ WARNING: lib/rpc unit tests not run." -- @echo "+++ Either tcl, runtest, or Perl is unavailable." -- @echo "+++" -- @echo 'Skipped rpc tests: runtest or Perl not found' >> $(SKIPTESTS) -- --unit-test-ok: unit-test-body -- --PASS=@PASS@ --unit-test-body: runenv.sh runenv.exp -- $(RM) krb5cc_rpc_test_* -- $(ENV_SETUP) $(VALGRIND) $(START_SERVERS) -- RPC_TEST_KEYTAB=/tmp/rpc_test_keytab.$$$$ ; export RPC_TEST_KEYTAB ; \ -- trap "echo Failed, cleaning up... ; rm -f $$RPC_TEST_KEYTAB ; $(ENV_SETUP) $(STOP_SERVERS) ; trap '' 0 ; exit 1" 0 1 2 3 14 15 ; \ -- if $(ENV_SETUP) \ -- $(RUNTEST) SERVER=./server CLIENT=./client \ -- KINIT=$(BUILDTOP)/clients/kinit/kinit \ -- KDESTROY=$(BUILDTOP)/clients/kdestroy/kdestroy \ -- PRIOCNTL_HACK=@PRIOCNTL_HACK@ VALGRIND="$(VALGRIND)" \ -- PASS="$(PASS)" --tool rpc_test $(RUNTESTFLAGS) ; \ -- then \ -- echo Cleaning up... ; \ -- rm -f $$RPC_TEST_KEYTAB krb5cc_rpc_test_* ; \ -- $(ENV_SETUP) $(STOP_SERVERS) ; \ -- trap 0 ; exit 0 ; \ -- else exit 1 ; fi -+check-pytests: -+ $(RUNPYTEST) $(srcdir)/t_rpc.py $(PYTESTFLAGS) - - clean: - $(RM) server client -- $(RM) dbg.log rpc_test.log rpc_test.sum runenv.exp - -diff --git a/src/lib/rpc/unit-test/client.c b/src/lib/rpc/unit-test/client.c -index 5edde49df..c9a812bc5 100644 ---- a/src/lib/rpc/unit-test/client.c -+++ b/src/lib/rpc/unit-test/client.c -@@ -231,32 +231,6 @@ main(argc, argv) - else - gssrpc_xdr_free(xdr_wrapstring, echo_resp); - -- /* -- * Test fix for secure-rpc/586, part 1: btree keys must be -- * unique. Create another context from the same credentials; it -- * should have the same expiration time and will cause the server -- * to abort if the clients are not differentiated. -- * -- * Test fix for secure-rpc/586, part 2: btree keys cannot be -- * mutated in place. To test this: a second client, *with a -- * later expiration time*, must be run. The second client should -- * destroy itself *after* the first one; if the key-mutating bug -- * is not fixed, the second client_data will be in the btree -- * before the first, but its key will be larger; thus, when the -- * first client calls AUTH_DESTROY, the server won't find it in -- * the btree and call abort. -- * -- * For unknown reasons, running just a second client didn't -- * tickle the bug; the btree code seemed to guess which node to -- * look at first. Running a total of three clients does ticket -- * the bug. Thus, the full test sequence looks like this: -- * -- * kinit -l 20m user && client server test@ddn 200 -- * sleep 1 -- * kini -l 30m user && client server test@ddn 300 -- * sleep 1 -- * kinit -l 40m user && client server test@ddn 400 -- */ - if (! auth_once) { - tmp_auth = clnt->cl_auth; - clnt->cl_auth = auth_gssapi_create_default(clnt, target); -diff --git a/src/lib/rpc/unit-test/config/unix.exp b/src/lib/rpc/unit-test/config/unix.exp -deleted file mode 100644 -index 18da62be4..000000000 ---- a/src/lib/rpc/unit-test/config/unix.exp -+++ /dev/null -@@ -1,176 +0,0 @@ --# --# $Id$ --# -- --source runenv.exp -- --set kill /bin/kill --set sleep /bin/sleep --set kinit $KINIT --set kdestroy $KDESTROY -- --set hostname [exec hostname] -- --# Hack around Solaris 9 kernel race condition that causes last output --# from a pty to get dropped. --if { $PRIOCNTL_HACK } { -- catch {exec priocntl -s -c FX -m 30 -p 30 -i pid [getpid]} -- rename spawn oldspawn -- proc spawn { args } { -- upvar 1 spawn_id spawn_id -- set newargs {} -- set inflags 1 -- set eatnext 0 -- foreach arg $args { -- if { $arg == "-ignore" \ -- || $arg == "-open" \ -- || $arg == "-leaveopen" } { -- lappend newargs $arg -- set eatnext 1 -- continue -- } -- if [string match "-*" $arg] { -- lappend newargs $arg -- continue -- } -- if { $eatnext } { -- set eatnext 0 -- lappend newargs $arg -- continue -- } -- if { $inflags } { -- set inflags 0 -- set newargs [concat $newargs {priocntl -e -c FX -p 0}] -- } -- lappend newargs $arg -- } -- set pid [eval oldspawn $newargs] -- return $pid -- } --} -- --if { [string length $VALGRIND] } { -- rename spawn valgrind_aux_spawn -- proc spawn { args } { -- global VALGRIND -- upvar 1 spawn_id spawn_id -- set newargs {} -- set inflags 1 -- set eatnext 0 -- foreach arg $args { -- if { $arg == "-ignore" \ -- || $arg == "-open" \ -- || $arg == "-leaveopen" } { -- lappend newargs $arg -- set eatnext 1 -- continue -- } -- if [string match "-*" $arg] { -- lappend newargs $arg -- continue -- } -- if { $eatnext } { -- set eatnext 0 -- lappend newargs $arg -- continue -- } -- if { $inflags } { -- set inflags 0 -- # Only run valgrind for local programs, not -- # system ones. --#&&![string match "/bin/sh" $arg] sh is used to start kadmind! -- if [string match "/" [string index $arg 0]]&&![string match "/bin/ls" $arg]&&![regexp {/kshd$} $arg] { -- set newargs [concat $newargs $VALGRIND] -- } elseif [string match "." [string index $arg 0]] { -- set newargs [concat $newargs $VALGRIND] -- } -- } -- lappend newargs $arg -- } -- set pid [eval valgrind_aux_spawn $newargs] -- return $pid -- } --} -- --# this will initialize the database and keytab --load_lib "helpers.exp" -- --proc rpc_test_version {} { -- global CLIENT -- global SERVER -- -- clone_output "$CLIENT version " -- clone_output "$SERVER version " --} -- --proc rpc_test_load {} { -- # --} -- --# rpc_test_exit -- clean up and exit --proc rpc_test_exit {} { -- global server_id -- global server_pid -- global server_started -- global kill -- -- if {[catch { -- expect { -- -i $server_id -- eof { -- fail "server exited!" -- verbose $expect_out(buffer) 1 -- } -- timeout { pass "server survived" } -- } -- } tmp]} { -- fail "server exited! (expect failed)" -- } --} -- --# --# rpc_test_start -- start the rpc_test server running --# --proc rpc_test_start { } { -- global SERVER PROT -- global server_id -- global server_pid -- global server_started -- global server_port -- global env -- -- if [info exists server_pid] { rpc_test_exit } -- -- set env(KRB5_KTNAME) FILE:$env(RPC_TEST_KEYTAB) -- -- verbose "% $SERVER" 1 -- set server_pid [spawn $SERVER $PROT] -- set server_id $spawn_id -- set server_started 1 -- set server_port -1 -- -- unset env(KRB5_KTNAME) -- -- set timeout 30 -- -- expect { -- -re "port: (\[0-9\]*)\r\n" { -- set server_port $expect_out(1,string) -- } -- "running" { } -- eof { -- send_error "server exited!" -- verbose $expect_out(buffer) 1 -- } -- timeout { -- send_error "server didn't start in $timeout seconds" -- verbose $expect_out(buffer) 1 -- } -- } -- --} -- --set MULTIPASS { -- {tcp PROT=-t dummy=[rpc_test_start]} -- {udp PROT=-u dummy=[rpc_test_start]} --} -diff --git a/src/lib/rpc/unit-test/lib/helpers.exp b/src/lib/rpc/unit-test/lib/helpers.exp -deleted file mode 100644 -index eb2797c53..000000000 ---- a/src/lib/rpc/unit-test/lib/helpers.exp -+++ /dev/null -@@ -1,234 +0,0 @@ --if {[info commands exp_version] != {}} { -- set exp_version_4 [regexp {^4} [exp_version]] --} else { -- set exp_version_4 [regexp {^4} [expect_version]] --} -- --# Backward compatibility until we're using expect 5 everywhere --if {$exp_version_4} { -- global wait_error_index wait_errno_index wait_status_index -- set wait_error_index 0 -- set wait_errno_index 1 -- set wait_status_index 1 --} else { -- set wait_error_index 2 -- set wait_errno_index 3 -- set wait_status_index 3 --} -- --proc set_from_env {varname default_value} { -- global env -- upvar $varname v -- -- if [info exists env($varname)] { -- set v $env($varname) -- } else { -- set v $default_value -- } --} --proc expect_tcl_prompt {} { -- global kadmin_tcl_spawn_id -- expect { -- -i $kadmin_tcl_spawn_id -- -re "^% $" { } -- -re . { perror "unexpected output {$expect_out(buffer)} from subprocess, expecting tcl prompt" } -- timeout { perror "timeout waiting for tcl prompt" } -- eof { perror "eof from subprocess when expecting tcl prompt" } -- } --} --proc send_tcl_cmd_await_echo {cmd} { -- global kadmin_tcl_spawn_id -- send -i $kadmin_tcl_spawn_id "$cmd\n" -- expect { -- -i $kadmin_tcl_spawn_id -- -ex "$cmd\r\n" { } -- timeout { perror "timeout waiting for tcl subprocess to echo input" } -- eof { perror "eof waiting for tcl subprocess to echo input" } -- } --} --proc expect_kadm_ok {} { -- global kadmin_tcl_spawn_id -- expect { -- -i $kadmin_tcl_spawn_id -- -re "^OK KADM5_OK \[^\n\]*\n" {} -- -re "^ERROR \[^\n\]*\n" { perror "kadmin tcl subprocess reported unexpected error" } -- -re "^marshall_new_creds: \[^\n\]*\n" { exp_continue } -- -re "^gssapi_\[^\n\]*\n" { exp_continue } -- -re "^\r?\n" { exp_continue } -- eof { perror "kadmin tcl subprocess died" } -- default { perror "didn't get ok back" } -- } --} --proc setup_database {} { -- global env spawn_id kadmin_tcl_spawn_id TESTDIR CANON_HOST -- -- # XXXXX -- set_from_env TOP {/x/x/x/x/x} -- send_user "TOP=$TOP\n" -- -- set_from_env TESTDIR $env(TOP)/testing -- set_from_env CLNTTCL $TESTDIR/util/kadm5_clnt_tcl -- set_from_env TCLUTIL $TESTDIR/tcl/util.t -- set env(TCLUTIL) $TCLUTIL -- set env(PATH) "$TOP/install/admin:$env(PATH)" -- -- # $VERBOSE ? -- -- if [info exists spawn_id] { set x $spawn_id } -- spawn $CLNTTCL -- set kadmin_tcl_spawn_id $spawn_id -- if [info exists x] { set spawn_id $x } -- -- expect_tcl_prompt -- # tcl 8.4 for some reason screws up autodetection of output EOL -- # translation. Work around it for now. -- send_tcl_cmd_await_echo "if { \[info commands fconfigure\] != \"\" } { fconfigure stdout -translation lf }" -- expect_tcl_prompt -- send_tcl_cmd_await_echo "source {$TCLUTIL}" -- expect_tcl_prompt -- send_tcl_cmd_await_echo "set h {$CANON_HOST}" -- expect { -- -ex "$CANON_HOST\r\n" { } -- timeout { perror "timeout waiting for subprocess" } -- eof { perror "eof from subprocess" } -- } -- expect_tcl_prompt -- -- send_tcl_cmd_await_echo {kadm5_init admin admin $KADM5_ADMIN_SERVICE null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 server_handle} -- expect_kadm_ok -- expect "^% " -- send_tcl_cmd_await_echo {kadm5_create_principal $server_handle [simple_principal server/$h] {KADM5_PRINCIPAL} admin} -- expect_kadm_ok -- expect "^% " -- send_tcl_cmd_await_echo {kadm5_randkey_principal $server_handle server/$h key null} -- expect_kadm_ok -- expect "^% " -- send_tcl_cmd_await_echo {kadm5_create_principal $server_handle [simple_principal notserver/$h] {KADM5_PRINCIPAL} admin} -- expect_kadm_ok -- expect "^% " -- send_tcl_cmd_await_echo {kadm5_randkey_principal $server_handle notserver/$h key null} -- expect_kadm_ok -- expect "^% " -- send_tcl_cmd_await_echo {kadm5_destroy $server_handle} -- expect_kadm_ok -- expect "^% " -- wait -nowait -i $spawn_id -- close -i $spawn_id --} -- --if ![info exists CANON_HOST] { -- set CANON_HOST $env(QUALNAME) -- setup_database -- file delete $env(RPC_TEST_KEYTAB) -- exec $env(TOP)/cli/kadmin -p admin -w admin ktadd -k $env(RPC_TEST_KEYTAB) server/$CANON_HOST --} -- -- --proc kinit {princ pass lifetime} { -- global kinit -- global wait_error_index wait_errno_index wait_status_index -- -- spawn -noecho $kinit -5 -l $lifetime $princ -- expect { -- -re "Password for $princ.*: " { send "$pass\n"; expect eof } -- timeout { perror "Timeout waiting for kinit"; close } -- eof -- } -- -- set ret [wait] -- if {[lindex $ret $wait_error_index] == -1} { -- perror \ -- "wait(kinit $princ) returned error [lindex $ret $wait_errno_index]" -- } else { -- if {[lindex $ret $wait_status_index] != 0} { -- perror \ -- "kinit $princ failed with [lindex $ret $wait_status_index]" -- } -- } --} -- --proc flush_server {} { -- global server_id -- global expect_out -- -- verbose "flushing server output" 1 -- -- while {1} { -- set timeout 5 -- -- expect { -- -i $server_id -- -re "^.+$" { -- verbose "server output: $expect_out(buffer)" -- } -- timeout { break } -- } -- } --} -- --proc start_client {testname ccname user password lifetime count -- {target ""}} { -- global env CLIENT PROT hostname server_port spawn_id verbose -- -- if {$target == ""} { -- set target "server@$hostname" -- } -- -- set env(KRB5CCNAME) FILE:[pwd]/krb5cc_rpc_test_$ccname -- kinit $user $password $lifetime -- -- if {$verbose > 0} { -- spawn $CLIENT -a 1 -s 1 -m 1 $PROT $hostname $server_port $target $count -- } else { -- spawn $CLIENT $PROT $hostname $server_port $target $count -- } -- -- verbose "$testname: client $ccname started" -- -- unset env(KRB5CCNAME) --} -- --proc eof_client {testname ccname id status} { -- verbose "$testname: eof'ing for client $ccname" 1 -- -- expect { -- -i $id -- -re "^marshall_new_creds\[^\n\]*\n" { exp_continue } -- -re "^gssapi_\[^\n\]*\n" { exp_continue } -- -re "^\r?\n" { exp_continue } -- eof { verbose $expect_out(buffer) 1 } -- timeout { -- fail "$testname: timeout waiting for client $ccname to exit" -- } -- } -- wait_client $testname $ccname $id $status --} -- -- --proc wait_client {testname ccname id status} { -- global env -- global kill -- global kdestroy -- global wait_error_index wait_errno_index wait_status_index -- -- verbose "$testname: waiting for client $ccname" 1 -- -- set ret [wait -i $id] -- if {[lindex $ret $wait_error_index] == -1} { -- fail \ -- "$testname: wait $ccname returned error [lindex $ret $wait_errno_index]" -- } else { -- if {[lindex $ret $wait_status_index] == $status} { -- pass "$testname: client $ccname" -- } else { -- fail "$testname: client $ccname: unexpected return status [lindex $ret $wait_status_index], should be $status." -- } -- } -- -- set env(KRB5CCNAME) FILE:[pwd]/krb5cc_rpc_test_$ccname -- if {[catch "exec $kdestroy -5"] != 0} { -- perror "$testname: cannot destroy client $ccname ccache" -- } -- -- unset env(KRB5CCNAME) --} -diff --git a/src/lib/rpc/unit-test/rpc_test.0/expire.exp b/src/lib/rpc/unit-test/rpc_test.0/expire.exp -deleted file mode 100644 -index e19cca0ef..000000000 ---- a/src/lib/rpc/unit-test/rpc_test.0/expire.exp -+++ /dev/null -@@ -1,49 +0,0 @@ --set timeout 40 -- --load_lib "helpers.exp" -- --global server_started -- --proc expired {} { -- global spawn_id server_id -- -- start_client expired expired testuser notathena -1m 100 -- eof_client expired expired $spawn_id 2 -- -- expect { -- -i $server_id -- -re "rpc_test server: Authen.*failed:.*credential.*expired" { pass "expired" } -- timeout { fail "expired: timeout waiting for expired creds error" } -- } -- -- flush_server --} -- --# This test doesn't work after #6948, because the client won't try to --# authenticate using an expired TGT. --#if { $server_started } {expired } -- --proc overlap {} { -- global spawn_id -- -- start_client expire 1 testuser notathena 20m 100 -- set client1_id $spawn_id -- flush_server -- -- start_client expire 2 testuser notathena 40m 300 -- set client2_id $spawn_id -- flush_server -- -- start_client expire 3 testuser notathena 60m 500 -- set client3_id $spawn_id -- flush_server -- -- eof_client expire 1 $client1_id 0 -- eof_client expire 2 $client2_id 0 -- eof_client expire 3 $client3_id 0 -- -- flush_server --} --if { $server_started } {overlap} -- -- -diff --git a/src/lib/rpc/unit-test/rpc_test.0/fullrun.exp b/src/lib/rpc/unit-test/rpc_test.0/fullrun.exp -deleted file mode 100644 -index 73083de1f..000000000 ---- a/src/lib/rpc/unit-test/rpc_test.0/fullrun.exp -+++ /dev/null -@@ -1,91 +0,0 @@ --set timeout 120 -- --load_lib "helpers.exp" -- --global spawn_id --global server_id --global server_started -- --if { !$server_started } {return} -- --# Start the client and do a full run --start_client "full run" fullrun testuser notathena 8h 1026 --set client_id $spawn_id -- --# --# test: did we get 11 dots? --# --verbose "Starting RPC echo test. This will take about 50 seconds.\n" -- --set ver_line "rpc_test server: bad verifier\[^\r\n\]*\[\r\n]+" -- --set dots 0 --set server_lines 0 --while {1} { -- expect { -- -i $server_id -- -re $ver_line { -- verbose "Got line from server." -- incr server_lines -- } -- default { -- exp_continue -- } -- -- -i $client_id -- . { -- incr dots -- verbose "$expect_out(buffer)" 1 -- if ($dots==11) { break } -- } -- eof { -- # -- # test: was the exit status right? -- # -- wait_client "full run" fullrun $client_id 0 -- break -- } -- -- timeout { -- verbose "Timeout waiting for dot\n" 1 -- fail "full run: timeout waiting for dot" -- break -- } -- } --} --if {$dots==11} { -- pass "fullrun: echo test" --} else { -- fail "fullrun: echo test: expected 11 dots, got $dots" --} -- --# --# test: server logged four bad verifiers? --# --verbose "full run: checking server output" -- --# Small timeout, since the server should have already printed everything --set timeout 5 -- --while {$server_lines < 4} { -- expect { -- -i $server_id -- -re $ver_line { -- incr server_lines -- } -- -re ".+\r\n" { -- verbose "Unexpected server output: $expect_out(buffer)" -- } -- default { -- break -- } -- } --} -- --if {$server_lines == 4} { -- pass "fullrun: bad verifiers" --} else { -- fail "fullrun: expected four bad verifiers, got $server_lines" --} -- --flush_server -diff --git a/src/lib/rpc/unit-test/rpc_test.0/gsserr.exp b/src/lib/rpc/unit-test/rpc_test.0/gsserr.exp -deleted file mode 100644 -index 005971989..000000000 ---- a/src/lib/rpc/unit-test/rpc_test.0/gsserr.exp -+++ /dev/null -@@ -1,30 +0,0 @@ --set timeout 30 -- --load_lib "helpers.exp" -- --global spawn_id --global server_id --global server_started --global hostname -- --if { !$server_started } {return} -- --start_client "gss err" gsserr testuser notathena 8h 1026 notserver@$hostname -- --eof_client "gss err" gsserr $spawn_id 2 -- --# --# test: server logged an authentication attempted failed? --# --verbose "gss err: checking server output" -- --expect { -- -i $server_id -- -re "rpc_test server: Authent.*failed: .* not found in keytab" { -- pass "gss err: server logged auth error" -- } -- eof { fail "gss err: server exited" } -- timeout { fail "gss err: timeout waiting for server output" } --} -- --flush_server -diff --git a/src/lib/rpc/unit-test/server.c b/src/lib/rpc/unit-test/server.c -index 13e99bb06..c3bbcbf8c 100644 ---- a/src/lib/rpc/unit-test/server.c -+++ b/src/lib/rpc/unit-test/server.c -@@ -37,7 +37,7 @@ static void rpc_test_badverf(gss_name_t client, gss_name_t server, - caddr_t data); - - #ifndef SERVICE_NAME --#define SERVICE_NAME "server" -+#define SERVICE_NAME "host" - #endif - - static void usage() -@@ -120,7 +120,6 @@ main(int argc, char **argv) - prot == IPPROTO_TCP ? "tcp" : "udp"); - exit(1); - } -- printf("port: %d\n", (int)transp->xp_port); - - if (svcauth_gssapi_set_names(names, 0) == FALSE) { - fprintf(stderr, "unable to set gssapi names\n"); -@@ -144,6 +143,8 @@ main(int argc, char **argv) - signal(SIGTERM, handlesig); - #endif - printf("running\n"); -+ printf("port: %d\n", (int)transp->xp_port); -+ fflush(stdout); - - svc_run(); - fprintf(stderr, "svc_run returned"); -@@ -177,6 +178,7 @@ static void rpc_test_badverf(gss_name_t client, gss_name_t server, - inet_ntoa(rqst->rq_xprt->xp_raddr.sin_addr), - ntohs(rqst->rq_xprt->xp_raddr.sin_port), - (int) server_name.length, (char *) server_name.value); -+ fflush(stdout); - - (void) gss_release_buffer(&minor_stat, &client_name); - (void) gss_release_buffer(&minor_stat, &server_name); -@@ -211,6 +213,7 @@ void rpc_test_badauth(OM_uint32 major, OM_uint32 minor, - printf("rpc_test server: Authentication attempt failed: %s", a); - log_badauth_display_status(major, minor); - printf("\n"); -+ fflush(stdout); - } - - void log_miscerr(struct svc_req *rqst, struct rpc_msg *msg, -@@ -220,6 +223,7 @@ void log_miscerr(struct svc_req *rqst, struct rpc_msg *msg, - - a = inet_ntoa(rqst->rq_xprt->xp_raddr.sin_addr); - printf("Miscellaneous RPC error: %s, %s\n", a, error); -+ fflush(stdout); - } - - void log_badauth_display_status(OM_uint32 major, OM_uint32 minor) -@@ -243,10 +247,12 @@ void log_badauth_display_status_1(OM_uint32 code, int type, int rec) - log_badauth_display_status_1(gssstat,GSS_C_GSS_CODE,1); - log_badauth_display_status_1(minor_stat, - GSS_C_MECH_CODE, 1); -- } else -+ } else { - printf("GSS-API authentication error %.*s: " - "recursive failure!\n", (int) msg.length, - (char *)msg.value); -+ } -+ fflush(stdout); - return; - } - -@@ -256,4 +262,5 @@ void log_badauth_display_status_1(OM_uint32 code, int type, int rec) - if (!msg_ctx) - break; - } -+ fflush(stdout); - } -diff --git a/src/lib/rpc/unit-test/t_rpc.py b/src/lib/rpc/unit-test/t_rpc.py -new file mode 100644 -index 000000000..4e565d25c ---- /dev/null -+++ b/src/lib/rpc/unit-test/t_rpc.py -@@ -0,0 +1,29 @@ -+import re -+ -+from k5test import * -+ -+realm = K5Realm() -+ -+server = realm.start_server(['./server', '-t'], 'running') -+line = server.stdout.readline() -+portstr = re.match(r'^port: (\d+)$', line).group(1) -+ -+realm.run(['./client', '-t', hostname, portstr, 'host@' + hostname, '1026'], -+ expected_msg='...........') -+ -+for i in range(4): -+ line = server.stdout.readline() -+ if 'rpc_test server: bad verifier from user@KRBTEST.COM at ' not in line: -+ fail('unexpected server message: ' + line) -+ output(line) -+ -+realm.addprinc('nokey/' + hostname) -+ -+realm.run(['./client', '-t', hostname, portstr, 'nokey@' + hostname, '1026'], -+ expected_code=2) -+ -+line = server.stdout.readline() -+if 'rpc_test server: Authentication attempt failed: ' not in line: -+ fail('unexpected server message: ' + line) -+ -+success('gssrpc auth_gssapi tests') diff --git a/Use-two-queues-for-concurrent-t_otp.py-daemons.patch b/Use-two-queues-for-concurrent-t_otp.py-daemons.patch deleted file mode 100644 index 80093f3..0000000 --- a/Use-two-queues-for-concurrent-t_otp.py-daemons.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 35d041e432ea6d4611b232cc9bb72a36552eda27 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Wed, 4 Mar 2020 17:18:51 -0500 -Subject: [PATCH] Use two queues for concurrent t_otp.py daemons - -t_otp.py occasionally fails during the #8708 regression test, reading -a true answer instead of the expected false answer during the first -verify() call. Most likely the daemons are writing their answers to -the shared queue out of order. Use a separate queue for the second -daemon to ensure correct correlation of results. - -(cherry picked from commit c03f67eefec05db19e84e889fab7c25904929633) ---- - src/tests/t_otp.py | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/src/tests/t_otp.py b/src/tests/t_otp.py -index cba871a0f..c3b820a41 100755 ---- a/src/tests/t_otp.py -+++ b/src/tests/t_otp.py -@@ -256,16 +256,17 @@ verify(daemon, queue, True, realm.user_princ, 'accept') - ## tokens configured, with the first rejecting and the second - ## accepting. With the bug, the KDC incorrectly rejects the request - ## and then performs invalid memory accesses, most likely crashing. -+queue2 = Queue() - daemon1 = UDPRadiusDaemon(args=(server_addr, secret_file, 'accept1', queue)) --daemon2 = UnixRadiusDaemon(args=(socket_file, None, 'accept2', queue)) -+daemon2 = UnixRadiusDaemon(args=(socket_file, None, 'accept2', queue2)) - daemon1.start() - queue.get() - daemon2.start() --queue.get() -+queue2.get() - oconf = '[' + otpconfig_1('udp') + ', ' + otpconfig_1('unix') + ']' - realm.run([kadminl, 'setstr', realm.user_princ, 'otp', oconf]) - realm.kinit(realm.user_princ, 'accept2', flags=flags) - verify(daemon1, queue, False, realm.user_princ.split('@')[0], 'accept2') --verify(daemon2, queue, True, realm.user_princ, 'accept2') -+verify(daemon2, queue2, True, realm.user_princ, 'accept2') - - success('OTP tests') diff --git a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch b/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch index 3d0cd46..6d74df5 100644 --- a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch +++ b/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch @@ -1,4 +1,4 @@ -From 3a83d2b4c2a3eea5dde8de883ee9b41630a6a487 Mon Sep 17 00:00:00 2001 +From 146967416993f66c3ba32cbf3881e43e7bc1ed1c Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 9 Nov 2018 15:12:21 -0500 Subject: [PATCH] [downstream] FIPS with PRNG and RADIUS and MD4 @@ -39,10 +39,10 @@ Last-updated: krb5-1.17 15 files changed, 151 insertions(+), 33 deletions(-) diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst -index 1d2aa7f68..3a8b9cf47 100644 +index e4e2443ed..af3df5871 100644 --- a/doc/admin/conf_files/krb5_conf.rst +++ b/doc/admin/conf_files/krb5_conf.rst -@@ -331,6 +331,12 @@ The libdefaults section may contain any of the following relations: +@@ -330,6 +330,12 @@ The libdefaults section may contain any of the following relations: qualification of shortnames, set this relation to the empty string with ``qualify_shortname = ""``. (New in release 1.18.) @@ -111,7 +111,7 @@ index 2da691329..f79679a0b 100644 state->data = (void *) malloc(16); if (state->data == NULL) diff --git a/src/lib/crypto/openssl/enc_provider/rc4.c b/src/lib/crypto/openssl/enc_provider/rc4.c -index a65d57b7a..6ccaca94a 100644 +index bc87c6f42..9bf407899 100644 --- a/src/lib/crypto/openssl/enc_provider/rc4.c +++ b/src/lib/crypto/openssl/enc_provider/rc4.c @@ -66,6 +66,9 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data, @@ -349,7 +349,7 @@ index 03c613716..d89982a13 100644 return retval; diff --git a/src/lib/krad/internal.h b/src/lib/krad/internal.h -index 996a89372..312dc8258 100644 +index 0143d155a..223ffd730 100644 --- a/src/lib/krad/internal.h +++ b/src/lib/krad/internal.h @@ -39,6 +39,8 @@ @@ -475,7 +475,7 @@ index c597174b6..fc2d24800 100644 } diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c -index 437f7e91a..0f90443ce 100644 +index c96a9b4ee..eca432424 100644 --- a/src/lib/krad/remote.c +++ b/src/lib/krad/remote.c @@ -263,7 +263,7 @@ on_io_write(krad_remote *rr) diff --git a/downstream-Remove-3des-support.patch b/downstream-Remove-3des-support.patch index ae4124f..1bf529e 100644 --- a/downstream-Remove-3des-support.patch +++ b/downstream-Remove-3des-support.patch @@ -1,4 +1,4 @@ -From 0ef71d2bef3efcb38b20fc8b3050944286ada726 Mon Sep 17 00:00:00 2001 +From 3af536f114e1c1b33b1579f9f16bbb3f497d4a1d Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 26 Mar 2019 18:51:10 -0400 Subject: [PATCH] [downstream] Remove 3des support @@ -8,11 +8,11 @@ des3-hmac-sha1, des3-cbc-sha1-kd). Update all tests and documentation to user other enctypes. Mark the 3DES enctypes UNSUPPORTED and retain their constants. -Last-updated: 1.18-beta2 +Last-updated: 1.19-beta1 --- doc/admin/advanced/retiring-des.rst | 11 + doc/admin/conf_files/kdc_conf.rst | 7 +- - doc/admin/enctypes.rst | 13 +- + doc/admin/enctypes.rst | 10 +- doc/admin/troubleshoot.rst | 9 +- doc/appdev/refs/macros/index.rst | 1 - doc/conf.py | 2 +- @@ -28,7 +28,7 @@ Last-updated: 1.18-beta2 src/lib/crypto/builtin/des/Makefile.in | 80 ---- src/lib/crypto/builtin/des/d3_aead.c | 133 ------ src/lib/crypto/builtin/des/d3_kysched.c | 51 --- - src/lib/crypto/builtin/des/deps | 148 ------- + src/lib/crypto/builtin/des/deps | 150 ------- src/lib/crypto/builtin/des/des_int.h | 285 ------------- src/lib/crypto/builtin/des/des_keys.c | 40 -- src/lib/crypto/builtin/des/destest.c | 240 ----------- @@ -45,7 +45,7 @@ Last-updated: 1.18-beta2 src/lib/crypto/builtin/des/t_verify.c | 395 ------------------ src/lib/crypto/builtin/des/weak_key.c | 86 ---- .../crypto/builtin/enc_provider/Makefile.in | 6 +- - src/lib/crypto/builtin/enc_provider/deps | 12 - + src/lib/crypto/builtin/enc_provider/deps | 13 - src/lib/crypto/builtin/enc_provider/des3.c | 105 ----- src/lib/crypto/crypto_tests/t_cf2.expected | 1 - src/lib/crypto/crypto_tests/t_cf2.in | 5 - @@ -83,7 +83,6 @@ Last-updated: 1.18-beta2 .../api.current/randkey-principal-v2.exp | 4 +- src/lib/krb5/krb/init_ctx.c | 3 - src/lib/krb5/krb/s4u_creds.c | 2 - - src/lib/krb5/krb/t_copy_context.c | 2 +- src/lib/krb5/krb/t_etypes.c | 48 +-- src/lib/krb5/os/t_trace.c | 4 +- src/lib/krb5/os/t_trace.ref | 2 +- @@ -106,7 +105,7 @@ Last-updated: 1.18-beta2 src/tests/t_salt.py | 5 +- src/util/k5test.py | 7 - .../leash/htmlhelp/html/Encryption_Types.htm | 13 - - 96 files changed, 163 insertions(+), 4834 deletions(-) + 95 files changed, 160 insertions(+), 4835 deletions(-) delete mode 100644 src/lib/crypto/builtin/des/ISSUES delete mode 100644 src/lib/crypto/builtin/des/Makefile.in delete mode 100644 src/lib/crypto/builtin/des/d3_aead.c @@ -135,7 +134,7 @@ Last-updated: 1.18-beta2 delete mode 100644 src/lib/crypto/openssl/enc_provider/des3.c diff --git a/doc/admin/advanced/retiring-des.rst b/doc/admin/advanced/retiring-des.rst -index 4a964c15c..cb6258d77 100644 +index 38f76d3f4..d5e3c30c0 100644 --- a/doc/admin/advanced/retiring-des.rst +++ b/doc/admin/advanced/retiring-des.rst @@ -10,6 +10,13 @@ ability have rendered DES vulnerable to brute force attacks on its 56-bit @@ -164,19 +163,19 @@ index 4a964c15c..cb6258d77 100644 ------------- diff --git a/doc/admin/conf_files/kdc_conf.rst b/doc/admin/conf_files/kdc_conf.rst -index 9759756a2..cf8a12547 100644 +index 1dc958d62..3a72aabef 100644 --- a/doc/admin/conf_files/kdc_conf.rst +++ b/doc/admin/conf_files/kdc_conf.rst -@@ -843,8 +843,6 @@ Encryption types marked as "weak" are available for compatibility but - not recommended for use. +@@ -848,8 +848,6 @@ Encryption types marked as "weak" and "deprecated" are available for + compatibility but not recommended for use. ==================================================== ========================================================= -des3-cbc-raw Triple DES cbc mode raw (weak) --des3-cbc-sha1 des3-hmac-sha1 des3-cbc-sha1-kd Triple DES cbc mode with HMAC/sha1 +-des3-cbc-sha1 des3-hmac-sha1 des3-cbc-sha1-kd Triple DES cbc mode with HMAC/sha1 (deprecated) aes256-cts-hmac-sha1-96 aes256-cts aes256-sha1 AES-256 CTS mode with 96-bit SHA-1 HMAC aes128-cts-hmac-sha1-96 aes128-cts aes128-sha1 AES-128 CTS mode with 96-bit SHA-1 HMAC aes256-cts-hmac-sha384-192 aes256-sha2 AES-256 CTS mode with 192-bit SHA-384 HMAC -@@ -853,7 +851,6 @@ arcfour-hmac rc4-hmac arcfour-hmac-md5 RC4 with HMAC/MD5 +@@ -858,7 +856,6 @@ arcfour-hmac rc4-hmac arcfour-hmac-md5 RC4 with HMAC/MD5 (deprecat arcfour-hmac-exp rc4-hmac-exp arcfour-hmac-md5-exp Exportable RC4 with HMAC/MD5 (weak) camellia256-cts-cmac camellia256-cts Camellia-256 CTS mode with CMAC camellia128-cts-cmac camellia128-cts Camellia-128 CTS mode with CMAC @@ -184,7 +183,7 @@ index 9759756a2..cf8a12547 100644 aes The AES family: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, aes256-cts-hmac-sha384-192, and aes128-cts-hmac-sha256-128 rc4 The RC4 family: arcfour-hmac camellia The Camellia family: camellia256-cts-cmac and camellia128-cts-cmac -@@ -865,8 +862,8 @@ from the current list by prefixing them with a minus sign ("-"). +@@ -870,8 +867,8 @@ from the current list by prefixing them with a minus sign ("-"). Types or families can be prefixed with a plus sign ("+") for symmetry; it has the same meaning as just listing the type or family. For example, "``DEFAULT -rc4``" would be the default set of encryption @@ -196,35 +195,35 @@ index 9759756a2..cf8a12547 100644 While **aes128-cts** and **aes256-cts** are supported for all Kerberos diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst -index caf6d9267..65b55cdb9 100644 +index 047185afb..b08d954d9 100644 --- a/doc/admin/enctypes.rst +++ b/doc/admin/enctypes.rst -@@ -129,7 +129,7 @@ enctype weak? krb5 Windows - des-cbc-crc weak <1.18 >=2000 - des-cbc-md4 weak <1.18 ? - des-cbc-md5 weak <1.18 >=2000 --des3-cbc-sha1 >=1.1 none -+des3-cbc-sha1 <1.18 none - arcfour-hmac >=1.3 >=2000 - arcfour-hmac-exp weak >=1.3 >=2000 - aes128-cts-hmac-sha1-96 >=1.3 >=Vista -@@ -140,7 +140,10 @@ camellia128-cts-cmac >=1.9 none - camellia256-cts-cmac >=1.9 none - ========================== ===== ======== ======= - --krb5 releases 1.18 and later do not support single-DES. krb5 releases --1.8 and later disable the single-DES enctypes by default. Microsoft --Windows releases Windows 7 and later disable single-DES enctypes by --default. -+krb5 releases 1.8 and later disable the single-DES enctypes by -+default. Microsoft Windows releases Windows 7 and later disable -+single-DES enctypes by default. +@@ -129,7 +129,7 @@ enctype weak? krb5 Windows + des-cbc-crc weak <1.18 >=2000 + des-cbc-md4 weak <1.18 ? + des-cbc-md5 weak <1.18 >=2000 +-des3-cbc-sha1 deprecated >=1.1 none ++des3-cbc-sha1 deprecated <1.18 none + arcfour-hmac deprecated >=1.3 >=2000 + arcfour-hmac-exp weak >=1.3 >=2000 + aes128-cts-hmac-sha1-96 >=1.3 >=Vista +@@ -148,9 +148,11 @@ default. + krb5 releases 1.17 and later flag deprecated encryption types + (including ``des3-cbc-sha1`` and ``arcfour-hmac``) in KDC logs and + kadmin output. krb5 release 1.19 issues a warning during initial +-authentication if ``des3-cbc-sha1`` is used. Future releases will +-disable ``des3-cbc-sha1`` by default and eventually remove support for +-it. ++authentication if ``des3-cbc-sha1`` is used. + +krb5 releases 1.18 and later remove single-DES and 3DES +(downstream-only patch) enctype support. Microsoft Windows never +supported 3DES. + + + Migrating away from older encryption types diff --git a/doc/admin/troubleshoot.rst b/doc/admin/troubleshoot.rst -index 6a0c7f89b..263fc9c97 100644 +index ade5e1f87..e4dc54f7e 100644 --- a/doc/admin/troubleshoot.rst +++ b/doc/admin/troubleshoot.rst @@ -73,11 +73,10 @@ credential verification failed: KDC has no support for encryption type @@ -244,7 +243,7 @@ index 6a0c7f89b..263fc9c97 100644 .. _err_cert_chain_cert_expired: diff --git a/doc/appdev/refs/macros/index.rst b/doc/appdev/refs/macros/index.rst -index 68debe714..788d094bf 100644 +index cebb6644c..4d51e795c 100644 --- a/doc/appdev/refs/macros/index.rst +++ b/doc/appdev/refs/macros/index.rst @@ -36,7 +36,6 @@ Public @@ -256,10 +255,10 @@ index 68debe714..788d094bf 100644 CKSUMTYPE_NIST_SHA.rst CKSUMTYPE_RSA_MD4.rst diff --git a/doc/conf.py b/doc/conf.py -index c32b2882a..5eeafc30f 100644 +index 9226b8e01..19cf38326 100644 --- a/doc/conf.py +++ b/doc/conf.py -@@ -272,7 +272,7 @@ else: +@@ -271,7 +271,7 @@ else: rst_epilog += ''' .. |krb5conf| replace:: ``/etc/krb5.conf`` .. |defkeysalts| replace:: ``aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal`` @@ -269,7 +268,7 @@ index c32b2882a..5eeafc30f 100644 .. |copy| unicode:: U+000A9 ''' diff --git a/doc/mitK5features.rst b/doc/mitK5features.rst -index 5d286b6ee..f4594ed13 100644 +index 4954bb3aa..92ce2a772 100644 --- a/doc/mitK5features.rst +++ b/doc/mitK5features.rst @@ -37,7 +37,7 @@ Database backends: LDAP, DB2, LMDB @@ -282,7 +281,7 @@ index 5d286b6ee..f4594ed13 100644 Interoperability ---------------- diff --git a/src/Makefile.in b/src/Makefile.in -index 56c7a4e6f..70db82a30 100644 +index f9270aba2..c958da60f 100644 --- a/src/Makefile.in +++ b/src/Makefile.in @@ -130,7 +130,7 @@ WINMAKEFILES=Makefile \ @@ -304,10 +303,10 @@ index 56c7a4e6f..70db82a30 100644 ##DOS## $(WCONFIG) config < $@.in > $@ ##DOS##lib\crypto\builtin\camellia\Makefile: lib\crypto\builtin\camellia\Makefile.in $(MKFDEP) diff --git a/src/configure.ac b/src/configure.ac -index 440a22bd9..d4e4da525 100644 +index bd151ca26..27c2383d7 100644 --- a/src/configure.ac +++ b/src/configure.ac -@@ -1481,7 +1481,6 @@ V5_AC_OUTPUT_MAKEFILE(. +@@ -1480,7 +1480,6 @@ V5_AC_OUTPUT_MAKEFILE(. lib/crypto lib/crypto/krb lib/crypto/$CRYPTO_IMPL lib/crypto/$CRYPTO_IMPL/enc_provider lib/crypto/$CRYPTO_IMPL/hash_provider @@ -316,7 +315,7 @@ index 440a22bd9..d4e4da525 100644 lib/crypto/$CRYPTO_IMPL/sha1 lib/crypto/$CRYPTO_IMPL/sha2 lib/crypto/$CRYPTO_IMPL/aes lib/crypto/$CRYPTO_IMPL/camellia diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin -index e9435c693..6355e6540 100644 +index db80063eb..63e67a2ba 100644 --- a/src/include/krb5/krb5.hin +++ b/src/include/krb5/krb5.hin @@ -426,8 +426,8 @@ typedef struct _krb5_crypto_iov { @@ -365,10 +364,10 @@ index 8a4b87de1..d7f1d076b 100644 + supported_enctypes = aes256-cts:normal aes128-cts:normal aes256-sha2:normal aes128-sha2:normal } diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c -index ba0ce0b71..e3352f9cc 100644 +index 60f30c4f4..c65375aef 100644 --- a/src/kdc/kdc_util.c +++ b/src/kdc/kdc_util.c -@@ -1103,8 +1103,6 @@ enctype_name(krb5_enctype ktype, char *buf, size_t buflen) +@@ -1017,8 +1017,6 @@ enctype_name(krb5_enctype ktype, char *buf, size_t buflen) name = "rsaEncryption-EnvOID"; else if (ktype == ENCTYPE_RSA_ES_OAEP_ENV) name = "id-RSAES-OAEP-EnvOID"; @@ -377,7 +376,7 @@ index ba0ce0b71..e3352f9cc 100644 else return krb5_enctype_to_name(ktype, FALSE, buf, buflen); -@@ -1826,8 +1824,6 @@ krb5_boolean +@@ -1605,8 +1603,6 @@ krb5_boolean enctype_requires_etype_info_2(krb5_enctype enctype) { switch(enctype) { @@ -470,7 +469,7 @@ index 157891103..000000000 -const? diff --git a/src/lib/crypto/builtin/des/Makefile.in b/src/lib/crypto/builtin/des/Makefile.in deleted file mode 100644 -index ed25dab7c..000000000 +index 54b329d0f..000000000 --- a/src/lib/crypto/builtin/des/Makefile.in +++ /dev/null @@ -1,80 +0,0 @@ @@ -527,7 +526,7 @@ index ed25dab7c..000000000 -verify$(EXEEXT): t_verify.$(OBJEXT) $(TOBJS) f_parity.$(OBJEXT) \ - $(COM_ERR_DEPLIB) $(SUPPORT_DEPLIB) - $(CC_LINK) -o $@ t_verify.$(OBJEXT) $(TOBJS) f_parity.$(OBJEXT) \ -- -lcom_err $(SUPPORT_LIB) +- $(COM_ERR_LIB) $(SUPPORT_LIB) - -destest$(EXEEXT): destest.$(OBJEXT) $(TOBJS) $(SUPPORT_DEPLIB) - $(CC_LINK) -o $@ destest.$(OBJEXT) $(TOBJS) $(SUPPORT_LIB) @@ -752,17 +751,18 @@ index ebd1050b1..000000000 -} diff --git a/src/lib/crypto/builtin/des/deps b/src/lib/crypto/builtin/des/deps deleted file mode 100644 -index df2a31dac..000000000 +index a1db1f36e..000000000 --- a/src/lib/crypto/builtin/des/deps +++ /dev/null -@@ -1,148 +0,0 @@ +@@ -1,150 +0,0 @@ -# -# Generated makefile dependencies follow. -# -d3_aead.so d3_aead.po $(OUTPRE)d3_aead.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ - $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ - $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \ -- $(srcdir)/../aes/aes.h $(srcdir)/../crypto_mod.h $(srcdir)/../sha2/sha2.h \ +- $(srcdir)/../aes/aes.h $(srcdir)/../aes/brg_types.h \ +- $(srcdir)/../crypto_mod.h $(srcdir)/../sha2/sha2.h \ - $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ @@ -786,19 +786,20 @@ index df2a31dac..000000000 - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ - $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../aes/aes.h \ -- $(srcdir)/../crypto_mod.h $(srcdir)/../sha2/sha2.h \ -- $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ -- $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ -- $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ -- $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ -- $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \ -- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \ -- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ -- des_int.h des_keys.c +- $(srcdir)/../aes/brg_types.h $(srcdir)/../crypto_mod.h \ +- $(srcdir)/../sha2/sha2.h $(top_srcdir)/include/k5-buf.h \ +- $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ +- $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ +- $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ +- $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \ +- $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ +- $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \ +- $(top_srcdir)/include/socket-utils.h des_int.h des_keys.c -f_aead.so f_aead.po $(OUTPRE)f_aead.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ - $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ - $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \ -- $(srcdir)/../aes/aes.h $(srcdir)/../crypto_mod.h $(srcdir)/../sha2/sha2.h \ +- $(srcdir)/../aes/aes.h $(srcdir)/../aes/brg_types.h \ +- $(srcdir)/../crypto_mod.h $(srcdir)/../sha2/sha2.h \ - $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ @@ -1489,7 +1490,7 @@ index 52114304e..000000000 -} diff --git a/src/lib/crypto/builtin/des/doc/libdes.doc b/src/lib/crypto/builtin/des/doc/libdes.doc deleted file mode 100644 -index 19c03c1d3..000000000 +index 6e9431ed2..000000000 --- a/src/lib/crypto/builtin/des/doc/libdes.doc +++ /dev/null @@ -1,208 +0,0 @@ @@ -1644,7 +1645,7 @@ index 19c03c1d3..000000000 - by "*key", then after getting a new key, call the des_set_key() - routine when needed. - -- No meaningfull value is returned. Void is not used for compatibility +- No meaningful value is returned. Void is not used for compatibility - with other compilers. - - @@ -3625,7 +3626,7 @@ index 7ff34eedc..000000000 -1C587F1C13924FEF 305532286D6F295A 63FAC0D034D9F793 diff --git a/src/lib/crypto/builtin/des/t_verify.c b/src/lib/crypto/builtin/des/t_verify.c deleted file mode 100644 -index f4332f5c0..000000000 +index 4a19933ca..000000000 --- a/src/lib/crypto/builtin/des/t_verify.c +++ /dev/null @@ -1,395 +0,0 @@ @@ -3956,7 +3957,7 @@ index f4332f5c0..000000000 - printf("%02x ",cipher_text[j]); - printf("\n\n"); - if ( memcmp((char *)cipher_text, (char *)checksum, 8) ) { -- printf("verify: error in CBC cheksum\n"); +- printf("verify: error in CBC checksum\n"); - exit(-1); - } - else @@ -4150,17 +4151,18 @@ index 3459e1d0e..af6276b96 100644 $(srcdir)/camellia.c \ $(srcdir)/rc4.c diff --git a/src/lib/crypto/builtin/enc_provider/deps b/src/lib/crypto/builtin/enc_provider/deps -index 7a3324c44..c1201cc1a 100644 +index ea4ffecd8..061289a91 100644 --- a/src/lib/crypto/builtin/enc_provider/deps +++ b/src/lib/crypto/builtin/enc_provider/deps -@@ -1,18 +1,6 @@ +@@ -1,19 +1,6 @@ # # Generated makefile dependencies follow. # -des3.so des3.po $(OUTPRE)des3.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ - $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ - $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \ -- $(srcdir)/../aes/aes.h $(srcdir)/../crypto_mod.h $(srcdir)/../des/des_int.h \ +- $(srcdir)/../aes/aes.h $(srcdir)/../aes/brg_types.h \ +- $(srcdir)/../crypto_mod.h $(srcdir)/../des/des_int.h \ - $(srcdir)/../sha2/sha2.h $(top_srcdir)/include/k5-buf.h \ - $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ - $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ @@ -4311,7 +4313,7 @@ index 73e2f8fbc..c4d23b506 100644 key1 key2 diff --git a/src/lib/crypto/crypto_tests/t_cksums.c b/src/lib/crypto/crypto_tests/t_cksums.c -index 4da14ea43..84408fb68 100644 +index 8297fcbf5..3063d12ec 100644 --- a/src/lib/crypto/crypto_tests/t_cksums.c +++ b/src/lib/crypto/crypto_tests/t_cksums.c @@ -59,16 +59,6 @@ struct test { @@ -4593,7 +4595,7 @@ index ecc2e08c9..f5fbe8a2a 100644 "hmac-md5-rc4", { "hmac-md5-enc", "hmac-md5-earcfour" }, "Microsoft HMAC MD5", diff --git a/src/lib/crypto/krb/crypto_int.h b/src/lib/crypto/krb/crypto_int.h -index ba693f8a4..5cc1f8e43 100644 +index 19f808749..4bc430c7a 100644 --- a/src/lib/crypto/krb/crypto_int.h +++ b/src/lib/crypto/krb/crypto_int.h @@ -276,10 +276,6 @@ krb5_error_code krb5int_aes2_string_to_key(const struct krb5_keytypes *enc, @@ -4814,7 +4816,7 @@ index 157462526..863090beb 100644 - return 0; -} diff --git a/src/lib/crypto/libk5crypto.exports b/src/lib/crypto/libk5crypto.exports -index 451d5e035..9db181381 100644 +index d6cc1b423..f44cb9170 100644 --- a/src/lib/crypto/libk5crypto.exports +++ b/src/lib/crypto/libk5crypto.exports @@ -86,7 +86,6 @@ krb5_k_verify_checksum @@ -5193,10 +5195,10 @@ index 1c439c2cd..000000000 - krb5int_default_free_state -}; diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c -index c821cc830..c5bddb1e8 100644 +index 636ee303f..e2c5e2b59 100644 --- a/src/lib/gssapi/krb5/accept_sec_context.c +++ b/src/lib/gssapi/krb5/accept_sec_context.c -@@ -1010,7 +1010,6 @@ kg_accept_krb5(minor_status, context_handle, +@@ -1039,7 +1039,6 @@ kg_accept_krb5(minor_status, context_handle, } switch (negotiated_etype) { @@ -5205,7 +5207,7 @@ index c821cc830..c5bddb1e8 100644 case ENCTYPE_ARCFOUR_HMAC_EXP: /* RFC 4121 accidentally omits RC4-HMAC-EXP as a "not-newer" diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h -index 2e2c775d6..f5b0fede6 100644 +index a7e0e63ec..3bacdcd35 100644 --- a/src/lib/gssapi/krb5/gssapiP_krb5.h +++ b/src/lib/gssapi/krb5/gssapiP_krb5.h @@ -125,14 +125,14 @@ enum sgn_alg { @@ -5552,7 +5554,7 @@ index 85a9574f3..3ce2a90ce 100644 code = 0; retval = GSS_S_BAD_SIG; diff --git a/src/lib/gssapi/krb5/util_crypt.c b/src/lib/gssapi/krb5/util_crypt.c -index ddb0af8fc..d6c71aeb8 100644 +index 84f194988..32150f5e3 100644 --- a/src/lib/gssapi/krb5/util_crypt.c +++ b/src/lib/gssapi/krb5/util_crypt.c @@ -97,17 +97,6 @@ kg_setup_keys(krb5_context context, krb5_gss_ctx_id_rec *ctx, krb5_key subkey, @@ -5623,7 +5625,7 @@ index 2925c1c43..2f76c8b43 100644 if { ! [cmd {kadm5_destroy $server_handle}]} { perror "$test: unexpected failure in destroy" diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c -index e7d67cca4..9a4741fa6 100644 +index 21d5cb1ca..a8ba6fc5b 100644 --- a/src/lib/krb5/krb/init_ctx.c +++ b/src/lib/krb5/krb/init_ctx.c @@ -59,7 +59,6 @@ @@ -5634,7 +5636,7 @@ index e7d67cca4..9a4741fa6 100644 ENCTYPE_ARCFOUR_HMAC, ENCTYPE_CAMELLIA128_CTS_CMAC, ENCTYPE_CAMELLIA256_CTS_CMAC, 0 -@@ -479,8 +478,6 @@ krb5int_parse_enctype_list(krb5_context context, const char *profkey, +@@ -456,8 +455,6 @@ krb5int_parse_enctype_list(krb5_context context, const char *profkey, /* Set all enctypes in the default list. */ for (i = 0; default_list[i]; i++) mod_list(default_list[i], sel, weak, &list); @@ -5644,10 +5646,10 @@ index e7d67cca4..9a4741fa6 100644 mod_list(ENCTYPE_AES256_CTS_HMAC_SHA1_96, sel, weak, &list); mod_list(ENCTYPE_AES128_CTS_HMAC_SHA1_96, sel, weak, &list); diff --git a/src/lib/krb5/krb/s4u_creds.c b/src/lib/krb5/krb/s4u_creds.c -index 504eb557f..fc5c886d6 100644 +index 44d113e7c..966278578 100644 --- a/src/lib/krb5/krb/s4u_creds.c +++ b/src/lib/krb5/krb/s4u_creds.c -@@ -287,8 +287,6 @@ verify_s4u2self_reply(krb5_context context, +@@ -288,8 +288,6 @@ verify_s4u2self_reply(krb5_context context, assert(req_s4u_user != NULL); switch (subkey->enctype) { @@ -5656,21 +5658,8 @@ index 504eb557f..fc5c886d6 100644 case ENCTYPE_ARCFOUR_HMAC: case ENCTYPE_ARCFOUR_HMAC_EXP : not_newer = TRUE; -diff --git a/src/lib/krb5/krb/t_copy_context.c b/src/lib/krb5/krb/t_copy_context.c -index 2970a8cea..fb82daf19 100644 ---- a/src/lib/krb5/krb/t_copy_context.c -+++ b/src/lib/krb5/krb/t_copy_context.c -@@ -113,7 +113,7 @@ main(int argc, char **argv) - { - krb5_context ctx, ctx2; - krb5_plugin_initvt_fn *mods; -- const krb5_enctype etypes1[] = { ENCTYPE_DES3_CBC_SHA1, 0 }; -+ const krb5_enctype etypes1[] = { ENCTYPE_AES128_CTS_HMAC_SHA256_128, 0 }; - const krb5_enctype etypes2[] = { ENCTYPE_AES128_CTS_HMAC_SHA1_96, - ENCTYPE_AES256_CTS_HMAC_SHA1_96, 0 }; - krb5_prompt_type ptypes[] = { KRB5_PROMPT_TYPE_PASSWORD }; diff --git a/src/lib/krb5/krb/t_etypes.c b/src/lib/krb5/krb/t_etypes.c -index f609e938a..248ffea90 100644 +index 90c9f626c..935aca12f 100644 --- a/src/lib/krb5/krb/t_etypes.c +++ b/src/lib/krb5/krb/t_etypes.c @@ -50,17 +50,6 @@ static struct { @@ -5787,7 +5776,7 @@ index e3d284631..586661bb7 100644 #define CKK_CAST3 (0x17) #define CKK_CAST128 (0x18) diff --git a/src/plugins/preauth/pkinit/pkinit_clnt.c b/src/plugins/preauth/pkinit/pkinit_clnt.c -index 1a642139a..2f0431991 100644 +index 2817cc213..a385da7c3 100644 --- a/src/plugins/preauth/pkinit/pkinit_clnt.c +++ b/src/plugins/preauth/pkinit/pkinit_clnt.c @@ -212,14 +212,6 @@ pkinit_as_req_create(krb5_context context, @@ -5806,7 +5795,7 @@ index 1a642139a..2f0431991 100644 case DH_PROTOCOL: TRACE_PKINIT_CLIENT_REQ_DH(context); diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h -index 8064a07d0..a291889b0 100644 +index 77d5c61fe..1f9868351 100644 --- a/src/plugins/preauth/pkinit/pkinit_crypto.h +++ b/src/plugins/preauth/pkinit/pkinit_crypto.h @@ -380,18 +380,6 @@ krb5_error_code server_process_dh @@ -5829,10 +5818,10 @@ index 8064a07d0..a291889b0 100644 * this functions takes in crypto specific representation of * trustedCertifiers and creates a list of diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -index 8c7fd0cca..52976895b 100644 +index d7d1593f4..0a67c44ef 100644 --- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -@@ -5487,44 +5487,6 @@ cleanup: +@@ -5488,44 +5488,6 @@ cleanup: return retval; } @@ -5963,7 +5952,7 @@ index 2279202d3..96b0307d7 100644 /* initial key, w, x, y, T, S, K */ "8846F7EAEE8FB117AD06BDD830B7586C", diff --git a/src/tests/dejagnu/config/default.exp b/src/tests/dejagnu/config/default.exp -index b047ef1f7..4d8c917cd 100644 +index 619fcce48..0a2ed723d 100644 --- a/src/tests/dejagnu/config/default.exp +++ b/src/tests/dejagnu/config/default.exp @@ -15,8 +15,6 @@ set timeout 100 @@ -6042,7 +6031,7 @@ index b047ef1f7..4d8c917cd 100644 {allow_weak_crypto(kdc)=false} {allow_weak_crypto(replica)=false} {allow_weak_crypto(client)=false} -@@ -946,7 +911,6 @@ proc setup_kerberos_db { standalone } { +@@ -945,7 +910,6 @@ proc setup_kerberos_db { standalone } { global REALMNAME KDB5_UTIL KADMIN_LOCAL KEY global tmppwd hostname global spawn_id @@ -6050,7 +6039,7 @@ index b047ef1f7..4d8c917cd 100644 global multipass_name last_passname_db set failall 0 -@@ -1143,48 +1107,6 @@ proc setup_kerberos_db { standalone } { +@@ -1142,48 +1106,6 @@ proc setup_kerberos_db { standalone } { } } @@ -6100,7 +6089,7 @@ index b047ef1f7..4d8c917cd 100644 # create the admin database lock file diff --git a/src/tests/dejagnu/krb-standalone/kprop.exp b/src/tests/dejagnu/krb-standalone/kprop.exp -index f71ee8638..8c08cf42f 100644 +index 661e3fd9a..2b8f60045 100644 --- a/src/tests/dejagnu/krb-standalone/kprop.exp +++ b/src/tests/dejagnu/krb-standalone/kprop.exp @@ -54,7 +54,7 @@ proc doit { } { @@ -6258,7 +6247,7 @@ index f71774cdc..d1857c433 100644 "3BB3AE288C12B3B9D06B208A4151B3B6", "9AEA11A3BCF3C53F1F91F5A0BA2132E2501ADF5F3C28" diff --git a/src/tests/t_authdata.py b/src/tests/t_authdata.py -index c589adf2a..4fbdbec05 100644 +index 3fa957ad2..2e01f46bc 100644 --- a/src/tests/t_authdata.py +++ b/src/tests/t_authdata.py @@ -174,7 +174,7 @@ realm.run([kvno, 'restricted']) @@ -6271,7 +6260,7 @@ index c589adf2a..4fbdbec05 100644 realm.run(['./forward']) realm.run([kvno, realm.host_princ]) diff --git a/src/tests/t_etype_info.py b/src/tests/t_etype_info.py -index 2a052fc17..ace0edc3c 100644 +index c982508d8..96e90a69d 100644 --- a/src/tests/t_etype_info.py +++ b/src/tests/t_etype_info.py @@ -1,6 +1,6 @@ @@ -6282,7 +6271,7 @@ index 2a052fc17..ace0edc3c 100644 conf = {'libdefaults': {'allow_weak_crypto': 'true'}, 'realms': {'$realm': {'supported_enctypes': supported_enctypes}}} realm = K5Realm(create_host=False, get_creds=False, krb5_conf=conf) -@@ -24,9 +24,9 @@ def test_etinfo(princ, enctypes, expected_lines): +@@ -26,9 +26,9 @@ def test_etinfo(princ, enctypes, expected_lines): # With no newer enctypes in the request, PA-ETYPE-INFO2, # PA-ETYPE-INFO, and PA-PW-SALT appear in the AS-REP, each listing one # key for the most preferred matching enctype. @@ -6295,7 +6284,7 @@ index 2a052fc17..ace0edc3c 100644 'asrep pw_salt KRBTEST.COMuser']) # With a newer enctype in the request (even if it is not the most -@@ -37,9 +37,9 @@ test_etinfo('user', 'rc4 aes256-cts', +@@ -39,9 +39,9 @@ test_etinfo('user', 'rc4 aes256-cts', # In preauth-required errors, PA-PW-SALT does not appear, but the same # etype-info2 values are expected. @@ -6308,7 +6297,7 @@ index 2a052fc17..ace0edc3c 100644 test_etinfo('preauthuser', 'rc4 aes256-cts', ['error etype_info2 rc4-hmac KRBTEST.COMpreauthuser']) -@@ -48,8 +48,8 @@ test_etinfo('preauthuser', 'rc4 aes256-cts', +@@ -50,8 +50,8 @@ test_etinfo('preauthuser', 'rc4 aes256-cts', # (to allow for preauth mechs which don't depend on long-term keys). # An AS-REP cannot be generated without preauth as there is no reply # key. @@ -6348,7 +6337,7 @@ index 2c825a692..f29e0d550 100755 realm.stop() diff --git a/src/tests/t_mkey.py b/src/tests/t_mkey.py -index 99273c907..f84041ca4 100755 +index 32f4070bc..da0ed1831 100755 --- a/src/tests/t_mkey.py +++ b/src/tests/t_mkey.py @@ -7,7 +7,6 @@ import struct @@ -6421,10 +6410,10 @@ index 65084bbf3..55ca89745 100755 # Test using different salt types in a principal's key list. # Parameters from one key in the list must not leak over to later ones. diff --git a/src/util/k5test.py b/src/util/k5test.py -index 442a4e4f7..eea92275d 100644 +index 10f6b0a25..d234a5667 100644 --- a/src/util/k5test.py +++ b/src/util/k5test.py -@@ -1299,13 +1299,6 @@ _passes = [ +@@ -1277,13 +1277,6 @@ _passes = [ # No special settings; exercises AES256. ('default', None, None, None), diff --git a/downstream-SELinux-integration.patch b/downstream-SELinux-integration.patch index 4574a19..96cf861 100644 --- a/downstream-SELinux-integration.patch +++ b/downstream-SELinux-integration.patch @@ -1,4 +1,4 @@ -From 2c4d04d1da4dbb1a312db965f3392d7d0bc67a17 Mon Sep 17 00:00:00 2001 +From 289615de0c73969574e3d48611deda66989c36c0 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:30:53 -0400 Subject: [PATCH] [downstream] SELinux integration @@ -67,7 +67,7 @@ Last-updated: krb5-1.18-beta1 create mode 100644 src/util/support/selinux.c diff --git a/src/aclocal.m4 b/src/aclocal.m4 -index 59621e3e7..398eca7e4 100644 +index ca9fcf664..5afb96e58 100644 --- a/src/aclocal.m4 +++ b/src/aclocal.m4 @@ -85,6 +85,7 @@ AC_SUBST_FILE(libnodeps_frag) @@ -78,7 +78,7 @@ index 59621e3e7..398eca7e4 100644 KRB5_LIB_PARAMS KRB5_AC_INITFINI KRB5_AC_ENABLE_THREADS -@@ -1739,4 +1740,51 @@ AC_SUBST(PAM_LIBS) +@@ -1745,4 +1746,51 @@ AC_SUBST(PAM_LIBS) AC_SUBST(PAM_MAN) AC_SUBST(NON_PAM_MAN) ])dnl @@ -131,7 +131,7 @@ index 59621e3e7..398eca7e4 100644 +AC_SUBST(SELINUX_LIBS) +])dnl diff --git a/src/build-tools/krb5-config.in b/src/build-tools/krb5-config.in -index f6184da3f..c17cb5eb5 100755 +index 9f96a8719..120922ac3 100755 --- a/src/build-tools/krb5-config.in +++ b/src/build-tools/krb5-config.in @@ -41,6 +41,7 @@ DL_LIB='@DL_LIB@' @@ -152,7 +152,7 @@ index f6184da3f..c17cb5eb5 100755 echo $lib_flags diff --git a/src/config/pre.in b/src/config/pre.in -index ce87e21ca..917357df9 100644 +index 7b3a583cc..0c51e6966 100644 --- a/src/config/pre.in +++ b/src/config/pre.in @@ -177,6 +177,7 @@ LD = $(PURE) @LD@ @@ -173,10 +173,10 @@ index ce87e21ca..917357df9 100644 GSS_LIBS = $(GSS_KRB5_LIB) # needs fixing if ever used on macOS! diff --git a/src/configure.ac b/src/configure.ac -index d1f576124..440a22bd9 100644 +index fdaba0ce7..bd151ca26 100644 --- a/src/configure.ac +++ b/src/configure.ac -@@ -1392,6 +1392,8 @@ AC_PATH_PROG(GROFF, groff) +@@ -1391,6 +1391,8 @@ AC_PATH_PROG(GROFF, groff) KRB5_WITH_PAM @@ -186,7 +186,7 @@ index d1f576124..440a22bd9 100644 if test "${localedir+set}" != set; then localedir='$(datadir)/locale' diff --git a/src/include/k5-int.h b/src/include/k5-int.h -index 9616b24bf..0d9af3d95 100644 +index b3e346991..93d3a1f97 100644 --- a/src/include/k5-int.h +++ b/src/include/k5-int.h @@ -128,6 +128,7 @@ typedef unsigned char u_char; @@ -236,7 +236,7 @@ index 000000000..dfaaa847c +#endif +#endif diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin -index 79761f6d2..e9435c693 100644 +index 045334a08..db80063eb 100644 --- a/src/include/krb5/krb5.hin +++ b/src/include/krb5/krb5.hin @@ -87,6 +87,12 @@ @@ -288,7 +288,7 @@ index ff2f25050..e3457622a 100644 com_err(progname, errno, _("while creating 'ok' file, '%s'"), file_ok); goto cleanup; diff --git a/src/kdc/main.c b/src/kdc/main.c -index 38d76b3b1..eb6966f2d 100644 +index 27aa10da0..b5916b147 100644 --- a/src/kdc/main.c +++ b/src/kdc/main.c @@ -872,7 +872,7 @@ write_pid_file(const char *path) @@ -301,7 +301,7 @@ index 38d76b3b1..eb6966f2d 100644 return errno; pid = (unsigned long) getpid(); diff --git a/src/kprop/kpropd.c b/src/kprop/kpropd.c -index 5622d56e1..356e3e0e6 100644 +index 874ba1305..9d6378cc0 100644 --- a/src/kprop/kpropd.c +++ b/src/kprop/kpropd.c @@ -487,6 +487,9 @@ doit(int fd) @@ -416,7 +416,7 @@ index 7b100a0ec..5683a0433 100644 _("Credential cache directory %s does not exist"), dirname); diff --git a/src/lib/krb5/keytab/kt_file.c b/src/lib/krb5/keytab/kt_file.c -index 021c94398..aaf573439 100644 +index e510211fc..f3ea28c8e 100644 --- a/src/lib/krb5/keytab/kt_file.c +++ b/src/lib/krb5/keytab/kt_file.c @@ -735,14 +735,14 @@ krb5_ktfileint_open(krb5_context context, krb5_keytab id, int mode) @@ -463,7 +463,7 @@ index 7db30a33b..2b9d01921 100644 * maybe someone took away write permission so we could only * get shared locks? diff --git a/src/plugins/kdb/db2/kdb_db2.c b/src/plugins/kdb/db2/kdb_db2.c -index 5106a5c99..e481e8121 100644 +index 1a476b586..b40bb2240 100644 --- a/src/plugins/kdb/db2/kdb_db2.c +++ b/src/plugins/kdb/db2/kdb_db2.c @@ -694,8 +694,8 @@ ctx_create_db(krb5_context context, krb5_db2_context *dbc) @@ -542,7 +542,7 @@ index d8b26e701..b0daa7c02 100644 if (fname != NULL && fcntl(rfd, F_SETFD, 1) == -1) { diff --git a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c -index b92cb58c7..0a95101ad 100644 +index e87688d66..30f7c00ab 100644 --- a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c +++ b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c @@ -190,7 +190,7 @@ kdb5_ldap_stash_service_password(int argc, char **argv) diff --git a/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch b/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch index 149bb0a..9ede1d4 100644 --- a/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch +++ b/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch @@ -1,4 +1,4 @@ -From a89e833a2ae26197a0edf864bb9274d776003c60 Mon Sep 17 00:00:00 2001 +From 7b22d94779ff340db5f9f25cf7b55aeb365091e1 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 15 Nov 2019 20:05:16 +0000 Subject: [PATCH] [downstream] Use backported version of OpenSSL-3 KDF @@ -12,7 +12,7 @@ Last-updated: krb5-1.17 3 files changed, 428 insertions(+), 189 deletions(-) diff --git a/src/configure.ac b/src/configure.ac -index d4e4da525..29be532cb 100644 +index 27c2383d7..d3e022274 100644 --- a/src/configure.ac +++ b/src/configure.ac @@ -282,6 +282,10 @@ AC_SUBST(CRYPTO_IMPL) @@ -441,7 +441,7 @@ index 6707a7308..915a173dd 100644 return k5_sp800_108_counter_hmac(hash, inkey, outrnd, in_constant, &empty); diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -index 52976895b..dd718c2be 100644 +index 0a67c44ef..dbb054378 100644 --- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c @@ -38,6 +38,13 @@ diff --git a/downstream-fix-debuginfo-with-y.tab.c.patch b/downstream-fix-debuginfo-with-y.tab.c.patch index 13072cf..c31c013 100644 --- a/downstream-fix-debuginfo-with-y.tab.c.patch +++ b/downstream-fix-debuginfo-with-y.tab.c.patch @@ -1,4 +1,4 @@ -From 0f98db9b00fa2ce685f841db18fff641f8eaa904 Mon Sep 17 00:00:00 2001 +From 27614a4fd889525fbd1ca5cb45c20c64a4f9568c Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:49:25 -0400 Subject: [PATCH] [downstream] fix debuginfo with y.tab.c diff --git a/downstream-ksu-pam-integration.patch b/downstream-ksu-pam-integration.patch index be0e02f..050f195 100644 --- a/downstream-ksu-pam-integration.patch +++ b/downstream-ksu-pam-integration.patch @@ -1,4 +1,4 @@ -From a5a642c33a2f57d24c1cfa8ca3e286418206ab55 Mon Sep 17 00:00:00 2001 +From f7749ad59d75c2da64f4e9defdbfbc0c1e345bfb Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:29:58 -0400 Subject: [PATCH] [downstream] ksu pam integration @@ -30,10 +30,10 @@ Last-updated: krb5-1.18-beta1 create mode 100644 src/clients/ksu/pam.h diff --git a/src/aclocal.m4 b/src/aclocal.m4 -index 8709a7f5d..59621e3e7 100644 +index 024d6370c..ca9fcf664 100644 --- a/src/aclocal.m4 +++ b/src/aclocal.m4 -@@ -1671,3 +1671,72 @@ if test "$with_ldap" = yes; then +@@ -1677,3 +1677,72 @@ if test "$with_ldap" = yes; then OPENLDAP_PLUGIN=yes fi ])dnl @@ -145,11 +145,11 @@ index 8b4edce4d..9d58f29b5 100644 clean: $(RM) ksu diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c -index 57c349200..508242e0e 100644 +index af1286172..931f05404 100644 --- a/src/clients/ksu/main.c +++ b/src/clients/ksu/main.c @@ -26,6 +26,7 @@ - * KSU was writen by: Ari Medvinsky, ari@isi.edu + * KSU was written by: Ari Medvinsky, ari@isi.edu */ +#include "autoconf.h" @@ -760,10 +760,10 @@ index 000000000..0ab76569c +void appl_pam_cleanup(void); +#endif diff --git a/src/configure.ac b/src/configure.ac -index 234f4281c..d1f576124 100644 +index 49814922f..fdaba0ce7 100644 --- a/src/configure.ac +++ b/src/configure.ac -@@ -1390,6 +1390,8 @@ AC_SUBST([VERTO_VERSION]) +@@ -1389,6 +1389,8 @@ AC_SUBST([VERTO_VERSION]) AC_PATH_PROG(GROFF, groff) diff --git a/downstream-netlib-and-dns.patch b/downstream-netlib-and-dns.patch index 682e3df..17f1c00 100644 --- a/downstream-netlib-and-dns.patch +++ b/downstream-netlib-and-dns.patch @@ -1,4 +1,4 @@ -From 29f58a8059cb73ca586514b57458b2b17e091f36 Mon Sep 17 00:00:00 2001 +From df80ded9756b0637ab7cca706e1520f3f372c2e2 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:46:21 -0400 Subject: [PATCH] [downstream] netlib and dns @@ -11,10 +11,10 @@ Last-updated: krb5-1.3.1 1 file changed, 1 insertion(+) diff --git a/src/aclocal.m4 b/src/aclocal.m4 -index 398eca7e4..7ef2db56b 100644 +index 5afb96e58..4a4d460e3 100644 --- a/src/aclocal.m4 +++ b/src/aclocal.m4 -@@ -720,6 +720,7 @@ AC_HELP_STRING([--with-netlib=LIBS], use user defined resolver library), +@@ -718,6 +718,7 @@ AC_HELP_STRING([--with-netlib=LIBS], use user defined resolver library), LIBS="$LIBS $withval" AC_MSG_RESULT("netlib will use \'$withval\'") fi diff --git a/krb5.spec b/krb5.spec index a465681..604f84c 100644 --- a/krb5.spec +++ b/krb5.spec @@ -1,5 +1,3 @@ -%global WITH_DIRSRV 1 - # Set this so that find-lang.sh will recognize the .po files. %global gettext_domain mit-krb5 # Guess where the -libs subpackage's docs are going to go. @@ -8,21 +6,24 @@ %global configure_default_ccache_name 1 %global configured_default_ccache_name KEYRING:persistent:%%{uid} -# leave empty or set to e.g., -beta2 -%global prerelease %{nil} +# either beta1 or % { nil } +%global prerelease beta1 +%if %{defined prerelease} +%global dashpre -%{prerelease} +%global zdpd 0.%{prerelease}. +%endif # Should be in form 5.0, 6.1, etc. %global kdbversion 8.0 Summary: The Kerberos network authentication system Name: krb5 -Version: 1.18.3 -# for prerelease, should be e.g., 0.% {prerelease}.1% { ?dist } (without spaces) -Release: 5%{?dist} +Version: 1.19 +Release: %{?zdpd}2%{?dist} # rharwood has trust path to signing key and verifies on check-in -Source0: https://web.mit.edu/kerberos/dist/krb5/1.18/krb5-%{version}%{prerelease}.tar.gz -Source1: https://web.mit.edu/kerberos/dist/krb5/1.18/krb5-%{version}%{prerelease}.tar.gz.asc +Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz +Source1: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz.asc # Numbering is a relic of old init systems etc. It's easiest to just leave. Source2: kprop.service @@ -46,37 +47,6 @@ Patch4: downstream-fix-debuginfo-with-y.tab.c.patch Patch5: downstream-Remove-3des-support.patch Patch6: downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch Patch7: downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch -Patch9: Allow-certauth-modules-to-set-hw-authent-flag.patch -Patch11: Refresh-manually-acquired-creds-from-client-keytab.patch -Patch13: Add-finalization-safety-check-to-com_err.patch -Patch15: Correctly-import-service-GSS-host-based-name.patch -Patch16: Do-expiration-warnings-for-all-init_creds-APIs.patch -Patch17: Pass-gss_localname-through-SPNEGO.patch -Patch18: Omit-KDC-indicator-check-for-S4U2Self-requests.patch -Patch19: Fix-typo-in-in-in-the-ksu-man-page.patch -Patch21: Replace-gssrpc-tests-with-a-Python-script.patch -Patch22: Default-dns_canonicalize_hostname-to-fallback.patch -Patch23: Remove-resolver-test-utility.patch -Patch24: Omit-PA_FOR_USER-if-we-can-t-compute-its-checksum.patch -Patch25: Improve-negoex_parse_token-code-hygiene.patch -Patch26: Refactor-krb5-GSS-checksum-handling.patch -Patch27: Implement-GSS_C_CHANNEL_BOUND_FLAG.patch -Patch28: Implement-KERB_AP_OPTIONS_CBT-server-side.patch -Patch29: Add-client_aware_channel_bindings-option.patch -Patch30: Pass-channel-bindings-through-SPNEGO.patch -Patch31: Add-channel-bindings-tests.patch -Patch32: Use-two-queues-for-concurrent-t_otp.py-daemons.patch -Patch34: Ignore-bad-enctypes-in-krb5_string_to_keysalts.patch -Patch35: Fix-leak-in-KERB_AP_OPTIONS_CBT-server-support.patch -Patch37: Add-three-kvno-options-from-Heimdal-kgetcred.patch -Patch39: Improve-KDC-alias-checking-for-S4U-requests.patch -Patch40: Adjust-KDC-alias-helper-function-contract.patch -Patch41: Allow-aliases-when-matching-U2U-second-ticket.patch -Patch42: Refactor-KDC-authdata-list-management-helpers.patch -Patch43: Avoid-passing-DB-entry-structures-in-KDC.patch -Patch44: Minimize-usage-of-tgs_server-in-KDC.patch -Patch45: Fix-minor-static-analysis-defects.patch -Patch46: Install-shared-libraries-as-executable.patch Patch47: Document-k-option-in-kvno-1-synopsis.patch License: MIT @@ -211,7 +181,7 @@ contains only the libkadm5clnt and libkadm5serv shared objects. This interface is not considered stable. %prep -%autosetup -S git -n %{name}-%{version}%{prerelease} +%autosetup -S git -n %{name}-%{version}%{?dashpre} ln NOTICE LICENSE # Generate an FDS-compatible LDIF file. @@ -276,9 +246,7 @@ CPPFLAGS="`echo $DEFINES $INCLUDES`" --with-tcl \ --enable-dns-for-realm \ --with-ldap \ -%if %{WITH_DIRSRV} --with-dirsrv-account-locking \ -%endif --enable-pkinit \ --with-crypto-impl=openssl \ --with-tls-impl=openssl \ @@ -317,13 +285,17 @@ rm -fr build-html/_sources %ifnarch s390x pushd src -# ugh. COPR doesn't expose the keyring, so try to cope. -KEYCTL=keyctl -keyctl list @u &>/dev/null || KEYCTL=: +# ugh. COPR doesn't work right with the tests. I suspect keyring issues, but +# can't actually debug, so... +%if 0%{?copr_username:1} +%global keyctl : +%else +%global keyctl keyctl +%endif # The build system may give us a revoked session keyring, so run affected # tests with a new one. -$KEYCTL session - make check OFFLINE=yes TMPDIR=%{_tmppath} +%{keyctl} session - make check OFFLINE=yes TMPDIR=%{_tmppath} popd %endif @@ -639,6 +611,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Wed Dec 16 2020 Robbie Harwood - 1.19-0.beta1.2 +- New upstream version (1.19-beta1) + * Wed Dec 16 2020 Robbie Harwood - 1.18.3-5 - Fix runstatedir configuration - Why couldn't systemd just leave it alone? diff --git a/sources b/sources index 6ed904d..c36c920 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (krb5-1.18.3.tar.gz) = cf0bf6cf8f622fa085954e6da998d952cf64dc7ccc319972ed81ea0542089cabf2d0e8243df84da01ad6f40584768ca2f02d108630c6741fa7b3d7d98c887c01 -SHA512 (krb5-1.18.3.tar.gz.asc) = 7c5a83e13d00910d895d545ed63310ebec48c90c29846dd54e48048f710360e8306778729b636baa091a4e9048998ff6d4dfe37f88dd6292540d55678c961a30 +SHA512 (krb5-1.19-beta1.tar.gz) = 3538a13a38c20d6b5fee0fba474bc49a12434b184de409f829e7b6e5c76ad2fc105fc27f2574a93c3cd9fe9ccf3d5d98f6cd3bdd13a089bb3485e0c3974417de +SHA512 (krb5-1.19-beta1.tar.gz.asc) = cfa793f83f0adaba87f2fe242b0796ed8732de898501d51b745d57a55d98966b337e68f29ec0ae233b15613baca70f2c56f742e467d310e157e3b49b59ad9c5f From 9fb5239517e1095421fd19cb964949a1f5594988 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 12 Jan 2021 12:44:13 -0500 Subject: [PATCH 010/103] New upstream version (1.19-beta2) --- .gitignore | 2 + Document-k-option-in-kvno-1-synopsis.patch | 38 ------------------- ...am-FIPS-with-PRNG-and-RADIUS-and-MD4.patch | 4 +- downstream-Remove-3des-support.patch | 22 +++++------ downstream-SELinux-integration.patch | 10 ++--- ...ackported-version-of-OpenSSL-3-KDF-i.patch | 4 +- downstream-fix-debuginfo-with-y.tab.c.patch | 2 +- downstream-ksu-pam-integration.patch | 4 +- downstream-netlib-and-dns.patch | 2 +- krb5.spec | 8 ++-- sources | 4 +- 11 files changed, 33 insertions(+), 67 deletions(-) delete mode 100644 Document-k-option-in-kvno-1-synopsis.patch diff --git a/.gitignore b/.gitignore index 258cd98..c686550 100644 --- a/.gitignore +++ b/.gitignore @@ -191,3 +191,5 @@ krb5-1.8.3-pdf.tar.gz /krb5-1.18.3.tar.gz.asc /krb5-1.19-beta1.tar.gz /krb5-1.19-beta1.tar.gz.asc +/krb5-1.19-beta2.tar.gz +/krb5-1.19-beta2.tar.gz.asc diff --git a/Document-k-option-in-kvno-1-synopsis.patch b/Document-k-option-in-kvno-1-synopsis.patch deleted file mode 100644 index 28323f4..0000000 --- a/Document-k-option-in-kvno-1-synopsis.patch +++ /dev/null @@ -1,38 +0,0 @@ -From b401a1127f27f8cd564e32411f799648a8fd5481 Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Tue, 24 Nov 2020 12:52:02 -0500 -Subject: [PATCH] Document -k option in kvno(1) synopsis - -becd1ad6830b526d08ddaf5b2b6f213154c6446c attempted to unify the -synopsis, option descriptions, and xusage(), but missed one option. - -(cherry picked from commit d81e76d9ddab9e880bcf54eabf07119af91d28c7) ---- - doc/user/user_commands/kvno.rst | 1 + - src/man/kvno.man | 1 + - 2 files changed, 2 insertions(+) - -diff --git a/doc/user/user_commands/kvno.rst b/doc/user/user_commands/kvno.rst -index 65c44e1c0..93a5132b2 100644 ---- a/doc/user/user_commands/kvno.rst -+++ b/doc/user/user_commands/kvno.rst -@@ -9,6 +9,7 @@ SYNOPSIS - **kvno** - [**-c** *ccache*] - [**-e** *etype*] -+[**-k** *keytab*] - [**-q**] - [**-u** | **-S** *sname*] - [**-P**] -diff --git a/src/man/kvno.man b/src/man/kvno.man -index 953d168e6..ebdd6e8ca 100644 ---- a/src/man/kvno.man -+++ b/src/man/kvno.man -@@ -35,6 +35,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]] - \fBkvno\fP - [\fB\-c\fP \fIccache\fP] - [\fB\-e\fP \fIetype\fP] -+[\fB\-k\fP \fIkeytab\fP] - [\fB\-q\fP] - [\fB\-u\fP | \fB\-S\fP \fIsname\fP] - [\fB\-P\fP] diff --git a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch b/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch index 6d74df5..8ca2534 100644 --- a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch +++ b/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch @@ -1,4 +1,4 @@ -From 146967416993f66c3ba32cbf3881e43e7bc1ed1c Mon Sep 17 00:00:00 2001 +From 836fdca1ac4bb58498551e1afe8ca6e55d41902d Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 9 Nov 2018 15:12:21 -0500 Subject: [PATCH] [downstream] FIPS with PRNG and RADIUS and MD4 @@ -39,7 +39,7 @@ Last-updated: krb5-1.17 15 files changed, 151 insertions(+), 33 deletions(-) diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst -index e4e2443ed..af3df5871 100644 +index cb17a8485..29ddca3a4 100644 --- a/doc/admin/conf_files/krb5_conf.rst +++ b/doc/admin/conf_files/krb5_conf.rst @@ -330,6 +330,12 @@ The libdefaults section may contain any of the following relations: diff --git a/downstream-Remove-3des-support.patch b/downstream-Remove-3des-support.patch index 1bf529e..046a1be 100644 --- a/downstream-Remove-3des-support.patch +++ b/downstream-Remove-3des-support.patch @@ -1,4 +1,4 @@ -From 3af536f114e1c1b33b1579f9f16bbb3f497d4a1d Mon Sep 17 00:00:00 2001 +From 329c97793a3e96e79f618bc54914ec89a9e99828 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 26 Mar 2019 18:51:10 -0400 Subject: [PATCH] [downstream] Remove 3des support @@ -255,7 +255,7 @@ index cebb6644c..4d51e795c 100644 CKSUMTYPE_NIST_SHA.rst CKSUMTYPE_RSA_MD4.rst diff --git a/doc/conf.py b/doc/conf.py -index 9226b8e01..19cf38326 100644 +index 543202bf4..4fb6aae14 100644 --- a/doc/conf.py +++ b/doc/conf.py @@ -271,7 +271,7 @@ else: @@ -281,7 +281,7 @@ index 4954bb3aa..92ce2a772 100644 Interoperability ---------------- diff --git a/src/Makefile.in b/src/Makefile.in -index f9270aba2..c958da60f 100644 +index 7d2507ef8..c16715ac7 100644 --- a/src/Makefile.in +++ b/src/Makefile.in @@ -130,7 +130,7 @@ WINMAKEFILES=Makefile \ @@ -303,7 +303,7 @@ index f9270aba2..c958da60f 100644 ##DOS## $(WCONFIG) config < $@.in > $@ ##DOS##lib\crypto\builtin\camellia\Makefile: lib\crypto\builtin\camellia\Makefile.in $(MKFDEP) diff --git a/src/configure.ac b/src/configure.ac -index bd151ca26..27c2383d7 100644 +index dd2cad3ee..3e1052db7 100644 --- a/src/configure.ac +++ b/src/configure.ac @@ -1480,7 +1480,6 @@ V5_AC_OUTPUT_MAKEFILE(. @@ -5195,7 +5195,7 @@ index 1c439c2cd..000000000 - krb5int_default_free_state -}; diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c -index 636ee303f..e2c5e2b59 100644 +index 75f071c3e..fcf2c2152 100644 --- a/src/lib/gssapi/krb5/accept_sec_context.c +++ b/src/lib/gssapi/krb5/accept_sec_context.c @@ -1039,7 +1039,6 @@ kg_accept_krb5(minor_status, context_handle, @@ -5625,7 +5625,7 @@ index 2925c1c43..2f76c8b43 100644 if { ! [cmd {kadm5_destroy $server_handle}]} { perror "$test: unexpected failure in destroy" diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c -index 21d5cb1ca..a8ba6fc5b 100644 +index be31eb31e..d2b70acad 100644 --- a/src/lib/krb5/krb/init_ctx.c +++ b/src/lib/krb5/krb/init_ctx.c @@ -59,7 +59,6 @@ @@ -5952,7 +5952,7 @@ index 2279202d3..96b0307d7 100644 /* initial key, w, x, y, T, S, K */ "8846F7EAEE8FB117AD06BDD830B7586C", diff --git a/src/tests/dejagnu/config/default.exp b/src/tests/dejagnu/config/default.exp -index 619fcce48..0a2ed723d 100644 +index 85bbf478a..302dee74c 100644 --- a/src/tests/dejagnu/config/default.exp +++ b/src/tests/dejagnu/config/default.exp @@ -15,8 +15,6 @@ set timeout 100 @@ -6031,7 +6031,7 @@ index 619fcce48..0a2ed723d 100644 {allow_weak_crypto(kdc)=false} {allow_weak_crypto(replica)=false} {allow_weak_crypto(client)=false} -@@ -945,7 +910,6 @@ proc setup_kerberos_db { standalone } { +@@ -946,7 +911,6 @@ proc setup_kerberos_db { standalone } { global REALMNAME KDB5_UTIL KADMIN_LOCAL KEY global tmppwd hostname global spawn_id @@ -6039,7 +6039,7 @@ index 619fcce48..0a2ed723d 100644 global multipass_name last_passname_db set failall 0 -@@ -1142,48 +1106,6 @@ proc setup_kerberos_db { standalone } { +@@ -1143,48 +1107,6 @@ proc setup_kerberos_db { standalone } { } } @@ -6410,10 +6410,10 @@ index 65084bbf3..55ca89745 100755 # Test using different salt types in a principal's key list. # Parameters from one key in the list must not leak over to later ones. diff --git a/src/util/k5test.py b/src/util/k5test.py -index 10f6b0a25..d234a5667 100644 +index 6afe4b92c..789b0f4b9 100644 --- a/src/util/k5test.py +++ b/src/util/k5test.py -@@ -1277,13 +1277,6 @@ _passes = [ +@@ -1278,13 +1278,6 @@ _passes = [ # No special settings; exercises AES256. ('default', None, None, None), diff --git a/downstream-SELinux-integration.patch b/downstream-SELinux-integration.patch index 96cf861..7c134eb 100644 --- a/downstream-SELinux-integration.patch +++ b/downstream-SELinux-integration.patch @@ -1,4 +1,4 @@ -From 289615de0c73969574e3d48611deda66989c36c0 Mon Sep 17 00:00:00 2001 +From 1de6ec4cb5b2a1b7b88680ae0f72551a3b5178e6 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:30:53 -0400 Subject: [PATCH] [downstream] SELinux integration @@ -152,7 +152,7 @@ index 9f96a8719..120922ac3 100755 echo $lib_flags diff --git a/src/config/pre.in b/src/config/pre.in -index 7b3a583cc..0c51e6966 100644 +index 3752174c7..0d2068575 100644 --- a/src/config/pre.in +++ b/src/config/pre.in @@ -177,6 +177,7 @@ LD = $(PURE) @LD@ @@ -163,7 +163,7 @@ index 7b3a583cc..0c51e6966 100644 INSTALL=@INSTALL@ INSTALL_STRIP= -@@ -402,7 +403,7 @@ SUPPORT_LIB = -l$(SUPPORT_LIBNAME) +@@ -403,7 +404,7 @@ SUPPORT_LIB = -l$(SUPPORT_LIBNAME) # HESIOD_LIBS is -lhesiod... HESIOD_LIBS = @HESIOD_LIBS@ @@ -173,7 +173,7 @@ index 7b3a583cc..0c51e6966 100644 GSS_LIBS = $(GSS_KRB5_LIB) # needs fixing if ever used on macOS! diff --git a/src/configure.ac b/src/configure.ac -index fdaba0ce7..bd151ca26 100644 +index 693f76a81..dd2cad3ee 100644 --- a/src/configure.ac +++ b/src/configure.ac @@ -1391,6 +1391,8 @@ AC_PATH_PROG(GROFF, groff) @@ -186,7 +186,7 @@ index fdaba0ce7..bd151ca26 100644 if test "${localedir+set}" != set; then localedir='$(datadir)/locale' diff --git a/src/include/k5-int.h b/src/include/k5-int.h -index b3e346991..93d3a1f97 100644 +index cf524252f..efb523689 100644 --- a/src/include/k5-int.h +++ b/src/include/k5-int.h @@ -128,6 +128,7 @@ typedef unsigned char u_char; diff --git a/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch b/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch index 9ede1d4..cb35de1 100644 --- a/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch +++ b/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch @@ -1,4 +1,4 @@ -From 7b22d94779ff340db5f9f25cf7b55aeb365091e1 Mon Sep 17 00:00:00 2001 +From 120e84b63c322c227fb8c6ee8a2f56f47d3e57f5 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 15 Nov 2019 20:05:16 +0000 Subject: [PATCH] [downstream] Use backported version of OpenSSL-3 KDF @@ -12,7 +12,7 @@ Last-updated: krb5-1.17 3 files changed, 428 insertions(+), 189 deletions(-) diff --git a/src/configure.ac b/src/configure.ac -index 27c2383d7..d3e022274 100644 +index 3e1052db7..ea708491b 100644 --- a/src/configure.ac +++ b/src/configure.ac @@ -282,6 +282,10 @@ AC_SUBST(CRYPTO_IMPL) diff --git a/downstream-fix-debuginfo-with-y.tab.c.patch b/downstream-fix-debuginfo-with-y.tab.c.patch index c31c013..96c21ac 100644 --- a/downstream-fix-debuginfo-with-y.tab.c.patch +++ b/downstream-fix-debuginfo-with-y.tab.c.patch @@ -1,4 +1,4 @@ -From 27614a4fd889525fbd1ca5cb45c20c64a4f9568c Mon Sep 17 00:00:00 2001 +From db57bb9939da544af242c054d10e69a022558b4e Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:49:25 -0400 Subject: [PATCH] [downstream] fix debuginfo with y.tab.c diff --git a/downstream-ksu-pam-integration.patch b/downstream-ksu-pam-integration.patch index 050f195..15b9b35 100644 --- a/downstream-ksu-pam-integration.patch +++ b/downstream-ksu-pam-integration.patch @@ -1,4 +1,4 @@ -From f7749ad59d75c2da64f4e9defdbfbc0c1e345bfb Mon Sep 17 00:00:00 2001 +From 25f948637140fb6aade80f99d9e7e096250135cd Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:29:58 -0400 Subject: [PATCH] [downstream] ksu pam integration @@ -760,7 +760,7 @@ index 000000000..0ab76569c +void appl_pam_cleanup(void); +#endif diff --git a/src/configure.ac b/src/configure.ac -index 49814922f..fdaba0ce7 100644 +index 4eb080784..693f76a81 100644 --- a/src/configure.ac +++ b/src/configure.ac @@ -1389,6 +1389,8 @@ AC_SUBST([VERTO_VERSION]) diff --git a/downstream-netlib-and-dns.patch b/downstream-netlib-and-dns.patch index 17f1c00..4141da9 100644 --- a/downstream-netlib-and-dns.patch +++ b/downstream-netlib-and-dns.patch @@ -1,4 +1,4 @@ -From df80ded9756b0637ab7cca706e1520f3f372c2e2 Mon Sep 17 00:00:00 2001 +From 26a01204b4cb424e6f9cf4190f7290b0665f6f74 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:46:21 -0400 Subject: [PATCH] [downstream] netlib and dns diff --git a/krb5.spec b/krb5.spec index 604f84c..fcf894d 100644 --- a/krb5.spec +++ b/krb5.spec @@ -7,7 +7,7 @@ %global configured_default_ccache_name KEYRING:persistent:%%{uid} # either beta1 or % { nil } -%global prerelease beta1 +%global prerelease beta2 %if %{defined prerelease} %global dashpre -%{prerelease} %global zdpd 0.%{prerelease}. @@ -19,7 +19,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19 -Release: %{?zdpd}2%{?dist} +Release: %{?zdpd}1%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -47,7 +47,6 @@ Patch4: downstream-fix-debuginfo-with-y.tab.c.patch Patch5: downstream-Remove-3des-support.patch Patch6: downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch Patch7: downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch -Patch47: Document-k-option-in-kvno-1-synopsis.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -611,6 +610,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Tue Jan 12 2021 Robbie Harwood - 1.19-1 +- New upstream version (1.19-beta2) + * Wed Dec 16 2020 Robbie Harwood - 1.19-0.beta1.2 - New upstream version (1.19-beta1) diff --git a/sources b/sources index c36c920..5daa433 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (krb5-1.19-beta1.tar.gz) = 3538a13a38c20d6b5fee0fba474bc49a12434b184de409f829e7b6e5c76ad2fc105fc27f2574a93c3cd9fe9ccf3d5d98f6cd3bdd13a089bb3485e0c3974417de -SHA512 (krb5-1.19-beta1.tar.gz.asc) = cfa793f83f0adaba87f2fe242b0796ed8732de898501d51b745d57a55d98966b337e68f29ec0ae233b15613baca70f2c56f742e467d310e157e3b49b59ad9c5f +SHA512 (krb5-1.19-beta2.tar.gz) = 2864a40c44575a9482d33165bc39e76f6bb476bdcc5bc87c9864f562925638118a236a788da870567d0f83df9aacb5f79145993f38f95cec1fa5b080f2561169 +SHA512 (krb5-1.19-beta2.tar.gz.asc) = fd17198c934907811abebd47b70f6c30e68aa5800f6dde90568241db1413da34557c689af66757e47d94e08d261573f0b1ee56929947f6dcc9fcbb9dcdd2e903 From b23f8f62150248278c63669cd663c6ef25dc66fe Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 26 Jan 2021 16:06:22 +0000 Subject: [PATCH 011/103] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- krb5.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/krb5.spec b/krb5.spec index fcf894d..063f1b1 100644 --- a/krb5.spec +++ b/krb5.spec @@ -19,7 +19,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19 -Release: %{?zdpd}1%{?dist} +Release: %{?zdpd}1%{?dist}.1 # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -610,6 +610,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Tue Jan 26 2021 Fedora Release Engineering - 1.19-0.beta2.1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Tue Jan 12 2021 Robbie Harwood - 1.19-1 - New upstream version (1.19-beta2) From 327ebd0b263aa5adaafd83851b8dd9953f984c01 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Wed, 27 Jan 2021 19:44:26 +0000 Subject: [PATCH 012/103] Cope with new autotools behavior wrt runstatedir --- krb5.spec | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/krb5.spec b/krb5.spec index 063f1b1..62b763c 100644 --- a/krb5.spec +++ b/krb5.spec @@ -19,7 +19,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19 -Release: %{?zdpd}1%{?dist}.1 +Release: %{?zdpd}1%{?dist}.2 # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -223,9 +223,6 @@ sed -i -e s,7778,`expr "$PORT" + 1`,g $cfg source %{_libdir}/tclConfig.sh pushd src -# Set this so that configure will have a value - upstream defaults it from -# localstatedir, which is wrong for us. -export runstatedir=/run # Work out the CFLAGS and CPPFLAGS which we intend to use. INCLUDES=-I%{_includedir}/et CFLAGS="`echo $RPM_OPT_FLAGS $DEFINES $INCLUDES -fPIC -fno-strict-aliasing -fstack-protector-all`" @@ -236,6 +233,7 @@ CPPFLAGS="`echo $DEFINES $INCLUDES`" CPPFLAGS="$CPPFLAGS" \ SS_LIB="-lss" \ --enable-shared \ + --runstatedir=/run \ --localstatedir=%{_var}/kerberos \ --disable-rpath \ --without-krb5-config \ @@ -610,6 +608,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Wed Jan 27 2021 Robbie Harwood - 1.19.0.beta2.1.2 +- Cope with new autotools behavior wrt runstatedir + * Tue Jan 26 2021 Fedora Release Engineering - 1.19-0.beta2.1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild From ef09340be020c9841b9ab2fb0fca0adae163942a Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Thu, 28 Jan 2021 10:56:02 -0500 Subject: [PATCH 013/103] Add APIs for marshalling credentials --- Add-APIs-for-marshalling-credentials.patch | 220 +++++++++++++++++++++ krb5.spec | 6 +- 2 files changed, 225 insertions(+), 1 deletion(-) create mode 100644 Add-APIs-for-marshalling-credentials.patch diff --git a/Add-APIs-for-marshalling-credentials.patch b/Add-APIs-for-marshalling-credentials.patch new file mode 100644 index 0000000..39b3455 --- /dev/null +++ b/Add-APIs-for-marshalling-credentials.patch @@ -0,0 +1,220 @@ +From fd3ffdf173173e08abfe9ba78922f63723541c54 Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Thu, 14 Jan 2021 18:13:09 -0500 +Subject: [PATCH] Add APIs for marshalling credentials + +Faciliate KCM daemon implementations by providing functions to +deserialize and reserialize credentials in the FILE v4 format. + +[ghudson@mit.edu: minor editorial changes] + +ticket: 8980 (new) +(cherry picked from commit 18ea3bd2fca55b789b7de9c663624bc11d348fa6) +--- + doc/appdev/refs/api/index.rst | 2 ++ + src/include/krb5/krb5.hin | 36 ++++++++++++++++++++++ + src/lib/krb5/ccache/ccmarshal.c | 53 +++++++++++++++++++++++++++++++++ + src/lib/krb5/ccache/t_marshal.c | 15 +++++++++- + src/lib/krb5/libkrb5.exports | 2 ++ + src/lib/krb5_32.def | 4 +++ + 6 files changed, 111 insertions(+), 1 deletion(-) + +diff --git a/doc/appdev/refs/api/index.rst b/doc/appdev/refs/api/index.rst +index 727d9b492..9e03fd386 100644 +--- a/doc/appdev/refs/api/index.rst ++++ b/doc/appdev/refs/api/index.rst +@@ -232,6 +232,7 @@ Rarely used public interfaces + krb5_kt_remove_entry.rst + krb5_kt_start_seq_get.rst + krb5_make_authdata_kdc_issued.rst ++ krb5_marshal_credentials.rst + krb5_merge_authdata.rst + krb5_mk_1cred.rst + krb5_mk_error.rst +@@ -285,6 +286,7 @@ Rarely used public interfaces + krb5_tkt_creds_get_times.rst + krb5_tkt_creds_init.rst + krb5_tkt_creds_step.rst ++ krb5_unmarshal_credentials.rst + krb5_verify_init_creds.rst + krb5_verify_init_creds_opt_init.rst + krb5_verify_init_creds_opt_set_ap_req_nofail.rst +diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin +index 63e67a2ba..c26dde535 100644 +--- a/src/include/krb5/krb5.hin ++++ b/src/include/krb5/krb5.hin +@@ -3125,6 +3125,42 @@ krb5_get_credentials(krb5_context context, krb5_flags options, + krb5_ccache ccache, krb5_creds *in_creds, + krb5_creds **out_creds); + ++/** ++ * Serialize a @c krb5_creds object. ++ * ++ * @param [in] context Library context ++ * @param [in] creds The credentials object to serialize ++ * @param [out] data_out The serialized credentials ++ * ++ * Serialize @a creds in the format used by the FILE ccache format (vesion 4) ++ * and KCM ccache protocol. ++ * ++ * Use krb5_free_data() to free @a data_out when it is no longer needed. ++ * ++ * @retval 0 Success; otherwise - Kerberos error codes ++ */ ++krb5_error_code KRB5_CALLCONV ++krb5_marshal_credentials(krb5_context context, krb5_creds *in_creds, ++ krb5_data **data_out); ++ ++/** ++ * Deserialize a @c krb5_creds object. ++ * ++ * @param [in] context Library context ++ * @param [in] data The serialized credentials ++ * @param [out] creds_out The resulting creds object ++ * ++ * Deserialize @a data to credentials in the format used by the FILE ccache ++ * format (vesion 4) and KCM ccache protocol. ++ * ++ * Use krb5_free_creds() to free @a creds_out when it is no longer needed. ++ * ++ * @retval 0 Success; otherwise - Kerberos error codes ++ */ ++krb5_error_code KRB5_CALLCONV ++krb5_unmarshal_credentials(krb5_context context, const krb5_data *data, ++ krb5_creds **creds_out); ++ + /** @deprecated Replaced by krb5_get_validated_creds. */ + krb5_error_code KRB5_CALLCONV + krb5_get_credentials_validate(krb5_context context, krb5_flags options, +diff --git a/src/lib/krb5/ccache/ccmarshal.c b/src/lib/krb5/ccache/ccmarshal.c +index ae634ccab..ab284e721 100644 +--- a/src/lib/krb5/ccache/ccmarshal.c ++++ b/src/lib/krb5/ccache/ccmarshal.c +@@ -515,3 +515,56 @@ k5_marshal_mcred(struct k5buf *buf, krb5_creds *mcred) + if (mcred->second_ticket.length > 0) + put_data(buf, version, &mcred->second_ticket); + } ++ ++krb5_error_code KRB5_CALLCONV ++krb5_marshal_credentials(krb5_context context, krb5_creds *in_creds, ++ krb5_data **data_out) ++{ ++ krb5_error_code ret; ++ krb5_data *data; ++ struct k5buf buf; ++ ++ *data_out = NULL; ++ ++ data = k5alloc(sizeof(krb5_data), &ret); ++ if (ret) ++ return ret; ++ ++ k5_buf_init_dynamic(&buf); ++ k5_marshal_cred(&buf, 4, in_creds); ++ ++ ret = k5_buf_status(&buf); ++ if (ret) { ++ free(data); ++ return ret; ++ } ++ ++ /* Steal payload from buf. */ ++ *data = make_data(buf.data, buf.len); ++ *data_out = data; ++ return 0; ++} ++ ++krb5_error_code KRB5_CALLCONV ++krb5_unmarshal_credentials(krb5_context context, const krb5_data *data, ++ krb5_creds **creds_out) ++{ ++ krb5_error_code ret; ++ krb5_creds *creds; ++ ++ *creds_out = NULL; ++ ++ creds = k5alloc(sizeof(krb5_creds), &ret); ++ if (ret) ++ return ret; ++ ++ ret = k5_unmarshal_cred((unsigned char *)data->data, data->length, 4, ++ creds); ++ if (ret) { ++ free(creds); ++ return ret; ++ } ++ ++ *creds_out = creds; ++ return 0; ++} +diff --git a/src/lib/krb5/ccache/t_marshal.c b/src/lib/krb5/ccache/t_marshal.c +index bd0284afa..96e0931a2 100644 +--- a/src/lib/krb5/ccache/t_marshal.c ++++ b/src/lib/krb5/ccache/t_marshal.c +@@ -268,13 +268,14 @@ main(int argc, char **argv) + krb5_context context; + krb5_ccache cache; + krb5_principal princ; +- krb5_creds cred1, cred2; ++ krb5_creds cred1, cred2, *alloc_cred; + krb5_cc_cursor cursor; + const char *filename; + char *ccname, filebuf[256]; + int version, fd; + const struct test *t; + struct k5buf buf; ++ krb5_data ser_data, *alloc_data; + + if (argc != 2) + abort(); +@@ -285,6 +286,18 @@ main(int argc, char **argv) + if (krb5_init_context(&context) != 0) + abort(); + ++ /* Test public functions for unmarshalling and marshalling. */ ++ ser_data = make_data((char *)tests[3].cred1, tests[3].cred1len); ++ if (krb5_unmarshal_credentials(context, &ser_data, &alloc_cred) != 0) ++ abort(); ++ verify_cred1(alloc_cred); ++ if (krb5_marshal_credentials(context, alloc_cred, &alloc_data) != 0) ++ abort(); ++ assert(alloc_data->length == tests[3].cred1len); ++ assert(memcmp(tests[3].cred1, alloc_data->data, alloc_data->length) == 0); ++ krb5_free_data(context, alloc_data); ++ krb5_free_creds(context, alloc_cred); ++ + for (version = FIRST_VERSION; version <= 4; version++) { + t = &tests[version - 1]; + +diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports +index 72652f2ce..9de0fcdb3 100644 +--- a/src/lib/krb5/libkrb5.exports ++++ b/src/lib/krb5/libkrb5.exports +@@ -489,6 +489,7 @@ krb5_lock_file + krb5_make_authdata_kdc_issued + krb5_make_full_ipaddr + krb5_make_fulladdr ++krb5_marshal_credentials + krb5_mcc_ops + krb5_merge_authdata + krb5_mk_1cred +@@ -591,6 +592,7 @@ krb5_timeofday + krb5_timestamp_to_sfstring + krb5_timestamp_to_string + krb5_unlock_file ++krb5_unmarshal_credentials + krb5_unpack_full_ipaddr + krb5_unparse_name + krb5_unparse_name_ext +diff --git a/src/lib/krb5_32.def b/src/lib/krb5_32.def +index 4953907aa..60b8dd311 100644 +--- a/src/lib/krb5_32.def ++++ b/src/lib/krb5_32.def +@@ -503,3 +503,7 @@ EXPORTS + ; new in 1.19 + k5_cc_store_primary_cred @470 ; PRIVATE + k5_kt_have_match @471 ; PRIVATE GSSAPI ++ ++; new in 1.20 ++ krb5_marshal_credentials @472 ++ krb5_unmarshal_credentials @473 diff --git a/krb5.spec b/krb5.spec index 62b763c..75e83f7 100644 --- a/krb5.spec +++ b/krb5.spec @@ -19,7 +19,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19 -Release: %{?zdpd}1%{?dist}.2 +Release: %{?zdpd}2%{?dist}.2 # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -47,6 +47,7 @@ Patch4: downstream-fix-debuginfo-with-y.tab.c.patch Patch5: downstream-Remove-3des-support.patch Patch6: downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch Patch7: downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch +Patch8: Add-APIs-for-marshalling-credentials.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -608,6 +609,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Thu Jan 28 2021 Robbie Harwood - 1.19-2 +- Add APIs for marshalling credentials + * Wed Jan 27 2021 Robbie Harwood - 1.19.0.beta2.1.2 - Cope with new autotools behavior wrt runstatedir From 54bf131a4adaf8bb87e989b0087d48d18dc5f82d Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Thu, 28 Jan 2021 16:16:22 +0000 Subject: [PATCH 014/103] Fix up weird mass rebuild versioning --- krb5.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/krb5.spec b/krb5.spec index 75e83f7..73bda4a 100644 --- a/krb5.spec +++ b/krb5.spec @@ -19,7 +19,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19 -Release: %{?zdpd}2%{?dist}.2 +Release: %{?zdpd}3%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -609,10 +609,13 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog -* Thu Jan 28 2021 Robbie Harwood - 1.19-2 +* Thu Jan 28 2021 Robbie Harwood - 1.19-0.beta2.3 +- Fix up weird mass rebuild versioning + +* Thu Jan 28 2021 Robbie Harwood - 1.19-0.beta2.2.2 - Add APIs for marshalling credentials -* Wed Jan 27 2021 Robbie Harwood - 1.19.0.beta2.1.2 +* Wed Jan 27 2021 Robbie Harwood - 1.19-0.beta2.1.2 - Cope with new autotools behavior wrt runstatedir * Tue Jan 26 2021 Fedora Release Engineering - 1.19-0.beta2.1.1 From 042ca4af99e6c40f648d3e0738dc6a23b418dd07 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Thu, 28 Jan 2021 16:37:37 +0000 Subject: [PATCH 015/103] Require krb5-pkinit from krb5-{server,workstation} --- krb5.spec | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/krb5.spec b/krb5.spec index 73bda4a..87f00ec 100644 --- a/krb5.spec +++ b/krb5.spec @@ -19,7 +19,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19 -Release: %{?zdpd}3%{?dist} +Release: %{?zdpd}4%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -115,6 +115,7 @@ Kerberos, you need to install this package. %package server Summary: The KDC and related programs for Kerberos 5 Requires: %{name}-libs%{?_isa} = %{version}-%{release} +Requires: %{name}-pkinit%{?_isa} = %{version}-%{release} Requires(post): systemd-units Requires(preun): systemd-units Requires(postun): systemd-units @@ -151,6 +152,7 @@ realm, you need to install this package. %package workstation Summary: Kerberos 5 programs for use on workstations Requires: %{name}-libs%{?_isa} = %{version}-%{release} +Requires: %{name}-pkinit%{?_isa} = %{version}-%{release} Requires: libkadm5%{?_isa} = %{version}-%{release} %description workstation @@ -609,6 +611,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Thu Jan 28 2021 Robbie Harwood - 1.19-0.beta2.4 +- Require krb5-pkinit from krb5-{server,workstation} + * Thu Jan 28 2021 Robbie Harwood - 1.19-0.beta2.3 - Fix up weird mass rebuild versioning From 0dd40e4ff052566efcaa5425c4cb56bd5d23d56f Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Thu, 28 Jan 2021 13:18:14 -0500 Subject: [PATCH 016/103] Support host-based GSS initiator names --- ...canonicalization-helper-to-k5test.py.patch | 84 +++ Support-host-based-GSS-initiator-names.patch | 578 ++++++++++++++++++ krb5.spec | 7 +- 3 files changed, 668 insertions(+), 1 deletion(-) create mode 100644 Add-hostname-canonicalization-helper-to-k5test.py.patch create mode 100644 Support-host-based-GSS-initiator-names.patch diff --git a/Add-hostname-canonicalization-helper-to-k5test.py.patch b/Add-hostname-canonicalization-helper-to-k5test.py.patch new file mode 100644 index 0000000..93d3963 --- /dev/null +++ b/Add-hostname-canonicalization-helper-to-k5test.py.patch @@ -0,0 +1,84 @@ +From 3204462c480484845513f2d7f323e367efde62cd Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Fri, 15 Jan 2021 14:43:34 -0500 +Subject: [PATCH] Add hostname canonicalization helper to k5test.py + +To facilitate fallback tests, add a canonicalize_hostname() function +to k5test.py which works similarly to krb5_expand_hostname(). Use it +in t_gssapi.py for the recently-added acceptor name fallback test. + +(cherry picked from commit 225fffe4e912772acea3a01d45bafb60bfb80948) +--- + src/tests/gssapi/t_gssapi.py | 11 +++-------- + src/util/k5test.py | 22 ++++++++++++++++++++++ + 2 files changed, 25 insertions(+), 8 deletions(-) + +diff --git a/src/tests/gssapi/t_gssapi.py b/src/tests/gssapi/t_gssapi.py +index 1af6f31c2..e22cec427 100755 +--- a/src/tests/gssapi/t_gssapi.py ++++ b/src/tests/gssapi/t_gssapi.py +@@ -8,7 +8,7 @@ for realm in multipass_realms(): + realm.run(['./t_iov', '-s', 'p:' + realm.host_princ]) + realm.run(['./t_pcontok', 'p:' + realm.host_princ]) + +-realm = K5Realm(krb5_conf={'libdefaults': {'rdns': 'false'}}) ++realm = K5Realm() + + # Test gss_add_cred(). + realm.run(['./t_add_cred']) +@@ -62,13 +62,8 @@ realm.run(['./t_accname', 'p:host/-nomatch-', + expected_msg=' not found in keytab') + + # If possible, test with an acceptor name requiring fallback to match +-# against a keytab entry. Forward-canonicalize the hostname, relying +-# on the rdns=false realm setting. +-try: +- ai = socket.getaddrinfo(hostname, None, 0, 0, 0, socket.AI_CANONNAME) +- (family, socktype, proto, canonname, sockaddr) = ai[0] +-except socket.gaierror: +- canonname = hostname ++# against a keytab entry. ++canonname = canonicalize_hostname(hostname) + if canonname != hostname: + os.rename(realm.keytab, realm.keytab + '.save') + canonprinc = 'host/' + canonname +diff --git a/src/util/k5test.py b/src/util/k5test.py +index 789b0f4b9..251d11a9d 100644 +--- a/src/util/k5test.py ++++ b/src/util/k5test.py +@@ -155,6 +155,10 @@ Scripts may use the following functions and variables: + * password(name): Return a weakly random password based on name. The + password will be consistent across calls with the same name. + ++* canonicalize_hostname(name, rdns=True): Return the DNS ++ canonicalization of name, optionally using reverse DNS. On error, ++ return name converted to lowercase. ++ + * stop_daemon(proc): Stop a daemon process started with + realm.start_server() or realm.start_in_inetd(). Only necessary if + the port needs to be reused; daemon processes will be stopped +@@ -458,6 +462,24 @@ def password(name): + return name + str(os.getpid()) + + ++def canonicalize_hostname(name, rdns=True): ++ """Canonicalize name using DNS, optionally with reverse DNS.""" ++ try: ++ ai = socket.getaddrinfo(name, None, 0, 0, 0, socket.AI_CANONNAME) ++ except socket.gaierror as e: ++ return name.lower() ++ (family, socktype, proto, canonname, sockaddr) = ai[0] ++ ++ if not rdns: ++ return canonname.lower() ++ ++ try: ++ rname = socket.getnameinfo(sockaddr, socket.NI_NAMEREQD) ++ except socket.gaierror: ++ return canonname.lower() ++ return rname[0].lower() ++ ++ + # Exit handler which ensures processes are cleaned up and, on failure, + # prints messages to help developers debug the problem. + def _onexit(): diff --git a/Support-host-based-GSS-initiator-names.patch b/Support-host-based-GSS-initiator-names.patch new file mode 100644 index 0000000..f04609f --- /dev/null +++ b/Support-host-based-GSS-initiator-names.patch @@ -0,0 +1,578 @@ +From 067e3a509442d81d1a31dd4bcbcc190f55369cc9 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Fri, 15 Jan 2021 13:51:34 -0500 +Subject: [PATCH] Support host-based GSS initiator names + +When checking if we can get initial credentials in the GSS krb5 mech, +use krb5_kt_have_match() to support fallback iteration. When scanning +the ccache or getting initial credentials, rewrite cred->name->princ +to the canonical client name. When a name check is necessary (such as +when the caller specifies both a name and ccache), use a new internal +API k5_sname_compare() to support fallback iteration. Add fallback +iteration to krb5_cc_cache_match() to allow host-based names to be +canonicalized against the cache collection. + +Create and store the matching principal for acceptor names in +acquire_accept_cred() so that it isn't affected by changes in +cred->name->princ during acquire_init_cred(). + +ticket: 8978 (new) +(cherry picked from commit c374ab40dd059a5938ffc0440d87457ac5da3a46) +--- + src/include/k5-int.h | 9 +++ + src/include/k5-trace.h | 3 + + src/lib/gssapi/krb5/accept_sec_context.c | 15 +--- + src/lib/gssapi/krb5/acquire_cred.c | 89 ++++++++++++++---------- + src/lib/gssapi/krb5/gssapiP_krb5.h | 1 + + src/lib/gssapi/krb5/rel_cred.c | 1 + + src/lib/krb5/ccache/cccursor.c | 57 +++++++++++---- + src/lib/krb5/libkrb5.exports | 1 + + src/lib/krb5/os/sn2princ.c | 23 +++++- + src/lib/krb5_32.def | 1 + + src/tests/gssapi/t_client_keytab.py | 44 ++++++++++++ + src/tests/gssapi/t_credstore.py | 32 +++++++++ + 12 files changed, 214 insertions(+), 62 deletions(-) + +diff --git a/src/include/k5-int.h b/src/include/k5-int.h +index efb523689..46f2ce2d3 100644 +--- a/src/include/k5-int.h ++++ b/src/include/k5-int.h +@@ -2411,4 +2411,13 @@ void k5_change_error_message_code(krb5_context ctx, krb5_error_code oldcode, + #define k5_prependmsg krb5_prepend_error_message + #define k5_wrapmsg krb5_wrap_error_message + ++/* ++ * Like krb5_principal_compare(), but with canonicalization of sname if ++ * fallback is enabled. This function should be avoided if multiple matches ++ * are required, since repeated canonicalization is inefficient. ++ */ ++krb5_boolean ++k5_sname_compare(krb5_context context, krb5_const_principal sname, ++ krb5_const_principal princ); ++ + #endif /* _KRB5_INT_H */ +diff --git a/src/include/k5-trace.h b/src/include/k5-trace.h +index b3e039dc8..79b5a7a85 100644 +--- a/src/include/k5-trace.h ++++ b/src/include/k5-trace.h +@@ -105,6 +105,9 @@ void krb5int_trace(krb5_context context, const char *fmt, ...); + + #endif /* DISABLE_TRACING */ + ++#define TRACE_CC_CACHE_MATCH(c, princ, ret) \ ++ TRACE(c, "Matching {princ} in collection with result: {kerr}", \ ++ princ, ret) + #define TRACE_CC_DESTROY(c, cache) \ + TRACE(c, "Destroying ccache {ccache}", cache) + #define TRACE_CC_GEN_NEW(c, cache) \ +diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c +index fcf2c2152..a1d7e0d96 100644 +--- a/src/lib/gssapi/krb5/accept_sec_context.c ++++ b/src/lib/gssapi/krb5/accept_sec_context.c +@@ -683,7 +683,6 @@ kg_accept_krb5(minor_status, context_handle, + krb5_flags ap_req_options = 0; + krb5_enctype negotiated_etype; + krb5_authdata_context ad_context = NULL; +- krb5_principal accprinc = NULL; + krb5_ap_req *request = NULL; + + code = krb5int_accessor (&kaccess, KRB5INT_ACCESS_VERSION); +@@ -849,17 +848,9 @@ kg_accept_krb5(minor_status, context_handle, + } + } + +- if (!cred->default_identity) { +- if ((code = kg_acceptor_princ(context, cred->name, &accprinc))) { +- major_status = GSS_S_FAILURE; +- goto fail; +- } +- } +- +- code = krb5_rd_req_decoded(context, &auth_context, request, accprinc, +- cred->keytab, &ap_req_options, NULL); +- +- krb5_free_principal(context, accprinc); ++ code = krb5_rd_req_decoded(context, &auth_context, request, ++ cred->acceptor_mprinc, cred->keytab, ++ &ap_req_options, NULL); + if (code) { + major_status = GSS_S_FAILURE; + goto fail; +diff --git a/src/lib/gssapi/krb5/acquire_cred.c b/src/lib/gssapi/krb5/acquire_cred.c +index 632ee7def..e226a0269 100644 +--- a/src/lib/gssapi/krb5/acquire_cred.c ++++ b/src/lib/gssapi/krb5/acquire_cred.c +@@ -123,11 +123,11 @@ gss_krb5int_register_acceptor_identity(OM_uint32 *minor_status, + /* Try to verify that keytab contains at least one entry for name. Return 0 if + * it does, KRB5_KT_NOTFOUND if it doesn't, or another error as appropriate. */ + static krb5_error_code +-check_keytab(krb5_context context, krb5_keytab kt, krb5_gss_name_t name) ++check_keytab(krb5_context context, krb5_keytab kt, krb5_gss_name_t name, ++ krb5_principal mprinc) + { + krb5_error_code code; + krb5_keytab_entry ent; +- krb5_principal accprinc = NULL; + char *princname; + + if (name->service == NULL) { +@@ -141,21 +141,15 @@ check_keytab(krb5_context context, krb5_keytab kt, krb5_gss_name_t name) + if (kt->ops->start_seq_get == NULL) + return 0; + +- /* Get the partial principal for the acceptor name. */ +- code = kg_acceptor_princ(context, name, &accprinc); +- if (code) +- return code; +- +- /* Scan the keytab for host-based entries matching accprinc. */ +- code = k5_kt_have_match(context, kt, accprinc); ++ /* Scan the keytab for host-based entries matching mprinc. */ ++ code = k5_kt_have_match(context, kt, mprinc); + if (code == KRB5_KT_NOTFOUND) { +- if (krb5_unparse_name(context, accprinc, &princname) == 0) { ++ if (krb5_unparse_name(context, mprinc, &princname) == 0) { + k5_setmsg(context, code, _("No key table entry found matching %s"), + princname); + free(princname); + } + } +- krb5_free_principal(context, accprinc); + return code; + } + +@@ -202,8 +196,14 @@ acquire_accept_cred(krb5_context context, OM_uint32 *minor_status, + } + + if (cred->name != NULL) { ++ code = kg_acceptor_princ(context, cred->name, &cred->acceptor_mprinc); ++ if (code) { ++ major = GSS_S_FAILURE; ++ goto cleanup; ++ } ++ + /* Make sure we have keys matching the desired name in the keytab. */ +- code = check_keytab(context, kt, cred->name); ++ code = check_keytab(context, kt, cred->name, cred->acceptor_mprinc); + if (code) { + if (code == KRB5_KT_NOTFOUND) { + k5_change_error_message_code(context, code, KG_KEYTAB_NOMATCH); +@@ -324,7 +324,6 @@ static krb5_boolean + can_get_initial_creds(krb5_context context, krb5_gss_cred_id_rec *cred) + { + krb5_error_code code; +- krb5_keytab_entry entry; + + if (cred->password != NULL) + return TRUE; +@@ -336,20 +335,21 @@ can_get_initial_creds(krb5_context context, krb5_gss_cred_id_rec *cred) + if (cred->name == NULL) + return !krb5_kt_have_content(context, cred->client_keytab); + +- /* Check if we have a keytab key for the client principal. */ +- code = krb5_kt_get_entry(context, cred->client_keytab, cred->name->princ, +- 0, 0, &entry); +- if (code) { +- krb5_clear_error_message(context); +- return FALSE; +- } +- krb5_free_keytab_entry_contents(context, &entry); +- return TRUE; ++ /* ++ * Check if we have a keytab key for the client principal. This is a bit ++ * more permissive than we really want because krb5_kt_have_match() ++ * supports wildcarding and obeys ignore_acceptor_hostname, but that should ++ * generally be harmless. ++ */ ++ code = k5_kt_have_match(context, cred->client_keytab, cred->name->princ); ++ return code == 0; + } + +-/* Scan cred->ccache for name, expiry time, impersonator, refresh time. */ ++/* Scan cred->ccache for name, expiry time, impersonator, refresh time. If ++ * check_name is true, verify the cache name against the credential name. */ + static krb5_error_code +-scan_ccache(krb5_context context, krb5_gss_cred_id_rec *cred) ++scan_ccache(krb5_context context, krb5_gss_cred_id_rec *cred, ++ krb5_boolean check_name) + { + krb5_error_code code; + krb5_ccache ccache = cred->ccache; +@@ -365,23 +365,31 @@ scan_ccache(krb5_context context, krb5_gss_cred_id_rec *cred) + if (code) + return code; + +- /* Credentials cache principal must match the initiator name. */ + code = krb5_cc_get_principal(context, ccache, &ccache_princ); + if (code != 0) + goto cleanup; +- if (cred->name != NULL && +- !krb5_principal_compare(context, ccache_princ, cred->name->princ)) { +- code = KG_CCACHE_NOMATCH; +- goto cleanup; +- } + +- /* Save the ccache principal as the credential name if not already set. */ +- if (!cred->name) { ++ if (cred->name == NULL) { ++ /* Save the ccache principal as the credential name. */ + code = kg_init_name(context, ccache_princ, NULL, NULL, NULL, + KG_INIT_NAME_NO_COPY, &cred->name); + if (code) + goto cleanup; + ccache_princ = NULL; ++ } else { ++ /* Check against the desired name if needed. */ ++ if (check_name) { ++ if (!k5_sname_compare(context, cred->name->princ, ccache_princ)) { ++ code = KG_CCACHE_NOMATCH; ++ goto cleanup; ++ } ++ } ++ ++ /* Replace the credential name principal with the canonical client ++ * principal, retaining acceptor_mprinc if set. */ ++ krb5_free_principal(context, cred->name->princ); ++ cred->name->princ = ccache_princ; ++ ccache_princ = NULL; + } + + assert(cred->name->princ != NULL); +@@ -447,7 +455,7 @@ get_cache_for_name(krb5_context context, krb5_gss_cred_id_rec *cred) + assert(cred->name != NULL && cred->ccache == NULL); + #ifdef USE_LEASH + code = get_ccache_leash(context, cred->name->princ, &cred->ccache); +- return code ? code : scan_ccache(context, cred); ++ return code ? code : scan_ccache(context, cred, TRUE); + #else + /* Check first whether we can acquire tickets, to avoid overwriting the + * extended error message from krb5_cc_cache_match. */ +@@ -456,7 +464,7 @@ get_cache_for_name(krb5_context context, krb5_gss_cred_id_rec *cred) + /* Look for an existing cache for the client principal. */ + code = krb5_cc_cache_match(context, cred->name->princ, &cred->ccache); + if (code == 0) +- return scan_ccache(context, cred); ++ return scan_ccache(context, cred, FALSE); + if (code != KRB5_CC_NOTFOUND || !can_get) + return code; + krb5_clear_error_message(context); +@@ -633,6 +641,13 @@ get_initial_cred(krb5_context context, const struct verify_params *verify, + kg_cred_set_initial_refresh(context, cred, &creds.times); + cred->have_tgt = TRUE; + cred->expire = creds.times.endtime; ++ ++ /* Steal the canonical client principal name from creds and save it in the ++ * credential name, retaining acceptor_mprinc if set. */ ++ krb5_free_principal(context, cred->name->princ); ++ cred->name->princ = creds.client; ++ creds.client = NULL; ++ + krb5_free_cred_contents(context, &creds); + cleanup: + krb5_get_init_creds_opt_free(context, opt); +@@ -721,7 +736,7 @@ acquire_init_cred(krb5_context context, OM_uint32 *minor_status, + + if (cred->ccache != NULL) { + /* The caller specified a ccache; check what's in it. */ +- code = scan_ccache(context, cred); ++ code = scan_ccache(context, cred, TRUE); + if (code == KRB5_FCC_NOFILE) { + /* See if we can get initial creds. If the caller didn't specify + * a name, pick one from the client keytab. */ +@@ -984,7 +999,7 @@ kg_cred_resolve(OM_uint32 *minor_status, krb5_context context, + } + } + if (cred->ccache != NULL) { +- code = scan_ccache(context, cred); ++ code = scan_ccache(context, cred, FALSE); + if (code) + goto kerr; + } +@@ -996,7 +1011,7 @@ kg_cred_resolve(OM_uint32 *minor_status, krb5_context context, + code = krb5int_cc_default(context, &cred->ccache); + if (code) + goto kerr; +- code = scan_ccache(context, cred); ++ code = scan_ccache(context, cred, FALSE); + if (code == KRB5_FCC_NOFILE) { + /* Default ccache doesn't exist; fall through to client keytab. */ + krb5_cc_close(context, cred->ccache); +diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h +index 3bacdcd35..fd7abbd77 100644 +--- a/src/lib/gssapi/krb5/gssapiP_krb5.h ++++ b/src/lib/gssapi/krb5/gssapiP_krb5.h +@@ -175,6 +175,7 @@ typedef struct _krb5_gss_cred_id_rec { + /* name/type of credential */ + gss_cred_usage_t usage; + krb5_gss_name_t name; ++ krb5_principal acceptor_mprinc; + krb5_principal impersonator; + unsigned int default_identity : 1; + unsigned int iakerb_mech : 1; +diff --git a/src/lib/gssapi/krb5/rel_cred.c b/src/lib/gssapi/krb5/rel_cred.c +index a9515daf7..0da6c1b95 100644 +--- a/src/lib/gssapi/krb5/rel_cred.c ++++ b/src/lib/gssapi/krb5/rel_cred.c +@@ -72,6 +72,7 @@ krb5_gss_release_cred(minor_status, cred_handle) + if (cred->name) + kg_release_name(context, &cred->name); + ++ krb5_free_principal(context, cred->acceptor_mprinc); + krb5_free_principal(context, cred->impersonator); + + if (cred->req_enctypes) +diff --git a/src/lib/krb5/ccache/cccursor.c b/src/lib/krb5/ccache/cccursor.c +index 8f5872116..760216d05 100644 +--- a/src/lib/krb5/ccache/cccursor.c ++++ b/src/lib/krb5/ccache/cccursor.c +@@ -30,6 +30,7 @@ + + #include "cc-int.h" + #include "../krb/int-proto.h" ++#include "../os/os-proto.h" + + #include + +@@ -141,18 +142,18 @@ krb5_cccol_cursor_free(krb5_context context, + return 0; + } + +-krb5_error_code KRB5_CALLCONV +-krb5_cc_cache_match(krb5_context context, krb5_principal client, +- krb5_ccache *cache_out) ++static krb5_error_code ++match_caches(krb5_context context, krb5_const_principal client, ++ krb5_ccache *cache_out) + { + krb5_error_code ret; + krb5_cccol_cursor cursor; + krb5_ccache cache = NULL; + krb5_principal princ; +- char *name; + krb5_boolean eq; + + *cache_out = NULL; ++ + ret = krb5_cccol_cursor_new(context, &cursor); + if (ret) + return ret; +@@ -169,20 +170,52 @@ krb5_cc_cache_match(krb5_context context, krb5_principal client, + krb5_cc_close(context, cache); + } + krb5_cccol_cursor_free(context, &cursor); ++ + if (ret) + return ret; +- if (cache == NULL) { +- ret = krb5_unparse_name(context, client, &name); +- if (ret == 0) { +- k5_setmsg(context, KRB5_CC_NOTFOUND, ++ if (cache == NULL) ++ return KRB5_CC_NOTFOUND; ++ ++ *cache_out = cache; ++ return 0; ++} ++ ++krb5_error_code KRB5_CALLCONV ++krb5_cc_cache_match(krb5_context context, krb5_principal client, ++ krb5_ccache *cache_out) ++{ ++ krb5_error_code ret; ++ struct canonprinc iter = { client, .subst_defrealm = TRUE }; ++ krb5_const_principal canonprinc = NULL; ++ krb5_ccache cache = NULL; ++ char *name; ++ ++ *cache_out = NULL; ++ ++ while ((ret = k5_canonprinc(context, &iter, &canonprinc)) == 0 && ++ canonprinc != NULL) { ++ ret = match_caches(context, canonprinc, &cache); ++ if (ret != KRB5_CC_NOTFOUND) ++ break; ++ } ++ free_canonprinc(&iter); ++ ++ if (ret == 0 && canonprinc == NULL) { ++ ret = KRB5_CC_NOTFOUND; ++ if (krb5_unparse_name(context, client, &name) == 0) { ++ k5_setmsg(context, ret, + _("Can't find client principal %s in cache collection"), + name); + krb5_free_unparsed_name(context, name); + } +- ret = KRB5_CC_NOTFOUND; +- } else +- *cache_out = cache; +- return ret; ++ } ++ ++ TRACE_CC_CACHE_MATCH(context, client, ret); ++ if (ret) ++ return ret; ++ ++ *cache_out = cache; ++ return 0; + } + + /* Store the error state for code from context into errsave, but only if code +diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports +index 9de0fcdb3..25141dfc5 100644 +--- a/src/lib/krb5/libkrb5.exports ++++ b/src/lib/krb5/libkrb5.exports +@@ -181,6 +181,7 @@ k5_size_authdata_context + k5_size_context + k5_size_keyblock + k5_size_principal ++k5_sname_compare + k5_unmarshal_cred + k5_unmarshal_princ + k5_unwrap_cammac_svc +diff --git a/src/lib/krb5/os/sn2princ.c b/src/lib/krb5/os/sn2princ.c +index 8b7214189..c99b7da17 100644 +--- a/src/lib/krb5/os/sn2princ.c ++++ b/src/lib/krb5/os/sn2princ.c +@@ -277,7 +277,8 @@ k5_canonprinc(krb5_context context, struct canonprinc *iter, + + /* If we're not doing fallback, the input principal is canonical. */ + if (context->dns_canonicalize_hostname != CANONHOST_FALLBACK || +- iter->princ->type != KRB5_NT_SRV_HST || iter->princ->length != 2) { ++ iter->princ->type != KRB5_NT_SRV_HST || iter->princ->length != 2 || ++ iter->princ->data[1].length == 0) { + *princ_out = (step == 1) ? iter->princ : NULL; + return 0; + } +@@ -288,6 +289,26 @@ k5_canonprinc(krb5_context context, struct canonprinc *iter, + return canonicalize_princ(context, iter, step == 2, princ_out); + } + ++krb5_boolean ++k5_sname_compare(krb5_context context, krb5_const_principal sname, ++ krb5_const_principal princ) ++{ ++ krb5_error_code ret; ++ struct canonprinc iter = { sname, .subst_defrealm = TRUE }; ++ krb5_const_principal canonprinc = NULL; ++ krb5_boolean match = FALSE; ++ ++ while ((ret = k5_canonprinc(context, &iter, &canonprinc)) == 0 && ++ canonprinc != NULL) { ++ if (krb5_principal_compare(context, canonprinc, princ)) { ++ match = TRUE; ++ break; ++ } ++ } ++ free_canonprinc(&iter); ++ return match; ++} ++ + krb5_error_code KRB5_CALLCONV + krb5_sname_to_principal(krb5_context context, const char *hostname, + const char *sname, krb5_int32 type, +diff --git a/src/lib/krb5_32.def b/src/lib/krb5_32.def +index 60b8dd311..cf690dbe4 100644 +--- a/src/lib/krb5_32.def ++++ b/src/lib/krb5_32.def +@@ -507,3 +507,4 @@ EXPORTS + ; new in 1.20 + krb5_marshal_credentials @472 + krb5_unmarshal_credentials @473 ++ k5_sname_compare @474 ; PRIVATE GSSAPI +diff --git a/src/tests/gssapi/t_client_keytab.py b/src/tests/gssapi/t_client_keytab.py +index 7847b3ecd..9a61d53b8 100755 +--- a/src/tests/gssapi/t_client_keytab.py ++++ b/src/tests/gssapi/t_client_keytab.py +@@ -141,5 +141,49 @@ msgs = ('Getting initial credentials for user/admin@KRBTEST.COM', + '/Matching credential not found') + realm.run(['./t_ccselect', phost], expected_code=1, + expected_msg='Ticket expired', expected_trace=msgs) ++realm.run([kdestroy, '-A']) ++ ++# Test 19: host-based initiator name ++mark('host-based initiator name') ++hsvc = 'h:svc@' + hostname ++svcprinc = 'svc/%s@%s' % (hostname, realm.realm) ++realm.addprinc(svcprinc) ++realm.extract_keytab(svcprinc, realm.client_keytab) ++# On the first run we match against the keytab while getting tickets, ++# substituting the default realm. ++msgs = ('/Can\'t find client principal svc/%s@ in' % hostname, ++ 'Getting initial credentials for svc/%s@' % hostname, ++ 'Found entries for %s in keytab' % svcprinc, ++ 'Retrieving %s from FILE:%s' % (svcprinc, realm.client_keytab), ++ 'Storing %s -> %s in' % (svcprinc, realm.krbtgt_princ), ++ 'Retrieving %s -> %s from' % (svcprinc, realm.krbtgt_princ), ++ 'authenticator for %s -> %s' % (svcprinc, realm.host_princ)) ++realm.run(['./t_ccselect', phost, hsvc], expected_trace=msgs) ++# On the second run we match against the collection. ++msgs = ('Matching svc/%s@ in collection with result: 0' % hostname, ++ 'Getting credentials %s -> %s' % (svcprinc, realm.host_princ), ++ 'authenticator for %s -> %s' % (svcprinc, realm.host_princ)) ++realm.run(['./t_ccselect', phost, hsvc], expected_trace=msgs) ++realm.run([kdestroy, '-A']) ++ ++# Test 20: host-based initiator name with fallback ++mark('host-based fallback initiator name') ++canonname = canonicalize_hostname(hostname) ++if canonname != hostname: ++ hfsvc = 'h:fsvc@' + hostname ++ canonprinc = 'fsvc/%s@%s' % (canonname, realm.realm) ++ realm.addprinc(canonprinc) ++ realm.extract_keytab(canonprinc, realm.client_keytab) ++ msgs = ('/Can\'t find client principal fsvc/%s@ in' % hostname, ++ 'Found entries for %s in keytab' % canonprinc, ++ 'authenticator for %s -> %s' % (canonprinc, realm.host_princ)) ++ realm.run(['./t_ccselect', phost, hfsvc], expected_trace=msgs) ++ msgs = ('Matching fsvc/%s@ in collection with result: 0' % hostname, ++ 'Getting credentials %s -> %s' % (canonprinc, realm.host_princ)) ++ realm.run(['./t_ccselect', phost, hfsvc], expected_trace=msgs) ++ realm.run([kdestroy, '-A']) ++else: ++ skipped('GSS initiator name fallback test', ++ '%s does not canonicalize to a different name' % hostname) + + success('Client keytab tests') +diff --git a/src/tests/gssapi/t_credstore.py b/src/tests/gssapi/t_credstore.py +index c11975bf5..9be57bb82 100644 +--- a/src/tests/gssapi/t_credstore.py ++++ b/src/tests/gssapi/t_credstore.py +@@ -15,6 +15,38 @@ msgs = ('Storing %s -> %s in %s' % (service_cs, realm.krbtgt_princ, + realm.run(['./t_credstore', '-s', 'p:' + service_cs, 'ccache', storagecache, + 'keytab', servicekeytab], expected_trace=msgs) + ++mark('matching') ++scc = 'FILE:' + os.path.join(realm.testdir, 'service_cache') ++realm.kinit(realm.host_princ, flags=['-k', '-c', scc]) ++realm.run(['./t_credstore', '-i', 'p:' + realm.host_princ, 'ccache', scc]) ++realm.run(['./t_credstore', '-i', 'h:host', 'ccache', scc]) ++realm.run(['./t_credstore', '-i', 'h:host@' + hostname, 'ccache', scc]) ++realm.run(['./t_credstore', '-i', 'p:wrong', 'ccache', scc], ++ expected_code=1, expected_msg='does not match desired name') ++realm.run(['./t_credstore', '-i', 'h:host@-nomatch-', 'ccache', scc], ++ expected_code=1, expected_msg='does not match desired name') ++realm.run(['./t_credstore', '-i', 'h:svc', 'ccache', scc], ++ expected_code=1, expected_msg='does not match desired name') ++ ++mark('matching (fallback)') ++canonname = canonicalize_hostname(hostname) ++if canonname != hostname: ++ canonprinc = 'host/%s@%s' % (canonname, realm.realm) ++ realm.addprinc(canonprinc) ++ realm.extract_keytab(canonprinc, realm.keytab) ++ realm.kinit(canonprinc, flags=['-k', '-c', scc]) ++ realm.run(['./t_credstore', '-i', 'h:host', 'ccache', scc]) ++ realm.run(['./t_credstore', '-i', 'h:host@' + hostname, 'ccache', scc]) ++ realm.run(['./t_credstore', '-i', 'h:host@' + canonname, 'ccache', scc]) ++ realm.run(['./t_credstore', '-i', 'p:' + canonprinc, 'ccache', scc]) ++ realm.run(['./t_credstore', '-i', 'p:' + realm.host_princ, 'ccache', scc], ++ expected_code=1, expected_msg='does not match desired name') ++ realm.run(['./t_credstore', '-i', 'h:host@-nomatch-', 'ccache', scc], ++ expected_code=1, expected_msg='does not match desired name') ++else: ++ skipped('fallback matching test', ++ '%s does not canonicalize to a different name' % hostname) ++ + mark('rcache') + # t_credstore -r should produce a replay error normally, but not with + # rcache set to "none:". diff --git a/krb5.spec b/krb5.spec index 87f00ec..8994c9c 100644 --- a/krb5.spec +++ b/krb5.spec @@ -19,7 +19,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19 -Release: %{?zdpd}4%{?dist} +Release: %{?zdpd}5%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -48,6 +48,8 @@ Patch5: downstream-Remove-3des-support.patch Patch6: downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch Patch7: downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch Patch8: Add-APIs-for-marshalling-credentials.patch +Patch9: Add-hostname-canonicalization-helper-to-k5test.py.patch +Patch10: Support-host-based-GSS-initiator-names.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -611,6 +613,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Thu Jan 28 2021 Robbie Harwood - 1.19-5 +- Support host-based GSS initiator names + * Thu Jan 28 2021 Robbie Harwood - 1.19-0.beta2.4 - Require krb5-pkinit from krb5-{server,workstation} From 105082cb422bee964b8feb51f39771c9d0425c34 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Mon, 1 Feb 2021 15:58:49 -0500 Subject: [PATCH 017/103] Hoist and add an option for disabling %check --- krb5.spec | 44 ++++++++++++++++++++++++++++---------------- 1 file changed, 28 insertions(+), 16 deletions(-) diff --git a/krb5.spec b/krb5.spec index 8994c9c..8be82d9 100644 --- a/krb5.spec +++ b/krb5.spec @@ -1,3 +1,27 @@ +%bcond_without check +%if %{without check} +%global skipcheck 1 +%endif + +# COPR doesn't work right with the tests. I suspect keyring issues, +# but can't actually debug, so... +%if 0%{?copr_username:1} +%global skipcheck 1 +%endif + +# There are 0 test machines for this architecture, very few builders, and +# they're not very well provisioned / maintained. I can't support it. +# Patches welcome, but there's nothing I can do - it fails more than half the +# for "infrastructure issues" that I can't hope to debug. +%ifarch s390x +%global skipcheck 1 +%endif + +# RHEL runs upstream's test suite in a separate pass after build. +%if 0%{?rhel} +%global skipcheck 1 +%endif + # Set this so that find-lang.sh will recognize the .po files. %global gettext_domain mit-krb5 # Guess where the -libs subpackage's docs are going to go. @@ -278,26 +302,14 @@ sphinx-build -a -b man -t pathsubs doc build-man sphinx-build -a -b html -t pathsubs doc build-html rm -fr build-html/_sources -%check - -# There are 0 test machines for this architecture, very few builders, and -# they're not very well provisioned / maintained. I can't support it. -# Patches welcome, but there's nothing I can do - it fails more than half the -# time for no discernable reason. -%ifnarch s390x -pushd src - -# ugh. COPR doesn't work right with the tests. I suspect keyring issues, but -# can't actually debug, so... -%if 0%{?copr_username:1} -%global keyctl : +%if 0%{?skipcheck} %else -%global keyctl keyctl -%endif +%check +pushd src # The build system may give us a revoked session keyring, so run affected # tests with a new one. -%{keyctl} session - make check OFFLINE=yes TMPDIR=%{_tmppath} +keyctl session - make check OFFLINE=yes TMPDIR=%{_tmppath} popd %endif From d5839d05119d47fad99e688c0a54d295c6e30024 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 2 Feb 2021 10:24:01 -0500 Subject: [PATCH 018/103] New upstream version (1.19) --- .gitignore | 2 ++ Add-APIs-for-marshalling-credentials.patch | 2 +- ...me-canonicalization-helper-to-k5test.py.patch | 2 +- Support-host-based-GSS-initiator-names.patch | 2 +- ...tream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch | 2 +- downstream-Remove-3des-support.patch | 2 +- downstream-SELinux-integration.patch | 2 +- ...e-backported-version-of-OpenSSL-3-KDF-i.patch | 2 +- downstream-fix-debuginfo-with-y.tab.c.patch | 2 +- downstream-ksu-pam-integration.patch | 2 +- downstream-netlib-and-dns.patch | 2 +- krb5.spec | 16 +++++++++------- sources | 4 ++-- 13 files changed, 23 insertions(+), 19 deletions(-) diff --git a/.gitignore b/.gitignore index c686550..591c859 100644 --- a/.gitignore +++ b/.gitignore @@ -193,3 +193,5 @@ krb5-1.8.3-pdf.tar.gz /krb5-1.19-beta1.tar.gz.asc /krb5-1.19-beta2.tar.gz /krb5-1.19-beta2.tar.gz.asc +/krb5-1.19.tar.gz +/krb5-1.19.tar.gz.asc diff --git a/Add-APIs-for-marshalling-credentials.patch b/Add-APIs-for-marshalling-credentials.patch index 39b3455..4c963d3 100644 --- a/Add-APIs-for-marshalling-credentials.patch +++ b/Add-APIs-for-marshalling-credentials.patch @@ -1,4 +1,4 @@ -From fd3ffdf173173e08abfe9ba78922f63723541c54 Mon Sep 17 00:00:00 2001 +From 057b45609fa457f2247df93b163f31723fd18077 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Thu, 14 Jan 2021 18:13:09 -0500 Subject: [PATCH] Add APIs for marshalling credentials diff --git a/Add-hostname-canonicalization-helper-to-k5test.py.patch b/Add-hostname-canonicalization-helper-to-k5test.py.patch index 93d3963..83697cd 100644 --- a/Add-hostname-canonicalization-helper-to-k5test.py.patch +++ b/Add-hostname-canonicalization-helper-to-k5test.py.patch @@ -1,4 +1,4 @@ -From 3204462c480484845513f2d7f323e367efde62cd Mon Sep 17 00:00:00 2001 +From 1d7b365e670f19beae319fde2abf1de0601a2a34 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Fri, 15 Jan 2021 14:43:34 -0500 Subject: [PATCH] Add hostname canonicalization helper to k5test.py diff --git a/Support-host-based-GSS-initiator-names.patch b/Support-host-based-GSS-initiator-names.patch index f04609f..a9ca98d 100644 --- a/Support-host-based-GSS-initiator-names.patch +++ b/Support-host-based-GSS-initiator-names.patch @@ -1,4 +1,4 @@ -From 067e3a509442d81d1a31dd4bcbcc190f55369cc9 Mon Sep 17 00:00:00 2001 +From c1df10d60512e1697ef18b343c237c6a96baf62c Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Fri, 15 Jan 2021 13:51:34 -0500 Subject: [PATCH] Support host-based GSS initiator names diff --git a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch b/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch index 8ca2534..ed61cf0 100644 --- a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch +++ b/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch @@ -1,4 +1,4 @@ -From 836fdca1ac4bb58498551e1afe8ca6e55d41902d Mon Sep 17 00:00:00 2001 +From b57c3a8fbeb0e83c9faa63ac49c5ed58971aa934 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 9 Nov 2018 15:12:21 -0500 Subject: [PATCH] [downstream] FIPS with PRNG and RADIUS and MD4 diff --git a/downstream-Remove-3des-support.patch b/downstream-Remove-3des-support.patch index 046a1be..efb79d0 100644 --- a/downstream-Remove-3des-support.patch +++ b/downstream-Remove-3des-support.patch @@ -1,4 +1,4 @@ -From 329c97793a3e96e79f618bc54914ec89a9e99828 Mon Sep 17 00:00:00 2001 +From 5ff60c965583977ee4a4f98555973f9920fc79cd Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 26 Mar 2019 18:51:10 -0400 Subject: [PATCH] [downstream] Remove 3des support diff --git a/downstream-SELinux-integration.patch b/downstream-SELinux-integration.patch index 7c134eb..d68bd92 100644 --- a/downstream-SELinux-integration.patch +++ b/downstream-SELinux-integration.patch @@ -1,4 +1,4 @@ -From 1de6ec4cb5b2a1b7b88680ae0f72551a3b5178e6 Mon Sep 17 00:00:00 2001 +From 99e57d4cbf0eb060162b7038d6e7b202d2716784 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:30:53 -0400 Subject: [PATCH] [downstream] SELinux integration diff --git a/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch b/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch index cb35de1..9ba0821 100644 --- a/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch +++ b/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch @@ -1,4 +1,4 @@ -From 120e84b63c322c227fb8c6ee8a2f56f47d3e57f5 Mon Sep 17 00:00:00 2001 +From 387ae61e2b6384eba692e777cc1bcc3d34bfa8c6 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 15 Nov 2019 20:05:16 +0000 Subject: [PATCH] [downstream] Use backported version of OpenSSL-3 KDF diff --git a/downstream-fix-debuginfo-with-y.tab.c.patch b/downstream-fix-debuginfo-with-y.tab.c.patch index 96c21ac..d40aef7 100644 --- a/downstream-fix-debuginfo-with-y.tab.c.patch +++ b/downstream-fix-debuginfo-with-y.tab.c.patch @@ -1,4 +1,4 @@ -From db57bb9939da544af242c054d10e69a022558b4e Mon Sep 17 00:00:00 2001 +From 83899829c5e26b98f0c9d124d1e56e7b84c75c02 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:49:25 -0400 Subject: [PATCH] [downstream] fix debuginfo with y.tab.c diff --git a/downstream-ksu-pam-integration.patch b/downstream-ksu-pam-integration.patch index 15b9b35..7da5ccf 100644 --- a/downstream-ksu-pam-integration.patch +++ b/downstream-ksu-pam-integration.patch @@ -1,4 +1,4 @@ -From 25f948637140fb6aade80f99d9e7e096250135cd Mon Sep 17 00:00:00 2001 +From 07d19a2c4f369a7a524c919c5a453e702967b530 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:29:58 -0400 Subject: [PATCH] [downstream] ksu pam integration diff --git a/downstream-netlib-and-dns.patch b/downstream-netlib-and-dns.patch index 4141da9..7b17912 100644 --- a/downstream-netlib-and-dns.patch +++ b/downstream-netlib-and-dns.patch @@ -1,4 +1,4 @@ -From 26a01204b4cb424e6f9cf4190f7290b0665f6f74 Mon Sep 17 00:00:00 2001 +From ea8156d348a533cc4418903ee351121366872c17 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:46:21 -0400 Subject: [PATCH] [downstream] netlib and dns diff --git a/krb5.spec b/krb5.spec index 8be82d9..7f08af2 100644 --- a/krb5.spec +++ b/krb5.spec @@ -30,8 +30,7 @@ %global configure_default_ccache_name 1 %global configured_default_ccache_name KEYRING:persistent:%%{uid} -# either beta1 or % { nil } -%global prerelease beta2 +# for prereleases, % global prerelease beta1 %if %{defined prerelease} %global dashpre -%{prerelease} %global zdpd 0.%{prerelease}. @@ -43,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19 -Release: %{?zdpd}5%{?dist} +Release: %{?zdpd}1%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -209,7 +208,7 @@ contains only the libkadm5clnt and libkadm5serv shared objects. This interface is not considered stable. %prep -%autosetup -S git -n %{name}-%{version}%{?dashpre} +%autosetup -S git_am -n %{name}-%{version}%{?dashpre} ln NOTICE LICENSE # Generate an FDS-compatible LDIF file. @@ -282,8 +281,8 @@ CPPFLAGS="`echo $DEFINES $INCLUDES`" --with-prng-alg=os \ --with-lmdb \ || (cat config.log; exit 1) -# Now build it. -make +# Build fast, but get better errors if we fail +make %{?_smp_mflags} || make -j1 popd # Sanity check the KDC_RUN_DIR. @@ -625,7 +624,10 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog -* Thu Jan 28 2021 Robbie Harwood - 1.19-5 +* Tue Feb 02 2021 Robbie Harwood - 1.19-1 +- New upstream version (1.19) + +* Thu Jan 28 2021 Robbie Harwood - 1.19-0.beta2.5 - Support host-based GSS initiator names * Thu Jan 28 2021 Robbie Harwood - 1.19-0.beta2.4 diff --git a/sources b/sources index 5daa433..dec9e28 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (krb5-1.19-beta2.tar.gz) = 2864a40c44575a9482d33165bc39e76f6bb476bdcc5bc87c9864f562925638118a236a788da870567d0f83df9aacb5f79145993f38f95cec1fa5b080f2561169 -SHA512 (krb5-1.19-beta2.tar.gz.asc) = fd17198c934907811abebd47b70f6c30e68aa5800f6dde90568241db1413da34557c689af66757e47d94e08d261573f0b1ee56929947f6dcc9fcbb9dcdd2e903 +SHA512 (krb5-1.19.tar.gz) = 99d4e75ff69bffc85698177b48ca430a7a9f077c3b6c4a422ed410b264f9a762a97db5d7e0764812e2530975f1c6c12031a5dabea1154bc01a26470e3ea960a9 +SHA512 (krb5-1.19.tar.gz.asc) = b5ee91d91f4fd727cdc61502753d679e9a87361b4c6f5db377ddf9fa1ae42447b8f46fc1c271e2253e88fb96a84fda88393003195076c16eb90506c1d7df731e From 90bc2e25b3235fd9b561f9b857f78fec988c62ad Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 5 Feb 2021 15:33:20 -0500 Subject: [PATCH 019/103] Cope with autoconf rollback --- krb5.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/krb5.spec b/krb5.spec index 7f08af2..aaf18d0 100644 --- a/krb5.spec +++ b/krb5.spec @@ -251,6 +251,9 @@ sed -i -e s,7778,`expr "$PORT" + 1`,g $cfg source %{_libdir}/tclConfig.sh pushd src +# This should be safe to remove once we have autoconf >= 2.70 +export runstatedir=/run + # Work out the CFLAGS and CPPFLAGS which we intend to use. INCLUDES=-I%{_includedir}/et CFLAGS="`echo $RPM_OPT_FLAGS $DEFINES $INCLUDES -fPIC -fno-strict-aliasing -fstack-protector-all`" From 35a4aa7b99d1eb139f4ae0e0fe87b17ada77a999 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 5 Feb 2021 20:39:13 +0000 Subject: [PATCH 020/103] No code change; just coping with reverted autoconf --- krb5.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/krb5.spec b/krb5.spec index aaf18d0..f61e44a 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19 -Release: %{?zdpd}1%{?dist} +Release: %{?zdpd}2%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -627,6 +627,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Fri Feb 05 2021 Robbie Harwood - 1.19-2 +- No code change; just coping with reverted autoconf + * Tue Feb 02 2021 Robbie Harwood - 1.19-1 - New upstream version (1.19) From d3ac4cf9b013e2eac320177fe64d420cc8f4d74b Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Mon, 15 Feb 2021 15:54:54 -0500 Subject: [PATCH 021/103] Hoist the KDC_RUN_DIR check --- krb5.spec | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/krb5.spec b/krb5.spec index f61e44a..96be371 100644 --- a/krb5.spec +++ b/krb5.spec @@ -284,18 +284,22 @@ CPPFLAGS="`echo $DEFINES $INCLUDES`" --with-prng-alg=os \ --with-lmdb \ || (cat config.log; exit 1) -# Build fast, but get better errors if we fail -make %{?_smp_mflags} || make -j1 -popd # Sanity check the KDC_RUN_DIR. -configured_dir=`grep KDC_RUN_DIR src/include/osconf.h | awk '{print $NF}'` +pushd include +make osconf.h +popd +configured_dir=`grep KDC_RUN_DIR include/osconf.h | awk '{print $NF}'` configured_dir=`eval echo $configured_dir` if test "$configured_dir" != /run/krb5kdc ; then echo Failed to configure KDC_RUN_DIR. exit 1 fi +# Build fast, but get better errors if we fail +make %{?_smp_mflags} || make -j1 +popd + # Build the docs. make -C src/doc paths.py version.py cp src/doc/paths.py doc/ From 00a0ac8abc1516c2580646b92b554939a5e01075 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Wed, 17 Feb 2021 16:12:41 -0500 Subject: [PATCH 022/103] Restore krb5_set_default_tgs_ktypes() --- Restore-krb5_set_default_tgs_ktypes.patch | 54 +++++++++++++++++++++++ krb5.spec | 6 ++- 2 files changed, 59 insertions(+), 1 deletion(-) create mode 100644 Restore-krb5_set_default_tgs_ktypes.patch diff --git a/Restore-krb5_set_default_tgs_ktypes.patch b/Restore-krb5_set_default_tgs_ktypes.patch new file mode 100644 index 0000000..742e302 --- /dev/null +++ b/Restore-krb5_set_default_tgs_ktypes.patch @@ -0,0 +1,54 @@ +From faa975dd74df535960bf8f82990f352d022a12a5 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Fri, 12 Feb 2021 15:11:25 -0500 +Subject: [PATCH] Restore krb5_set_default_tgs_ktypes() + +Samba only uses the correct name (krb5_set_default_tgs_enctypes) if it +cannot find the old one in the library, so removing the name causes a +linker error for existing builds. + +(cherry picked from commit 17ee97788611f8f8f4a6bd69968a9499f4db2215) + +ticket: 8985 +version_fixed: 1.19.1 + +(cherry picked from commit 3e36b25712d940a8e325abc407143634365b51d0) +--- + src/lib/krb5/krb/init_ctx.c | 11 +++++++++++ + src/lib/krb5/libkrb5.exports | 1 + + 2 files changed, 12 insertions(+) + +diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c +index d2b70acad..bfa99d9eb 100644 +--- a/src/lib/krb5/krb/init_ctx.c ++++ b/src/lib/krb5/krb/init_ctx.c +@@ -375,6 +375,17 @@ krb5_set_default_tgs_enctypes(krb5_context context, const krb5_enctype *etypes) + return 0; + } + ++/* Old name for above function. This is not a public API, but Samba (as of ++ * 2021-02-12) uses this name if it finds it in the library. */ ++krb5_error_code ++krb5_set_default_tgs_ktypes(krb5_context context, const krb5_enctype *etypes); ++ ++krb5_error_code ++krb5_set_default_tgs_ktypes(krb5_context context, const krb5_enctype *etypes) ++{ ++ return krb5_set_default_tgs_enctypes(context, etypes); ++} ++ + /* + * Add etype to, or remove etype from, the zero-terminated list *list_ptr, + * reallocating if the list size changes. Filter out weak enctypes if +diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports +index 25141dfc5..df6e2ffbe 100644 +--- a/src/lib/krb5/libkrb5.exports ++++ b/src/lib/krb5/libkrb5.exports +@@ -567,6 +567,7 @@ krb5_set_config_files + krb5_set_debugging_time + krb5_set_default_realm + krb5_set_default_tgs_enctypes ++krb5_set_default_tgs_ktypes + krb5_set_error_message + krb5_set_password + krb5_set_password_using_ccache diff --git a/krb5.spec b/krb5.spec index 96be371..a2f4234 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19 -Release: %{?zdpd}2%{?dist} +Release: %{?zdpd}3%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -73,6 +73,7 @@ Patch7: downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch Patch8: Add-APIs-for-marshalling-credentials.patch Patch9: Add-hostname-canonicalization-helper-to-k5test.py.patch Patch10: Support-host-based-GSS-initiator-names.patch +Patch11: Restore-krb5_set_default_tgs_ktypes.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -631,6 +632,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Wed Feb 17 2021 Robbie Harwood - 1.19-3 +- Restore krb5_set_default_tgs_ktypes() + * Fri Feb 05 2021 Robbie Harwood - 1.19-2 - No code change; just coping with reverted autoconf From 3faaf11da73e25d6685931f23f28e55a26fe1bd3 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Thu, 18 Feb 2021 16:51:47 -0500 Subject: [PATCH 023/103] New upstream version (1.19.1) --- Add-APIs-for-marshalling-credentials.patch | 6 +-- ...canonicalization-helper-to-k5test.py.patch | 2 +- Restore-krb5_set_default_tgs_ktypes.patch | 54 ------------------- Support-host-based-GSS-initiator-names.patch | 4 +- ...am-FIPS-with-PRNG-and-RADIUS-and-MD4.patch | 4 +- downstream-Remove-3des-support.patch | 10 ++-- downstream-SELinux-integration.patch | 12 ++--- ...ackported-version-of-OpenSSL-3-KDF-i.patch | 4 +- downstream-fix-debuginfo-with-y.tab.c.patch | 2 +- downstream-ksu-pam-integration.patch | 2 +- downstream-netlib-and-dns.patch | 2 +- krb5.spec | 8 +-- 12 files changed, 29 insertions(+), 81 deletions(-) delete mode 100644 Restore-krb5_set_default_tgs_ktypes.patch diff --git a/Add-APIs-for-marshalling-credentials.patch b/Add-APIs-for-marshalling-credentials.patch index 4c963d3..105f358 100644 --- a/Add-APIs-for-marshalling-credentials.patch +++ b/Add-APIs-for-marshalling-credentials.patch @@ -1,4 +1,4 @@ -From 057b45609fa457f2247df93b163f31723fd18077 Mon Sep 17 00:00:00 2001 +From 4505316756e42db02b6dabe0a6b075fe52852371 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Thu, 14 Jan 2021 18:13:09 -0500 Subject: [PATCH] Add APIs for marshalling credentials @@ -187,7 +187,7 @@ index bd0284afa..96e0931a2 100644 t = &tests[version - 1]; diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports -index 72652f2ce..9de0fcdb3 100644 +index 2d9d56530..adbfa332b 100644 --- a/src/lib/krb5/libkrb5.exports +++ b/src/lib/krb5/libkrb5.exports @@ -489,6 +489,7 @@ krb5_lock_file @@ -198,7 +198,7 @@ index 72652f2ce..9de0fcdb3 100644 krb5_mcc_ops krb5_merge_authdata krb5_mk_1cred -@@ -591,6 +592,7 @@ krb5_timeofday +@@ -592,6 +593,7 @@ krb5_timeofday krb5_timestamp_to_sfstring krb5_timestamp_to_string krb5_unlock_file diff --git a/Add-hostname-canonicalization-helper-to-k5test.py.patch b/Add-hostname-canonicalization-helper-to-k5test.py.patch index 83697cd..501984f 100644 --- a/Add-hostname-canonicalization-helper-to-k5test.py.patch +++ b/Add-hostname-canonicalization-helper-to-k5test.py.patch @@ -1,4 +1,4 @@ -From 1d7b365e670f19beae319fde2abf1de0601a2a34 Mon Sep 17 00:00:00 2001 +From d898d94cef8e1a8772a91cd3a62255c33f109636 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Fri, 15 Jan 2021 14:43:34 -0500 Subject: [PATCH] Add hostname canonicalization helper to k5test.py diff --git a/Restore-krb5_set_default_tgs_ktypes.patch b/Restore-krb5_set_default_tgs_ktypes.patch deleted file mode 100644 index 742e302..0000000 --- a/Restore-krb5_set_default_tgs_ktypes.patch +++ /dev/null @@ -1,54 +0,0 @@ -From faa975dd74df535960bf8f82990f352d022a12a5 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Fri, 12 Feb 2021 15:11:25 -0500 -Subject: [PATCH] Restore krb5_set_default_tgs_ktypes() - -Samba only uses the correct name (krb5_set_default_tgs_enctypes) if it -cannot find the old one in the library, so removing the name causes a -linker error for existing builds. - -(cherry picked from commit 17ee97788611f8f8f4a6bd69968a9499f4db2215) - -ticket: 8985 -version_fixed: 1.19.1 - -(cherry picked from commit 3e36b25712d940a8e325abc407143634365b51d0) ---- - src/lib/krb5/krb/init_ctx.c | 11 +++++++++++ - src/lib/krb5/libkrb5.exports | 1 + - 2 files changed, 12 insertions(+) - -diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c -index d2b70acad..bfa99d9eb 100644 ---- a/src/lib/krb5/krb/init_ctx.c -+++ b/src/lib/krb5/krb/init_ctx.c -@@ -375,6 +375,17 @@ krb5_set_default_tgs_enctypes(krb5_context context, const krb5_enctype *etypes) - return 0; - } - -+/* Old name for above function. This is not a public API, but Samba (as of -+ * 2021-02-12) uses this name if it finds it in the library. */ -+krb5_error_code -+krb5_set_default_tgs_ktypes(krb5_context context, const krb5_enctype *etypes); -+ -+krb5_error_code -+krb5_set_default_tgs_ktypes(krb5_context context, const krb5_enctype *etypes) -+{ -+ return krb5_set_default_tgs_enctypes(context, etypes); -+} -+ - /* - * Add etype to, or remove etype from, the zero-terminated list *list_ptr, - * reallocating if the list size changes. Filter out weak enctypes if -diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports -index 25141dfc5..df6e2ffbe 100644 ---- a/src/lib/krb5/libkrb5.exports -+++ b/src/lib/krb5/libkrb5.exports -@@ -567,6 +567,7 @@ krb5_set_config_files - krb5_set_debugging_time - krb5_set_default_realm - krb5_set_default_tgs_enctypes -+krb5_set_default_tgs_ktypes - krb5_set_error_message - krb5_set_password - krb5_set_password_using_ccache diff --git a/Support-host-based-GSS-initiator-names.patch b/Support-host-based-GSS-initiator-names.patch index a9ca98d..ebcae16 100644 --- a/Support-host-based-GSS-initiator-names.patch +++ b/Support-host-based-GSS-initiator-names.patch @@ -1,4 +1,4 @@ -From c1df10d60512e1697ef18b343c237c6a96baf62c Mon Sep 17 00:00:00 2001 +From 8c57937f3ca793fe3f8fdd636be0bc11c24069bc Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Fri, 15 Jan 2021 13:51:34 -0500 Subject: [PATCH] Support host-based GSS initiator names @@ -418,7 +418,7 @@ index 8f5872116..760216d05 100644 /* Store the error state for code from context into errsave, but only if code diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports -index 9de0fcdb3..25141dfc5 100644 +index adbfa332b..df6e2ffbe 100644 --- a/src/lib/krb5/libkrb5.exports +++ b/src/lib/krb5/libkrb5.exports @@ -181,6 +181,7 @@ k5_size_authdata_context diff --git a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch b/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch index ed61cf0..047a59e 100644 --- a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch +++ b/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch @@ -1,4 +1,4 @@ -From b57c3a8fbeb0e83c9faa63ac49c5ed58971aa934 Mon Sep 17 00:00:00 2001 +From 4a62aeae7b747cd289548949f940525365fe0947 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 9 Nov 2018 15:12:21 -0500 Subject: [PATCH] [downstream] FIPS with PRNG and RADIUS and MD4 @@ -39,7 +39,7 @@ Last-updated: krb5-1.17 15 files changed, 151 insertions(+), 33 deletions(-) diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst -index cb17a8485..29ddca3a4 100644 +index 675175955..adba8238d 100644 --- a/doc/admin/conf_files/krb5_conf.rst +++ b/doc/admin/conf_files/krb5_conf.rst @@ -330,6 +330,12 @@ The libdefaults section may contain any of the following relations: diff --git a/downstream-Remove-3des-support.patch b/downstream-Remove-3des-support.patch index efb79d0..2bc2479 100644 --- a/downstream-Remove-3des-support.patch +++ b/downstream-Remove-3des-support.patch @@ -1,4 +1,4 @@ -From 5ff60c965583977ee4a4f98555973f9920fc79cd Mon Sep 17 00:00:00 2001 +From fef4e551d3d2dcb55e58cc182304254c36aa8949 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 26 Mar 2019 18:51:10 -0400 Subject: [PATCH] [downstream] Remove 3des support @@ -5625,7 +5625,7 @@ index 2925c1c43..2f76c8b43 100644 if { ! [cmd {kadm5_destroy $server_handle}]} { perror "$test: unexpected failure in destroy" diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c -index be31eb31e..d2b70acad 100644 +index aa35baa3c..bfa99d9eb 100644 --- a/src/lib/krb5/krb/init_ctx.c +++ b/src/lib/krb5/krb/init_ctx.c @@ -59,7 +59,6 @@ @@ -5636,7 +5636,7 @@ index be31eb31e..d2b70acad 100644 ENCTYPE_ARCFOUR_HMAC, ENCTYPE_CAMELLIA128_CTS_CMAC, ENCTYPE_CAMELLIA256_CTS_CMAC, 0 -@@ -456,8 +455,6 @@ krb5int_parse_enctype_list(krb5_context context, const char *profkey, +@@ -467,8 +466,6 @@ krb5int_parse_enctype_list(krb5_context context, const char *profkey, /* Set all enctypes in the default list. */ for (i = 0; default_list[i]; i++) mod_list(default_list[i], sel, weak, &list); @@ -5818,10 +5818,10 @@ index 77d5c61fe..1f9868351 100644 * this functions takes in crypto specific representation of * trustedCertifiers and creates a list of diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -index d7d1593f4..0a67c44ef 100644 +index e5940a513..e1153344e 100644 --- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -@@ -5488,44 +5488,6 @@ cleanup: +@@ -5486,44 +5486,6 @@ cleanup: return retval; } diff --git a/downstream-SELinux-integration.patch b/downstream-SELinux-integration.patch index d68bd92..0ba8b6c 100644 --- a/downstream-SELinux-integration.patch +++ b/downstream-SELinux-integration.patch @@ -1,4 +1,4 @@ -From 99e57d4cbf0eb060162b7038d6e7b202d2716784 Mon Sep 17 00:00:00 2001 +From e787771b618a344d45ac515927e914602f48946f Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:30:53 -0400 Subject: [PATCH] [downstream] SELinux integration @@ -131,7 +131,7 @@ index ca9fcf664..5afb96e58 100644 +AC_SUBST(SELINUX_LIBS) +])dnl diff --git a/src/build-tools/krb5-config.in b/src/build-tools/krb5-config.in -index 9f96a8719..120922ac3 100755 +index dead0dddc..fef3e054f 100755 --- a/src/build-tools/krb5-config.in +++ b/src/build-tools/krb5-config.in @@ -41,6 +41,7 @@ DL_LIB='@DL_LIB@' @@ -142,7 +142,7 @@ index 9f96a8719..120922ac3 100755 LIBS='@LIBS@' GEN_LIB=@GEN_LIB@ -@@ -255,7 +256,7 @@ if test -n "$do_libs"; then +@@ -254,7 +255,7 @@ if test -n "$do_libs"; then fi # If we ever support a flag to generate output suitable for static @@ -253,7 +253,7 @@ index 045334a08..db80063eb 100644 #include diff --git a/src/kadmin/dbutil/dump.c b/src/kadmin/dbutil/dump.c -index ff2f25050..e3457622a 100644 +index 634ba4a8b..cea7939f4 100644 --- a/src/kadmin/dbutil/dump.c +++ b/src/kadmin/dbutil/dump.c @@ -148,12 +148,21 @@ create_ofile(char *ofile, char **tmpname) @@ -288,7 +288,7 @@ index ff2f25050..e3457622a 100644 com_err(progname, errno, _("while creating 'ok' file, '%s'"), file_ok); goto cleanup; diff --git a/src/kdc/main.c b/src/kdc/main.c -index 27aa10da0..b5916b147 100644 +index 3be6dcb07..24d441e16 100644 --- a/src/kdc/main.c +++ b/src/kdc/main.c @@ -872,7 +872,7 @@ write_pid_file(const char *path) @@ -301,7 +301,7 @@ index 27aa10da0..b5916b147 100644 return errno; pid = (unsigned long) getpid(); diff --git a/src/kprop/kpropd.c b/src/kprop/kpropd.c -index 874ba1305..9d6378cc0 100644 +index 498ca599a..c6b8efc28 100644 --- a/src/kprop/kpropd.c +++ b/src/kprop/kpropd.c @@ -487,6 +487,9 @@ doit(int fd) diff --git a/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch b/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch index 9ba0821..84551d1 100644 --- a/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch +++ b/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch @@ -1,4 +1,4 @@ -From 387ae61e2b6384eba692e777cc1bcc3d34bfa8c6 Mon Sep 17 00:00:00 2001 +From 687bb26cb0877fa5497e90f7d325de42b456da2a Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 15 Nov 2019 20:05:16 +0000 Subject: [PATCH] [downstream] Use backported version of OpenSSL-3 KDF @@ -441,7 +441,7 @@ index 6707a7308..915a173dd 100644 return k5_sp800_108_counter_hmac(hash, inkey, outrnd, in_constant, &empty); diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -index 0a67c44ef..dbb054378 100644 +index e1153344e..911e74fd9 100644 --- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c @@ -38,6 +38,13 @@ diff --git a/downstream-fix-debuginfo-with-y.tab.c.patch b/downstream-fix-debuginfo-with-y.tab.c.patch index d40aef7..172a093 100644 --- a/downstream-fix-debuginfo-with-y.tab.c.patch +++ b/downstream-fix-debuginfo-with-y.tab.c.patch @@ -1,4 +1,4 @@ -From 83899829c5e26b98f0c9d124d1e56e7b84c75c02 Mon Sep 17 00:00:00 2001 +From d5ea86ef491feb38f12e6aa53b7579ac02675df6 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:49:25 -0400 Subject: [PATCH] [downstream] fix debuginfo with y.tab.c diff --git a/downstream-ksu-pam-integration.patch b/downstream-ksu-pam-integration.patch index 7da5ccf..7490bf2 100644 --- a/downstream-ksu-pam-integration.patch +++ b/downstream-ksu-pam-integration.patch @@ -1,4 +1,4 @@ -From 07d19a2c4f369a7a524c919c5a453e702967b530 Mon Sep 17 00:00:00 2001 +From 90ba715be48c2e1b6c7ca53cb1d75f3af2c388d6 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:29:58 -0400 Subject: [PATCH] [downstream] ksu pam integration diff --git a/downstream-netlib-and-dns.patch b/downstream-netlib-and-dns.patch index 7b17912..de4f9bf 100644 --- a/downstream-netlib-and-dns.patch +++ b/downstream-netlib-and-dns.patch @@ -1,4 +1,4 @@ -From ea8156d348a533cc4418903ee351121366872c17 Mon Sep 17 00:00:00 2001 +From ad123366e5fb2694cf6d9f4f292a001a761b78fa Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:46:21 -0400 Subject: [PATCH] [downstream] netlib and dns diff --git a/krb5.spec b/krb5.spec index a2f4234..a3454d6 100644 --- a/krb5.spec +++ b/krb5.spec @@ -41,8 +41,8 @@ Summary: The Kerberos network authentication system Name: krb5 -Version: 1.19 -Release: %{?zdpd}3%{?dist} +Version: 1.19.1 +Release: %{?zdpd}1%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -73,7 +73,6 @@ Patch7: downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch Patch8: Add-APIs-for-marshalling-credentials.patch Patch9: Add-hostname-canonicalization-helper-to-k5test.py.patch Patch10: Support-host-based-GSS-initiator-names.patch -Patch11: Restore-krb5_set_default_tgs_ktypes.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -632,6 +631,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Thu Feb 18 2021 Robbie Harwood - 1.19.1-1 +- New upstream version (1.19.1) + * Wed Feb 17 2021 Robbie Harwood - 1.19-3 - Restore krb5_set_default_tgs_ktypes() From ab3f34f0e757af2367b8c31b9bd42feae03d0e48 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Thu, 18 Feb 2021 16:52:28 -0500 Subject: [PATCH 024/103] ... including the sources this time --- .gitignore | 2 ++ sources | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 591c859..01d1000 100644 --- a/.gitignore +++ b/.gitignore @@ -195,3 +195,5 @@ krb5-1.8.3-pdf.tar.gz /krb5-1.19-beta2.tar.gz.asc /krb5-1.19.tar.gz /krb5-1.19.tar.gz.asc +/krb5-1.19.1.tar.gz +/krb5-1.19.1.tar.gz.asc diff --git a/sources b/sources index dec9e28..e74f7db 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (krb5-1.19.tar.gz) = 99d4e75ff69bffc85698177b48ca430a7a9f077c3b6c4a422ed410b264f9a762a97db5d7e0764812e2530975f1c6c12031a5dabea1154bc01a26470e3ea960a9 -SHA512 (krb5-1.19.tar.gz.asc) = b5ee91d91f4fd727cdc61502753d679e9a87361b4c6f5db377ddf9fa1ae42447b8f46fc1c271e2253e88fb96a84fda88393003195076c16eb90506c1d7df731e +SHA512 (krb5-1.19.1.tar.gz) = 36bf33802119ada4650a8f69f1daca95aaf882dc96bfa7061f0340a5decd588c31fc10108ddadf1042934e0e2c3bbd975deec565b0a7f0fc2baf8b8cc6d97491 +SHA512 (krb5-1.19.1.tar.gz.asc) = 078924730ce441630b4ac553a76ba0ebacb09b67dd057a53e3cf42185dd80bf423e875bddd306e4e91873797a9c013a7b0cae66134976abdea2c9752028e66c7 From d20ec5d3bca4e811bdef8add432140143a60be10 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Mon, 1 Mar 2021 21:27:49 +0000 Subject: [PATCH 025/103] Make test dependencies contingent on skipcheck; no code changes --- krb5.spec | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/krb5.spec b/krb5.spec index a3454d6..25549d0 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.1 -Release: %{?zdpd}1%{?dist} +Release: %{?zdpd}2%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -89,6 +89,8 @@ BuildRequires: systemd-units # For autosetup BuildRequires: git +%if 0%{?skipcheck} +%else # For the test framework. BuildRequires: perl-interpreter, dejagnu, tcl-devel, python3 BuildRequires: net-tools, rpcbind @@ -98,6 +100,7 @@ BuildRequires: libverto-devel BuildRequires: openldap-devel BuildRequires: lmdb-devel BuildRequires: python3-pyrad +%endif # Need KDFs. This is the backported version BuildRequires: openssl-devel >= 1:1.1.1d-4 @@ -631,6 +634,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Mon Mar 01 2021 Robbie Harwood - 1.19.1-2 +- Make test dependencies contingent on skipcheck; no code changes + * Thu Feb 18 2021 Robbie Harwood - 1.19.1-1 - New upstream version (1.19.1) From 1c03da79deb8ed96af1eed5beacd2db24c4212a6 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Mon, 1 Mar 2021 21:46:01 +0000 Subject: [PATCH 026/103] Further test dependency fixes; no code changes --- krb5.spec | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/krb5.spec b/krb5.spec index 25549d0..e50cefd 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.1 -Release: %{?zdpd}2%{?dist} +Release: %{?zdpd}3%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -80,25 +80,26 @@ BuildRequires: autoconf, bison, make, flex, gawk, gettext, pkgconfig, sed BuildRequires: gcc, gcc-c++ BuildRequires: libcom_err-devel, libedit-devel, libss-devel BuildRequires: gzip, ncurses-devel -BuildRequires: python3-sphinx +BuildRequires: python3, python3-sphinx BuildRequires: keyutils, keyutils-libs-devel >= 1.5.8 BuildRequires: libselinux-devel BuildRequires: pam-devel BuildRequires: systemd-units +BuildRequires: tcl-devel +BuildRequires: libverto-devel +BuildRequires: openldap-devel +BuildRequires: lmdb-devel +BuildRequires: perl-interpreter # For autosetup BuildRequires: git %if 0%{?skipcheck} %else -# For the test framework. -BuildRequires: perl-interpreter, dejagnu, tcl-devel, python3 +BuildRequires: dejagnu BuildRequires: net-tools, rpcbind BuildRequires: hostname BuildRequires: iproute -BuildRequires: libverto-devel -BuildRequires: openldap-devel -BuildRequires: lmdb-devel BuildRequires: python3-pyrad %endif @@ -634,6 +635,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Mon Mar 01 2021 Robbie Harwood - 1.19.1-3 +- Further test dependency fixes; no code changes + * Mon Mar 01 2021 Robbie Harwood - 1.19.1-2 - Make test dependencies contingent on skipcheck; no code changes From cf3e70c97c326c331315b0eeb1e2694732e700e6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 2 Mar 2021 16:13:34 +0100 Subject: [PATCH 027/103] Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. --- krb5.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/krb5.spec b/krb5.spec index e50cefd..81f9a94 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.1 -Release: %{?zdpd}3%{?dist} +Release: %{?zdpd}3%{?dist}.1 # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -635,6 +635,10 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Tue Mar 02 2021 Zbigniew JÄ™drzejewski-Szmek - 1.19.1-3.1 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + * Mon Mar 01 2021 Robbie Harwood - 1.19.1-3 - Further test dependency fixes; no code changes From d67d35a3c66a7c210b347191a78a158172ff0330 Mon Sep 17 00:00:00 2001 From: Filip Dvorak Date: Mon, 29 Mar 2021 15:21:43 +0000 Subject: [PATCH 028/103] Update tests/inplace-upgrade-sanity-test/runtest.sh --- tests/inplace-upgrade-sanity-test/runtest.sh | 115 ++++++++++++++----- 1 file changed, 89 insertions(+), 26 deletions(-) diff --git a/tests/inplace-upgrade-sanity-test/runtest.sh b/tests/inplace-upgrade-sanity-test/runtest.sh index cdd4744..7454540 100755 --- a/tests/inplace-upgrade-sanity-test/runtest.sh +++ b/tests/inplace-upgrade-sanity-test/runtest.sh @@ -36,15 +36,10 @@ PACKAGES="krb5-libs krb5-server krb5-workstation openssh" TEST_ENTROPY_SOURCE=${TEST_ENTROPY_SOURCE:-no} echo TEST_ENTROPY_SOURCE=$TEST_ENTROPY_SOURCE -hostnamectl set-hostname test.fedora.com - -host_ip=`hostname -I | awk '{print$1}'` -echo "$host_ip test.fedora.com" >> /etc/hosts - -krb5REALM1='ZMRAZ.COM' -krb5REALM2='PKIS.NET' +krb5REALM1='TEST1.REDHAT.COM' +krb5REALM2='TEST2.REDHAT.COM' krb5HostName=`hostname` -krb5DomainName='fedora.com' +krb5DomainName=`hostname -d` krb5User='alice' krb5UserPass='alice' krb5UserKrbPass='aaa' @@ -58,6 +53,8 @@ krb5confdir="/etc/krb5.conf.d" krb5kdcconf="/var/kerberos/krb5kdc/kdc.conf" krb5kadmacl="/var/kerberos/krb5kdc/kadm5.acl" + + rlJournalStart rlPhaseStartSetup for pkg in $PACKAGES; do @@ -65,6 +62,8 @@ rlJournalStart done rlRun "TmpDir=\$(mktemp -d)" rlRun "pushd $TmpDir" + echo "-----/etc/krb5.conf----"; cat /etc/krb5.conf + echo "-----/var/kerberos/krb5kdc/kdc.conf-----"; cat /var/kerberos/krb5kdc/kdc.conf rlPhaseEnd # Run this part on OLD and in "normal" mode @@ -73,9 +72,19 @@ rlJournalStart # Stop and backup rlRun "rlServiceStop kadmin krb5kdc" rlRun "rm -f /var/kerberos/krb5kdc/principal* /var/kerberos/krb5kdc/.k5*" - rlFileBackup $krb5conf /var/kerberos/krb5kdc /etc/sysconfig/{kadmin,krb5kdc} + rlFileBackup $krb5conf /var/kerberos/krb5kdc /etc/sysconfig/{kadmin,krb5kdc} /etc/hosts + rlFileBackup --clean /root/.k5login [ -e /etc/krb5.keytab ] && rlFileBackup /etc/krb5.keytab [ -e $krb5confdir ] && rlFileBackup $krb5confdir + # Make sure IPv4 is used for ssh connection + if ! grep `hostname` /etc/hosts; then + DEF_DEV=`ip route |grep default |awk '{print $5}'` + echo DEF_DEV=$DEF_DEV + DEF_IP=`ip -o -4 addr show dev $DEF_DEV |awk '{print $4}' |grep -v '/32' |sed 's|/.*||'` + echo DEF_IP=$DEF_IP + rlRun "echo '$DEF_IP `hostname`' >>/etc/hosts" + grep `hostname` /etc/hosts + fi # Basic setup of KDC and krb5.conf if rlIsRHEL 6; then rlRun "sed -i \"s/EXAMPLE.COM/$krb5REALM1/\" $krb5conf" @@ -99,28 +108,59 @@ rlJournalStart dict_file = /usr/share/dict/words admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal - } +} _EOF - rlIsRHEL 6 || rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal/\" /var/kerberos/krb5kdc/kdc.conf" + + +if rlIsRHEL '7'; then + rlLog "Modify supported_enctypes for RHEL-7." + rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal/\" /var/kerberos/krb5kdc/kdc.conf" + # Remove 3DES and DES cipher suite from kdc.conf - Fedora 31 + # Fedora 31 - krb5 will be removing support for DES, 3DES, and crc-32 entirely + # they will not be allowed in session keys or long-term keys. (BZ#1670398) + # https://fedoraproject.org/wiki/Changes/krb5_crypto_modernization +elif rlIsFedora '>=31';then + rlLog "Modify supported_enctypes for Fedora >=31. Remove *DES ciphers." + rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal/\" /var/kerberos/krb5kdc/kdc.conf" +elif rlIsRHEL '8' && [ `rpm -q --qf '%{VERSION}' krb5-server | cut -d"." -f2` -lt 18 ];then + rlLog "Modify supported_enctypes for RHEL-8." + rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal/\" /var/kerberos/krb5kdc/kdc.conf" +else + #RHEL-8 Bug 1802334 - [Rebase] krb5: rebase to 1.18: + #- Removal of *DES encryption types + #https://bugzilla.redhat.com/show_bug.cgi?id=1802334 + rlLog "Modify supported_enctypes for RHEL-8 with krb-1.18. Remove *DES ciphers." + rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal/\" /var/kerberos/krb5kdc/kdc.conf" +fi rlRun "sed -i \"s/\[realms\]/[realms]\n $krb5REALM2 = {\n kdc = $krb5HostName\n admin_server = $krb5HostName\n }/\" $krb5conf" - cat >> $krb5conf << _EOF + cat >> $krb5conf << _EOF [capaths] $krb5REALM1 = { $krb5REALM2 = . } _EOF - # Test the entropy source (not relevant for RHEL6) + # BZ#1394908: Test the entropy source (not relevant for RHEL6) if ! rlIsRHEL 6 && [[ $TEST_ENTROPY_SOURCE == 'yes' ]]; then - rlLog "The source of entropy will be tested as well" + rlLog "BZ#1394908: The source of entropy will be tested as well" + # Check number of audit rules + number_rules=$(auditctl -l | grep -v "No rules" | wc -l) + if [[ ${number_rules} -ne 0 ]];then + truncate -s0 /var/log/audit/audit.log + rlRun "auditctl -D" 0 "Delete previous audit rules" + fi START_DATE=`date +%H:%M:%S` echo START_DATE=$START_DATE sleep 1 rlRun "auditctl -w /dev/random -p rwxa -k RAND" auditctl -l - sleep 1 + sleep 5 rlRun "ausearch -i -k RAND -ts $START_DATE" fi + + echo "-----/etc/krb5.conf----"; cat /etc/krb5.conf + echo "-----/var/kerberos/krb5kdc/kdc.conf-----"; cat /var/kerberos/krb5kdc/kdc.conf + # Create the realm databases rlRun "rngd -r /dev/urandom" rlRun "kdb5_util create -s -r $krb5REALM1 -P $krb5KDCPass" @@ -145,12 +185,12 @@ _EOF rlRun "kadmin.local -r $krb5REALM2 -q \"addprinc -randkey host/$krb5HostName\"" rlRun "kadmin.local -r $krb5REALM2 -q \"addprinc -pw $krb5KDCPass krbtgt/$krb5REALM1@$krb5REALM2\"" rlRun "kadmin.local -r $krb5REALM2 -q \"addprinc -pw $krb5KDCPass krbtgt/$krb5REALM2@$krb5REALM1\"" - # Create test system user + # Create test system user [ $krb5User != "root" ] && rlRun "useradd $krb5User" rlRun "echo $krb5UserPass | passwd --stdin $krb5User" rlPhaseEnd fi - + rlPhaseStartTest "Daemon start and log file test" # Make sure there is enough entropy and start recording of the logs rlRun "rngd -r /dev/urandom" @@ -190,6 +230,10 @@ _EOF echo "/var/log/kadmind.log:" tail -n 100 /var/log/kadmind.log fi + + #add 'list' privilege for root/master + sed -i -e '$a*/master@EXAMPLE.COM *' /var/kerberos/krb5kdc/kadm5.acl + # Restart daemon auto start if rlIsRHEL 6; then rlRun "service krb5kdc restart" @@ -204,11 +248,21 @@ _EOF fi rlRun "echo $krb5UserKrbPass |kinit $krb5User && klist" rlRun "kdestroy" - rlRun "kadmin -p root/master -w rrr -q ''" + rlRun "kadmin -p root/master -w rrr -q 'getprincs'" rlAssertGrep "AS_REQ.*$krb5User@$krb5REALM1.*krbtgt/$krb5REALM1@$krb5REALM1" krb5kdc.log.record - cat krb5kdc.log.record - rlAssertGrep "Request: kadm5_init.*root/master@$krb5REALM1.*service=kadmin/`hostname`@$krb5REALM1" kadmind.log.record - cat kadmind.log.record + +#The principal related to kadmin are not created with hostname (kadmin/hostname@REALM) during creating krb5 DB +#RHEL9 constains only kadmin/admin@REALM - this change was intentional - Don't create hostbased principals in new KDBs +#https://krbdev.mit.edu/rt/Ticket/Display.html?id=8935 + if rlIsRHEL 9 || rlIsFedora '>=33';then + kadmin_princ="Request: kadm5_init.*root/master@$krb5REALM1.*service=kadmin/admin@$krb5REALM1" + else + kadmin_princ="Request: kadm5_init.*root/master@$krb5REALM1.*service=kadmin/.*`hostname`@$krb5REALM1" + fi + rlAssertGrep "${kadmin_princ}" kadmind.log.record + #rlAssertGrep "Request: kadm5_init.*root\/master@$krb5REALM1.*service=kadmin\/(admin|.*`hostname`)@$krb5REALM1" kadmind.log.record -E + echo "***krb5kdc.log.record***" && cat krb5kdc.log.record + echo "***kadmind.log.record***" && cat kadmind.log.record # Stop log recording kill $KADMIND_LOG_PID kill $KRB5KDC_LOG_PID @@ -238,6 +292,13 @@ _EOF cat klist.log rlAssertGrep "host/`hostname`@$krb5REALM1" klist.log rlRun "kdestroy" + #BZ1841488-sshd cannot write into reply cache (/var/tmp/krb5_0.rcache2) due to security context + #The problem is that this file had security context: system_u:object_r:kadmind_tmp_t:s0. + #This is a problem when the ssh via krb5-GSSAPI is used because sshd service cannot write into this file. + if rlIsRHEL '>=8.3' || rlIsFedora '>=32'; then + rlLog "BZ1841488-sshd cannot write into reply cache (/var/tmp/krb5_0.rcache2) due to security context" + rlRun "sesearch -s sshd_t -t kadmind_tmp_t -c file -p write --allow | grep ^allow" + fi rlPhaseEnd rlPhaseStartTest "Basic kadmin and kpasswd test" @@ -279,13 +340,14 @@ _EOF rlRun "kdestroy" rlPhaseEnd - # Test the entropy source (not relevant for RHEL6) + # BZ#1394908: Test the entropy source (not relevant for RHEL6) if ! rlIsRHEL 6 && [[ $TEST_ENTROPY_SOURCE == 'yes' ]]; then - rlPhaseStartTest "Enable faster getrandom-based entropy system" + rlPhaseStartTest "BZ#1394908: Enable faster getrandom-based entropy system" echo START_DATE=$START_DATE auditctl -l + sleep 5 rlRun "ausearch -i -k RAND -ts $START_DATE" - rlRun "ausearch -i -k RAND -ts $START_DATE |grep comm= |grep -v 'comm=rngd'" 1 + rlRun "ausearch -i -k RAND -ts $START_DATE |grep comm= | grep -v comm=auditctl |grep -v 'comm=rngd'" 1 rlRun "auditctl -D" rlPhaseEnd fi @@ -299,10 +361,11 @@ _EOF [ $krb5User != "root" ] && rlRun "userdel -r -f $krb5User" rlPhaseEnd fi - + rlPhaseStartCleanup + rlRun "kdestroy -A" rlRun "popd" rlRun "rm -r $TmpDir" rlPhaseEnd rlJournalPrintText -rlJournalEnd +rlJournalEnd \ No newline at end of file From 002bf4053e28673f9a0d4e1c2638d91f18ba0fbd Mon Sep 17 00:00:00 2001 From: Filip Dvorak Date: Tue, 30 Mar 2021 08:29:53 +0000 Subject: [PATCH 029/103] Update tests/inplace-upgrade-sanity-test/Makefile Added setools-console package into Makefile. --- tests/inplace-upgrade-sanity-test/Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/inplace-upgrade-sanity-test/Makefile b/tests/inplace-upgrade-sanity-test/Makefile index ccd8818..cfff69d 100644 --- a/tests/inplace-upgrade-sanity-test/Makefile +++ b/tests/inplace-upgrade-sanity-test/Makefile @@ -55,6 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 20m" >> $(METADATA) @echo "RunFor: krb5" >> $(METADATA) @echo "Requires: expect krb5-server krb5-workstation openssh-clients openssh-server rng-tools" >> $(METADATA) + @echo "Requires: setools-console" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) From 7ef49093167675c758482592a713ed540d97a011 Mon Sep 17 00:00:00 2001 From: Miroslav Vadkerti Date: Mon, 29 Mar 2021 10:30:49 +0200 Subject: [PATCH 030/103] Onboard krb5 to downstream gating Because krb5 is auto-synced via DistroBaker, we need to add downstream gating configuration in Fedora. Signed-off-by: Miroslav Vadkerti --- gating.yaml | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 gating.yaml diff --git a/gating.yaml b/gating.yaml new file mode 100644 index 0000000..5588d06 --- /dev/null +++ b/gating.yaml @@ -0,0 +1,6 @@ + --- !Policy + product_versions: + - rhel-9 + decision_context: osci_compose_gate + rules: + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional} From c183c8de7d1fe4c492feae96a12bae5b426a2e6a Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Wed, 3 Mar 2021 16:23:34 -0500 Subject: [PATCH 031/103] Fix the mess the mass rebuild made of Release --- krb5.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/krb5.spec b/krb5.spec index 81f9a94..e21080b 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.1 -Release: %{?zdpd}3%{?dist}.1 +Release: %{?zdpd}4%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz From 1c2362203efef27ede12cd70d9e746eb4fe5ef19 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Mon, 3 May 2021 17:50:44 -0400 Subject: [PATCH 032/103] Add rpminspect configuration --- rpminspect.yaml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 rpminspect.yaml diff --git a/rpminspect.yaml b/rpminspect.yaml new file mode 100644 index 0000000..a31a5e3 --- /dev/null +++ b/rpminspect.yaml @@ -0,0 +1,17 @@ +--- +inspections: + # https://bugzilla.redhat.com/show_bug.cgi?id=1956479 + badfuncs: off + + # Not a Java package + javabytecode: off + + # I need to be able to *add* functions, and also we export internal + # functions that are not considered part of our ABI. + abidiff: off + + # These just flag when things change "too much" + changedfiles: off + filesize: off + patches: off + upstream: off From e9fb111a119250ea761f3f3a3059cca72bd71d76 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 4 May 2021 15:02:53 -0400 Subject: [PATCH 033/103] Suppress static analyzer warning in FIPS override --- Add-APIs-for-marshalling-credentials.patch | 2 +- ...hostname-canonicalization-helper-to-k5test.py.patch | 2 +- Support-host-based-GSS-initiator-names.patch | 2 +- downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch | 10 ++++++---- krb5.spec | 5 ++++- 5 files changed, 13 insertions(+), 8 deletions(-) diff --git a/Add-APIs-for-marshalling-credentials.patch b/Add-APIs-for-marshalling-credentials.patch index 105f358..da613e9 100644 --- a/Add-APIs-for-marshalling-credentials.patch +++ b/Add-APIs-for-marshalling-credentials.patch @@ -1,4 +1,4 @@ -From 4505316756e42db02b6dabe0a6b075fe52852371 Mon Sep 17 00:00:00 2001 +From c1fe1c8fa3df7f50c7e28d52263d0d24afb4b3a1 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Thu, 14 Jan 2021 18:13:09 -0500 Subject: [PATCH] Add APIs for marshalling credentials diff --git a/Add-hostname-canonicalization-helper-to-k5test.py.patch b/Add-hostname-canonicalization-helper-to-k5test.py.patch index 501984f..75c3e87 100644 --- a/Add-hostname-canonicalization-helper-to-k5test.py.patch +++ b/Add-hostname-canonicalization-helper-to-k5test.py.patch @@ -1,4 +1,4 @@ -From d898d94cef8e1a8772a91cd3a62255c33f109636 Mon Sep 17 00:00:00 2001 +From 3e78bc5d48513fe38f3bc4228b12abcdc0733ee2 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Fri, 15 Jan 2021 14:43:34 -0500 Subject: [PATCH] Add hostname canonicalization helper to k5test.py diff --git a/Support-host-based-GSS-initiator-names.patch b/Support-host-based-GSS-initiator-names.patch index ebcae16..25b074f 100644 --- a/Support-host-based-GSS-initiator-names.patch +++ b/Support-host-based-GSS-initiator-names.patch @@ -1,4 +1,4 @@ -From 8c57937f3ca793fe3f8fdd636be0bc11c24069bc Mon Sep 17 00:00:00 2001 +From 3133e5e24e94bf060e23a4d97cbdf74e934d010f Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Fri, 15 Jan 2021 13:51:34 -0500 Subject: [PATCH] Support host-based GSS initiator names diff --git a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch b/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch index 047a59e..d48b1cd 100644 --- a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch +++ b/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch @@ -1,4 +1,4 @@ -From 4a62aeae7b747cd289548949f940525365fe0947 Mon Sep 17 00:00:00 2001 +From 852e9efad17e3ef6ea54f91044a279bb34020ecf Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 9 Nov 2018 15:12:21 -0500 Subject: [PATCH] [downstream] FIPS with PRNG and RADIUS and MD4 @@ -19,6 +19,8 @@ post6 restores MD4 (and therefore keygen-only RC4). post7 restores MD5 and adds radius_md5_fips_override. +post8 silences a static analyzer warning. + Last-updated: krb5-1.17 --- doc/admin/conf_files/krb5_conf.rst | 6 +++ @@ -349,7 +351,7 @@ index 03c613716..d89982a13 100644 return retval; diff --git a/src/lib/krad/internal.h b/src/lib/krad/internal.h -index 0143d155a..223ffd730 100644 +index 0143d155a..57672982f 100644 --- a/src/lib/krad/internal.h +++ b/src/lib/krad/internal.h @@ -39,6 +39,8 @@ @@ -407,8 +409,8 @@ index 0143d155a..223ffd730 100644 + if (!FIPS_mode()) + return 0; + -+ profile_get_boolean(ctx->profile, "libdefaults", -+ "radius_md5_fips_override", NULL, 0, &val); ++ (void)profile_get_boolean(ctx->profile, "libdefaults", ++ "radius_md5_fips_override", NULL, 0, &val); + return !val; +} + diff --git a/krb5.spec b/krb5.spec index e21080b..c4a407e 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.1 -Release: %{?zdpd}4%{?dist} +Release: %{?zdpd}5%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -635,6 +635,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Tue May 04 2021 Robbie Harwood - 1.19.1-5 +- Suppress static analyzer warning in FIPS override + * Tue Mar 02 2021 Zbigniew JÄ™drzejewski-Szmek - 1.19.1-3.1 - Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. From 69e05d5e39b3a10e453a6cf72c646cd6c2876ea8 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 4 May 2021 15:21:05 -0400 Subject: [PATCH 034/103] Remove broken gating file Currently the gating file prevents building: rharwood@eesha:~/krb5.fedora/rawhide$ fedpkg build Could not execute build: Found a gating.yaml file in your repo with additional Greenwave policies, but it is not valid. Please fix the file or skip this check using the option --skip-remote-rules-validation. Error response from Greenwave: YAML Parser Error: mapping values are not allowed here in "", line 2, column 18: product_versions: ^ rharwood@eesha:~/krb5.fedora/rawhide$ Patches to add it back will be considered if and only if they don't break the build. --- gating.yaml | 6 ------ 1 file changed, 6 deletions(-) delete mode 100644 gating.yaml diff --git a/gating.yaml b/gating.yaml deleted file mode 100644 index 5588d06..0000000 --- a/gating.yaml +++ /dev/null @@ -1,6 +0,0 @@ - --- !Policy - product_versions: - - rhel-9 - decision_context: osci_compose_gate - rules: - - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional} From 904d264a4145af06e7524b1b6a6e75a8e01d3b38 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Thu, 20 May 2021 13:48:19 -0400 Subject: [PATCH 035/103] Add KCM_OP_GET_CRED_LIST and KCM_OP_RETRIEVE support --- ...P_GET_CRED_LIST-for-faster-iteration.patch | 358 ++++++++++++++++++ Use-KCM_OP_RETRIEVE-in-KCM-client.patch | 235 ++++++++++++ krb5.spec | 7 +- 3 files changed, 599 insertions(+), 1 deletion(-) create mode 100644 Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch create mode 100644 Use-KCM_OP_RETRIEVE-in-KCM-client.patch diff --git a/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch b/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch new file mode 100644 index 0000000..237de35 --- /dev/null +++ b/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch @@ -0,0 +1,358 @@ +From dc92022ad26cec8085a852dec6aeba310fa7a751 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pavel=20B=C5=99ezina?= +Date: Thu, 11 Feb 2021 15:33:10 +0100 +Subject: [PATCH] Add KCM_OP_GET_CRED_LIST for faster iteration + +For large caches, one IPC operation per credential dominates the cost +of iteration. Instead transfer the whole list of credentials to the +client in one IPC operation. + +Add optional support for the new opcode to the test KCM server to +allow testing of the main and fallback code paths. + +[ghudson@mit.edu: fixed memory leaks and potential memory errors; +adjusted code style and comments; rewrote commit message; added +kcmserver.py support and tests] + +ticket: 8990 (new) +(cherry picked from commit 81bdb47d8ded390263d8ee48f71d5c312b4f1736) +--- + src/include/kcm.h | 12 ++- + src/lib/krb5/ccache/cc_kcm.c | 144 ++++++++++++++++++++++++++++++++--- + src/tests/kcmserver.py | 28 ++++++- + src/tests/t_ccache.py | 10 ++- + 4 files changed, 175 insertions(+), 19 deletions(-) + +diff --git a/src/include/kcm.h b/src/include/kcm.h +index 5ea1447cd..e4140c3a0 100644 +--- a/src/include/kcm.h ++++ b/src/include/kcm.h +@@ -51,9 +51,9 @@ + * + * All replies begin with a 32-bit big-endian reply code. + * +- * Parameters are appended to the request or reply with no delimiters. Flags +- * and time offsets are stored as 32-bit big-endian integers. Names are +- * marshalled as zero-terminated strings. Principals and credentials are ++ * Parameters are appended to the request or reply with no delimiters. Flags, ++ * time offsets, and lengths are stored as 32-bit big-endian integers. Names ++ * are marshalled as zero-terminated strings. Principals and credentials are + * marshalled in the v4 FILE ccache format. UUIDs are 16 bytes. UUID lists + * are not delimited, so nothing can come after them. + */ +@@ -89,7 +89,11 @@ typedef enum kcm_opcode { + KCM_OP_HAVE_NTLM_CRED, + KCM_OP_DEL_NTLM_CRED, + KCM_OP_DO_NTLM_AUTH, +- KCM_OP_GET_NTLM_USER_LIST ++ KCM_OP_GET_NTLM_USER_LIST, ++ ++ /* MIT extensions */ ++ KCM_OP_MIT_EXTENSION_BASE = 13000, ++ KCM_OP_GET_CRED_LIST, /* (name) -> (count, count*{len, cred}) */ + } kcm_opcode; + + #endif /* KCM_H */ +diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c +index 9093f894d..772928e4d 100644 +--- a/src/lib/krb5/ccache/cc_kcm.c ++++ b/src/lib/krb5/ccache/cc_kcm.c +@@ -61,6 +61,17 @@ struct uuid_list { + size_t pos; + }; + ++struct cred_list { ++ krb5_creds *creds; ++ size_t count; ++ size_t pos; ++}; ++ ++struct kcm_cursor { ++ struct uuid_list *uuids; ++ struct cred_list *creds; ++}; ++ + struct kcmio { + SOCKET fd; + #ifdef __APPLE__ +@@ -489,6 +500,69 @@ free_uuid_list(struct uuid_list *uuids) + free(uuids); + } + ++static void ++free_cred_list(struct cred_list *list) ++{ ++ size_t i; ++ ++ if (list == NULL) ++ return; ++ ++ /* Creds are transferred to the caller as list->pos is incremented, so we ++ * can start freeing there. */ ++ for (i = list->pos; i < list->count; i++) ++ krb5_free_cred_contents(NULL, &list->creds[i]); ++ free(list->creds); ++ free(list); ++} ++ ++/* Fetch a cred list from req->reply. */ ++static krb5_error_code ++kcmreq_get_cred_list(struct kcmreq *req, struct cred_list **creds_out) ++{ ++ struct cred_list *list; ++ const unsigned char *data; ++ krb5_error_code ret = 0; ++ size_t count, len, i; ++ ++ *creds_out = NULL; ++ ++ /* Check a rough bound on the count to prevent very large allocations. */ ++ count = k5_input_get_uint32_be(&req->reply); ++ if (count > req->reply.len / 4) ++ return KRB5_KCM_MALFORMED_REPLY; ++ ++ list = malloc(sizeof(*list)); ++ if (list == NULL) ++ return ENOMEM; ++ ++ list->creds = NULL; ++ list->count = count; ++ list->pos = 0; ++ list->creds = k5calloc(count, sizeof(*list->creds), &ret); ++ if (list->creds == NULL) { ++ free(list); ++ return ret; ++ } ++ ++ for (i = 0; i < count; i++) { ++ len = k5_input_get_uint32_be(&req->reply); ++ data = k5_input_get_bytes(&req->reply, len); ++ if (data == NULL) ++ break; ++ ret = k5_unmarshal_cred(data, len, 4, &list->creds[i]); ++ if (ret) ++ break; ++ } ++ if (i < count) { ++ free_cred_list(list); ++ return (ret == ENOMEM) ? ENOMEM : KRB5_KCM_MALFORMED_REPLY; ++ } ++ ++ *creds_out = list; ++ return 0; ++} ++ + static void + kcmreq_free(struct kcmreq *req) + { +@@ -753,33 +827,53 @@ kcm_start_seq_get(krb5_context context, krb5_ccache cache, + { + krb5_error_code ret; + struct kcmreq req = EMPTY_KCMREQ; +- struct uuid_list *uuids; ++ struct uuid_list *uuids = NULL; ++ struct cred_list *creds = NULL; ++ struct kcm_cursor *cursor; + + *cursor_out = NULL; + + get_kdc_offset(context, cache); + +- kcmreq_init(&req, KCM_OP_GET_CRED_UUID_LIST, cache); ++ kcmreq_init(&req, KCM_OP_GET_CRED_LIST, cache); + ret = cache_call(context, cache, &req); +- if (ret) ++ if (ret == 0) { ++ /* GET_CRED_LIST is available. */ ++ ret = kcmreq_get_cred_list(&req, &creds); ++ if (ret) ++ goto cleanup; ++ } else if (ret == KRB5_FCC_INTERNAL) { ++ /* Fall back to GET_CRED_UUID_LIST. */ ++ kcmreq_free(&req); ++ kcmreq_init(&req, KCM_OP_GET_CRED_UUID_LIST, cache); ++ ret = cache_call(context, cache, &req); ++ if (ret) ++ goto cleanup; ++ ret = kcmreq_get_uuid_list(&req, &uuids); ++ if (ret) ++ goto cleanup; ++ } else { + goto cleanup; +- ret = kcmreq_get_uuid_list(&req, &uuids); +- if (ret) ++ } ++ ++ cursor = k5alloc(sizeof(*cursor), &ret); ++ if (cursor == NULL) + goto cleanup; +- *cursor_out = (krb5_cc_cursor)uuids; ++ cursor->uuids = uuids; ++ cursor->creds = creds; ++ *cursor_out = (krb5_cc_cursor)cursor; + + cleanup: + kcmreq_free(&req); + return ret; + } + +-static krb5_error_code KRB5_CALLCONV +-kcm_next_cred(krb5_context context, krb5_ccache cache, krb5_cc_cursor *cursor, +- krb5_creds *cred_out) ++static krb5_error_code ++next_cred_by_uuid(krb5_context context, krb5_ccache cache, ++ struct uuid_list *uuids, krb5_creds *cred_out) + { + krb5_error_code ret; + struct kcmreq req; +- struct uuid_list *uuids = (struct uuid_list *)*cursor; + + memset(cred_out, 0, sizeof(*cred_out)); + +@@ -797,11 +891,39 @@ kcm_next_cred(krb5_context context, krb5_ccache cache, krb5_cc_cursor *cursor, + return map_invalid(ret); + } + ++static krb5_error_code KRB5_CALLCONV ++kcm_next_cred(krb5_context context, krb5_ccache cache, krb5_cc_cursor *cursor, ++ krb5_creds *cred_out) ++{ ++ struct kcm_cursor *c = (struct kcm_cursor *)*cursor; ++ struct cred_list *list; ++ ++ if (c->uuids != NULL) ++ return next_cred_by_uuid(context, cache, c->uuids, cred_out); ++ ++ list = c->creds; ++ if (list->pos >= list->count) ++ return KRB5_CC_END; ++ ++ /* Transfer memory ownership of one cred to the caller. */ ++ *cred_out = list->creds[list->pos]; ++ memset(&list->creds[list->pos], 0, sizeof(*list->creds)); ++ list->pos++; ++ ++ return 0; ++} ++ + static krb5_error_code KRB5_CALLCONV + kcm_end_seq_get(krb5_context context, krb5_ccache cache, + krb5_cc_cursor *cursor) + { +- free_uuid_list((struct uuid_list *)*cursor); ++ struct kcm_cursor *c = *cursor; ++ ++ if (c == NULL) ++ return 0; ++ free_uuid_list(c->uuids); ++ free_cred_list(c->creds); ++ free(c); + *cursor = NULL; + return 0; + } +diff --git a/src/tests/kcmserver.py b/src/tests/kcmserver.py +index 57432e5a7..8c5e66ff1 100644 +--- a/src/tests/kcmserver.py ++++ b/src/tests/kcmserver.py +@@ -23,6 +23,7 @@ + # traceback.print_exception(etype, value, tb, file=f) + # sys.excepthook = ehook + ++import optparse + import select + import socket + import struct +@@ -49,12 +50,14 @@ class KCMOpcodes(object): + SET_DEFAULT_CACHE = 21 + GET_KDC_OFFSET = 22 + SET_KDC_OFFSET = 23 ++ GET_CRED_LIST = 13001 + + + class KRB5Errors(object): + KRB5_CC_END = -1765328242 + KRB5_CC_NOSUPP = -1765328137 + KRB5_FCC_NOFILE = -1765328189 ++ KRB5_FCC_INTERNAL = -1765328188 + + + def make_uuid(): +@@ -183,6 +186,14 @@ def op_set_kdc_offset(argbytes): + return 0, b'' + + ++def op_get_cred_list(argbytes): ++ name, rest = unmarshal_name(argbytes) ++ cache = get_cache(name) ++ creds = [cache.creds[u] for u in cache.cred_uuids] ++ return 0, (struct.pack('>L', len(creds)) + ++ b''.join(struct.pack('>L', len(c)) + c for c in creds)) ++ ++ + ophandlers = { + KCMOpcodes.GEN_NEW : op_gen_new, + KCMOpcodes.INITIALIZE : op_initialize, +@@ -197,7 +208,8 @@ ophandlers = { + KCMOpcodes.GET_DEFAULT_CACHE : op_get_default_cache, + KCMOpcodes.SET_DEFAULT_CACHE : op_set_default_cache, + KCMOpcodes.GET_KDC_OFFSET : op_get_kdc_offset, +- KCMOpcodes.SET_KDC_OFFSET : op_set_kdc_offset ++ KCMOpcodes.SET_KDC_OFFSET : op_set_kdc_offset, ++ KCMOpcodes.GET_CRED_LIST : op_get_cred_list + } + + # Read and respond to a request from the socket s. +@@ -215,7 +227,11 @@ def service_request(s): + + majver, minver, op = struct.unpack('>BBH', req[:4]) + argbytes = req[4:] +- code, payload = ophandlers[op](argbytes) ++ ++ if op in ophandlers: ++ code, payload = ophandlers[op](argbytes) ++ else: ++ code, payload = KRB5Errors.KRB5_FCC_INTERNAL, b'' + + # The KCM response is the code (4 bytes) and the response payload. + # The Heimdal IPC response is the length of the KCM response (4 +@@ -226,9 +242,15 @@ def service_request(s): + s.sendall(hipc_response) + return True + ++parser = optparse.OptionParser() ++parser.add_option('-c', '--credlist', action='store_true', dest='credlist', ++ default=False, help='Support KCM_OP_GET_CRED_LIST') ++(options, args) = parser.parse_args() ++if not options.credlist: ++ del ophandlers[KCMOpcodes.GET_CRED_LIST] + + server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) +-server.bind(sys.argv[1]) ++server.bind(args[0]) + server.listen(5) + select_input = [server,] + sys.stderr.write('starting...\n') +diff --git a/src/tests/t_ccache.py b/src/tests/t_ccache.py +index 66804afa5..90040fb7b 100755 +--- a/src/tests/t_ccache.py ++++ b/src/tests/t_ccache.py +@@ -125,10 +125,18 @@ def collection_test(realm, ccname): + + + collection_test(realm, 'DIR:' + os.path.join(realm.testdir, 'cc')) ++ ++# Test KCM without and with GET_CRED_LIST support. + kcmserver_path = os.path.join(srctop, 'tests', 'kcmserver.py') +-realm.start_server([sys.executable, kcmserver_path, kcm_socket_path], ++kcmd = realm.start_server([sys.executable, kcmserver_path, kcm_socket_path], ++ 'starting...') ++collection_test(realm, 'KCM:') ++stop_daemon(kcmd) ++os.remove(kcm_socket_path) ++realm.start_server([sys.executable, kcmserver_path, '-c', kcm_socket_path], + 'starting...') + collection_test(realm, 'KCM:') ++ + if test_keyring: + def cleanup_keyring(anchor, name): + out = realm.run(['keyctl', 'list', anchor]) diff --git a/Use-KCM_OP_RETRIEVE-in-KCM-client.patch b/Use-KCM_OP_RETRIEVE-in-KCM-client.patch new file mode 100644 index 0000000..22c6593 --- /dev/null +++ b/Use-KCM_OP_RETRIEVE-in-KCM-client.patch @@ -0,0 +1,235 @@ +From 04a810c642245947d5f32a498ed7b1a6f9a11006 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Fri, 26 Mar 2021 23:38:54 -0400 +Subject: [PATCH] Use KCM_OP_RETRIEVE in KCM client + +In kcm_retrieve(), try KCM_OP_RETRIEVE. Fall back to iteration if the +server doesn't implement it, or if we can an answer incompatible with +KRB5_TC_SUPPORTED_KTYPES. + +In kcmserver.py, implement partial decoding for creds and cred tags so +that we can do a basic principal name match. + +ticket: 8997 (new) +(cherry picked from commit 795ebba8c039be172ab93cd41105c73ffdba0fdb) +--- + src/include/kcm.h | 2 +- + src/lib/krb5/ccache/cc_kcm.c | 52 +++++++++++++++++++++++++++++++++--- + src/tests/kcmserver.py | 44 +++++++++++++++++++++++++++--- + src/tests/t_ccache.py | 11 +++++--- + 4 files changed, 99 insertions(+), 10 deletions(-) + +diff --git a/src/include/kcm.h b/src/include/kcm.h +index e4140c3a0..5a3e55ce6 100644 +--- a/src/include/kcm.h ++++ b/src/include/kcm.h +@@ -68,7 +68,7 @@ typedef enum kcm_opcode { + KCM_OP_INITIALIZE, /* (name, princ) -> () */ + KCM_OP_DESTROY, /* (name) -> () */ + KCM_OP_STORE, /* (name, cred) -> () */ +- KCM_OP_RETRIEVE, ++ KCM_OP_RETRIEVE, /* (name, flags, credtag) -> (cred) */ + KCM_OP_GET_PRINCIPAL, /* (name) -> (princ) */ + KCM_OP_GET_CRED_UUID_LIST, /* (name) -> (uuid, ...) */ + KCM_OP_GET_CRED_BY_UUID, /* (name, uuid) -> (cred) */ +diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c +index 772928e4d..80f8bf631 100644 +--- a/src/lib/krb5/ccache/cc_kcm.c ++++ b/src/lib/krb5/ccache/cc_kcm.c +@@ -792,9 +792,55 @@ static krb5_error_code KRB5_CALLCONV + kcm_retrieve(krb5_context context, krb5_ccache cache, krb5_flags flags, + krb5_creds *mcred, krb5_creds *cred_out) + { +- /* There is a KCM opcode for retrieving creds, but Heimdal's client doesn't +- * use it. It causes the KCM daemon to actually make a TGS request. */ +- return k5_cc_retrieve_cred_default(context, cache, flags, mcred, cred_out); ++ krb5_error_code ret; ++ struct kcmreq req = EMPTY_KCMREQ; ++ krb5_creds cred; ++ krb5_enctype *enctypes = NULL; ++ ++ memset(&cred, 0, sizeof(cred)); ++ ++ /* Include KCM_GC_CACHED in flags to prevent Heimdal's sssd from making a ++ * TGS request itself. */ ++ kcmreq_init(&req, KCM_OP_RETRIEVE, cache); ++ k5_buf_add_uint32_be(&req.reqbuf, map_tcflags(flags) | KCM_GC_CACHED); ++ k5_marshal_mcred(&req.reqbuf, mcred); ++ ret = cache_call(context, cache, &req); ++ ++ /* Fall back to iteration if the server does not support retrieval. */ ++ if (ret == KRB5_FCC_INTERNAL || ret == KRB5_CC_IO) { ++ ret = k5_cc_retrieve_cred_default(context, cache, flags, mcred, ++ cred_out); ++ goto cleanup; ++ } ++ if (ret) ++ goto cleanup; ++ ++ ret = k5_unmarshal_cred(req.reply.ptr, req.reply.len, 4, &cred); ++ if (ret) ++ goto cleanup; ++ ++ /* In rare cases we might retrieve a credential with a session key this ++ * context can't support, in which case we must retry using iteration. */ ++ if (flags & KRB5_TC_SUPPORTED_KTYPES) { ++ ret = krb5_get_tgs_ktypes(context, cred.server, &enctypes); ++ if (ret) ++ goto cleanup; ++ if (!k5_etypes_contains(enctypes, cred.keyblock.enctype)) { ++ ret = k5_cc_retrieve_cred_default(context, cache, flags, mcred, ++ cred_out); ++ goto cleanup; ++ } ++ } ++ ++ *cred_out = cred; ++ memset(&cred, 0, sizeof(cred)); ++ ++cleanup: ++ kcmreq_free(&req); ++ krb5_free_cred_contents(context, &cred); ++ free(enctypes); ++ /* Heimdal's KCM returns KRB5_CC_END if no cred is found. */ ++ return (ret == KRB5_CC_END) ? KRB5_CC_NOTFOUND : map_invalid(ret); + } + + static krb5_error_code KRB5_CALLCONV +diff --git a/src/tests/kcmserver.py b/src/tests/kcmserver.py +index 8c5e66ff1..25e6f2bbe 100644 +--- a/src/tests/kcmserver.py ++++ b/src/tests/kcmserver.py +@@ -40,6 +40,7 @@ class KCMOpcodes(object): + INITIALIZE = 4 + DESTROY = 5 + STORE = 6 ++ RETRIEVE = 7 + GET_PRINCIPAL = 8 + GET_CRED_UUID_LIST = 9 + GET_CRED_BY_UUID = 10 +@@ -54,6 +55,7 @@ class KCMOpcodes(object): + + + class KRB5Errors(object): ++ KRB5_CC_NOTFOUND = -1765328243 + KRB5_CC_END = -1765328242 + KRB5_CC_NOSUPP = -1765328137 + KRB5_FCC_NOFILE = -1765328189 +@@ -86,11 +88,29 @@ def get_cache(name): + return cache + + ++def unpack_data(argbytes): ++ dlen, = struct.unpack('>L', argbytes[:4]) ++ return argbytes[4:dlen+4], argbytes[dlen+4:] ++ ++ + def unmarshal_name(argbytes): + offset = argbytes.find(b'\0') + return argbytes[0:offset], argbytes[offset+1:] + + ++def unmarshal_princ(argbytes): ++ # Ignore the type at argbytes[0:4]. ++ ncomps, = struct.unpack('>L', argbytes[4:8]) ++ realm, rest = unpack_data(argbytes[8:]) ++ comps = [] ++ for i in range(ncomps): ++ comp, rest = unpack_data(rest) ++ comps.append(comp) ++ # Asssume no quoting is needed. ++ princ = b'/'.join(comps) + b'@' + realm ++ return princ, rest ++ ++ + def op_gen_new(argbytes): + # Does not actually check for uniqueness. + global next_unique +@@ -126,6 +146,22 @@ def op_store(argbytes): + return 0, b'' + + ++def op_retrieve(argbytes): ++ name, rest = unmarshal_name(argbytes) ++ # Ignore the flags at rest[0:4] and the header at rest[4:8]. ++ # Assume there are client and server creds in the tag and match ++ # only against them. ++ cprinc, rest = unmarshal_princ(rest[8:]) ++ sprinc, rest = unmarshal_princ(rest) ++ cache = get_cache(name) ++ for cred in (cache.creds[u] for u in cache.cred_uuids): ++ cred_cprinc, rest = unmarshal_princ(cred) ++ cred_sprinc, rest = unmarshal_princ(rest) ++ if cred_cprinc == cprinc and cred_sprinc == sprinc: ++ return 0, cred ++ return KRB5Errors.KRB5_CC_NOTFOUND, b'' ++ ++ + def op_get_principal(argbytes): + name, rest = unmarshal_name(argbytes) + cache = get_cache(name) +@@ -199,6 +235,7 @@ ophandlers = { + KCMOpcodes.INITIALIZE : op_initialize, + KCMOpcodes.DESTROY : op_destroy, + KCMOpcodes.STORE : op_store, ++ KCMOpcodes.RETRIEVE : op_retrieve, + KCMOpcodes.GET_PRINCIPAL : op_get_principal, + KCMOpcodes.GET_CRED_UUID_LIST : op_get_cred_uuid_list, + KCMOpcodes.GET_CRED_BY_UUID : op_get_cred_by_uuid, +@@ -243,10 +280,11 @@ def service_request(s): + return True + + parser = optparse.OptionParser() +-parser.add_option('-c', '--credlist', action='store_true', dest='credlist', +- default=False, help='Support KCM_OP_GET_CRED_LIST') ++parser.add_option('-f', '--fallback', action='store_true', dest='fallback', ++ default=False, help='Do not support RETRIEVE/GET_CRED_LIST') + (options, args) = parser.parse_args() +-if not options.credlist: ++if options.fallback: ++ del ophandlers[KCMOpcodes.RETRIEVE] + del ophandlers[KCMOpcodes.GET_CRED_LIST] + + server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) +diff --git a/src/tests/t_ccache.py b/src/tests/t_ccache.py +index 90040fb7b..6ea9fb969 100755 +--- a/src/tests/t_ccache.py ++++ b/src/tests/t_ccache.py +@@ -25,7 +25,7 @@ from k5test import * + kcm_socket_path = os.path.join(os.getcwd(), 'testdir', 'kcm') + conf = {'libdefaults': {'kcm_socket': kcm_socket_path, + 'kcm_mach_service': '-'}} +-realm = K5Realm(create_host=False, krb5_conf=conf) ++realm = K5Realm(krb5_conf=conf) + + keyctl = which('keyctl') + out = realm.run([klist, '-c', 'KEYRING:process:abcd'], expected_code=1) +@@ -71,6 +71,11 @@ def collection_test(realm, ccname): + realm.kinit('alice', password('alice')) + realm.run([klist], expected_msg='Default principal: alice@') + realm.run([klist, '-A', '-s']) ++ realm.run([kvno, realm.host_princ], expected_msg = 'kvno = 1') ++ realm.run([kvno, realm.host_princ], expected_msg = 'kvno = 1') ++ out = realm.run([klist]) ++ if out.count(realm.host_princ) != 1: ++ fail('Wrong number of service tickets in cache') + realm.run([kdestroy]) + output = realm.run([klist], expected_code=1) + if 'No credentials cache' not in output and 'not found' not in output: +@@ -126,14 +131,14 @@ def collection_test(realm, ccname): + + collection_test(realm, 'DIR:' + os.path.join(realm.testdir, 'cc')) + +-# Test KCM without and with GET_CRED_LIST support. ++# Test KCM with and without RETRIEVE and GET_CRED_LIST support. + kcmserver_path = os.path.join(srctop, 'tests', 'kcmserver.py') + kcmd = realm.start_server([sys.executable, kcmserver_path, kcm_socket_path], + 'starting...') + collection_test(realm, 'KCM:') + stop_daemon(kcmd) + os.remove(kcm_socket_path) +-realm.start_server([sys.executable, kcmserver_path, '-c', kcm_socket_path], ++realm.start_server([sys.executable, kcmserver_path, '-f', kcm_socket_path], + 'starting...') + collection_test(realm, 'KCM:') + diff --git a/krb5.spec b/krb5.spec index c4a407e..ac83dce 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.1 -Release: %{?zdpd}5%{?dist} +Release: %{?zdpd}6%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -73,6 +73,8 @@ Patch7: downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch Patch8: Add-APIs-for-marshalling-credentials.patch Patch9: Add-hostname-canonicalization-helper-to-k5test.py.patch Patch10: Support-host-based-GSS-initiator-names.patch +Patch11: Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch +Patch12: Use-KCM_OP_RETRIEVE-in-KCM-client.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -635,6 +637,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Thu May 20 2021 Robbie Harwood - 1.19.1-6 +- Add KCM_OP_GET_CRED_LIST and KCM_OP_RETRIEVE support + * Tue May 04 2021 Robbie Harwood - 1.19.1-5 - Suppress static analyzer warning in FIPS override From c4150c67d14ea9272ae0bca9eca2bcbf5b349dc4 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Thu, 20 May 2021 13:59:15 -0400 Subject: [PATCH 036/103] Fix context for previous backport --- ...CM-flag-transmission-for-remove_cred.patch | 103 ++++++++++++++++++ Use-KCM_OP_RETRIEVE-in-KCM-client.patch | 10 +- krb5.spec | 8 +- 3 files changed, 114 insertions(+), 7 deletions(-) create mode 100644 Fix-KCM-flag-transmission-for-remove_cred.patch diff --git a/Fix-KCM-flag-transmission-for-remove_cred.patch b/Fix-KCM-flag-transmission-for-remove_cred.patch new file mode 100644 index 0000000..0542bfa --- /dev/null +++ b/Fix-KCM-flag-transmission-for-remove_cred.patch @@ -0,0 +1,103 @@ +From 1f160bee7ee2c6242fa2625b9f3e8fc211cec6c4 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Mon, 29 Mar 2021 14:32:56 -0400 +Subject: [PATCH] Fix KCM flag transmission for remove_cred + +MIT krb5 uses low bits for KRB5_TC flags, while Heimdal uses high bits +so that the same flag word can also hold KRB5_GC flags. Add a mapping +function and send the Heimdal flag values when performing a +remove_cred operation. + +ticket: 8995 +(cherry picked from commit 11a82cf424f9c905bb73680c64524f087090d4ef) +--- + src/include/kcm.h | 19 +++++++++++++++++++ + src/lib/krb5/ccache/cc_kcm.c | 36 +++++++++++++++++++++++++++++++++++- + 2 files changed, 54 insertions(+), 1 deletion(-) + +diff --git a/src/include/kcm.h b/src/include/kcm.h +index e4140c3a0..9b66f1cbd 100644 +--- a/src/include/kcm.h ++++ b/src/include/kcm.h +@@ -56,8 +56,27 @@ + * are marshalled as zero-terminated strings. Principals and credentials are + * marshalled in the v4 FILE ccache format. UUIDs are 16 bytes. UUID lists + * are not delimited, so nothing can come after them. ++ * ++ * Flag words must use Heimdal flag values, which are not the same as MIT krb5 ++ * values for KRB5_GC and KRB5_TC constants. The same flag word may contain ++ * both kinds of flags in Heimdal, but not in MIT krb5. Defines for the ++ * applicable Heimdal flag values are given below using KCM_GC and KCM_TC ++ * prefixes. + */ + ++#define KCM_GC_CACHED (1U << 0) ++ ++#define KCM_TC_DONT_MATCH_REALM (1U << 31) ++#define KCM_TC_MATCH_KEYTYPE (1U << 30) ++#define KCM_TC_MATCH_SRV_NAMEONLY (1U << 29) ++#define KCM_TC_MATCH_FLAGS_EXACT (1U << 28) ++#define KCM_TC_MATCH_FLAGS (1U << 27) ++#define KCM_TC_MATCH_TIMES_EXACT (1U << 26) ++#define KCM_TC_MATCH_TIMES (1U << 25) ++#define KCM_TC_MATCH_AUTHDATA (1U << 24) ++#define KCM_TC_MATCH_2ND_TKT (1U << 23) ++#define KCM_TC_MATCH_IS_SKEY (1U << 22) ++ + /* Opcodes without comments are currently unused in the MIT client + * implementation. */ + typedef enum kcm_opcode { +diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c +index 772928e4d..1f81a2190 100644 +--- a/src/lib/krb5/ccache/cc_kcm.c ++++ b/src/lib/krb5/ccache/cc_kcm.c +@@ -110,6 +110,40 @@ map_invalid(krb5_error_code code) + KRB5_KCM_MALFORMED_REPLY : code; + } + ++/* ++ * Map an MIT krb5 KRB5_TC flag word to the equivalent Heimdal flag word. Note ++ * that there is no MIT krb5 equivalent for Heimdal's KRB5_TC_DONT_MATCH_REALM ++ * (which is like KRB5_TC_MATCH_SRV_NAMEONLY but also applies to the client ++ * principal) and no Heimdal equivalent for MIT krb5's KRB5_TC_SUPPORTED_KTYPES ++ * (which matches against enctypes from the krb5_context rather than the ++ * matching cred). ++ */ ++static inline krb5_flags ++map_tcflags(krb5_flags mitflags) ++{ ++ krb5_flags heimflags = 0; ++ ++ if (mitflags & KRB5_TC_MATCH_TIMES) ++ heimflags |= KCM_TC_MATCH_TIMES; ++ if (mitflags & KRB5_TC_MATCH_IS_SKEY) ++ heimflags |= KCM_TC_MATCH_IS_SKEY; ++ if (mitflags & KRB5_TC_MATCH_FLAGS) ++ heimflags |= KCM_TC_MATCH_FLAGS; ++ if (mitflags & KRB5_TC_MATCH_TIMES_EXACT) ++ heimflags |= KCM_TC_MATCH_TIMES_EXACT; ++ if (mitflags & KRB5_TC_MATCH_FLAGS_EXACT) ++ heimflags |= KCM_TC_MATCH_FLAGS_EXACT; ++ if (mitflags & KRB5_TC_MATCH_AUTHDATA) ++ heimflags |= KCM_TC_MATCH_AUTHDATA; ++ if (mitflags & KRB5_TC_MATCH_SRV_NAMEONLY) ++ heimflags |= KCM_TC_MATCH_SRV_NAMEONLY; ++ if (mitflags & KRB5_TC_MATCH_2ND_TKT) ++ heimflags |= KCM_TC_MATCH_2ND_TKT; ++ if (mitflags & KRB5_TC_MATCH_KTYPE) ++ heimflags |= KCM_TC_MATCH_KEYTYPE; ++ return heimflags; ++} ++ + /* Begin a request for the given opcode. If cache is non-null, supply the + * cache name as a request parameter. */ + static void +@@ -936,7 +970,7 @@ kcm_remove_cred(krb5_context context, krb5_ccache cache, krb5_flags flags, + struct kcmreq req; + + kcmreq_init(&req, KCM_OP_REMOVE_CRED, cache); +- k5_buf_add_uint32_be(&req.reqbuf, flags); ++ k5_buf_add_uint32_be(&req.reqbuf, map_tcflags(flags)); + k5_marshal_mcred(&req.reqbuf, mcred); + ret = cache_call(context, cache, &req); + kcmreq_free(&req); diff --git a/Use-KCM_OP_RETRIEVE-in-KCM-client.patch b/Use-KCM_OP_RETRIEVE-in-KCM-client.patch index 22c6593..c0abcf3 100644 --- a/Use-KCM_OP_RETRIEVE-in-KCM-client.patch +++ b/Use-KCM_OP_RETRIEVE-in-KCM-client.patch @@ -1,4 +1,4 @@ -From 04a810c642245947d5f32a498ed7b1a6f9a11006 Mon Sep 17 00:00:00 2001 +From 8f073717c0373bcd4d13e338273449f00325b00c Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Fri, 26 Mar 2021 23:38:54 -0400 Subject: [PATCH] Use KCM_OP_RETRIEVE in KCM client @@ -20,10 +20,10 @@ ticket: 8997 (new) 4 files changed, 99 insertions(+), 10 deletions(-) diff --git a/src/include/kcm.h b/src/include/kcm.h -index e4140c3a0..5a3e55ce6 100644 +index 9b66f1cbd..85c20d345 100644 --- a/src/include/kcm.h +++ b/src/include/kcm.h -@@ -68,7 +68,7 @@ typedef enum kcm_opcode { +@@ -87,7 +87,7 @@ typedef enum kcm_opcode { KCM_OP_INITIALIZE, /* (name, princ) -> () */ KCM_OP_DESTROY, /* (name) -> () */ KCM_OP_STORE, /* (name, cred) -> () */ @@ -33,10 +33,10 @@ index e4140c3a0..5a3e55ce6 100644 KCM_OP_GET_CRED_UUID_LIST, /* (name) -> (uuid, ...) */ KCM_OP_GET_CRED_BY_UUID, /* (name, uuid) -> (cred) */ diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c -index 772928e4d..80f8bf631 100644 +index 1f81a2190..ef77ac216 100644 --- a/src/lib/krb5/ccache/cc_kcm.c +++ b/src/lib/krb5/ccache/cc_kcm.c -@@ -792,9 +792,55 @@ static krb5_error_code KRB5_CALLCONV +@@ -826,9 +826,55 @@ static krb5_error_code KRB5_CALLCONV kcm_retrieve(krb5_context context, krb5_ccache cache, krb5_flags flags, krb5_creds *mcred, krb5_creds *cred_out) { diff --git a/krb5.spec b/krb5.spec index ac83dce..d571916 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.1 -Release: %{?zdpd}6%{?dist} +Release: %{?zdpd}7%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -74,7 +74,8 @@ Patch8: Add-APIs-for-marshalling-credentials.patch Patch9: Add-hostname-canonicalization-helper-to-k5test.py.patch Patch10: Support-host-based-GSS-initiator-names.patch Patch11: Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch -Patch12: Use-KCM_OP_RETRIEVE-in-KCM-client.patch +Patch12: Fix-KCM-flag-transmission-for-remove_cred.patch +Patch13: Use-KCM_OP_RETRIEVE-in-KCM-client.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -637,6 +638,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Thu May 20 2021 Robbie Harwood - 1.19.1-7 +- Fix context for previous backport + * Thu May 20 2021 Robbie Harwood - 1.19.1-6 - Add KCM_OP_GET_CRED_LIST and KCM_OP_RETRIEVE support From 72e80d67ef87e136c3d5dd7b1e0323f968769096 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Thu, 20 May 2021 17:26:12 -0400 Subject: [PATCH 037/103] Add all the sssd-kcm workarounds --- ...P_GET_CRED_LIST-for-faster-iteration.patch | 2 +- ...CM-flag-transmission-for-remove_cred.patch | 2 +- Fix-KCM-retrieval-support-for-sssd.patch | 62 +++++++++++++++++++ ...teration-fallback-work-with-sssd-kcm.patch | 26 ++++++++ Use-KCM_OP_RETRIEVE-in-KCM-client.patch | 4 +- krb5.spec | 9 ++- 6 files changed, 99 insertions(+), 6 deletions(-) create mode 100644 Fix-KCM-retrieval-support-for-sssd.patch create mode 100644 Make-KCM-iteration-fallback-work-with-sssd-kcm.patch diff --git a/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch b/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch index 237de35..060b039 100644 --- a/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch +++ b/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch @@ -1,4 +1,4 @@ -From dc92022ad26cec8085a852dec6aeba310fa7a751 Mon Sep 17 00:00:00 2001 +From a0ee8b02e56c65e5dcd569caed0e151cef004ef4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20B=C5=99ezina?= Date: Thu, 11 Feb 2021 15:33:10 +0100 Subject: [PATCH] Add KCM_OP_GET_CRED_LIST for faster iteration diff --git a/Fix-KCM-flag-transmission-for-remove_cred.patch b/Fix-KCM-flag-transmission-for-remove_cred.patch index 0542bfa..951be10 100644 --- a/Fix-KCM-flag-transmission-for-remove_cred.patch +++ b/Fix-KCM-flag-transmission-for-remove_cred.patch @@ -1,4 +1,4 @@ -From 1f160bee7ee2c6242fa2625b9f3e8fc211cec6c4 Mon Sep 17 00:00:00 2001 +From 04f0de4420508161ce439f262f2761ff51a07ab0 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Mon, 29 Mar 2021 14:32:56 -0400 Subject: [PATCH] Fix KCM flag transmission for remove_cred diff --git a/Fix-KCM-retrieval-support-for-sssd.patch b/Fix-KCM-retrieval-support-for-sssd.patch new file mode 100644 index 0000000..5fb7c2b --- /dev/null +++ b/Fix-KCM-retrieval-support-for-sssd.patch @@ -0,0 +1,62 @@ +From a5b2cff51808cd86fe8195e7ac074ecd25c3344d Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Tue, 11 May 2021 14:04:07 -0400 +Subject: [PATCH] Fix KCM retrieval support for sssd + +Commit 795ebba8c039be172ab93cd41105c73ffdba0fdb added a retrieval +handler using KCM_OP_RETRIEVE, falling back on the same error codes as +the previous KCM_OP_GET_CRED_LIST support. But sssd (as of 2.4) +returns KRB5_CC_NOSUPP instead of KRB5_CC_IO if it recognizes an +opcode but does not implement it. Add a helper function to recognize +all known unsupported-opcode error codes, and use it in kcm_retrieve() +and kcm_start_seq_get(). + +ticket: 8997 +(cherry picked from commit da103e36e13f3c846bcddbe38dd518a21e5260a0) +--- + src/lib/krb5/ccache/cc_kcm.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c +index 23fcf13ea..18505cd3d 100644 +--- a/src/lib/krb5/ccache/cc_kcm.c ++++ b/src/lib/krb5/ccache/cc_kcm.c +@@ -144,6 +144,20 @@ map_tcflags(krb5_flags mitflags) + return heimflags; + } + ++/* ++ * Return true if code could indicate an unsupported operation. Heimdal's KCM ++ * returns KRB5_FCC_INTERNAL. sssd's KCM daemon (as of sssd 2.4) returns ++ * KRB5_CC_NO_SUPP if it recognizes the operation but does not implement it, ++ * and KRB5_CC_IO if it doesn't recognize the operation (which is unfortunate ++ * since it could also indicate a communication failure). ++ */ ++static krb5_boolean ++unsupported_op_error(krb5_error_code code) ++{ ++ return code == KRB5_FCC_INTERNAL || code == KRB5_CC_IO || ++ code == KRB5_CC_NOSUPP; ++} ++ + /* Begin a request for the given opcode. If cache is non-null, supply the + * cache name as a request parameter. */ + static void +@@ -841,7 +855,7 @@ kcm_retrieve(krb5_context context, krb5_ccache cache, krb5_flags flags, + ret = cache_call(context, cache, &req); + + /* Fall back to iteration if the server does not support retrieval. */ +- if (ret == KRB5_FCC_INTERNAL || ret == KRB5_CC_IO) { ++ if (unsupported_op_error(ret)) { + ret = k5_cc_retrieve_cred_default(context, cache, flags, mcred, + cred_out); + goto cleanup; +@@ -922,7 +936,7 @@ kcm_start_seq_get(krb5_context context, krb5_ccache cache, + ret = kcmreq_get_cred_list(&req, &creds); + if (ret) + goto cleanup; +- } else if (ret == KRB5_FCC_INTERNAL || ret == KRB5_CC_IO) { ++ } else if (unsupported_op_error(ret)) { + /* Fall back to GET_CRED_UUID_LIST. */ + kcmreq_free(&req); + kcmreq_init(&req, KCM_OP_GET_CRED_UUID_LIST, cache); diff --git a/Make-KCM-iteration-fallback-work-with-sssd-kcm.patch b/Make-KCM-iteration-fallback-work-with-sssd-kcm.patch new file mode 100644 index 0000000..5fa3106 --- /dev/null +++ b/Make-KCM-iteration-fallback-work-with-sssd-kcm.patch @@ -0,0 +1,26 @@ +From 2dbca7e14c945d6394e0e05f285a068dcd541295 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pavel=20B=C5=99ezina?= +Date: Tue, 30 Mar 2021 14:35:28 +0200 +Subject: [PATCH] Make KCM iteration fallback work with sssd-kcm + +sssd-kcm returns KRB5_CC_IO if the operation code is not known. + +ticket: 8990 +(cherry picked from commit 06afae820a44c1dc96ad88a0b16c3e50bc938b2a) +--- + src/lib/krb5/ccache/cc_kcm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c +index 1f81a2190..46705f1da 100644 +--- a/src/lib/krb5/ccache/cc_kcm.c ++++ b/src/lib/krb5/ccache/cc_kcm.c +@@ -876,7 +876,7 @@ kcm_start_seq_get(krb5_context context, krb5_ccache cache, + ret = kcmreq_get_cred_list(&req, &creds); + if (ret) + goto cleanup; +- } else if (ret == KRB5_FCC_INTERNAL) { ++ } else if (ret == KRB5_FCC_INTERNAL || ret == KRB5_CC_IO) { + /* Fall back to GET_CRED_UUID_LIST. */ + kcmreq_free(&req); + kcmreq_init(&req, KCM_OP_GET_CRED_UUID_LIST, cache); diff --git a/Use-KCM_OP_RETRIEVE-in-KCM-client.patch b/Use-KCM_OP_RETRIEVE-in-KCM-client.patch index c0abcf3..401b363 100644 --- a/Use-KCM_OP_RETRIEVE-in-KCM-client.patch +++ b/Use-KCM_OP_RETRIEVE-in-KCM-client.patch @@ -1,4 +1,4 @@ -From 8f073717c0373bcd4d13e338273449f00325b00c Mon Sep 17 00:00:00 2001 +From c56d4b87de0f30a38dc61d374ad225d02d581eb3 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Fri, 26 Mar 2021 23:38:54 -0400 Subject: [PATCH] Use KCM_OP_RETRIEVE in KCM client @@ -33,7 +33,7 @@ index 9b66f1cbd..85c20d345 100644 KCM_OP_GET_CRED_UUID_LIST, /* (name) -> (uuid, ...) */ KCM_OP_GET_CRED_BY_UUID, /* (name, uuid) -> (cred) */ diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c -index 1f81a2190..ef77ac216 100644 +index 46705f1da..23fcf13ea 100644 --- a/src/lib/krb5/ccache/cc_kcm.c +++ b/src/lib/krb5/ccache/cc_kcm.c @@ -826,9 +826,55 @@ static krb5_error_code KRB5_CALLCONV diff --git a/krb5.spec b/krb5.spec index d571916..cbe0580 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.1 -Release: %{?zdpd}7%{?dist} +Release: %{?zdpd}8%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -75,7 +75,9 @@ Patch9: Add-hostname-canonicalization-helper-to-k5test.py.patch Patch10: Support-host-based-GSS-initiator-names.patch Patch11: Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch Patch12: Fix-KCM-flag-transmission-for-remove_cred.patch -Patch13: Use-KCM_OP_RETRIEVE-in-KCM-client.patch +Patch13: Make-KCM-iteration-fallback-work-with-sssd-kcm.patch +Patch14: Use-KCM_OP_RETRIEVE-in-KCM-client.patch +Patch15: Fix-KCM-retrieval-support-for-sssd.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -638,6 +640,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Thu May 20 2021 Robbie Harwood - 1.19.1-8 +- Add all the sssd-kcm workarounds + * Thu May 20 2021 Robbie Harwood - 1.19.1-7 - Fix context for previous backport From 65a1e5607c56c0d73208c1afd138c2e46695ba9b Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Wed, 2 Jun 2021 12:09:09 -0400 Subject: [PATCH 038/103] Fix doc build for Sphinx 4.0 --- Fix-doc-build-for-Sphinx-4.0.patch | 152 +++++++++++++++++++++++++++++ krb5.spec | 6 +- 2 files changed, 157 insertions(+), 1 deletion(-) create mode 100644 Fix-doc-build-for-Sphinx-4.0.patch diff --git a/Fix-doc-build-for-Sphinx-4.0.patch b/Fix-doc-build-for-Sphinx-4.0.patch new file mode 100644 index 0000000..ae3972c --- /dev/null +++ b/Fix-doc-build-for-Sphinx-4.0.patch @@ -0,0 +1,152 @@ +From 0bf023bdbb8335f48a6a4dcf8bd5dac9c2cd7fb6 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Wed, 26 May 2021 15:08:28 -0400 +Subject: [PATCH] Fix doc build for Sphinx 4.0 + +Use app.add_css_file() to register krb5.css if possible (it was added +in Sphinx 1.8), since the old name app.add_stylesheet() was removed in +Sphinx 4.0. + +Use the highlight directive instead of the highlightlang directive, +which was removed in Sphinx 4.0. + +Remove two duplicate table of contents entries to fix warnings. + +In the Github Actions configuration, add a second doc build using the +newest version of Sphinx. + +ticket: 9006 +tags: pullup +target_version: 1.19-next + +(cherry picked from commit 3fa40a32e22cb9de91fa1d18deddcba446515855) +--- + .github/workflows/doc.yml | 16 +++++++++++++++- + doc/appdev/refs/macros/index.rst | 1 - + doc/appdev/refs/types/index.rst | 1 - + doc/appdev/refs/types/krb5_int32.rst | 2 +- + doc/appdev/refs/types/krb5_ui_4.rst | 2 +- + doc/conf.py | 9 ++++++++- + doc/tools/define_document.tmpl | 2 +- + doc/tools/type_document.tmpl | 2 +- + 8 files changed, 27 insertions(+), 8 deletions(-) + +diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml +index 292df4cfe..75f467cde 100644 +--- a/.github/workflows/doc.yml ++++ b/.github/workflows/doc.yml +@@ -5,7 +5,7 @@ on: + pull_request: {paths: [doc/**, src/doc/*, src/include/krb5/krb5.hin, .github/workflows/doc.yml]} + + jobs: +- doc: ++ doc-older-sphinx: + runs-on: ubuntu-18.04 + steps: + - name: Checkout repository +@@ -19,6 +19,20 @@ jobs: + run: | + cd src/doc + make -f Makefile.in SPHINX_ARGS=-W htmlsrc ++ doc-newest-sphinx: ++ runs-on: ubuntu-18.04 ++ steps: ++ - name: Checkout repository ++ uses: actions/checkout@v1 ++ - name: Linux setup ++ run: | ++ sudo apt-get update -qq ++ sudo apt-get install -y doxygen python3-lxml python3-pip ++ pip3 install Cheetah3 sphinx ++ - name: Build documentation ++ run: | ++ cd src/doc ++ make -f Makefile.in SPHINX_ARGS=-W htmlsrc + - name: Upload HTML + uses: actions/upload-artifact@v2 + with: +diff --git a/doc/appdev/refs/macros/index.rst b/doc/appdev/refs/macros/index.rst +index 4d51e795c..0cb2e81bd 100644 +--- a/doc/appdev/refs/macros/index.rst ++++ b/doc/appdev/refs/macros/index.rst +@@ -54,7 +54,6 @@ Public + ENCTYPE_DES3_CBC_RAW.rst + ENCTYPE_DES3_CBC_SHA.rst + ENCTYPE_DES3_CBC_SHA1.rst +- ENCTYPE_DES3_CBC_SHA1.rst + ENCTYPE_DES_CBC_CRC.rst + ENCTYPE_DES_CBC_MD4.rst + ENCTYPE_DES_CBC_MD5.rst +diff --git a/doc/appdev/refs/types/index.rst b/doc/appdev/refs/types/index.rst +index dc414cfde..d8d2a8f3c 100644 +--- a/doc/appdev/refs/types/index.rst ++++ b/doc/appdev/refs/types/index.rst +@@ -62,7 +62,6 @@ Public + krb5_preauthtype.rst + krb5_principal.rst + krb5_principal_data.rst +- krb5_const_principal.rst + krb5_prompt.rst + krb5_prompt_type.rst + krb5_prompter_fct.rst +diff --git a/doc/appdev/refs/types/krb5_int32.rst b/doc/appdev/refs/types/krb5_int32.rst +index 2bc914b3c..28baafa38 100644 +--- a/doc/appdev/refs/types/krb5_int32.rst ++++ b/doc/appdev/refs/types/krb5_int32.rst +@@ -1,4 +1,4 @@ +-.. highlightlang:: c ++.. highlight:: c + + .. _krb5-int32-struct: + +diff --git a/doc/appdev/refs/types/krb5_ui_4.rst b/doc/appdev/refs/types/krb5_ui_4.rst +index de79bafe1..73eb38cf4 100644 +--- a/doc/appdev/refs/types/krb5_ui_4.rst ++++ b/doc/appdev/refs/types/krb5_ui_4.rst +@@ -1,4 +1,4 @@ +-.. highlightlang:: c ++.. highlight:: c + + .. _krb5-ui4-struct: + +diff --git a/doc/conf.py b/doc/conf.py +index 4fb6aae14..a876fd633 100644 +--- a/doc/conf.py ++++ b/doc/conf.py +@@ -98,8 +98,15 @@ pygments_style = 'sphinx' + + # -- Options for HTML output --------------------------------------------------- + ++# When we can rely on Sphinx 1.8 (released Sep 2018) we can just set: ++# html_css_files = ['kerb.css'] ++# But in the meantime, we add this file using either a way that works ++# after 1.8 or a way that works before 4.0. + def setup(app): +- app.add_stylesheet('kerb.css') ++ if callable(getattr(app, 'add_css_file', None)): ++ app.add_css_file('kerb.css') ++ else: ++ app.add_stylesheet('kerb.css') + + # The theme to use for HTML and HTML Help pages. See the documentation for + # a list of builtin themes. +diff --git a/doc/tools/define_document.tmpl b/doc/tools/define_document.tmpl +index ca56d866c..8e74dc302 100644 +--- a/doc/tools/define_document.tmpl ++++ b/doc/tools/define_document.tmpl +@@ -1,4 +1,4 @@ +-.. highlightlang:: c ++.. highlight:: c + + .. $composite.macro_reference($composite.name): + +diff --git a/doc/tools/type_document.tmpl b/doc/tools/type_document.tmpl +index 5987fa762..11aafb818 100644 +--- a/doc/tools/type_document.tmpl ++++ b/doc/tools/type_document.tmpl +@@ -1,4 +1,4 @@ +-.. highlightlang:: c ++.. highlight:: c + + .. $composite.struct_reference($composite.name): + diff --git a/krb5.spec b/krb5.spec index cbe0580..b59f39c 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.1 -Release: %{?zdpd}8%{?dist} +Release: %{?zdpd}9%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -78,6 +78,7 @@ Patch12: Fix-KCM-flag-transmission-for-remove_cred.patch Patch13: Make-KCM-iteration-fallback-work-with-sssd-kcm.patch Patch14: Use-KCM_OP_RETRIEVE-in-KCM-client.patch Patch15: Fix-KCM-retrieval-support-for-sssd.patch +Patch16: Fix-doc-build-for-Sphinx-4.0.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -640,6 +641,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Wed Jun 02 2021 Robbie Harwood - 1.19.1-9 +- Fix doc build for Sphinx 4.0 + * Thu May 20 2021 Robbie Harwood - 1.19.1-8 - Add all the sssd-kcm workarounds From 4df0096f2013dc5bc9fad459ddc18e83ac4da4c2 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Wed, 9 Jun 2021 10:55:13 -0400 Subject: [PATCH 039/103] Fix three canonicalization cases for fallback --- ...ith-keytab-to-defer-canonicalization.patch | 60 + ...in-k-with-fallback-or-referral-realm.patch | 64 + ...incipal-realm-canonicalization-cases.patch | 96 + ...dejagnu-kadmin-tests-to-Python-tests.patch | 1750 +++++++++++++++++ krb5.spec | 9 +- 5 files changed, 1978 insertions(+), 1 deletion(-) create mode 100644 Allow-kinit-with-keytab-to-defer-canonicalization.patch create mode 100644 Fix-kadmin-k-with-fallback-or-referral-realm.patch create mode 100644 Fix-some-principal-realm-canonicalization-cases.patch create mode 100644 Move-some-dejagnu-kadmin-tests-to-Python-tests.patch diff --git a/Allow-kinit-with-keytab-to-defer-canonicalization.patch b/Allow-kinit-with-keytab-to-defer-canonicalization.patch new file mode 100644 index 0000000..9315f66 --- /dev/null +++ b/Allow-kinit-with-keytab-to-defer-canonicalization.patch @@ -0,0 +1,60 @@ +From 090c7319652466339e3e6482bdd1b5a294638dff Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Thu, 3 Jun 2021 16:03:07 -0400 +Subject: [PATCH] Allow kinit with keytab to defer canonicalization + +[ghudson@mit.edu: added tests] + +ticket: 9012 (new) +(cherry picked from commit 5e6a6efc5df689d9fb8730d0227167ffbb6ece0e) +--- + src/clients/kinit/kinit.c | 11 ----------- + src/tests/t_keytab.py | 13 +++++++++++++ + 2 files changed, 13 insertions(+), 11 deletions(-) + +diff --git a/src/clients/kinit/kinit.c b/src/clients/kinit/kinit.c +index d1f5d74c3..5a6d7237c 100644 +--- a/src/clients/kinit/kinit.c ++++ b/src/clients/kinit/kinit.c +@@ -510,17 +510,6 @@ k5_begin(struct k_opts *opts, struct k5_data *k5) + _("when creating default server principal name")); + goto cleanup; + } +- if (k5->me->realm.data[0] == 0) { +- ret = krb5_unparse_name(k5->ctx, k5->me, &k5->name); +- if (ret == 0) { +- com_err(progname, KRB5_ERR_HOST_REALM_UNKNOWN, +- _("(principal %s)"), k5->name); +- } else { +- com_err(progname, KRB5_ERR_HOST_REALM_UNKNOWN, +- _("for local services")); +- } +- goto cleanup; +- } + } else if (k5->out_cc != NULL) { + /* If the output ccache is initialized, use its principal. */ + if (krb5_cc_get_principal(k5->ctx, k5->out_cc, &princ) == 0) +diff --git a/src/tests/t_keytab.py b/src/tests/t_keytab.py +index 850375c92..a9adebb26 100755 +--- a/src/tests/t_keytab.py ++++ b/src/tests/t_keytab.py +@@ -41,6 +41,19 @@ realm.kinit(realm.user_princ, flags=['-i'], + expected_msg='keytab specified, forcing -k') + realm.klist(realm.user_princ) + ++# Test default principal for -k. This operation requires ++# canonicalization against the keytab in krb5_get_init_creds_keytab() ++# as the krb5_sname_to_principal() result won't have a realm. Try ++# with and without without fallback processing since the code paths ++# are different. ++mark('default principal for -k') ++realm.run([kinit, '-k']) ++realm.klist(realm.host_princ) ++no_canon_conf = {'libdefaults': {'dns_canonicalize_hostname': 'false'}} ++no_canon = realm.special_env('no_canon', False, krb5_conf=no_canon_conf) ++realm.run([kinit, '-k'], env=no_canon) ++realm.klist(realm.host_princ) ++ + # Test extracting keys with multiple key versions present. + mark('multi-kvno extract') + os.remove(realm.keytab) diff --git a/Fix-kadmin-k-with-fallback-or-referral-realm.patch b/Fix-kadmin-k-with-fallback-or-referral-realm.patch new file mode 100644 index 0000000..3e03da1 --- /dev/null +++ b/Fix-kadmin-k-with-fallback-or-referral-realm.patch @@ -0,0 +1,64 @@ +From cd8ff035f5b4720a8fc457355726f7bd0eab5eaa Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Mon, 7 Jun 2021 15:00:41 -0400 +Subject: [PATCH] Fix kadmin -k with fallback or referral realm + +kadmin -k produces a client principal name with +krb5_sname_to_principal(), but it gets converted to a string and back +due to the signature of kadm5_init_with_skey(), which loses track of +the name type, so no canonicalization is performed. + +In libkadm5clnt initialization, recognize the important subset of this +case--an empty realm indicates either fallback processing or the +referral realm--and restore the host-based name type so that the +client principal can be canonicalized against the keytab. + +ticket: 9013 (new) +(cherry picked from commit dcb79089276624d7ddf44e08d35bd6d7d7e557d2) +--- + src/lib/kadm5/clnt/client_init.c | 7 +++++++ + src/tests/t_kadmin.py | 12 ++++++++++++ + 2 files changed, 19 insertions(+) + +diff --git a/src/lib/kadm5/clnt/client_init.c b/src/lib/kadm5/clnt/client_init.c +index aa1223bb3..0aaca701f 100644 +--- a/src/lib/kadm5/clnt/client_init.c ++++ b/src/lib/kadm5/clnt/client_init.c +@@ -221,9 +221,16 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, + return KADM5_MISSING_KRB5_CONF_PARAMS; + } + ++ /* ++ * Parse the client name. If it has an empty realm, it is almost certainly ++ * a host-based principal using DNS fallback processing or the referral ++ * realm, so give it the appropriate name type for canonicalization. ++ */ + code = krb5_parse_name(handle->context, client_name, &client); + if (code) + goto error; ++ if (init_type == INIT_SKEY && client->realm.length == 0) ++ client->type = KRB5_NT_SRV_HST; + + /* + * Get credentials. Also does some fallbacks in case kadmin/fqdn +diff --git a/src/tests/t_kadmin.py b/src/tests/t_kadmin.py +index fe6a3cc2e..98453d92e 100644 +--- a/src/tests/t_kadmin.py ++++ b/src/tests/t_kadmin.py +@@ -51,4 +51,16 @@ for i in range(200): + realm.run_kadmin(['addprinc', '-randkey', 'foo%d' % i]) + realm.run_kadmin(['listprincs'], expected_msg='foo199') + ++# Test kadmin -k with the default principal, with and without ++# fallback. This operation requires canonicalization against the ++# keytab in krb5_get_init_creds_keytab() as the ++# krb5_sname_to_principal() result won't have a realm. Try with and ++# without without fallback processing since the code paths are ++# different. ++mark('kadmin -k') ++realm.run([kadmin, '-k', 'getprinc', realm.host_princ]) ++no_canon_conf = {'libdefaults': {'dns_canonicalize_hostname': 'false'}} ++no_canon = realm.special_env('no_canon', False, krb5_conf=no_canon_conf) ++realm.run([kadmin, '-k', 'getprinc', realm.host_princ], env=no_canon) ++ + success('kadmin and kpasswd tests') diff --git a/Fix-some-principal-realm-canonicalization-cases.patch b/Fix-some-principal-realm-canonicalization-cases.patch new file mode 100644 index 0000000..2c6c915 --- /dev/null +++ b/Fix-some-principal-realm-canonicalization-cases.patch @@ -0,0 +1,96 @@ +From 5ae9bc98f23aeaa2ce17debe5a9b0cf1130e54ed Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Mon, 7 Jun 2021 13:27:29 -0400 +Subject: [PATCH] Fix some principal realm canonicalization cases + +The no_hostrealm and subst_defrealm flags in struct canonprinc were +only applied when dns_canonicalize_hostname=fallback; in the other +cases, the initial krb5_sname_to_principal() result is treated as +canonical. For no_hostrealm this limitation doesn't currently matter, +because all uses pass a principal with no realm as input. However, +subst_defrealm is used to convert the referral realm to the default +realm in krb5_get_init_creds_keytab(), krb5_cc_cache_match(), and +gss_acquire_cred() when it needs to check the desired name against a +specified ccache. + +In k5_canonprinc(), if the input principal is a +krb5_sname_to_principal() result and fallback isn't in effect, apply +subst_defrealm. Document in os-proto.h that no_hostrealm doesn't +remove an existing realm and that krb5_sname_to_principal() may +already have looked one up. + +ticket: 9011 (new) +(cherry picked from commit c077d0c6430c4ac163443aacc03d14d206a4cbb8) +--- + src/lib/krb5/os/os-proto.h | 13 +++++++++---- + src/lib/krb5/os/sn2princ.c | 24 +++++++++++++++++++++--- + 2 files changed, 30 insertions(+), 7 deletions(-) + +diff --git a/src/lib/krb5/os/os-proto.h b/src/lib/krb5/os/os-proto.h +index 7d5e7978f..a985f2aec 100644 +--- a/src/lib/krb5/os/os-proto.h ++++ b/src/lib/krb5/os/os-proto.h +@@ -85,10 +85,15 @@ struct sendto_callback_info { + + /* + * Initialize with all zeros except for princ. Set no_hostrealm to disable +- * host-to-realm lookup, which ordinarily happens after canonicalizing the host +- * part. Set subst_defrealm to substitute the default realm for the referral +- * realm after realm lookup (this has no effect if no_hostrealm is set). Free +- * with free_canonprinc() when done. ++ * host-to-realm lookup, which ordinarily happens during fallback processing ++ * after canonicalizing the host part. Set subst_defrealm to substitute the ++ * default realm for the referral realm after realm lookup. Do not set both ++ * flags. Free with free_canonprinc() when done. ++ * ++ * no_hostrealm only applies if fallback processing is in use ++ * (dns_canonicalize_hostname = fallback). It will not remove the realm if ++ * krb5_sname_to_principal() already canonicalized the hostname and looked up a ++ * realm. subst_defrealm applies whether or not fallback processing is in use. + */ + struct canonprinc { + krb5_const_principal princ; +diff --git a/src/lib/krb5/os/sn2princ.c b/src/lib/krb5/os/sn2princ.c +index c99b7da17..93c155932 100644 +--- a/src/lib/krb5/os/sn2princ.c ++++ b/src/lib/krb5/os/sn2princ.c +@@ -271,18 +271,36 @@ krb5_error_code + k5_canonprinc(krb5_context context, struct canonprinc *iter, + krb5_const_principal *princ_out) + { ++ krb5_error_code ret; + int step = ++iter->step; + + *princ_out = NULL; + +- /* If we're not doing fallback, the input principal is canonical. */ +- if (context->dns_canonicalize_hostname != CANONHOST_FALLBACK || +- iter->princ->type != KRB5_NT_SRV_HST || iter->princ->length != 2 || ++ /* If the hostname isn't from krb5_sname_to_principal(), the input ++ * principal is canonical. */ ++ if (iter->princ->type != KRB5_NT_SRV_HST || iter->princ->length != 2 || + iter->princ->data[1].length == 0) { + *princ_out = (step == 1) ? iter->princ : NULL; + return 0; + } + ++ /* If we're not doing fallback, the hostname is canonical, but we may need ++ * to substitute the default realm. */ ++ if (context->dns_canonicalize_hostname != CANONHOST_FALLBACK) { ++ if (step > 1) ++ return 0; ++ iter->copy = *iter->princ; ++ if (iter->subst_defrealm && iter->copy.realm.length == 0) { ++ ret = krb5_get_default_realm(context, &iter->realm); ++ if (ret) ++ return ret; ++ iter->copy = *iter->princ; ++ iter->copy.realm = string2data(iter->realm); ++ } ++ *princ_out = &iter->copy; ++ return 0; ++ } ++ + /* Canonicalize without DNS at step 1, with DNS at step 2. */ + if (step > 2) + return 0; diff --git a/Move-some-dejagnu-kadmin-tests-to-Python-tests.patch b/Move-some-dejagnu-kadmin-tests-to-Python-tests.patch new file mode 100644 index 0000000..9334c19 --- /dev/null +++ b/Move-some-dejagnu-kadmin-tests-to-Python-tests.patch @@ -0,0 +1,1750 @@ +From 9b3d8b9c395bf1a889ea6d6439dc3543c680480d Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Thu, 22 Apr 2021 15:51:36 -0400 +Subject: [PATCH] Move some dejagnu kadmin tests to Python tests + +Remove the dejagnu scripts kadmin.exp, pwchange.exp, and pwhist.exp. + +Add a new Python test script t_kadmin.py for the miscellaneous kadmin +tests from kadmin.exp. + +In t_changepw.py, use modprinc +needchange for one of the kinit +password change tests to gain the same coverage as pwchange.exp had, +and add the "password changes are usable by kinit" tests from +kadmin.exp. + +In t_policy.py, add the ticket 929 regression tests from kadmin.exp +and the ticket 2841 regression tests from pwhist.exp. + +(cherry picked from commit 8027531caf6911bb07bf13de087da0e6bef5a348) +--- + src/tests/Makefile.in | 1 + + src/tests/dejagnu/krb-standalone/kadmin.exp | 1133 ----------------- + src/tests/dejagnu/krb-standalone/pwchange.exp | 145 --- + src/tests/dejagnu/krb-standalone/pwhist.exp | 217 ---- + src/tests/t_changepw.py | 34 +- + src/tests/t_kadmin.py | 54 + + src/tests/t_policy.py | 62 + + 7 files changed, 143 insertions(+), 1503 deletions(-) + delete mode 100644 src/tests/dejagnu/krb-standalone/kadmin.exp + delete mode 100644 src/tests/dejagnu/krb-standalone/pwchange.exp + delete mode 100644 src/tests/dejagnu/krb-standalone/pwhist.exp + create mode 100644 src/tests/t_kadmin.py + +diff --git a/src/tests/Makefile.in b/src/tests/Makefile.in +index 6b7749129..ab416cc5f 100644 +--- a/src/tests/Makefile.in ++++ b/src/tests/Makefile.in +@@ -147,6 +147,7 @@ check-pytests: unlockiter s4u2self + $(RUNPYTEST) $(srcdir)/t_referral.py $(PYTESTFLAGS) + $(RUNPYTEST) $(srcdir)/t_skew.py $(PYTESTFLAGS) + $(RUNPYTEST) $(srcdir)/t_keytab.py $(PYTESTFLAGS) ++ $(RUNPYTEST) $(srcdir)/t_kadmin.py $(PYTESTFLAGS) + $(RUNPYTEST) $(srcdir)/t_kadmin_acl.py $(PYTESTFLAGS) + $(RUNPYTEST) $(srcdir)/t_kadmin_parsing.py $(PYTESTFLAGS) + $(RUNPYTEST) $(srcdir)/t_kdb.py $(PYTESTFLAGS) +diff --git a/src/tests/dejagnu/krb-standalone/kadmin.exp b/src/tests/dejagnu/krb-standalone/kadmin.exp +deleted file mode 100644 +index fa50a61fb..000000000 +--- a/src/tests/dejagnu/krb-standalone/kadmin.exp ++++ /dev/null +@@ -1,1133 +0,0 @@ +-# Kerberos kadmin test. +-# This is a DejaGnu test script. +-# This script tests Kerberos kadmin5 using kadmin.local as verification. +- +-#++ +-# kadmin_add - Test add new v5 principal function of kadmin. +-# +-# Adds principal $pname with password $password. Returns 1 on success. +-#-- +-proc kadmin_add { pname password } { +- global REALMNAME +- global KADMIN +- global KADMIN_LOCAL +- global KEY +- global spawn_id +- global tmppwd +- +- set good 0 +- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "ank $pname" +- expect_after { +- "Cannot contact any KDC" { +- fail "kadmin add $pname lost KDC" +- catch "expect_after" +- return 0 +- } +- timeout { +- fail "kadmin add $pname" +- catch "expect_after" +- return 0 +- } +- eof { +- fail "kadmin add $pname" +- catch "expect_after" +- return 0 +- } +- } +- expect -re "assword\[^\r\n\]*:" { +- send "adminpass$KEY\r" +- } +- expect "Enter password for principal \"$pname@$REALMNAME\":" { send "$password\r" } +- expect "Re-enter password for principal \"$pname@$REALMNAME\":" { send "$password\r" } +- expect "Principal \"$pname@$REALMNAME\" created." { set good 1 } +- expect_after +- expect eof +- set k_stat [wait -i $spawn_id] +- verbose "wait -i $spawn_id returned $k_stat (kadmin add)" +- catch "close -i $spawn_id" +- if { $good == 1 } { +- # +- # use kadmin.local to verify that a principal was created and that its +- # salt types are 0 (normal). +- # +- envstack_push +- setup_kerberos_env kdc +- spawn $KADMIN_LOCAL -r $REALMNAME +- envstack_pop +- expect_after { +- -i $spawn_id +- timeout { +- fail "kadmin add $pname" +- catch "expect_after" +- return 0 +- } +- eof { +- fail "kadmin add $pname" +- catch "expect_after" +- return 0 +- } +- } +- set good 0 +- expect "kadmin.local: " { send "getprinc $pname\r" } +- expect "Principal: $pname@$REALMNAME" { set good 1 } +- expect "Expiration date:" { verbose "got expiration date" } +- expect "Last password change:" { verbose "got last pwchange" } +- expect "Password expiration date:" { verbose "got pwexpire date" } +- expect "Maximum ticket life:" { verbose "got max life" } +- expect "Maximum renewable life:" { verbose "got max rlife" } +- expect "Last modified:" { verbose "got last modified" } +- expect "Last successful authentication:" { verbose "last succ auth" } +- expect "Last failed authentication:" { verbose "last pw failed" } +- expect "Failed password attempts:" { verbose "num failed attempts" } +- expect "Number of keys:" { verbose "num keys"} +- expect { +- "Key: " { verbose "Key listed" +- exp_continue +- } +- "Attributes:" { verbose "attributes" } +- } +- expect "kadmin.local: " { send "q\r" } +- +- expect_after +- expect eof +- set k_stat [wait -i $spawn_id] +- verbose "wait -i $spawn_id returned $k_stat (kadmin.local show)" +- catch "close -i $spawn_id" +- if { $good == 1 } { +- pass "kadmin add $pname" +- return 1 +- } +- else { +- fail "kadmin add $pname" +- return 0 +- } +- } +- else { +- fail "kadmin add $pname" +- return 0 +- } +-} +- +-#++ +-# kadmin_add_rnd - Test add new v5 principal with random key function. +-# +-# Adds principal $pname with random key. Returns 1 on success. +-#-- +-proc kadmin_add_rnd { pname { flags "" } } { +- global REALMNAME +- global KADMIN +- global KADMIN_LOCAL +- global KEY +- global spawn_id +- global tmppwd +- +- set good 0 +- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "ank -randkey $flags $pname" +- expect_after { +- "Cannot contact any KDC" { +- fail "kadmin add rnd $pname lost KDC" +- catch "expect_after" +- return 0 +- } +- timeout { +- fail "kadmin add_rnd $pname" +- catch "expect_after" +- return 0 +- } +- eof { +- fail "kadmin add_rnd $pname" +- catch "expect_after" +- return 0 +- } +- } +- expect -re "assword\[^\r\n\]*: *" { +- send "adminpass$KEY\r" +- } +- expect "Principal \"$pname@$REALMNAME\" created." { set good 1 } +- expect_after +- expect eof +- set k_stat [wait -i $spawn_id] +- verbose "wait -i $spawn_id returned $k_stat (kadmin add_rnd)" +- catch "close -i $spawn_id" +- if { $good == 1 } { +- # +- # use kadmin.local to verify that a principal was created and that its +- # salt types are 0 (normal). +- # +- envstack_push +- setup_kerberos_env kdc +- spawn $KADMIN_LOCAL -r $REALMNAME +- envstack_pop +- expect_after { +- -i $spawn_id +- timeout { +- fail "kadmin add_rnd $pname" +- catch "expect_after" +- return 0 +- } +- eof { +- fail "kadmin add_rnd $pname" +- catch "expect_after" +- return 0 +- } +- } +- set good 0 +- expect "kadmin.local:" { send "getprinc $pname\r" } +- expect "Principal: $pname@$REALMNAME" { set good 1 } +- expect "kadmin.local:" { send "q\r" } +- expect_after +- expect eof +- set k_stat [wait -i $spawn_id] +- verbose "wait -i $spawn_id returned $k_stat (kadmin.local show)" +- catch "close -i $spawn_id" +- if { $good == 1 } { +- pass "kadmin add_rnd $pname" +- return 1 +- } +- else { +- fail "kadmin add_rnd $pname" +- return 0 +- } +- } +- else { +- fail "kadmin add_rnd $pname" +- return 0 +- } +-} +- +-#++ +-# kadmin_show - Test show principal function of kadmin. +-# +-# Retrieves entry for $pname. Returns 1 on success. +-#-- +-proc kadmin_show { pname } { +- global REALMNAME +- global KADMIN +- global KEY +- global spawn_id +- +- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "get_principal $pname" +- expect_after { +- "Cannot contact any KDC" { +- fail "kadmin show $pname lost KDC" +- catch "expect_after" +- return 0 +- } +- timeout { +- fail "kadmin show $pname" +- catch "expect_after" +- return 0 +- } +- eof { +- fail "kadmin show $pname" +- catch "expect_after" +- return 0 +- } +- } +- expect -re "assword\[^\r\n\]*: *" +- send "adminpass$KEY\r" +- expect -re "\r.*Principal: $pname@$REALMNAME.*Key: .*Attributes:.*Policy: .*\r" +- expect_after +- expect eof +- set k_stat [wait -i $spawn_id] +- verbose "wait -i $spawn_id returned $k_stat (kadmin show)" +- catch "close -i $spawn_id" +- pass "kadmin show $pname" +- return 1 +-} +- +-#++ +-# kadmin_cpw - Test change password function of kadmin +-# +-# Change password of $pname to $password. Returns 1 on success. +-#-- +-proc kadmin_cpw { pname password } { +- global REALMNAME +- global KADMIN +- global KEY +- global spawn_id +- +- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "cpw $pname" +- expect_after { +- "Cannot contact any KDC" { +- fail "kadmin cpw $pname lost KDC" +- catch "expect_after" +- return 0 +- } +- timeout { +- fail "kadmin cpw $pname" +- catch "expect_after" +- return 0 +- } +- eof { +- fail "kadmin cpw $pname" +- catch "expect_after" +- return 0 +- } +- } +- expect -re "assword\[^\r\n\]*: *" { +- send "adminpass$KEY\r" +- } +- +- expect "Enter password for principal \"$pname@$REALMNAME\":" { send "$password\r" } +- expect "Re-enter password for principal \"$pname@$REALMNAME\":" { send "$password\r" } +- # When in doubt, jam one of these in there. +- expect "\r" +- expect "Password for \"$pname@$REALMNAME\" changed." +- expect_after +- expect eof +- set k_stat [wait -i $spawn_id] +- verbose "wait -i $spawn_id returned $k_stat (kadmin cpw)" +- catch "close -i $spawn_id" +- pass "kadmin cpw $pname" +- return 1 +-} +- +-#++ +-# kadmin_cpw_rnd - Test change random key function of kadmin. +-# +-# Changes principal $pname's key to a new random key. Returns 1 on success. +-#-- +-proc kadmin_cpw_rnd { pname } { +- global REALMNAME +- global KADMIN +- global KEY +- global spawn_id +- +- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "cpw -randkey $pname" +- expect_after { +- "Cannot contact any KDC" { +- fail "kadmin cpw_rnd $pname lost KDC" +- catch "expect_after" +- return 0 +- } +- timeout { +- fail "kadmin cpw_rnd $pname" +- catch "expect_after" +- return 0 +- } +- eof { +- fail "kadmin cpw_rnd $pname" +- catch "expect_after" +- return 0 +- } +- } +- expect -re "assword\[^\r\n\]*: *" { +- send "adminpass$KEY\r" +- } +- # When in doubt, jam one of these in there. +- expect "\r" +- expect "Key for \"$pname@$REALMNAME\" randomized." +- expect_after +- expect eof +- set k_stat [wait -i $spawn_id] +- verbose "wait -i $spawn_id returned $k_stat (kadmin cpw_rnd)" +- catch "close -i $spawn_id" +- pass "kadmin cpw_rnd $pname" +- return 1 +-} +- +-#++ +-# kadmin_modify - Test modify principal function of kadmin. +-# +-# Modifies principal $pname with flags $flags. Returns 1 on success. +-#-- +-proc kadmin_modify { pname flags } { +- global REALMNAME +- global KADMIN +- global KEY +- global spawn_id +- +- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "modprinc $flags $pname" +- expect_after { +- "Cannot contact any KDC" { +- fail "kadmin modify $pname ($flags) lost KDC" +- catch "expect_after" +- return 0 +- } +- timeout { +- fail "kadmin modify $pname" +- catch "expect_after" +- return 0 +- } +- eof { +- fail "kadmin modify $pname" +- catch "expect_after" +- return 0 +- } +- } +- expect -re "assword\[^\r\n\]*: *" +- send "adminpass$KEY\r" +- # When in doubt, jam one of these in there. +- expect "\r" +- expect "Principal \"$pname@$REALMNAME\" modified." +- expect_after +- expect eof +- set k_stat [wait -i $spawn_id] +- verbose "wait -i $spawn_id returned $k_stat (kadmin modify)" +- catch "close -i $spawn_id" +- pass "kadmin modify $pname" +- return 1 +-} +- +- +-#++ +-# kadmin_list - Test list database function of kadmin. +-# +-# Lists the database and verifies that output matches regular expression +-# "(.*@$REALMNAME)*". Returns 1 on success. +-#-- +-proc kadmin_list { } { +- global REALMNAME +- global KADMIN +- global KEY +- global spawn_id +- +- # "*" would match everything +- # "*n" should match a few like kadmin/admin but see ticket 5667 +- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "get_principals *n" +- expect_after { +- "Cannot contact any KDC" { +- fail "kadmin ldb lost KDC" +- catch "expect_after" +- return 0 +- } +- "Communication failure" { +- fail "kadmin ldb got RPC error" +- catch "expect_after" +- return 0 +- } +- timeout { +- fail "kadmin ldb" +- catch "expect_after" +- return 0 +- } +- eof { +- fail "kadmin ldb" +- catch "expect_after" +- return 0 +- } +- } +- expect -re "assword\[^\r\n\]*: *" { +- send "adminpass$KEY\r" +- } +- expect -re "\(.*@$REALMNAME\r\n\)+" +- expect_after +- expect eof +- set k_stat [wait -i $spawn_id] +- verbose "wait -i $spawn_id returned $k_stat (kadmin list)" +- catch "close -i $spawn_id" +- pass "kadmin ldb" +- return 1 +-} +- +-#++ +-# kadmin_extract - Test extract service key function of kadmin. +-# +-# Extracts service key for service name $name instance $instance. Returns +-# 1 on success. +-#-- +-proc kadmin_extract { instance name } { +- global REALMNAME +- global KADMIN +- global KEY +- global spawn_id +- global tmppwd +- +- catch "exec rm -f $tmppwd/keytab" +- +- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "xst -k $tmppwd/keytab $name/$instance" +- expect_after { +- "Cannot contact any KDC" { +- fail "kadmin xst $instance $name lost KDC" +- catch "expect_after" +- return 0 +- } +- timeout { +- fail "kadmin xst $instance $name" +- catch "expect_after" +- return 0 +- } +- eof { +- fail "kadmin xst $instance $name" +- catch "expect_after" +- return 0 +- } +- } +- expect -re "assword\[^\r\n\]*: *" { +- send "adminpass$KEY\r" +- } +- expect_after +- expect eof +- set k_stat [wait -i $spawn_id] +- verbose "wait -i $spawn_id returned $k_stat (kadmin xst)" +- catch "close -i $spawn_id" +- catch "exec rm -f $instance-new-keytab" +- pass "kadmin xst $instance $name" +- return 1 +-} +- +-#++ +-# kadmin_delete - Test delete principal function of kadmin. +-# +-# Deletes principal $pname. Returns 1 on success. +-#-- +-proc kadmin_delete { pname } { +- global REALMNAME +- global KADMIN +- global KADMIN_LOCAL +- global KEY +- global spawn_id +- global tmppwd +- +- set good 0 +- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "delprinc -force $pname" +- expect_after { +- "Cannot contact any KDC" { +- fail "kadmin_delete $pname lost KDC" +- catch "expect_after" +- return 0 +- } +- timeout { +- fail "kadmin delprinc $pname" +- catch "expect_after" +- return 0 +- } +- eof { +- fail "kadmin delprinc $pname" +- catch "expect_after" +- return 0 +- } +- } +- expect -re "assword\[^\r\n\]*: *" { +- send "adminpass$KEY\r" +- } +- expect "Principal \"$pname@$REALMNAME\" deleted." { set good 1 } +- expect_after +- expect eof +- set k_stat [wait -i $spawn_id] +- verbose "wait -i $spawn_id returned $k_stat (kadmin delprinc)" +- catch "close -i $spawn_id" +- if { $good == 1 } { +- # +- # use kadmin.local to verify that the old principal is not present. +- # +- envstack_push +- setup_kerberos_env kdc +- spawn $KADMIN_LOCAL -r $REALMNAME +- envstack_pop +- expect_after { +- -i $spawn_id +- timeout { +- fail "kadmin delprinc $pname" +- catch "expect_after" +- return 0 +- } +- eof { +- fail "kadmin delprinc $pname" +- catch "expect_after" +- return 0 +- } +- } +- set good 0 +- expect "kadmin.local: " { send "getprinc $pname\r" } +- expect "Principal does not exist while retrieving \"$pname@$REALMNAME\"." { set good 1 } +- expect "kadmin.local: " { send "quit\r" } +- expect_after +- expect eof +- set k_stat [wait -i $spawn_id] +- verbose "wait -i $spawn_id returned $k_stat (kadmin.local show)" +- catch "close -i $spawn_id" +- if { $good == 1 } { +- pass "kadmin delprinc $pname" +- return 1 +- } +- else { +- fail "kadmin delprinc $pname" +- return 0 +- } +- } +- else { +- fail "kadmin delprinc $pname" +- return 0 +- } +-} +- +-#++ +-# kadmin_delete - Test delete principal function of kadmin. +-# +-# Deletes principal $pname. Returns 1 on success. +-#-- +-proc kadmin_delete_locked_down { pname } { +- global REALMNAME +- global KADMIN +- global KADMIN_LOCAL +- global KEY +- global spawn_id +- global tmppwd +- +- # +- # First test that we fail, then unlock and retry +- # +- +- set good 0 +- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "delprinc -force $pname" +- expect_after { +- "Cannot contact any KDC" { +- fail "kadmin_delete $pname lost KDC" +- catch "expect_after" +- return 0 +- } +- timeout { +- fail "kadmin delprinc $pname" +- catch "expect_after" +- return 0 +- } +- eof { +- fail "kadmin delprinc $pname" +- catch "expect_after" +- return 0 +- } +- } +- expect -re "assword\[^\r\n\]*: *" { +- send "adminpass$KEY\r" +- } +- expect "delete_principal: Operation requires ``delete'' privilege while deleting principal \"$pname@$REALMNAME\"" { set good 1 } +- expect_after +- expect eof +- set k_stat [wait -i $spawn_id] +- verbose "wait -i $spawn_id returned $k_stat (kadmin delprinc)" +- catch "close -i $spawn_id" +- if { $good == 1 } { +- # +- # use kadmin.local to remove lockdown. +- # +- envstack_push +- setup_kerberos_env kdc +- spawn $KADMIN_LOCAL -r $REALMNAME +- envstack_pop +- expect_after { +- -i $spawn_id +- timeout { +- fail "kadmin delprinc $pname" +- catch "expect_after" +- return 0 +- } +- eof { +- fail "kadmin delprinc $pname" +- catch "expect_after" +- return 0 +- } +- } +- set good 0 +- expect "kadmin.local: " { send "modprinc -lockdown_keys $pname\r" } +- expect "Principal \"$pname@$REALMNAME\" modified." { set good 1 } +- expect "kadmin.local: " { send "quit\r" } +- expect_after +- expect eof +- set k_stat [wait -i $spawn_id] +- verbose "wait -i $spawn_id returned $k_stat (kadmin.local show)" +- catch "close -i $spawn_id" +- if { $good == 1 } { +- set good 0 +- if {[kadmin_delete $pname]} { set good 1 } +- } +- if { $good == 1 } { +- pass "kadmin delprinc $pname" +- return 1 +- } +- else { +- fail "kadmin delprinc $pname" +- return 0 +- } +- } +- else { +- fail "kadmin delprinc $pname" +- return 0 +- } +-} +- +-#++ +-# kpasswd_cpw - Test password changing using kpasswd. +-# +-# Change $princ's password from $opw to $npw. Returns 1 on success. +-#-- +-proc kpasswd_cpw { princ opw npw } { +- global KPASSWD +- global REALMNAME +- +- spawn $KPASSWD $princ +- expect_after { +- timeout { +- fail "kpasswd $princ $npw" +-# catch "expect_after" +- return 0 +- } +- eof { +- fail "kpasswd $princ $npw" +-# catch "expect_after" +- return 0 +- } +- } +- +-# expect "Changing password for $princ." +-# expect "Old password:" { send "$opw\r" } +-# expect "New password:" { send "$npw\r" } +-# expect "New password (again):" { send "$npw\r" } +- expect "Password for $princ@$REALMNAME:" { send "$opw\r" } +- expect "Enter new password:" { send "$npw\r" } +- expect "Enter it again:" { send "$npw\r" } +-# expect "Kerberos password changed." +- expect "Password changed." +- expect_after +- expect eof +- +- if ![check_exit_status "kpasswd"] { +- fail "kpasswd $princ $npw" +- return 0 +- } +- pass "kpasswd $princ $npw" +- return 1 +-} +- +-#++ +-# kadmin_addpol - Test add new policy function of kadmin. +-# +-# Adds policy $pname. Returns 1 on success. +-#-- +-proc kadmin_addpol { pname } { +- global REALMNAME +- global KADMIN +- global KADMIN_LOCAL +- global KEY +- global spawn_id +- global tmppwd +- +- set good 0 +- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "addpol $pname" +- expect_after { +- "Cannot contact any KDC" { +- fail "kadmin addpol $pname lost KDC" +- catch "expect_after" +- return 0 +- } +- timeout { +- fail "kadmin addpol $pname" +- catch "expect_after" +- return 0 +- } +- eof { +- fail "kadmin addpol $pname" +- catch "expect_after" +- return 0 +- } +- } +- expect -re "assword\[^\r\n\]*: *" { +- send "adminpass$KEY\r" +- } +- expect_after +- expect eof +- set k_stat [wait -i $spawn_id] +- verbose "wait -i $spawn_id returned $k_stat (kadmin addpol)" +- catch "close -i $spawn_id" +- # +- # use kadmin.local to verify that a policy was created +- # +- envstack_push +- setup_kerberos_env kdc +- spawn $KADMIN_LOCAL -r $REALMNAME +- envstack_pop +- expect_after { +- -i $spawn_id +- timeout { +- fail "kadmin addpol $pname" +- catch "expect_after" +- return 0 +- } +- eof { +- fail "kadmin addpol $pname" +- catch "expect_after" +- return 0 +- } +- } +- set good 0 +- expect "kadmin.local: " { send "getpol $pname\r" } +- expect "Policy: $pname" { set good 1 } +- expect "Maximum password life:" { verbose "got max pw life" } +- expect "Minimum password life:" { verbose "got min pw life" } +- expect "Minimum password length:" { verbose "got min pw length" } +- expect "Minimum number of password character classes:" { +- verbose "got min pw character classes" } +- expect "Number of old keys kept:" { verbose "got num old keys kept" } +- expect "kadmin.local: " { send "q\r" } +- +- expect_after +- expect eof +- set k_stat [wait -i $spawn_id] +- verbose "wait -i $spawn_id returned $k_stat (kadmin.local showpol)" +- catch "close -i $spawn_id" +- if { $good == 1 } { +- pass "kadmin addpol $pname" +- return 1 +- } +- else { +- fail "kadmin addpol $pname" +- return 0 +- } +-} +- +-#++ +-# kadmin_delpol - Test delete policy function of kadmin. +-# +-# Deletes policy $pname. Returns 1 on success. +-#-- +-proc kadmin_delpol { pname } { +- global REALMNAME +- global KADMIN +- global KADMIN_LOCAL +- global KEY +- global spawn_id +- global tmppwd +- +- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "delpol -force $pname" +- expect_after { +- "Cannot contact any KDC" { +- fail "kadmin_delpol $pname lost KDC" +- catch "expect_after" +- return 0 +- } +- timeout { +- fail "kadmin delpol $pname" +- catch "expect_after" +- return 0 +- } +- eof { +- fail "kadmin delpol $pname" +- catch "expect_after" +- return 0 +- } +- } +- expect -re "assword\[^\r\n\]*: *" { +- send "adminpass$KEY\r" +- } +- expect_after +- expect eof +- set k_stat [wait -i $spawn_id] +- verbose "wait -i $spawn_id returned $k_stat (kadmin delpol)" +- catch "close -i $spawn_id" +- # +- # use kadmin.local to verify that the old policy is not present. +- # +- envstack_push +- setup_kerberos_env kdc +- spawn $KADMIN_LOCAL -r $REALMNAME +- envstack_pop +- expect_after { +- -i $spawn_id +- timeout { +- fail "kadmin delpol $pname" +- catch "expect_after" +- return 0 +- } +- eof { +- fail "kadmin delpol $pname" +- catch "expect_after" +- return 0 +- } +- } +- set good 0 +- expect "kadmin.local: " { send "getpol $pname\r" } +- expect "Policy does not exist while retrieving policy \"$pname\"." { +- set good 1 +- } +- expect "kadmin.local: " { send "quit\r" } +- expect_after +- expect eof +- set k_stat [wait -i $spawn_id] +- verbose "wait -i $spawn_id returned $k_stat (kadmin.local showpol)" +- catch "close -i $spawn_id" +- if { $good == 1 } { +- pass "kadmin delpol $pname" +- return 1 +- } +- else { +- fail "kadmin delpol $pname" +- return 0 +- } +-} +- +-#++ +-# kadmin_listpols - Test list policy database function of kadmin. +-# +-# Lists the policies. Returns 1 on success. +-#-- +-proc kadmin_listpols { } { +- global REALMNAME +- global KADMIN +- global KEY +- global spawn_id +- +- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "get_policies *" +- expect_after { +- "Cannot contact any KDC" { +- fail "kadmin lpols lost KDC" +- catch "expect_after" +- return 0 +- } +- timeout { +- fail "kadmin lpols" +- catch "expect_after" +- return 0 +- } +- eof { +- fail "kadmin lpols" +- catch "expect_after" +- return 0 +- } +- } +- expect -re "assword\[^\r\n\]*: *" { +- send "adminpass$KEY\r" +- } +- expect_after +- expect eof +- set k_stat [wait -i $spawn_id] +- verbose "wait -i $spawn_id returned $k_stat (kadmin listpols)" +- catch "close -i $spawn_id" +- pass "kadmin lpols" +- return 1 +-} +- +-#++ +-# kadmin_modpol - Test modify policy function of kadmin. +-# +-# Modifies policy $pname with flags $flags. Returns 1 on success. +-#-- +-proc kadmin_modpol { pname flags } { +- global REALMNAME +- global KADMIN +- global KEY +- global spawn_id +- +- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "modpol $flags $pname" +- expect_after { +- "Cannot contact any KDC" { +- fail "kadmin modpol $pname ($flags) lost KDC" +- catch "expect_after" +- return 0 +- } +- timeout { +- fail "kadmin modpol $pname" +- catch "expect_after" +- return 0 +- } +- eof { +- fail "kadmin modpol $pname" +- catch "expect_after" +- return 0 +- } +- } +- expect -re "assword\[^\r\n\]*: *" +- send "adminpass$KEY\r" +- # When in doubt, jam one of these in there. +- expect "\r" +- # Sadly, kadmin doesn't print a confirmation message for policy operations. +- expect_after +- expect eof +- set k_stat [wait -i $spawn_id] +- verbose "wait -i $spawn_id returned $k_stat (kadmin modpol)" +- catch "close -i $spawn_id" +- pass "kadmin modpol $pname" +- return 1 +-} +- +-#++ +-# kadmin_showpol - Test show policy function of kadmin. +-# +-# Retrieves entry for $pname. Returns 1 on success. +-#-- +-proc kadmin_showpol { pname } { +- global REALMNAME +- global KADMIN +- global KEY +- global spawn_id +- +- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "get_policy $pname" +- expect_after { +- "Cannot contact any KDC" { +- fail "kadmin showpol $pname lost KDC" +- catch "expect_after" +- return 0 +- } +- timeout { +- fail "kadmin showpol $pname" +- catch "expect_after" +- return 0 +- } +- eof { +- fail "kadmin showpol $pname" +- catch "expect_after" +- return 0 +- } +- } +- expect -re "assword\[^\r\n\]*: *" +- send "adminpass$KEY\r" +- expect -re "\r.*Policy: $pname.*Number of old keys kept: .*\r" +- expect_after +- expect eof +- set k_stat [wait -i $spawn_id] +- verbose "wait -i $spawn_id returned $k_stat (kadmin showpol)" +- catch "close -i $spawn_id" +- pass "kadmin showpol $pname" +- return 1 +-} +- +-#++ +-# kdestroy +-#-- +-proc kdestroy { } { +- global KDESTROY +- +- spawn $KDESTROY -5 +- if ![check_exit_status "kdestroy"] { +- return 0 +- } +- return 1 +-} +- +-# Wrap the tests in a procedure, so that we can kill the daemons if +-# we get some sort of error. +- +-proc kadmin_test { } { +- global hostname +- +- # Start up the kerberos and kadmind daemons +- if {![start_kerberos_daemons 0] } { +- return +- } +- +- # Test basic kadmin functions. +- if {![kadmin_add v5principal/instance1 v5principal] \ +- || ![kadmin_addpol standardpol] \ +- || ![kadmin_showpol standardpol] \ +- || ![kadmin_listpols] \ +- || ![kadmin_modpol standardpol "-minlength 5"] \ +- || ![kadmin_add v4principal/instance2 v4principal] \ +- || ![kadmin_add_rnd v5random] \ +- || ![kadmin_show v5principal/instance1] \ +- || ![kadmin_show v4principal/instance2] \ +- || ![kadmin_show v5random] \ +- || ![kadmin_cpw v5principal/instance1 faroutman] \ +- || ![kadmin_cpw v4principal/instance2 honkydory] \ +- || ![kadmin_cpw_rnd v5random] \ +- || ![kadmin_modify v5random -allow_tix] \ +- || ![kadmin_modify v5random +allow_tix] \ +- || ![kadmin_modify v5random "-policy standardpol"] \ +- || ![kadmin_list] \ +- || ![kadmin_extract instance1 v5principal] \ +- || ![kadmin_delete v5random] \ +- || ![kadmin_delete v4principal/instance2] \ +- || ![kadmin_delete v5principal/instance1] \ +- || ![kadmin_delpol standardpol]} { +- return +- } +- +-# You cannot extract a v4 key... +-# || ![kadmin_extractv4 instance2 v4principal] \ +- +- # now test kpasswd +- if {![kadmin_add testprinc/instance thisisatest] \ +- || ![kpasswd_cpw testprinc/instance thisisatest anothertest] \ +- || ![kpasswd_cpw testprinc/instance anothertest goredsox] \ +- || ![kadmin_delete testprinc/instance]} { +- return +- } +- +- # now test that we can kinit with principals/passwords. +- # We defer kdestroying until after kpasswd at least once to test FAST automatic use in kpasswd +- if {![kadmin_add testprinc1/instance thisisatest] \ +- || ![kinit testprinc1/instance thisisatest 0] \ +- || ![kpasswd_cpw testprinc1/instance thisisatest anothertest] \ +- || ![kdestroy] \ +- || ![kinit testprinc1/instance anothertest 0] \ +- || ![kdestroy] \ +- || ![kpasswd_cpw testprinc1/instance anothertest goredsox] \ +- || ![kinit testprinc1/instance goredsox 0] \ +- || ![kdestroy] \ +- || ![kadmin_cpw testprinc1/instance betterwork] \ +- || ![kinit testprinc1/instance betterwork 0] \ +- || ![kdestroy] \ +- || ![kadmin_delete testprinc1/instance]} { +- return +- } +- +- # now test modify changes. +- if {![kadmin_add testuser longtestpw] \ +- || ![kinit testuser longtestpw 0] \ +- || ![kdestroy] \ +- || ![kadmin_modify testuser "-maxlife \"2500 seconds\""] \ +- || ![kinit testuser longtestpw 0] \ +- || ![kdestroy] \ +- || ![kadmin_delete testuser]} { +- return +- } +- +- # now test that reducing the history number doesn't make kadmind vulnerable. +- if {![kadmin_addpol crashpol] \ +- || ![kadmin_modpol crashpol "-history 5"] \ +- || ![kadmin_add crash first] \ +- || ![kadmin_modify crash "-policy crashpol"] \ +- || ![kadmin_cpw crash second] \ +- || ![kadmin_cpw crash third] \ +- || ![kadmin_cpw crash fourth] \ +- || ![kadmin_modpol crashpol "-history 3"] \ +- || ![kadmin_cpw crash fifth] \ +- || ![kadmin_delete crash] \ +- || ![kadmin_delpol crashpol]} { +- return +- } +- +- # test retrieval of large number of principals +- # bug [2877] +- for { set i 0 } { $i < 200 } { incr i } { +- if { ![kadmin_add "foo$i" foopass] } { +- return +- } +- } +- +- if { ![kadmin_list] } { +- return +- } +- +- # test fallback to kadmin/hostname +- if {![kadmin_add_rnd kadmin/$hostname] \ +- || ![kadmin_delete_locked_down kadmin/admin] \ +- || ![kadmin_list] \ +- || ![kadmin_add_rnd kadmin/admin -allow_tgs_req] \ +- || ![kadmin_list]} { +- return +- } +- +- verbose "kadmin_test succeeded" +-} +- +-run_once kadmin { +- # Set up the kerberos database. +- if {![get_hostname] \ +- || ![setup_kerberos_files] \ +- || ![setup_kerberos_env] \ +- || ![setup_kerberos_db 0]} { +- return +- } +- +- # Run the test. +- set status [catch kadmin_test msg] +- +- # Shut down the kerberos daemons and the rsh daemon. +- stop_kerberos_daemons +- +- if { $status != 0 } { +- send_error "ERROR: error in kadmin.exp\n" +- send_error "$msg\n" +- exit 1 +- } +-} +diff --git a/src/tests/dejagnu/krb-standalone/pwchange.exp b/src/tests/dejagnu/krb-standalone/pwchange.exp +deleted file mode 100644 +index 010e8344a..000000000 +--- a/src/tests/dejagnu/krb-standalone/pwchange.exp ++++ /dev/null +@@ -1,145 +0,0 @@ +-# Password-changing Kerberos test. +-# This is a DejaGnu test script. +- +-# We are about to start up a couple of daemon processes. We do all +-# the rest of the tests inside a proc, so that we can easily kill the +-# processes when the procedure ends. +- +-proc kinit_expecting_pwchange { name pass newpass } { +- global REALMNAME +- global KINIT +- global spawn_id +- +- # Use kinit to get a ticket. +- # +- # For now always get forwardable tickets. Later when we need to make +- # tests that distinguish between forwardable tickets and otherwise +- # we should but another option to this proc. --proven +- # +- spawn $KINIT -5 -f $name@$REALMNAME +- expect { +- "Password for $name@$REALMNAME:" { +- verbose "kinit started" +- } +- timeout { +- fail "kinit" +- return 0 +- } +- eof { +- fail "kinit" +- return 0 +- } +- } +- send "$pass\r" +- expect { +- "Enter new password: " { } +- timeout { +- fail "kinit (new password prompt)" +- return 0 +- } +- eof { +- fail "kinit (new password prompt)" +- return 0 +- } +- } +- send "$newpass\r" +- expect { +- " again: " { } +- timeout { +- fail "kinit (new password prompt2)" +- return 0 +- } +- eof { +- fail "kinit (new password prompt2)" +- return 0 +- } +- } +- send "$newpass\r" +- expect eof +- if ![check_exit_status kinit] { +- return 0 +- } +- +- return 1 +-} +- +-proc doit { } { +- global REALMNAME +- global KLIST +- global KDESTROY +- global KEY +- global KADMIN_LOCAL +- global KTUTIL +- global hostname +- global tmppwd +- global spawn_id +- global supported_enctypes +- global KRBIV +- global portbase +- global mode +- +- # Start up the kerberos and kadmind daemons. +- if ![start_kerberos_daemons 0] { +- return +- } +- +- # Use kadmin to add a key. +- if ![add_kerberos_key pwchanger 0] { +- return +- } +- +- setup_kerberos_env kdc +- spawn $KADMIN_LOCAL -q "modprinc +needchange pwchanger" +- catch expect_after +- expect { +- timeout { +- fail "kadmin.local modprinc +needchange" +- } +- eof { +- pass "kadmin.local modprinc +needchange" +- } +- } +- set k_stat [wait -i $spawn_id] +- verbose "wait -i $spawn_id returned $k_stat (kadmin modprinc +needchange)" +- catch "close -i $spawn_id" +- +- setup_kerberos_env client +- if ![kinit_expecting_pwchange pwchanger pwchanger$KEY floople] { +- return +- } +- pass "kinit (password change)" +- if ![kinit pwchanger floople 0] { +- return +- } +- pass "kinit (new password)" +- +- # Destroy the ticket. +- spawn $KDESTROY -5 +- if ![check_exit_status "kdestroy"] { +- return +- } +- pass "kdestroy" +-} +- +-run_once pwchange { +- # Set up the Kerberos files and environment. +- if {![get_hostname] || ![setup_kerberos_files] || ![setup_kerberos_env]} { +- return +- } +- +- # Initialize the Kerberos database. The argument tells +- # setup_kerberos_db that it is being called from here. +- if ![setup_kerberos_db 0] { +- return +- } +- +- set status [catch doit msg] +- +- stop_kerberos_daemons +- +- if { $status != 0 } { +- send_error "ERROR: error in pwchange.exp\n" +- send_error "$msg\n" +- exit 1 +- } +-} +diff --git a/src/tests/dejagnu/krb-standalone/pwhist.exp b/src/tests/dejagnu/krb-standalone/pwhist.exp +deleted file mode 100644 +index ed7a3771a..000000000 +--- a/src/tests/dejagnu/krb-standalone/pwhist.exp ++++ /dev/null +@@ -1,217 +0,0 @@ +-# password history tests +- +-# one *non-interactive* kadmin.local request +-proc onerq { rq pname str {flags ""} } { +- global REALMNAME +- global KADMIN_LOCAL +- +- spawn $KADMIN_LOCAL -r $REALMNAME -q "$rq $flags $pname" +- expect_after { +- timeout { +- verbose "kadmin.local $rq $flags $pname timed out" +- catch expect_after +- kill [exp_pid] +- close +- expect eof +- wait +- return 0 +- } eof { +- verbose "kadmin.local $rq $flags $pname got EOF" +- catch expect_after +- wait +- return 0 +- } +- } +- expect $str +- expect_after +- expect eof +- wait +- return 1 +-} +- +-proc addprinc { pname pw } { +- global REALMNAME +- +- return [onerq addprinc $pname \ +- "Principal \"$pname@$REALMNAME\" created." "-pw $pw"] +-} +- +-proc delprinc { pname } { +- global REALMNAME +- return [onerq delprinc $pname \ +- "Principal \"$pname@$REALMNAME\" deleted." "-force"] +-} +- +-proc cpw { pname pw } { +- global REALMNAME +- +- return [onerq cpw $pname \ +- "Password for \"$pname@$REALMNAME\" changed." "-pw $pw"] +-} +- +-proc modprinc { pname flags } { +- global REALMNAME +- +- return [onerq modprinc $pname \ +- "Principal \"$pname@$REALMNAME\" modified." $flags] +-} +- +-proc addpol { pname } { +- if ![onerq addpol $pname ""] { +- return 0 +- } +- return [onerq getpol $pname "Policy: $pname"] +-} +- +-proc delpol { pname } { +- onerq delpol $pname "" -force +- return [onerq getpol $pname \ +- "Policy does not exist while retrieving policy \"$pname\"."] +-} +- +-proc modpol { pname flags } { +- return [onerq modpol $pname "" $flags] +-} +- +-# Mandatory command must return true. +-# Issues a break in its parent on failure. +-proc mustrun { cmd } { +- if ![eval $cmd] { +- perror "mandatory command failed: $cmd" +- uplevel break +- } +-} +- +-# Fail test if command fails. +-# Issues a break in its parent on failure. +-proc chkpass { cmd } { +- upvar test test +- if ![eval $cmd] { +- verbose "unexpected failure: $cmd" +- fail $test +- uplevel break +- } +-} +- +-# Fail test if command succeeds. +-# Issues a break in its parent on failure. +-proc chkfail { cmd } { +- upvar test test +- if [eval $cmd] { +- verbose "unexpected success: $cmd" +- fail $test +- uplevel break +- } +-} +- +-# wrapper to run command (actually usually sequence of commands) +-# +-# If any part of CMD throws an exception, set failall, otherwise pass. +-# If failall is already true, report unresolved. +-proc wraptest { test cmd } { +- upvar failall failall +- if $failall { +- unresolved $test +- return +- } +- if [catch $cmd] { +- set failall 1 +- } else { +- pass $test +- } +-} +- +-run_once pwhist { +- # Set up the kerberos database. +- if {![get_hostname] \ +- || ![setup_kerberos_files] \ +- || ![setup_kerberos_env kdc] \ +- || ![setup_kerberos_db 0]} { +- return +- } +- +- set failall 0 +- wraptest "nkeys=1, nhist=3" { +- mustrun { addpol crashpol } +- mustrun { modpol crashpol "-history 3"} +- mustrun { addprinc crash 1111 } +- mustrun { modprinc crash "-policy crashpol" } +- chkpass { cpw crash 2222 } +- chkfail { cpw crash 2222 } +- chkfail { cpw crash 1111 } +- } +- verbose {old_keys [ 1111 ->[] ]} +- +- # The following will result in reading/writing past array bounds if +- # add_to_history() is not patched. +- # +- # NOTE: A pass from this test does not mean the bug isn't present; +- # check with Purify, valgrind, etc. +- wraptest "array bounds ok on nkeys=1, nhist 3->2" { +- mustrun { modpol crashpol "-history 2" } +- chkpass { cpw crash 3333 } +- } +- verbose {old_keys [ ->2222 ]} +- +- wraptest "verify nhist=2" { +- mustrun { delprinc crash } +- mustrun { addprinc crash 1111 } +- mustrun { modprinc crash "-policy crashpol" } +- chkpass { cpw crash 2222 } +- chkfail { cpw crash 2222 } +- chkfail { cpw crash 1111 } +- } +- verbose {old_keys [ ->1111 ]} +- +- # The following will fail if growing the history array causes an extra +- # key to be lost due to failure to shift entries. +- wraptest "grow nhist 2->3" { +- mustrun { modpol crashpol "-history 3" } +- chkpass { cpw crash 3333 } +- chkfail { cpw crash 3333 } +- chkfail { cpw crash 2222 } +- chkfail { cpw crash 1111 } +- } +- verbose {old_keys [ 2222 ->1111 ]} +- +- wraptest "grow nhist 3->4" { +- mustrun { modpol crashpol "-history 4" } +- chkfail { cpw crash 3333 } +- chkfail { cpw crash 2222 } +- chkfail { cpw crash 1111 } +- chkpass { cpw crash 4444 } +- chkfail { cpw crash 3333 } +- chkfail { cpw crash 2222 } +- chkfail { cpw crash 1111 } +- } +- verbose {old_keys [ 2222 3333 ->1111 ]} +- wraptest "shrink nhist 4->3" { +- mustrun { modpol crashpol "-history 3" } +- chkfail { cpw crash 4444 } +- chkfail { cpw crash 3333 } +- chkfail { cpw crash 2222 } +- chkfail { cpw crash 1111 } +- chkpass { cpw crash 5555 } +- } +- verbose {old_keys [ 4444 ->3333 ]} +- wraptest "verify nhist=3" { +- chkfail { cpw crash 5555 } +- chkfail { cpw crash 4444 } +- chkfail { cpw crash 3333 } +- chkpass { cpw crash 2222 } +- } +- verbose {old_keys [ ->4444 5555 ]} +- wraptest "shrink nhist 3->2" { +- mustrun { modpol crashpol "-history 2" } +- chkfail { cpw crash 2222 } +- chkfail { cpw crash 5555 } +- chkfail { cpw crash 4444 } +- chkpass { cpw crash 3333 } +- } +- verbose {old_keys [ ->2222 ]} +- +- delprinc crash +- delpol crashpol +- +- stop_kerberos_daemons +-} +diff --git a/src/tests/t_changepw.py b/src/tests/t_changepw.py +index 573bdbd49..bf8e3a9eb 100755 +--- a/src/tests/t_changepw.py ++++ b/src/tests/t_changepw.py +@@ -1,23 +1,24 @@ + from k5test import * + +-# This file is intended to cover any password-changing mechanism. For +-# now it only contains a regression test for #7868. +- + realm = K5Realm(create_host=False, get_creds=False, start_kadmind=True) ++realm.prep_kadmin() + + # Mark a principal as expired and change its password through kinit. ++mark('password change via kinit') + realm.run([kadminl, 'modprinc', '-pwexpire', '1 day ago', 'user']) + pwinput = password('user') + '\nabcd\nabcd\n' + realm.run([kinit, realm.user_princ], input=pwinput) + +-# Do the same thing with FAST, with tracing turned on. +-realm.run([kadminl, 'modprinc', '-pwexpire', '1 day ago', 'user']) ++# Regression test for #7868 (preauth options ignored when ++# krb5_get_init_creds_password() initiates a password change). This ++# time use the REQUIRES_PWCHANGE bit instead of the password ++# expiration time. ++mark('password change via kinit with FAST') ++realm.run([kadminl, 'modprinc', '+needchange', 'user']) + pwinput = 'abcd\nefgh\nefgh\n' + out, trace = realm.run([kinit, '-T', realm.ccache, realm.user_princ], + input=pwinput, return_trace=True) +- +-# Read the trace and check that FAST was used when getting the +-# kadmin/changepw ticket. ++# Check that FAST was used when getting the kadmin/changepw ticket. + getting_changepw = fast_used_for_changepw = False + for line in trace.splitlines(): + if 'Getting initial credentials for user@' in line: +@@ -29,4 +30,21 @@ for line in trace.splitlines(): + if not fast_used_for_changepw: + fail('FAST was not used to get kadmin/changepw ticket') + ++# Test that passwords specified via kadmin and kpasswd are usable with ++# kinit. ++mark('password change usability by kinit') ++realm.run([kadminl, 'addprinc', '-pw', 'pw1', 'testprinc']) ++# Run kpasswd with an active cache to exercise automatic FAST use. ++realm.kinit('testprinc', 'pw1') ++realm.run([kpasswd, 'testprinc'], input='pw1\npw2\npw2\n') ++realm.kinit('testprinc', 'pw2') ++realm.run([kdestroy]) ++realm.run([kpasswd, 'testprinc'], input='pw2\npw3\npw3\n') ++realm.kinit('testprinc', 'pw3') ++realm.run([kdestroy]) ++realm.run_kadmin(['cpw', '-pw', 'pw4', 'testprinc']) ++realm.kinit('testprinc', 'pw4') ++realm.run([kdestroy]) ++realm.run([kadminl, 'delprinc', 'testprinc']) ++ + success('Password change tests') +diff --git a/src/tests/t_kadmin.py b/src/tests/t_kadmin.py +new file mode 100644 +index 000000000..fe6a3cc2e +--- /dev/null ++++ b/src/tests/t_kadmin.py +@@ -0,0 +1,54 @@ ++from k5test import * ++ ++realm = K5Realm(start_kadmind=True) ++ ++# Create a principal. Test -q option and keyboard entry of the admin ++# password and principal password. Verify creation with kadmin.local. ++realm.run([kadmin, '-q', 'addprinc princ/pw'], ++ input=password('admin') + '\npw1\npw1\n') ++realm.run([kadminl, 'getprinc', 'princ/pw'], ++ expected_msg='Principal: princ/pw@KRBTEST.COM') ++ ++# Run the remaining tests with a cache for efficiency. ++realm.prep_kadmin() ++ ++realm.run_kadmin(['addpol', 'standardpol']) ++realm.run_kadmin(['listpols'], expected_msg='standardpol') ++realm.run_kadmin(['modpol', '-minlength', '5', 'standardpol']) ++realm.run_kadmin(['getpol', 'standardpol'], ++ expected_msg='Minimum password length: 5') ++ ++realm.run_kadmin(['addprinc', '-randkey', 'princ/random']) ++realm.run([kadminl, 'getprinc', 'princ/random'], ++ expected_msg='Principal: princ/random@KRBTEST.COM') ++ ++realm.run_kadmin(['cpw', 'princ/pw'], input='newpw\nnewpw\n') ++realm.run_kadmin(['cpw', '-randkey', 'princ/random']) ++ ++realm.run_kadmin(['modprinc', '-allow_tix', 'princ/random']) ++realm.run_kadmin(['modprinc', '+allow_tix', 'princ/random']) ++realm.run_kadmin(['modprinc', '-policy', 'standardpol', 'princ/random']) ++ ++realm.run_kadmin(['listprincs'], expected_msg='princ/random@KRBTEST.COM') ++ ++realm.run_kadmin(['ktadd', 'princ/pw']) ++ ++realm.run_kadmin(['delprinc', 'princ/random']) ++realm.run([kadminl, 'getprinc', 'princ/random'], expected_code=1, ++ expected_msg='Principal does not exist') ++realm.run_kadmin(['delprinc', 'princ/pw']) ++realm.run([kadminl, 'getprinc', 'princ/pw'], expected_code=1, ++ expected_msg='Principal does not exist') ++ ++realm.run_kadmin(['delpol', 'standardpol']) ++realm.run([kadminl, 'getpol', 'standardpol'], expected_code=1, ++ expected_msg='Policy does not exist') ++ ++# Regression test for #2877 (fixed-sized GSSRPC buffers can't ++# accomodate large listprinc results). ++mark('large listprincs result') ++for i in range(200): ++ realm.run_kadmin(['addprinc', '-randkey', 'foo%d' % i]) ++realm.run_kadmin(['listprincs'], expected_msg='foo199') ++ ++success('kadmin and kpasswd tests') +diff --git a/src/tests/t_policy.py b/src/tests/t_policy.py +index 5a0c06b86..2bb4f5f18 100755 +--- a/src/tests/t_policy.py ++++ b/src/tests/t_policy.py +@@ -25,6 +25,68 @@ realm.run([kadminl, 'cpw', '-pw', 'l0ngenough', 'pwuser'], expected_code=1, + realm.run([kadminl, 'cpw', '-pw', '3rdpassword', 'pwuser']) + realm.run([kadminl, 'cpw', '-pw', 'l0ngenough', 'pwuser']) + ++# Regression test for #929 (kadmind crash with more historical ++# passwords in a principal entry than current policy history setting). ++mark('password history (policy value reduced below current array size)') ++realm.run([kadminl, 'addpol', '-history', '5', 'histpol']) ++realm.addprinc('histprinc', 'first') ++realm.run([kadminl, 'modprinc', '-policy', 'histpol', 'histprinc']) ++realm.run([kadminl, 'cpw', '-pw', 'second', 'histprinc']) ++realm.run([kadminl, 'cpw', '-pw', 'third', 'histprinc']) ++realm.run([kadminl, 'cpw', '-pw', 'fourth', 'histprinc']) ++realm.run([kadminl, 'modpol', '-history', '3', 'histpol']) ++realm.run([kadminl, 'cpw', '-pw', 'fifth', 'histprinc']) ++realm.run([kadminl, 'delprinc', 'histprinc']) ++ ++# Regression test for #2841 (heap buffer overflow when policy history ++# value is reduced to match the number of historical passwords for a ++# principal). ++mark('password history (policy value reduced to current array size)') ++def histfail(*pwlist): ++ for pw in pwlist: ++ realm.run([kadminl, 'cpw', '-pw', pw, 'histprinc'], expected_code=1, ++ expected_msg='Cannot reuse password') ++realm.run([kadminl, 'modpol', '-history', '3', 'histpol']) ++realm.addprinc('histprinc', '1111') ++realm.run([kadminl, 'modprinc', '-policy', 'histpol', 'histprinc']) ++realm.run([kadminl, 'cpw', '-pw', '2222', 'histprinc']) ++histfail('2222', '1111') ++realm.run([kadminl, 'modpol', '-history', '2', 'histpol']) ++realm.run([kadminl, 'cpw', '-pw', '3333', 'histprinc']) ++ ++# Test that the history array is properly resized if the policy ++# history value is increased after the array is filled. ++mark('password history (policy value increase)') ++realm.run([kadminl, 'delprinc', 'histprinc']) ++realm.addprinc('histprinc', '1111') ++realm.run([kadminl, 'modprinc', '-policy', 'histpol', 'histprinc']) ++realm.run([kadminl, 'cpw', '-pw', '2222', 'histprinc']) ++histfail('2222', '1111') ++realm.run([kadminl, 'cpw', '-pw', '2222', 'histprinc'], expected_code=1, ++ expected_msg='Cannot reuse password') ++realm.run([kadminl, 'cpw', '-pw', '1111', 'histprinc'], expected_code=1, ++ expected_msg='Cannot reuse password') ++realm.run([kadminl, 'modpol', '-history', '3', 'histpol']) ++realm.run([kadminl, 'cpw', '-pw', '3333', 'histprinc']) ++histfail('3333', '2222', '1111') ++realm.run([kadminl, 'modpol', '-history', '4', 'histpol']) ++histfail('3333', '2222', '1111') ++realm.run([kadminl, 'cpw', '-pw', '4444', 'histprinc']) ++histfail('4444', '3333', '2222', '1111') ++ ++# Test that when the policy history value is reduced, all currently ++# known old passwords still fail until the next password change, after ++# which the new number of old passwords fails (but no more). ++mark('password history (policy value reduction)') ++realm.run([kadminl, 'modpol', '-history', '3', 'histpol']) ++histfail('4444', '3333', '2222', '1111') ++realm.run([kadminl, 'cpw', '-pw', '5555', 'histprinc']) ++histfail('5555', '3333', '3333') ++realm.run([kadminl, 'cpw', '-pw', '2222', 'histprinc']) ++realm.run([kadminl, 'modpol', '-history', '2', 'histpol']) ++histfail('2222', '5555', '4444') ++realm.run([kadminl, 'cpw', '-pw', '3333', 'histprinc']) ++ + # Test references to nonexistent policies. + mark('nonexistent policy references') + realm.run([kadminl, 'addprinc', '-randkey', '-policy', 'newpol', 'newuser']) diff --git a/krb5.spec b/krb5.spec index b59f39c..25d282e 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.1 -Release: %{?zdpd}9%{?dist} +Release: %{?zdpd}10%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -79,6 +79,10 @@ Patch13: Make-KCM-iteration-fallback-work-with-sssd-kcm.patch Patch14: Use-KCM_OP_RETRIEVE-in-KCM-client.patch Patch15: Fix-KCM-retrieval-support-for-sssd.patch Patch16: Fix-doc-build-for-Sphinx-4.0.patch +Patch17: Move-some-dejagnu-kadmin-tests-to-Python-tests.patch +Patch18: Fix-some-principal-realm-canonicalization-cases.patch +Patch19: Allow-kinit-with-keytab-to-defer-canonicalization.patch +Patch20: Fix-kadmin-k-with-fallback-or-referral-realm.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -641,6 +645,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Wed Jun 09 2021 Robbie Harwood - 1.19.1-10 +- Fix three canonicalization cases for fallback + * Wed Jun 02 2021 Robbie Harwood - 1.19.1-9 - Fix doc build for Sphinx 4.0 From 91bbbda93f828542274c82abc8288af0cfbba6fe Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Mon, 21 Jun 2021 13:16:44 -0400 Subject: [PATCH 040/103] Add the backward-compatible parts of openssl3 support --- Fix-k5tls-module-for-OpenSSL-3.patch | 57 ++ ...pkcs11-build-issues-with-openssl-3.0.patch | 551 ++++++++++++++++++ ...ecated-OpenSSL-calls-from-softpkcs11.patch | 149 +++++ krb5.spec | 8 +- 4 files changed, 764 insertions(+), 1 deletion(-) create mode 100644 Fix-k5tls-module-for-OpenSSL-3.patch create mode 100644 Fix-softpkcs11-build-issues-with-openssl-3.0.patch create mode 100644 Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch diff --git a/Fix-k5tls-module-for-OpenSSL-3.patch b/Fix-k5tls-module-for-OpenSSL-3.patch new file mode 100644 index 0000000..fd425b8 --- /dev/null +++ b/Fix-k5tls-module-for-OpenSSL-3.patch @@ -0,0 +1,57 @@ +From 201e38845e9f70234bcaa9ba7c25b28e38169b0a Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Sat, 29 May 2021 12:05:49 -0400 +Subject: [PATCH] Fix k5tls module for OpenSSL 3 + +Starting in OpenSSL 3, connection termination without a close_notify +alert causes SSL_read() to return SSL_ERROR_SSL instead of +SSL_ERROR_SYSCALL. OpenSSL 3 also provides a new option +SSL_OP_IGNORE_UNEXPECTED_EOF which allows an application to explicitly +ignore possible truncation attacks and receive SSL_ERROR_ZERO_RETURN +instead. + +Remove the call to SSL_CTX_get_options() since SSL_CTX_set_options() +doesn't clear existing options. + +[ghudson@mit.edu: edited commit message and comment] + +(cherry picked from commit aa9b4a2a64046afd2fab7cb49c346295874a5fb6) +--- + src/plugins/tls/k5tls/openssl.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/src/plugins/tls/k5tls/openssl.c b/src/plugins/tls/k5tls/openssl.c +index 76a43b3cd..99fda7ffc 100644 +--- a/src/plugins/tls/k5tls/openssl.c ++++ b/src/plugins/tls/k5tls/openssl.c +@@ -433,7 +433,7 @@ setup(krb5_context context, SOCKET fd, const char *servername, + char **anchors, k5_tls_handle *handle_out) + { + int e; +- long options; ++ long options = SSL_OP_NO_SSLv2; + SSL_CTX *ctx = NULL; + SSL *ssl = NULL; + k5_tls_handle handle = NULL; +@@ -448,8 +448,19 @@ setup(krb5_context context, SOCKET fd, const char *servername, + ctx = SSL_CTX_new(SSLv23_client_method()); + if (ctx == NULL) + goto error; +- options = SSL_CTX_get_options(ctx); +- SSL_CTX_set_options(ctx, options | SSL_OP_NO_SSLv2); ++ ++#ifdef SSL_OP_IGNORE_UNEXPECTED_EOF ++ /* ++ * For OpenSSL 3 and later, mark close_notify alerts as optional. We don't ++ * need to worry about truncation attacks because the protocols this module ++ * is used with (Kerberos and change-password) receive a single ++ * length-delimited message from the server. For prior versions of OpenSSL ++ * we check for SSL_ERROR_SYSCALL when reading instead (this error changes ++ * to SSL_ERROR_SSL in OpenSSL 3). ++ */ ++ options |= SSL_OP_IGNORE_UNEXPECTED_EOF; ++#endif ++ SSL_CTX_set_options(ctx, options); + + SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, verify_callback); + X509_STORE_set_flags(SSL_CTX_get_cert_store(ctx), 0); diff --git a/Fix-softpkcs11-build-issues-with-openssl-3.0.patch b/Fix-softpkcs11-build-issues-with-openssl-3.0.patch new file mode 100644 index 0000000..d7a0a5c --- /dev/null +++ b/Fix-softpkcs11-build-issues-with-openssl-3.0.patch @@ -0,0 +1,551 @@ +From a86b780ef275b35e8dc1e6d1886ec8e8d941f7c4 Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Sat, 15 May 2021 17:35:25 -0400 +Subject: [PATCH] Fix softpkcs11 build issues with openssl 3.0 + +EVP_PKEY_get0_RSA() has been modified to have const return type. Remove +its usages in favor of the EVP_PKEY interface. Also remove calls to +RSA_blinding_off(), which we don't need and would require a non-const +object. Similarly, remove RSA_set_method() calls that set a pre-existing +default. + +Since softpkcs11 doesn't link against krb5 and can't use zap(), allocate +buffers with OPENSSL_malloc() so can use OPENSSL_clear_free(). + +Move several argument validation checks to the top of their functions. + +Fix some incorrect/inconsistent log messages. + +(cherry picked from commit 00de1aad7b3647b91017c7009b0bc65cd0c8b2e0) +--- + src/tests/softpkcs11/main.c | 360 ++++++++++++++---------------------- + 1 file changed, 141 insertions(+), 219 deletions(-) + +diff --git a/src/tests/softpkcs11/main.c b/src/tests/softpkcs11/main.c +index 1cccdfb43..caa537b68 100644 +--- a/src/tests/softpkcs11/main.c ++++ b/src/tests/softpkcs11/main.c +@@ -375,10 +375,9 @@ add_st_object(void) + return NULL; + soft_token.object.objs = objs; + +- o = malloc(sizeof(*o)); ++ o = calloc(1, sizeof(*o)); + if (o == NULL) + return NULL; +- memset(o, 0, sizeof(*o)); + o->attrs = NULL; + o->num_attributes = 0; + o->object_handle = soft_token.object.num_objs; +@@ -424,7 +423,7 @@ add_pubkey_info(struct st_object *o, CK_KEY_TYPE key_type, EVP_PKEY *key) + CK_ULONG modulus_bits = 0; + CK_BYTE *exponent = NULL; + size_t exponent_len = 0; +- RSA *rsa; ++ const RSA *rsa; + const BIGNUM *n, *e; + + rsa = EVP_PKEY_get0_RSA(key); +@@ -445,8 +444,6 @@ add_pubkey_info(struct st_object *o, CK_KEY_TYPE key_type, EVP_PKEY *key) + add_object_attribute(o, 0, CKA_PUBLIC_EXPONENT, + exponent, exponent_len); + +- RSA_set_method(rsa, RSA_PKCS1_OpenSSL()); +- + free(modulus); + free(exponent); + } +@@ -679,10 +676,6 @@ add_certificate(char *label, + } else { + /* XXX verify keytype */ + +- if (key_type == CKK_RSA) +- RSA_set_method(EVP_PKEY_get0_RSA(o->u.private_key.key), +- RSA_PKCS1_OpenSSL()); +- + if (X509_check_private_key(cert, o->u.private_key.key) != 1) { + EVP_PKEY_free(o->u.private_key.key); + o->u.private_key.key = NULL; +@@ -695,7 +688,7 @@ add_certificate(char *label, + } + + ret = CKR_OK; +- out: ++out: + if (ret != CKR_OK) { + st_logf("something went wrong when adding cert!\n"); + +@@ -1224,8 +1217,6 @@ C_Login(CK_SESSION_HANDLE hSession, + } + + /* XXX check keytype */ +- RSA_set_method(EVP_PKEY_get0_RSA(o->u.private_key.key), +- RSA_PKCS1_OpenSSL()); + + if (X509_check_private_key(o->u.private_key.cert, o->u.private_key.key) != 1) { + EVP_PKEY_free(o->u.private_key.key); +@@ -1495,8 +1486,9 @@ C_Encrypt(CK_SESSION_HANDLE hSession, + struct st_object *o; + void *buffer = NULL; + CK_RV ret; +- RSA *rsa; +- int padding, len, buffer_len, padding_len; ++ size_t buffer_len = 0; ++ int padding; ++ EVP_PKEY_CTX *ctx = NULL; + + st_logf("Encrypt\n"); + +@@ -1512,70 +1504,58 @@ C_Encrypt(CK_SESSION_HANDLE hSession, + return CKR_ARGUMENTS_BAD; + } + +- rsa = EVP_PKEY_get0_RSA(o->u.public_key); +- +- if (rsa == NULL) +- return CKR_ARGUMENTS_BAD; +- +- RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */ +- +- buffer_len = RSA_size(rsa); +- +- buffer = malloc(buffer_len); +- if (buffer == NULL) { +- ret = CKR_DEVICE_MEMORY; +- goto out; +- } +- +- ret = CKR_OK; +- switch(state->encrypt_mechanism->mechanism) { +- case CKM_RSA_PKCS: +- padding = RSA_PKCS1_PADDING; +- padding_len = RSA_PKCS1_PADDING_SIZE; +- break; +- case CKM_RSA_X_509: +- padding = RSA_NO_PADDING; +- padding_len = 0; +- break; +- default: +- ret = CKR_FUNCTION_NOT_SUPPORTED; +- goto out; +- } +- +- if ((CK_ULONG)buffer_len + padding_len < ulDataLen) { +- ret = CKR_ARGUMENTS_BAD; +- goto out; +- } +- + if (pulEncryptedDataLen == NULL) { + st_logf("pulEncryptedDataLen NULL\n"); + ret = CKR_ARGUMENTS_BAD; + goto out; + } + +- if (pData == NULL_PTR) { ++ if (pData == NULL) { + st_logf("data NULL\n"); + ret = CKR_ARGUMENTS_BAD; + goto out; + } + +- len = RSA_public_encrypt(ulDataLen, pData, buffer, rsa, padding); +- if (len <= 0) { ++ switch(state->encrypt_mechanism->mechanism) { ++ case CKM_RSA_PKCS: ++ padding = RSA_PKCS1_PADDING; ++ break; ++ case CKM_RSA_X_509: ++ padding = RSA_NO_PADDING; ++ break; ++ default: ++ ret = CKR_FUNCTION_NOT_SUPPORTED; ++ goto out; ++ } ++ ++ ctx = EVP_PKEY_CTX_new(o->u.public_key, NULL); ++ if (ctx == NULL || EVP_PKEY_encrypt_init(ctx) <= 0 || ++ EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 || ++ EVP_PKEY_encrypt(ctx, NULL, &buffer_len, pData, ulDataLen) <= 0) { + ret = CKR_DEVICE_ERROR; + goto out; + } +- if (len > buffer_len) +- abort(); + +- if (pEncryptedData != NULL_PTR) +- memcpy(pEncryptedData, buffer, len); +- *pulEncryptedDataLen = len; +- +- out: +- if (buffer) { +- memset(buffer, 0, buffer_len); +- free(buffer); ++ buffer = OPENSSL_malloc(buffer_len); ++ if (buffer == NULL) { ++ ret = CKR_DEVICE_MEMORY; ++ goto out; + } ++ ++ if (EVP_PKEY_encrypt(ctx, buffer, &buffer_len, pData, ulDataLen) <= 0) { ++ ret = CKR_DEVICE_ERROR; ++ goto out; ++ } ++ st_logf("Encrypt done\n"); ++ ++ if (pEncryptedData != NULL) ++ memcpy(pEncryptedData, buffer, buffer_len); ++ *pulEncryptedDataLen = buffer_len; ++ ++ ret = CKR_OK; ++out: ++ OPENSSL_clear_free(buffer, buffer_len); ++ EVP_PKEY_CTX_free(ctx); + return ret; + } + +@@ -1646,8 +1626,9 @@ C_Decrypt(CK_SESSION_HANDLE hSession, + struct st_object *o; + void *buffer = NULL; + CK_RV ret; +- RSA *rsa; +- int padding, len, buffer_len, padding_len; ++ size_t buffer_len = 0; ++ int padding; ++ EVP_PKEY_CTX *ctx = NULL; + + st_logf("Decrypt\n"); + +@@ -1663,41 +1644,6 @@ C_Decrypt(CK_SESSION_HANDLE hSession, + return CKR_ARGUMENTS_BAD; + } + +- rsa = EVP_PKEY_get0_RSA(o->u.private_key.key); +- +- if (rsa == NULL) +- return CKR_ARGUMENTS_BAD; +- +- RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */ +- +- buffer_len = RSA_size(rsa); +- +- buffer = malloc(buffer_len); +- if (buffer == NULL) { +- ret = CKR_DEVICE_MEMORY; +- goto out; +- } +- +- ret = CKR_OK; +- switch(state->decrypt_mechanism->mechanism) { +- case CKM_RSA_PKCS: +- padding = RSA_PKCS1_PADDING; +- padding_len = RSA_PKCS1_PADDING_SIZE; +- break; +- case CKM_RSA_X_509: +- padding = RSA_NO_PADDING; +- padding_len = 0; +- break; +- default: +- ret = CKR_FUNCTION_NOT_SUPPORTED; +- goto out; +- } +- +- if ((CK_ULONG)buffer_len + padding_len < ulEncryptedDataLen) { +- ret = CKR_ARGUMENTS_BAD; +- goto out; +- } +- + if (pulDataLen == NULL) { + st_logf("pulDataLen NULL\n"); + ret = CKR_ARGUMENTS_BAD; +@@ -1710,24 +1656,48 @@ C_Decrypt(CK_SESSION_HANDLE hSession, + goto out; + } + +- len = RSA_private_decrypt(ulEncryptedDataLen, pEncryptedData, buffer, +- rsa, padding); +- if (len <= 0) { ++ switch(state->decrypt_mechanism->mechanism) { ++ case CKM_RSA_PKCS: ++ padding = RSA_PKCS1_PADDING; ++ break; ++ case CKM_RSA_X_509: ++ padding = RSA_NO_PADDING; ++ break; ++ default: ++ ret = CKR_FUNCTION_NOT_SUPPORTED; ++ goto out; ++ } ++ ++ ctx = EVP_PKEY_CTX_new(o->u.private_key.key, NULL); ++ if (ctx == NULL || EVP_PKEY_decrypt_init(ctx) <= 0 || ++ EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 || ++ EVP_PKEY_decrypt(ctx, NULL, &buffer_len, pEncryptedData, ++ ulEncryptedDataLen) <= 0) { + ret = CKR_DEVICE_ERROR; + goto out; + } +- if (len > buffer_len) +- abort(); ++ ++ buffer = OPENSSL_malloc(buffer_len); ++ if (buffer == NULL) { ++ ret = CKR_DEVICE_MEMORY; ++ goto out; ++ } ++ ++ if (EVP_PKEY_decrypt(ctx, buffer, &buffer_len, pEncryptedData, ++ ulEncryptedDataLen) <= 0) { ++ ret = CKR_DEVICE_ERROR; ++ goto out; ++ } ++ st_logf("Decrypt done\n"); + + if (pData != NULL_PTR) +- memcpy(pData, buffer, len); +- *pulDataLen = len; ++ memcpy(pData, buffer, buffer_len); ++ *pulDataLen = buffer_len; + +- out: +- if (buffer) { +- memset(buffer, 0, buffer_len); +- free(buffer); +- } ++ ret = CKR_OK; ++out: ++ OPENSSL_clear_free(buffer, buffer_len); ++ EVP_PKEY_CTX_free(ctx); + return ret; + } + +@@ -1806,8 +1776,9 @@ C_Sign(CK_SESSION_HANDLE hSession, + struct st_object *o; + void *buffer = NULL; + CK_RV ret; +- RSA *rsa; +- int padding, len, buffer_len, padding_len; ++ int padding; ++ size_t buffer_len = 0; ++ EVP_PKEY_CTX *ctx = NULL; + + st_logf("Sign\n"); + VERIFY_SESSION_HANDLE(hSession, &state); +@@ -1822,40 +1793,6 @@ C_Sign(CK_SESSION_HANDLE hSession, + return CKR_ARGUMENTS_BAD; + } + +- rsa = EVP_PKEY_get0_RSA(o->u.private_key.key); +- +- if (rsa == NULL) +- return CKR_ARGUMENTS_BAD; +- +- RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */ +- +- buffer_len = RSA_size(rsa); +- +- buffer = malloc(buffer_len); +- if (buffer == NULL) { +- ret = CKR_DEVICE_MEMORY; +- goto out; +- } +- +- switch(state->sign_mechanism->mechanism) { +- case CKM_RSA_PKCS: +- padding = RSA_PKCS1_PADDING; +- padding_len = RSA_PKCS1_PADDING_SIZE; +- break; +- case CKM_RSA_X_509: +- padding = RSA_NO_PADDING; +- padding_len = 0; +- break; +- default: +- ret = CKR_FUNCTION_NOT_SUPPORTED; +- goto out; +- } +- +- if ((CK_ULONG)buffer_len < ulDataLen + padding_len) { +- ret = CKR_ARGUMENTS_BAD; +- goto out; +- } +- + if (pulSignatureLen == NULL) { + st_logf("signature len NULL\n"); + ret = CKR_ARGUMENTS_BAD; +@@ -1868,26 +1805,46 @@ C_Sign(CK_SESSION_HANDLE hSession, + goto out; + } + +- len = RSA_private_encrypt(ulDataLen, pData, buffer, rsa, padding); +- st_logf("private encrypt done\n"); +- if (len <= 0) { ++ switch(state->sign_mechanism->mechanism) { ++ case CKM_RSA_PKCS: ++ padding = RSA_PKCS1_PADDING; ++ break; ++ case CKM_RSA_X_509: ++ padding = RSA_NO_PADDING; ++ break; ++ default: ++ ret = CKR_FUNCTION_NOT_SUPPORTED; ++ goto out; ++ } ++ ++ ctx = EVP_PKEY_CTX_new(o->u.private_key.key, NULL); ++ if (ctx == NULL || EVP_PKEY_sign_init(ctx) <= 0 || ++ EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 || ++ EVP_PKEY_sign(ctx, NULL, &buffer_len, pData, ulDataLen) <= 0) { + ret = CKR_DEVICE_ERROR; + goto out; + } +- if (len > buffer_len) +- abort(); + +- if (pSignature != NULL_PTR) +- memcpy(pSignature, buffer, len); +- *pulSignatureLen = len; ++ buffer = OPENSSL_malloc(buffer_len); ++ if (buffer == NULL) { ++ ret = CKR_DEVICE_MEMORY; ++ goto out; ++ } ++ ++ if (EVP_PKEY_sign(ctx, buffer, &buffer_len, pData, ulDataLen) <= 0) { ++ ret = CKR_DEVICE_ERROR; ++ goto out; ++ } ++ st_logf("Sign done\n"); ++ ++ if (pSignature != NULL) ++ memcpy(pSignature, buffer, buffer_len); ++ *pulSignatureLen = buffer_len; + + ret = CKR_OK; +- +- out: +- if (buffer) { +- memset(buffer, 0, buffer_len); +- free(buffer); +- } ++out: ++ OPENSSL_clear_free(buffer, buffer_len); ++ EVP_PKEY_CTX_free(ctx); + return ret; + } + +@@ -1951,10 +1908,9 @@ C_Verify(CK_SESSION_HANDLE hSession, + { + struct session_state *state; + struct st_object *o; +- void *buffer = NULL; + CK_RV ret; +- RSA *rsa; +- int padding, len, buffer_len; ++ int padding; ++ EVP_PKEY_CTX *ctx = NULL; + + st_logf("Verify\n"); + VERIFY_SESSION_HANDLE(hSession, &state); +@@ -1969,39 +1925,6 @@ C_Verify(CK_SESSION_HANDLE hSession, + return CKR_ARGUMENTS_BAD; + } + +- rsa = EVP_PKEY_get0_RSA(o->u.public_key); +- +- if (rsa == NULL) +- return CKR_ARGUMENTS_BAD; +- +- RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */ +- +- buffer_len = RSA_size(rsa); +- +- buffer = malloc(buffer_len); +- if (buffer == NULL) { +- ret = CKR_DEVICE_MEMORY; +- goto out; +- } +- +- ret = CKR_OK; +- switch(state->verify_mechanism->mechanism) { +- case CKM_RSA_PKCS: +- padding = RSA_PKCS1_PADDING; +- break; +- case CKM_RSA_X_509: +- padding = RSA_NO_PADDING; +- break; +- default: +- ret = CKR_FUNCTION_NOT_SUPPORTED; +- goto out; +- } +- +- if ((CK_ULONG)buffer_len < ulDataLen) { +- ret = CKR_ARGUMENTS_BAD; +- goto out; +- } +- + if (pSignature == NULL) { + st_logf("signature NULL\n"); + ret = CKR_ARGUMENTS_BAD; +@@ -2014,34 +1937,34 @@ C_Verify(CK_SESSION_HANDLE hSession, + goto out; + } + +- len = RSA_public_decrypt(ulDataLen, pData, buffer, rsa, padding); +- st_logf("private encrypt done\n"); +- if (len <= 0) { ++ switch(state->verify_mechanism->mechanism) { ++ case CKM_RSA_PKCS: ++ padding = RSA_PKCS1_PADDING; ++ break; ++ case CKM_RSA_X_509: ++ padding = RSA_NO_PADDING; ++ break; ++ default: ++ ret = CKR_FUNCTION_NOT_SUPPORTED; ++ goto out; ++ } ++ ++ ctx = EVP_PKEY_CTX_new(o->u.public_key, NULL); ++ if (ctx == NULL || EVP_PKEY_verify_init(ctx) <= 0 || ++ EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 || ++ EVP_PKEY_verify(ctx, pSignature, ulSignatureLen, pData, ++ ulDataLen) <= 0) { + ret = CKR_DEVICE_ERROR; + goto out; + } +- if (len > buffer_len) +- abort(); ++ st_logf("Verify done\n"); + +- if ((CK_ULONG)len != ulSignatureLen) { +- ret = CKR_GENERAL_ERROR; +- goto out; +- } +- +- if (memcmp(pSignature, buffer, len) != 0) { +- ret = CKR_GENERAL_ERROR; +- goto out; +- } +- +- out: +- if (buffer) { +- memset(buffer, 0, buffer_len); +- free(buffer); +- } ++ ret = CKR_OK; ++out: ++ EVP_PKEY_CTX_free(ctx); + return ret; + } + +- + CK_RV + C_VerifyUpdate(CK_SESSION_HANDLE hSession, + CK_BYTE_PTR pPart, +@@ -2072,7 +1995,6 @@ C_GenerateRandom(CK_SESSION_HANDLE hSession, + return CKR_FUNCTION_NOT_SUPPORTED; + } + +- + CK_FUNCTION_LIST funcs = { + { 2, 11 }, + C_Initialize, diff --git a/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch b/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch new file mode 100644 index 0000000..23f21a5 --- /dev/null +++ b/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch @@ -0,0 +1,149 @@ +From 5072bfdfaddae762680d0f9d97afa6dbf8274760 Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Sat, 15 May 2021 18:04:58 -0400 +Subject: [PATCH] Remove deprecated OpenSSL calls from softpkcs11 + +Rewrite add_pubkey_info() in terms of the EVP_PKEY interface. In this +process, fix its unchecked allocations and fail fast for non-RSA keys. + +(cherry picked from commit d6bf42279675100e3e4fe7c6e08eef74d49624cb) +--- + src/configure.ac | 1 + + src/tests/softpkcs11/main.c | 106 ++++++++++++++++++++++++------------ + 2 files changed, 72 insertions(+), 35 deletions(-) + +diff --git a/src/configure.ac b/src/configure.ac +index ea708491b..477819091 100644 +--- a/src/configure.ac ++++ b/src/configure.ac +@@ -1118,6 +1118,7 @@ int i = 1; + ])], k5_cv_openssl_version_okay=yes, k5_cv_openssl_version_okay=no)]) + old_LIBS="$LIBS" + AC_CHECK_LIB(crypto, PKCS7_get_signer_info) ++ AC_CHECK_FUNCS(EVP_PKEY_get_bn_param) + LIBS="$old_LIBS" + fi + if test "$k5_cv_openssl_version_okay" = yes && (test "$enable_pkinit" = yes || test "$enable_pkinit" = try); then +diff --git a/src/tests/softpkcs11/main.c b/src/tests/softpkcs11/main.c +index caa537b68..86b4ef711 100644 +--- a/src/tests/softpkcs11/main.c ++++ b/src/tests/softpkcs11/main.c +@@ -413,47 +413,83 @@ add_object_attribute(struct st_object *o, + return CKR_OK; + } + ++#ifdef HAVE_EVP_PKEY_GET_BN_PARAM ++ ++/* Declare owner pointers since EVP_PKEY_get_bn_param() gives us copies. */ ++#define DECLARE_BIGNUM(name) BIGNUM *name = NULL ++#define RELEASE_BIGNUM(bn) BN_clear_free(bn) + static CK_RV +-add_pubkey_info(struct st_object *o, CK_KEY_TYPE key_type, EVP_PKEY *key) ++get_bignums(EVP_PKEY *key, BIGNUM **n, BIGNUM **e) + { +- switch (key_type) { +- case CKK_RSA: { +- CK_BYTE *modulus = NULL; +- size_t modulus_len = 0; +- CK_ULONG modulus_bits = 0; +- CK_BYTE *exponent = NULL; +- size_t exponent_len = 0; +- const RSA *rsa; +- const BIGNUM *n, *e; ++ if (EVP_PKEY_get_bn_param(key, "n", n) == 0 || ++ EVP_PKEY_get_bn_param(key, "e", e) == 0) ++ return CKR_DEVICE_ERROR; + +- rsa = EVP_PKEY_get0_RSA(key); +- RSA_get0_key(rsa, &n, &e, NULL); +- modulus_bits = BN_num_bits(n); +- +- modulus_len = BN_num_bytes(n); +- modulus = malloc(modulus_len); +- BN_bn2bin(n, modulus); +- +- exponent_len = BN_num_bytes(e); +- exponent = malloc(exponent_len); +- BN_bn2bin(e, exponent); +- +- add_object_attribute(o, 0, CKA_MODULUS, modulus, modulus_len); +- add_object_attribute(o, 0, CKA_MODULUS_BITS, +- &modulus_bits, sizeof(modulus_bits)); +- add_object_attribute(o, 0, CKA_PUBLIC_EXPONENT, +- exponent, exponent_len); +- +- free(modulus); +- free(exponent); +- } +- default: +- /* XXX */ +- break; +- } + return CKR_OK; + } + ++#else ++ ++/* Declare const pointers since the old API gives us aliases. */ ++#define DECLARE_BIGNUM(name) const BIGNUM *name ++#define RELEASE_BIGNUM(bn) ++static CK_RV ++get_bignums(EVP_PKEY *key, const BIGNUM **n, const BIGNUM **e) ++{ ++ const RSA *rsa; ++ ++ rsa = EVP_PKEY_get0_RSA(key); ++ RSA_get0_key(rsa, n, e, NULL); ++ ++ return CKR_OK; ++} ++ ++#endif ++ ++static CK_RV ++add_pubkey_info(struct st_object *o, CK_KEY_TYPE key_type, EVP_PKEY *key) ++{ ++ CK_BYTE *modulus = NULL, *exponent = 0; ++ size_t modulus_len = 0, exponent_len = 0; ++ CK_ULONG modulus_bits = 0; ++ CK_RV ret; ++ DECLARE_BIGNUM(n); ++ DECLARE_BIGNUM(e); ++ ++ if (key_type != CKK_RSA) ++ abort(); ++ ++ ret = get_bignums(key, &n, &e); ++ if (ret != CKR_OK) ++ goto done; ++ ++ modulus_bits = BN_num_bits(n); ++ modulus_len = BN_num_bytes(n); ++ exponent_len = BN_num_bytes(e); ++ ++ modulus = malloc(modulus_len); ++ exponent = malloc(exponent_len); ++ if (modulus == NULL || exponent == NULL) { ++ ret = CKR_DEVICE_MEMORY; ++ goto done; ++ } ++ ++ BN_bn2bin(n, modulus); ++ BN_bn2bin(e, exponent); ++ ++ add_object_attribute(o, 0, CKA_MODULUS, modulus, modulus_len); ++ add_object_attribute(o, 0, CKA_MODULUS_BITS, &modulus_bits, ++ sizeof(modulus_bits)); ++ add_object_attribute(o, 0, CKA_PUBLIC_EXPONENT, exponent, exponent_len); ++ ++ ret = CKR_OK; ++done: ++ free(modulus); ++ free(exponent); ++ RELEASE_BIGNUM(n); ++ RELEASE_BIGNUM(e); ++ return ret; ++} + + static int + pem_callback(char *buf, int num, int w, void *key) diff --git a/krb5.spec b/krb5.spec index 25d282e..6d2a5cb 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.1 -Release: %{?zdpd}10%{?dist} +Release: %{?zdpd}11%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -83,6 +83,9 @@ Patch17: Move-some-dejagnu-kadmin-tests-to-Python-tests.patch Patch18: Fix-some-principal-realm-canonicalization-cases.patch Patch19: Allow-kinit-with-keytab-to-defer-canonicalization.patch Patch20: Fix-kadmin-k-with-fallback-or-referral-realm.patch +Patch21: Fix-softpkcs11-build-issues-with-openssl-3.0.patch +Patch22: Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch +Patch23: Fix-k5tls-module-for-OpenSSL-3.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -645,6 +648,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Mon Jun 21 2021 Robbie Harwood - 1.19.1-11 +- Add the backward-compatible parts of openssl3 support + * Wed Jun 09 2021 Robbie Harwood - 1.19.1-10 - Fix three canonicalization cases for fallback From c5044b07415e379cca8437a8a3c1d0fa00cabb13 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Mon, 28 Jun 2021 17:50:46 -0400 Subject: [PATCH 041/103] MEMORY locking fix and static analysis pullup --- ...context-after-failed-open-in-libkdb5.patch | 35 + ...aks-on-error-in-kadm5-init-functions.patch | 664 ++++++++++++++++++ Use-asan-in-one-of-the-CI-builds.patch | 22 + ...king-in-MEMORY-krb5_cc_get_principal.patch | 47 ++ krb5.spec | 9 +- 5 files changed, 776 insertions(+), 1 deletion(-) create mode 100644 Clean-up-context-after-failed-open-in-libkdb5.patch create mode 100644 Fix-leaks-on-error-in-kadm5-init-functions.patch create mode 100644 Use-asan-in-one-of-the-CI-builds.patch create mode 100644 Using-locking-in-MEMORY-krb5_cc_get_principal.patch diff --git a/Clean-up-context-after-failed-open-in-libkdb5.patch b/Clean-up-context-after-failed-open-in-libkdb5.patch new file mode 100644 index 0000000..a892a14 --- /dev/null +++ b/Clean-up-context-after-failed-open-in-libkdb5.patch @@ -0,0 +1,35 @@ +From 78c03a9b5ef3e3f894bea11c89e575b9bb4d1b0f Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Wed, 23 Jun 2021 16:57:39 -0400 +Subject: [PATCH] Clean up context after failed open in libkdb5 + +If krb5_db_open() or krb5_db_create() fails, release the dal_handle, +as the caller is unlikely to call krb5_db_close() after a failure. + +(cherry picked from commit 849b7056e703bd3724d909263769ce190db59acc) +--- + src/lib/kdb/kdb5.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/lib/kdb/kdb5.c b/src/lib/kdb/kdb5.c +index 47e9b31a7..11e2430c4 100644 +--- a/src/lib/kdb/kdb5.c ++++ b/src/lib/kdb/kdb5.c +@@ -675,6 +675,8 @@ krb5_db_open(krb5_context kcontext, char **db_args, int mode) + return status; + status = v->init_module(kcontext, section, db_args, mode); + free(section); ++ if (status) ++ (void)krb5_db_fini(kcontext); + return status; + } + +@@ -702,6 +704,8 @@ krb5_db_create(krb5_context kcontext, char **db_args) + return status; + status = v->create(kcontext, section, db_args); + free(section); ++ if (status) ++ (void)krb5_db_fini(kcontext); + return status; + } + diff --git a/Fix-leaks-on-error-in-kadm5-init-functions.patch b/Fix-leaks-on-error-in-kadm5-init-functions.patch new file mode 100644 index 0000000..ef12052 --- /dev/null +++ b/Fix-leaks-on-error-in-kadm5-init-functions.patch @@ -0,0 +1,664 @@ +From 6b2f7995ab23cffcababe537d57540236f99f0e3 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Wed, 23 Jun 2021 16:53:16 -0400 +Subject: [PATCH] Fix leaks on error in kadm5 init functions + +In the GENERIC_CHECK_HANDLE function, separate out the +version-checking logic so we can call it in the init functions before +allocating resources. + +In the client and server library initialization functions, use a +single exit path after argument validation, and share the destruction +code with kadm5_destroy() via a helper. + +(cherry picked from commit 552d7b7626450f963b8e37345c472420c842402c) +--- + src/lib/kadm5/admin_internal.h | 39 ++++--- + src/lib/kadm5/clnt/client_init.c | 174 +++++++++++----------------- + src/lib/kadm5/srv/server_init.c | 191 ++++++++++--------------------- + 3 files changed, 145 insertions(+), 259 deletions(-) + +diff --git a/src/lib/kadm5/admin_internal.h b/src/lib/kadm5/admin_internal.h +index faf8e9c36..9be53883a 100644 +--- a/src/lib/kadm5/admin_internal.h ++++ b/src/lib/kadm5/admin_internal.h +@@ -11,29 +11,32 @@ + + #define KADM5_SERVER_HANDLE_MAGIC 0x12345800 + +-#define GENERIC_CHECK_HANDLE(handle, old_api_version, new_api_version) \ ++#define CHECK_VERSIONS(struct_version, api_version, old_api_err, new_api_err) \ + { \ +- kadm5_server_handle_t srvr = \ +- (kadm5_server_handle_t) handle; \ +- \ +- if (! srvr) \ +- return KADM5_BAD_SERVER_HANDLE; \ +- if (srvr->magic_number != KADM5_SERVER_HANDLE_MAGIC) \ +- return KADM5_BAD_SERVER_HANDLE; \ +- if ((srvr->struct_version & KADM5_MASK_BITS) != \ +- KADM5_STRUCT_VERSION_MASK) \ ++ if ((struct_version & KADM5_MASK_BITS) != KADM5_STRUCT_VERSION_MASK) \ + return KADM5_BAD_STRUCT_VERSION; \ +- if (srvr->struct_version < KADM5_STRUCT_VERSION_1) \ ++ if (struct_version < KADM5_STRUCT_VERSION_1) \ + return KADM5_OLD_STRUCT_VERSION; \ +- if (srvr->struct_version > KADM5_STRUCT_VERSION_1) \ ++ if (struct_version > KADM5_STRUCT_VERSION_1) \ + return KADM5_NEW_STRUCT_VERSION; \ +- if ((srvr->api_version & KADM5_MASK_BITS) != \ +- KADM5_API_VERSION_MASK) \ ++ if ((api_version & KADM5_MASK_BITS) != KADM5_API_VERSION_MASK) \ + return KADM5_BAD_API_VERSION; \ +- if (srvr->api_version < KADM5_API_VERSION_2) \ +- return old_api_version; \ +- if (srvr->api_version > KADM5_API_VERSION_4) \ +- return new_api_version; \ ++ if (api_version < KADM5_API_VERSION_2) \ ++ return old_api_err; \ ++ if (api_version > KADM5_API_VERSION_4) \ ++ return new_api_err; \ ++ } ++ ++#define GENERIC_CHECK_HANDLE(handle, old_api_err, new_api_err) \ ++ { \ ++ kadm5_server_handle_t srvr = handle; \ ++ \ ++ if (srvr == NULL) \ ++ return KADM5_BAD_SERVER_HANDLE; \ ++ if (srvr->magic_number != KADM5_SERVER_HANDLE_MAGIC) \ ++ return KADM5_BAD_SERVER_HANDLE; \ ++ CHECK_VERSIONS(srvr->struct_version, srvr->api_version, \ ++ old_api_err, new_api_err); \ + } + + /* +diff --git a/src/lib/kadm5/clnt/client_init.c b/src/lib/kadm5/clnt/client_init.c +index 0aaca701f..75614bb19 100644 +--- a/src/lib/kadm5/clnt/client_init.c ++++ b/src/lib/kadm5/clnt/client_init.c +@@ -138,6 +138,36 @@ kadm5_init_with_skey(krb5_context context, char *client_name, + server_handle); + } + ++static kadm5_ret_t ++free_handle(kadm5_server_handle_t handle) ++{ ++ kadm5_ret_t ret = 0; ++ OM_uint32 minor_stat; ++ krb5_ccache ccache; ++ ++ if (handle == NULL) ++ return 0; ++ ++ if (handle->destroy_cache && handle->cache_name != NULL) { ++ ret = krb5_cc_resolve(handle->context, handle->cache_name, &ccache); ++ if (!ret) ++ ret = krb5_cc_destroy(handle->context, ccache); ++ } ++ free(handle->cache_name); ++ (void)gss_release_cred(&minor_stat, &handle->cred); ++ if (handle->clnt != NULL && handle->clnt->cl_auth != NULL) ++ AUTH_DESTROY(handle->clnt->cl_auth); ++ if (handle->clnt != NULL) ++ clnt_destroy(handle->clnt); ++ if (handle->client_socket != -1) ++ close(handle->client_socket); ++ free(handle->lhandle); ++ kadm5_free_config_params(handle->context, &handle->params); ++ free(handle); ++ ++ return ret; ++} ++ + static kadm5_ret_t + init_any(krb5_context context, char *client_name, enum init_type init_type, + char *pass, krb5_ccache ccache_in, char *service_name, +@@ -145,36 +175,34 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, + krb5_ui_4 api_version, char **db_args, void **server_handle) + { + int fd = -1; +- OM_uint32 minor_stat; + krb5_boolean iprop_enable; + int port; + rpcprog_t rpc_prog; + rpcvers_t rpc_vers; +- krb5_ccache ccache; + krb5_principal client = NULL, server = NULL; + struct timeval timeout; + +- kadm5_server_handle_t handle; ++ kadm5_server_handle_t handle = NULL; + kadm5_config_params params_local; + +- int code = 0; ++ krb5_error_code code; + generic_ret r = { 0, 0 }; + + initialize_ovk_error_table(); + initialize_ovku_error_table(); + +- if (! server_handle) { ++ if (server_handle == NULL || client_name == NULL) + return EINVAL; +- } + +- if (! (handle = malloc(sizeof(*handle)))) { +- return ENOMEM; +- } +- memset(handle, 0, sizeof(*handle)); +- if (! (handle->lhandle = malloc(sizeof(*handle)))) { +- free(handle); +- return ENOMEM; +- } ++ CHECK_VERSIONS(struct_version, api_version, KADM5_OLD_LIB_API_VERSION, ++ KADM5_NEW_LIB_API_VERSION); ++ ++ handle = k5alloc(sizeof(*handle), &code); ++ if (handle == NULL) ++ goto cleanup; ++ handle->lhandle = k5alloc(sizeof(*handle), &code); ++ if (handle->lhandle == NULL) ++ goto cleanup; + + handle->magic_number = KADM5_SERVER_HANDLE_MAGIC; + handle->struct_version = struct_version; +@@ -192,33 +220,20 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, + + handle->context = context; + +- if(client_name == NULL) { +- free(handle); +- return EINVAL; +- } +- +- /* +- * Verify the version numbers before proceeding; we can't use +- * CHECK_HANDLE because not all fields are set yet. +- */ +- GENERIC_CHECK_HANDLE(handle, KADM5_OLD_LIB_API_VERSION, +- KADM5_NEW_LIB_API_VERSION); +- + memset(¶ms_local, 0, sizeof(params_local)); + +- if ((code = kadm5_get_config_params(handle->context, 0, +- params_in, &handle->params))) { +- free(handle); +- return(code); +- } ++ code = kadm5_get_config_params(handle->context, 0, params_in, ++ &handle->params); ++ if (code) ++ goto cleanup; + + #define REQUIRED_PARAMS (KADM5_CONFIG_REALM | \ + KADM5_CONFIG_ADMIN_SERVER | \ + KADM5_CONFIG_KADMIND_PORT) + + if ((handle->params.mask & REQUIRED_PARAMS) != REQUIRED_PARAMS) { +- free(handle); +- return KADM5_MISSING_KRB5_CONF_PARAMS; ++ code = KADM5_MISSING_KRB5_CONF_PARAMS; ++ goto cleanup; + } + + /* +@@ -228,7 +243,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, + */ + code = krb5_parse_name(handle->context, client_name, &client); + if (code) +- goto error; ++ goto cleanup; + if (init_type == INIT_SKEY && client->realm.length == 0) + client->type = KRB5_NT_SRV_HST; + +@@ -239,7 +254,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, + code = get_init_creds(handle, client, init_type, pass, ccache_in, + service_name, handle->params.realm, &server); + if (code) +- goto error; ++ goto cleanup; + + /* If the service_name and client_name are iprop-centric, use the iprop + * port and RPC identifiers. */ +@@ -258,7 +273,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, + + code = connect_to_server(handle->params.admin_server, port, &fd); + if (code) +- goto error; ++ goto cleanup; + + handle->clnt = clnttcp_create(NULL, rpc_prog, rpc_vers, &fd, 0, 0); + if (handle->clnt == NULL) { +@@ -266,7 +281,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, + #ifdef DEBUG + clnt_pcreateerror("clnttcp_create"); + #endif +- goto error; ++ goto cleanup; + } + + /* Set a one-hour timeout. */ +@@ -278,10 +293,6 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, + handle->lhandle->clnt = handle->clnt; + handle->lhandle->client_socket = fd; + +- /* now that handle->clnt is set, we can check the handle */ +- if ((code = _kadm5_check_handle((void *) handle))) +- goto error; +- + /* + * The RPC connection is open; establish the GSS-API + * authentication context. +@@ -289,7 +300,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, + code = setup_gss(handle, params_in, + (init_type == INIT_CREDS) ? client : NULL, server); + if (code) +- goto error; ++ goto cleanup; + + /* + * Bypass the remainder of the code and return straight away +@@ -297,7 +308,8 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, + */ + if (iprop_enable) { + code = 0; +- *server_handle = (void *) handle; ++ *server_handle = handle; ++ handle = NULL; + goto cleanup; + } + +@@ -306,7 +318,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, + #ifdef DEBUG + clnt_perror(handle->clnt, "init_2 null resp"); + #endif +- goto error; ++ goto cleanup; + } + /* Drop down to v3 wire protocol if server does not support v4 */ + if (r.code == KADM5_NEW_SERVER_API_VERSION && +@@ -315,7 +327,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, + memset(&r, 0, sizeof(generic_ret)); + if (init_2(&handle->api_version, &r, handle->clnt)) { + code = KADM5_RPC_ERROR; +- goto error; ++ goto cleanup; + } + } + /* Drop down to v2 wire protocol if server does not support v3 */ +@@ -325,47 +337,21 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, + memset(&r, 0, sizeof(generic_ret)); + if (init_2(&handle->api_version, &r, handle->clnt)) { + code = KADM5_RPC_ERROR; +- goto error; ++ goto cleanup; + } + } + if (r.code) { + code = r.code; +- goto error; ++ goto cleanup; + } + +- *server_handle = (void *) handle; +- +- goto cleanup; +- +-error: +- /* +- * Note that it is illegal for this code to execute if "handle" +- * has not been allocated and initialized. I.e., don't use "goto +- * error" before the block of code at the top of the function +- * that allocates and initializes "handle". +- */ +- if (handle->destroy_cache && handle->cache_name) { +- if (krb5_cc_resolve(handle->context, +- handle->cache_name, &ccache) == 0) +- (void) krb5_cc_destroy (handle->context, ccache); +- } +- if (handle->cache_name) +- free(handle->cache_name); +- (void)gss_release_cred(&minor_stat, &handle->cred); +- if(handle->clnt && handle->clnt->cl_auth) +- AUTH_DESTROY(handle->clnt->cl_auth); +- if(handle->clnt) +- clnt_destroy(handle->clnt); +- if (fd != -1) +- close(fd); +- free(handle->lhandle); +- kadm5_free_config_params(handle->context, &handle->params); ++ *server_handle = handle; ++ handle = NULL; + + cleanup: +- krb5_free_principal(handle->context, client); +- krb5_free_principal(handle->context, server); +- if (code) +- free(handle); ++ krb5_free_principal(context, client); ++ krb5_free_principal(context, server); ++ (void)free_handle(handle); + + return code; + } +@@ -695,38 +681,8 @@ rpc_auth(kadm5_server_handle_t handle, kadm5_config_params *params_in, + kadm5_ret_t + kadm5_destroy(void *server_handle) + { +- OM_uint32 minor_stat; +- krb5_ccache ccache = NULL; +- int code = KADM5_OK; +- kadm5_server_handle_t handle = +- (kadm5_server_handle_t) server_handle; +- + CHECK_HANDLE(server_handle); +- +- if (handle->destroy_cache && handle->cache_name) { +- if ((code = krb5_cc_resolve(handle->context, +- handle->cache_name, &ccache)) == 0) +- code = krb5_cc_destroy (handle->context, ccache); +- } +- if (handle->cache_name) +- free(handle->cache_name); +- if (handle->cred) +- (void)gss_release_cred(&minor_stat, &handle->cred); +- if (handle->clnt && handle->clnt->cl_auth) +- AUTH_DESTROY(handle->clnt->cl_auth); +- if (handle->clnt) +- clnt_destroy(handle->clnt); +- if (handle->client_socket != -1) +- close(handle->client_socket); +- if (handle->lhandle) +- free (handle->lhandle); +- +- kadm5_free_config_params(handle->context, &handle->params); +- +- handle->magic_number = 0; +- free(handle); +- +- return code; ++ return free_handle(server_handle); + } + /* not supported on client */ + kadm5_ret_t kadm5_lock(void *server_handle) +diff --git a/src/lib/kadm5/srv/server_init.c b/src/lib/kadm5/srv/server_init.c +index 3adc4b57d..2c0d51efd 100644 +--- a/src/lib/kadm5/srv/server_init.c ++++ b/src/lib/kadm5/srv/server_init.c +@@ -19,23 +19,6 @@ + #include "osconf.h" + #include "iprop_hdr.h" + +-/* +- * Function check_handle +- * +- * Purpose: Check a server handle and return a com_err code if it is +- * invalid or 0 if it is valid. +- * +- * Arguments: +- * +- * handle The server handle. +- */ +- +-static int check_handle(void *handle) +-{ +- CHECK_HANDLE(handle); +- return 0; +-} +- + static int dup_db_args(kadm5_server_handle_t handle, char **db_args) + { + int count = 0; +@@ -84,6 +67,23 @@ static void free_db_args(kadm5_server_handle_t handle) + } + } + ++static void ++free_handle(kadm5_server_handle_t handle) ++{ ++ if (handle == NULL) ++ return; ++ ++ destroy_pwqual(handle); ++ k5_kadm5_hook_free_handles(handle->context, handle->hook_handles); ++ ulog_fini(handle->context); ++ krb5_db_fini(handle->context); ++ krb5_free_principal(handle->context, handle->current_caller); ++ kadm5_free_config_params(handle->context, &handle->params); ++ free(handle->lhandle); ++ free_db_args(handle); ++ free(handle); ++} ++ + kadm5_ret_t kadm5_init_with_password(krb5_context context, char *client_name, + char *pass, char *service_name, + kadm5_config_params *params, +@@ -163,8 +163,8 @@ kadm5_ret_t kadm5_init(krb5_context context, char *client_name, char *pass, + char **db_args, + void **server_handle) + { +- int ret; +- kadm5_server_handle_t handle; ++ krb5_error_code ret; ++ kadm5_server_handle_t handle = NULL; + kadm5_config_params params_local; /* for v1 compat */ + + if (! server_handle) +@@ -173,17 +173,17 @@ kadm5_ret_t kadm5_init(krb5_context context, char *client_name, char *pass, + if (! client_name) + return EINVAL; + +- if (! (handle = (kadm5_server_handle_t) malloc(sizeof *handle))) +- return ENOMEM; +- memset(handle, 0, sizeof(*handle)); ++ CHECK_VERSIONS(struct_version, api_version, KADM5_OLD_SERVER_API_VERSION, ++ KADM5_NEW_SERVER_API_VERSION); ++ ++ handle = k5alloc(sizeof(*handle), &ret); ++ if (handle == NULL) ++ goto cleanup; ++ handle->context = context; + + ret = dup_db_args(handle, db_args); +- if (ret) { +- free(handle); +- return ret; +- } +- +- handle->context = context; ++ if (ret) ++ goto cleanup; + + initialize_ovk_error_table(); + initialize_ovku_error_table(); +@@ -192,13 +192,6 @@ kadm5_ret_t kadm5_init(krb5_context context, char *client_name, char *pass, + handle->struct_version = struct_version; + handle->api_version = api_version; + +- /* +- * Verify the version numbers before proceeding; we can't use +- * CHECK_HANDLE because not all fields are set yet. +- */ +- GENERIC_CHECK_HANDLE(handle, KADM5_OLD_SERVER_API_VERSION, +- KADM5_NEW_SERVER_API_VERSION); +- + /* + * Acquire relevant profile entries. Merge values + * in params_in with values from profile, based on +@@ -208,11 +201,8 @@ kadm5_ret_t kadm5_init(krb5_context context, char *client_name, char *pass, + + ret = kadm5_get_config_params(handle->context, 1, params_in, + &handle->params); +- if (ret) { +- free_db_args(handle); +- free(handle); +- return(ret); +- } ++ if (ret) ++ goto cleanup; + + #define REQUIRED_PARAMS (KADM5_CONFIG_REALM | KADM5_CONFIG_DBNAME | \ + KADM5_CONFIG_ENCTYPE | \ +@@ -226,132 +216,69 @@ kadm5_ret_t kadm5_init(krb5_context context, char *client_name, char *pass, + KADM5_CONFIG_IPROP_PORT) + + if ((handle->params.mask & REQUIRED_PARAMS) != REQUIRED_PARAMS) { +- kadm5_free_config_params(handle->context, &handle->params); +- free_db_args(handle); +- free(handle); +- return KADM5_MISSING_CONF_PARAMS; ++ ret = KADM5_MISSING_CONF_PARAMS; ++ goto cleanup; + } + if ((handle->params.mask & KADM5_CONFIG_IPROP_ENABLED) == KADM5_CONFIG_IPROP_ENABLED + && handle->params.iprop_enabled) { + if ((handle->params.mask & IPROP_REQUIRED_PARAMS) != IPROP_REQUIRED_PARAMS) { +- kadm5_free_config_params(handle->context, &handle->params); +- free_db_args(handle); +- free(handle); +- return KADM5_MISSING_CONF_PARAMS; ++ ret = KADM5_MISSING_CONF_PARAMS; ++ goto cleanup; + } + } + + ret = krb5_set_default_realm(handle->context, handle->params.realm); +- if (ret) { +- kadm5_free_config_params(handle->context, &handle->params); +- free_db_args(handle); +- free(handle); +- return ret; +- } ++ if (ret) ++ goto cleanup; + + ret = krb5_db_open(handle->context, db_args, + KRB5_KDB_OPEN_RW | KRB5_KDB_SRV_TYPE_ADMIN); +- if (ret) { +- kadm5_free_config_params(handle->context, &handle->params); +- free_db_args(handle); +- free(handle); +- return(ret); +- } ++ if (ret) ++ goto cleanup; + +- if ((ret = krb5_parse_name(handle->context, client_name, +- &handle->current_caller))) { +- kadm5_free_config_params(handle->context, &handle->params); +- krb5_db_fini(handle->context); +- free_db_args(handle); +- free(handle); +- return ret; +- } ++ ret = krb5_parse_name(handle->context, client_name, ++ &handle->current_caller); ++ if (ret) ++ goto cleanup; + +- if (! (handle->lhandle = malloc(sizeof(*handle)))) { +- kadm5_free_config_params(handle->context, &handle->params); +- krb5_db_fini(handle->context); +- free_db_args(handle); +- free(handle); +- return ENOMEM; +- } ++ handle->lhandle = k5alloc(sizeof(*handle), &ret); ++ if (handle->lhandle == NULL) ++ goto cleanup; + *handle->lhandle = *handle; + handle->lhandle->api_version = KADM5_API_VERSION_4; + handle->lhandle->struct_version = KADM5_STRUCT_VERSION; + handle->lhandle->lhandle = handle->lhandle; + +- /* can't check the handle until current_caller is set */ +- ret = check_handle((void *) handle); +- if (ret) { +- kadm5_free_config_params(handle->context, &handle->params); +- free_db_args(handle); +- free(handle); +- return ret; +- } +- + ret = kdb_init_master(handle, handle->params.realm, + (handle->params.mask & KADM5_CONFIG_MKEY_FROM_KBD) + && handle->params.mkey_from_kbd); +- if (ret) { +- kadm5_free_config_params(handle->context, &handle->params); +- krb5_db_fini(handle->context); +- free_db_args(handle); +- free(handle); +- return ret; +- } ++ if (ret) ++ goto cleanup; + + ret = kdb_init_hist(handle, handle->params.realm); +- if (ret) { +- kadm5_free_config_params(handle->context, &handle->params); +- krb5_db_fini(handle->context); +- free_db_args(handle); +- free(handle); +- return ret; +- } ++ if (ret) ++ goto cleanup; + + ret = k5_kadm5_hook_load(context,&handle->hook_handles); +- if (ret) { +- kadm5_free_config_params(handle->context, &handle->params); +- krb5_db_fini(handle->context); +- krb5_free_principal(handle->context, handle->current_caller); +- free_db_args(handle); +- free(handle); +- return ret; +- } ++ if (ret) ++ goto cleanup; + + ret = init_pwqual(handle); +- if (ret) { +- kadm5_free_config_params(handle->context, &handle->params); +- k5_kadm5_hook_free_handles(context, handle->hook_handles); +- krb5_db_fini(handle->context); +- krb5_free_principal(handle->context, handle->current_caller); +- free_db_args(handle); +- free(handle); +- return ret; +- } ++ if (ret) ++ goto cleanup; + +- *server_handle = (void *) handle; ++ *server_handle = handle; ++ handle = NULL; + +- return KADM5_OK; ++cleanup: ++ free_handle(handle); ++ return ret; + } + + kadm5_ret_t kadm5_destroy(void *server_handle) + { +- kadm5_server_handle_t handle = server_handle; +- + CHECK_HANDLE(server_handle); +- +- destroy_pwqual(handle); +- +- k5_kadm5_hook_free_handles(handle->context, handle->hook_handles); +- ulog_fini(handle->context); +- krb5_db_fini(handle->context); +- krb5_free_principal(handle->context, handle->current_caller); +- kadm5_free_config_params(handle->context, &handle->params); +- handle->magic_number = 0; +- free(handle->lhandle); +- free_db_args(handle); +- free(handle); +- ++ free_handle(server_handle); + return KADM5_OK; + } + diff --git a/Use-asan-in-one-of-the-CI-builds.patch b/Use-asan-in-one-of-the-CI-builds.patch new file mode 100644 index 0000000..e6b1e86 --- /dev/null +++ b/Use-asan-in-one-of-the-CI-builds.patch @@ -0,0 +1,22 @@ +From 5457242ca6742ace42f1f7dbe37208752c6f26f4 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Mon, 21 Jun 2021 19:15:26 -0400 +Subject: [PATCH] Use asan in one of the CI builds + +(cherry picked from commit 7368354bcd0b58480a88b1fb81e63bd6aae7edf2) +--- + .github/workflows/build.yml | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml +index 8d1042b7b..06a35b7b9 100644 +--- a/.github/workflows/build.yml ++++ b/.github/workflows/build.yml +@@ -17,6 +17,7 @@ jobs: + os: ubuntu-18.04 + compiler: clang + makevars: CPPFLAGS=-Werror ++ configureopts: --enable-asan + - name: linux-clang-openssl + os: ubuntu-18.04 + compiler: clang diff --git a/Using-locking-in-MEMORY-krb5_cc_get_principal.patch b/Using-locking-in-MEMORY-krb5_cc_get_principal.patch new file mode 100644 index 0000000..2ae1967 --- /dev/null +++ b/Using-locking-in-MEMORY-krb5_cc_get_principal.patch @@ -0,0 +1,47 @@ +From d9a6607d47ff6449d1cad2a9a5b4d3b9b2768ddd Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Sun, 20 Jun 2021 19:24:07 -0400 +Subject: [PATCH] Using locking in MEMORY krb5_cc_get_principal() + +Without locking, the principal pointer could be freed out from under +krb5_copy_principal() by another thread calling krb5_cc_initialize() +or krb5_cc_destroy(). + +ticket: 9014 (new) +tags: pullup +target_version: 1.19-next +target_version: 1.18-next + +(cherry picked from commit 1848447291c68e21311f441b0458ae53471d00d3) +--- + src/lib/krb5/ccache/cc_memory.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/src/lib/krb5/ccache/cc_memory.c b/src/lib/krb5/ccache/cc_memory.c +index 610091a25..e4c795d25 100644 +--- a/src/lib/krb5/ccache/cc_memory.c ++++ b/src/lib/krb5/ccache/cc_memory.c +@@ -575,12 +575,17 @@ krb5_mcc_get_name (krb5_context context, krb5_ccache id) + krb5_error_code KRB5_CALLCONV + krb5_mcc_get_principal(krb5_context context, krb5_ccache id, krb5_principal *princ) + { +- krb5_mcc_data *ptr = (krb5_mcc_data *)id->data; +- if (!ptr->prin) { +- *princ = 0L; +- return KRB5_FCC_NOFILE; +- } +- return krb5_copy_principal(context, ptr->prin, princ); ++ krb5_error_code ret; ++ krb5_mcc_data *d = id->data; ++ ++ *princ = NULL; ++ k5_cc_mutex_lock(context, &d->lock); ++ if (d->prin == NULL) ++ ret = KRB5_FCC_NOFILE; ++ else ++ ret = krb5_copy_principal(context, d->prin, princ); ++ k5_cc_mutex_unlock(context, &d->lock); ++ return ret; + } + + krb5_error_code KRB5_CALLCONV diff --git a/krb5.spec b/krb5.spec index 6d2a5cb..6f8a7c8 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.1 -Release: %{?zdpd}11%{?dist} +Release: %{?zdpd}12%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -86,6 +86,10 @@ Patch20: Fix-kadmin-k-with-fallback-or-referral-realm.patch Patch21: Fix-softpkcs11-build-issues-with-openssl-3.0.patch Patch22: Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch Patch23: Fix-k5tls-module-for-OpenSSL-3.patch +Patch24: Fix-leaks-on-error-in-kadm5-init-functions.patch +Patch25: Clean-up-context-after-failed-open-in-libkdb5.patch +Patch26: Use-asan-in-one-of-the-CI-builds.patch +Patch27: Using-locking-in-MEMORY-krb5_cc_get_principal.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -648,6 +652,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Mon Jun 28 2021 Robbie Harwood - 1.19.1-12 +- MEMORY locking fix and static analysis pullup + * Mon Jun 21 2021 Robbie Harwood - 1.19.1-11 - Add the backward-compatible parts of openssl3 support From af96dc0c6c08934825f02525af71ad889d9f3042 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Thu, 1 Jul 2021 13:17:47 -0400 Subject: [PATCH 042/103] Fix use-after-free during krad remote_shutdown() --- ...up-gssapi_krb5-ccache-name-functions.patch | 193 ++++++++++++++++++ ...ter-free-during-krad-remote_shutdown.patch | 38 ++++ krb5.spec | 7 +- 3 files changed, 237 insertions(+), 1 deletion(-) create mode 100644 Clean-up-gssapi_krb5-ccache-name-functions.patch create mode 100644 Fix-use-after-free-during-krad-remote_shutdown.patch diff --git a/Clean-up-gssapi_krb5-ccache-name-functions.patch b/Clean-up-gssapi_krb5-ccache-name-functions.patch new file mode 100644 index 0000000..32f3fc4 --- /dev/null +++ b/Clean-up-gssapi_krb5-ccache-name-functions.patch @@ -0,0 +1,193 @@ +From 8285f21d40e30477436128ae2c28403cd5575074 Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Wed, 26 May 2021 18:22:10 -0400 +Subject: [PATCH] Clean up gssapi_krb5 ccache name functions + +Modernize kg_get_ccache_name() and kg_get_ccache_name(). Drop +unnecessary use of const in kg_get_ccache_name() so that its return +value can be properly freed. Fixes some static analyzer false +positives. + +(cherry picked from commit f573f7f8ee5269103a0492d6521a3242c5ffb63b) +--- + src/lib/gssapi/krb5/gssapiP_krb5.h | 3 +- + src/lib/gssapi/krb5/gssapi_krb5.c | 47 ++++++++-------------- + src/lib/gssapi/krb5/set_ccache.c | 64 ++++++++++++------------------ + 3 files changed, 42 insertions(+), 72 deletions(-) + +diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h +index fd7abbd77..88d41130a 100644 +--- a/src/lib/gssapi/krb5/gssapiP_krb5.h ++++ b/src/lib/gssapi/krb5/gssapiP_krb5.h +@@ -380,8 +380,7 @@ OM_uint32 kg_sync_ccache_name (krb5_context context, OM_uint32 *minor_status); + OM_uint32 kg_caller_provided_ccache_name (OM_uint32 *minor_status, + int *out_caller_provided_name); + +-OM_uint32 kg_get_ccache_name (OM_uint32 *minor_status, +- const char **out_name); ++OM_uint32 kg_get_ccache_name (OM_uint32 *minor_status, char **out_name); + + OM_uint32 kg_set_ccache_name (OM_uint32 *minor_status, + const char *name); +diff --git a/src/lib/gssapi/krb5/gssapi_krb5.c b/src/lib/gssapi/krb5/gssapi_krb5.c +index 46aa9b7a5..9915a8bb5 100644 +--- a/src/lib/gssapi/krb5/gssapi_krb5.c ++++ b/src/lib/gssapi/krb5/gssapi_krb5.c +@@ -253,46 +253,31 @@ kg_caller_provided_ccache_name (OM_uint32 *minor_status, + } + + OM_uint32 +-kg_get_ccache_name (OM_uint32 *minor_status, const char **out_name) ++kg_get_ccache_name(OM_uint32 *minor_status, char **out_name) + { +- const char *name = NULL; +- OM_uint32 err = 0; + char *kg_ccache_name; ++ const char *def_name; ++ OM_uint32 err; ++ krb5_context context; ++ ++ *out_name = NULL; + + kg_ccache_name = k5_getspecific(K5_KEY_GSS_KRB5_CCACHE_NAME); +- + if (kg_ccache_name != NULL) { +- name = strdup(kg_ccache_name); +- if (name == NULL) +- err = ENOMEM; ++ *out_name = strdup(kg_ccache_name); ++ err = (*out_name == NULL) ? ENOMEM : 0; + } else { +- krb5_context context = NULL; +- +- /* Reset the context default ccache (see text above), and then +- retrieve it. */ ++ /* Use the default ccache name. */ + err = krb5_gss_init_context(&context); +- if (!err) +- err = krb5_cc_set_default_name (context, NULL); +- if (!err) { +- name = krb5_cc_default_name(context); +- if (name) { +- name = strdup(name); +- if (name == NULL) +- err = ENOMEM; +- } +- } +- if (err && context) +- save_error_info(err, context); +- if (context) +- krb5_free_context(context); +- } +- +- if (!err) { +- if (out_name) { +- *out_name = name; +- } ++ if (err) ++ goto cleanup; ++ def_name = krb5_cc_default_name(context); ++ *out_name = (def_name != NULL) ? strdup(def_name) : NULL; ++ err = (*out_name == NULL) ? ENOMEM : 0; ++ krb5_free_context(context); + } + ++cleanup: + *minor_status = err; + return (*minor_status == 0) ? GSS_S_COMPLETE : GSS_S_FAILURE; + } +diff --git a/src/lib/gssapi/krb5/set_ccache.c b/src/lib/gssapi/krb5/set_ccache.c +index 8acf3ec90..91c3462be 100644 +--- a/src/lib/gssapi/krb5/set_ccache.c ++++ b/src/lib/gssapi/krb5/set_ccache.c +@@ -26,7 +26,7 @@ + + /* + * Set ccache name used by gssapi, and optionally obtain old ccache +- * name. Caller should not free returned name. ++ * name. Caller must not free returned name. + */ + + #include +@@ -38,11 +38,9 @@ gss_krb5int_ccache_name(OM_uint32 *minor_status, + const gss_OID desired_object, + const gss_buffer_t value) + { +- char *old_name = NULL; + OM_uint32 err = 0; +- OM_uint32 minor = 0; +- char *gss_out_name; + struct krb5_gss_ccache_name_req *req; ++ char *old_name, *cur_name = NULL; + + err = gss_krb5int_initialize_library(); + if (err) { +@@ -57,45 +55,33 @@ gss_krb5int_ccache_name(OM_uint32 *minor_status, + + req = (struct krb5_gss_ccache_name_req *)value->value; + +- gss_out_name = k5_getspecific(K5_KEY_GSS_KRB5_SET_CCACHE_OLD_NAME); ++ /* Our job is simple if the caller doesn't want the current name. */ ++ if (req->out_name == NULL) ++ return kg_set_ccache_name(minor_status, req->name); + +- if (req->out_name) { +- const char *tmp_name = NULL; ++ /* Fetch the current name and change it. */ ++ kg_get_ccache_name(&err, &cur_name); ++ if (err) ++ goto cleanup; ++ kg_set_ccache_name(&err, req->name); ++ if (err) ++ goto cleanup; + +- if (!err) { +- kg_get_ccache_name (&err, &tmp_name); +- } +- if (!err) { +- old_name = gss_out_name; +- gss_out_name = (char *)tmp_name; +- } +- } +- /* If out_name was NULL, we keep the same gss_out_name value, and +- don't free up any storage (leave old_name NULL). */ ++ /* Store the current name in a thread-specific variable. Free that ++ * variable's previous contents. */ ++ old_name = k5_getspecific(K5_KEY_GSS_KRB5_SET_CCACHE_OLD_NAME); ++ err = k5_setspecific(K5_KEY_GSS_KRB5_SET_CCACHE_OLD_NAME, cur_name); ++ if (err) ++ goto cleanup; ++ free(old_name); + +- if (!err) +- kg_set_ccache_name (&err, req->name); +- +- minor = k5_setspecific(K5_KEY_GSS_KRB5_SET_CCACHE_OLD_NAME, gss_out_name); +- if (minor) { +- /* Um. Now what? */ +- if (err == 0) { +- err = minor; +- } +- free(gss_out_name); +- gss_out_name = NULL; +- } +- +- if (!err) { +- if (req->out_name) { +- *(req->out_name) = gss_out_name; +- } +- } +- +- if (old_name != NULL) { +- free (old_name); +- } ++ /* Give the caller an alias to the stored value. */ ++ *req->out_name = cur_name; ++ cur_name = NULL; ++ err = 0; + ++cleanup: ++ free(cur_name); + *minor_status = err; + return (*minor_status == 0) ? GSS_S_COMPLETE : GSS_S_FAILURE; + } diff --git a/Fix-use-after-free-during-krad-remote_shutdown.patch b/Fix-use-after-free-during-krad-remote_shutdown.patch new file mode 100644 index 0000000..fb9c56d --- /dev/null +++ b/Fix-use-after-free-during-krad-remote_shutdown.patch @@ -0,0 +1,38 @@ +From bcd7b5e8aa0d325e9b178d9be3459759d39b631e Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Sat, 29 May 2021 13:25:59 -0400 +Subject: [PATCH] Fix use-after-free during krad remote_shutdown() + +Since elements of the queue can be removed on out-of-memory errors, +the correct call is K5_TAILQ_FOREACH_SAFE, not K5_TAILQ_FOREACH. +Reported by Coverity. + +ticket: 9015 (new) +tags: pullup +target_version: 1.19-next +target_version: 1.18-next + +(cherry picked from commit 8c88defb16b34937d5b72b4832c854ce2dbe32d1) +--- + src/lib/krad/remote.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c +index eca432424..7b5804b1d 100644 +--- a/src/lib/krad/remote.c ++++ b/src/lib/krad/remote.c +@@ -220,12 +220,12 @@ static void + remote_shutdown(krad_remote *rr) + { + krb5_error_code retval; +- request *r; ++ request *r, *next; + + remote_disconnect(rr); + + /* Start timers for all unsent packets. */ +- K5_TAILQ_FOREACH(r, &rr->list, list) { ++ K5_TAILQ_FOREACH_SAFE(r, &rr->list, list, next) { + if (r->timer == NULL) { + retval = request_start_timer(r, rr->vctx); + if (retval != 0) diff --git a/krb5.spec b/krb5.spec index 6f8a7c8..f1f9360 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.1 -Release: %{?zdpd}12%{?dist} +Release: %{?zdpd}13%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -90,6 +90,8 @@ Patch24: Fix-leaks-on-error-in-kadm5-init-functions.patch Patch25: Clean-up-context-after-failed-open-in-libkdb5.patch Patch26: Use-asan-in-one-of-the-CI-builds.patch Patch27: Using-locking-in-MEMORY-krb5_cc_get_principal.patch +Patch28: Fix-use-after-free-during-krad-remote_shutdown.patch +Patch29: Clean-up-gssapi_krb5-ccache-name-functions.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -652,6 +654,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Thu Jul 01 2021 Robbie Harwood - 1.19.1-13 +- Fix use-after-free during krad remote_shutdown() + * Mon Jun 28 2021 Robbie Harwood - 1.19.1-12 - MEMORY locking fix and static analysis pullup From 6a2eeb966621c96be097712e190a22cc63bcba7c Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Mon, 12 Jul 2021 13:11:12 -0400 Subject: [PATCH 043/103] Fix KDC null deref on bad encrypted challenge (CVE-2021-36222) --- ...ull-deref-on-bad-encrypted-challenge.patch | 113 ++++++++++++++++++ krb5.spec | 6 +- 2 files changed, 118 insertions(+), 1 deletion(-) create mode 100644 Fix-KDC-null-deref-on-bad-encrypted-challenge.patch diff --git a/Fix-KDC-null-deref-on-bad-encrypted-challenge.patch b/Fix-KDC-null-deref-on-bad-encrypted-challenge.patch new file mode 100644 index 0000000..4a7c7ae --- /dev/null +++ b/Fix-KDC-null-deref-on-bad-encrypted-challenge.patch @@ -0,0 +1,113 @@ +From 791211b00a53b394376d096c881b725ee739a936 Mon Sep 17 00:00:00 2001 +From: Joseph Sutton +Date: Wed, 7 Jul 2021 11:47:44 +1200 +Subject: [PATCH] Fix KDC null deref on bad encrypted challenge + +The function ec_verify() in src/kdc/kdc_preauth_ec.c contains a check +to avoid further processing if the armor key is NULL. However, this +check is bypassed by a call to k5memdup0() which overwrites retval +with 0 if the allocation succeeds. If the armor key is NULL, a call +to krb5_c_fx_cf2_simple() will then dereference it, resulting in a +crash. Add a check before the k5memdup0() call to avoid overwriting +retval. + +CVE-2021-36222: + +In MIT krb5 releases 1.16 and later, an unauthenticated attacker can +cause a null dereference in the KDC by sending a request containing a +PA-ENCRYPTED-CHALLENGE padata element without using FAST. + +[ghudson@mit.edu: trimmed patch; added test case; edited commit +message] + +ticket: 9007 (new) +tags: pullup +target_version: 1.19-next +target_version: 1.18-next + +(cherry picked from commit fc98f520caefff2e5ee9a0026fdf5109944b3562) +--- + src/kdc/kdc_preauth_ec.c | 3 ++- + src/tests/Makefile.in | 1 + + src/tests/t_cve-2021-36222.py | 46 +++++++++++++++++++++++++++++++++++ + 3 files changed, 49 insertions(+), 1 deletion(-) + create mode 100644 src/tests/t_cve-2021-36222.py + +diff --git a/src/kdc/kdc_preauth_ec.c b/src/kdc/kdc_preauth_ec.c +index 7e636b3f9..43a9902cc 100644 +--- a/src/kdc/kdc_preauth_ec.c ++++ b/src/kdc/kdc_preauth_ec.c +@@ -87,7 +87,8 @@ ec_verify(krb5_context context, krb5_data *req_pkt, krb5_kdc_req *request, + } + + /* Check for a configured FAST ec auth indicator. */ +- realmstr = k5memdup0(realm.data, realm.length, &retval); ++ if (retval == 0) ++ realmstr = k5memdup0(realm.data, realm.length, &retval); + if (realmstr != NULL) + retval = profile_get_string(context->profile, KRB5_CONF_REALMS, + realmstr, +diff --git a/src/tests/Makefile.in b/src/tests/Makefile.in +index ab416cc5f..20f27d748 100644 +--- a/src/tests/Makefile.in ++++ b/src/tests/Makefile.in +@@ -159,6 +159,7 @@ check-pytests: unlockiter s4u2self + $(RUNPYTEST) $(srcdir)/t_cve-2012-1015.py $(PYTESTFLAGS) + $(RUNPYTEST) $(srcdir)/t_cve-2013-1416.py $(PYTESTFLAGS) + $(RUNPYTEST) $(srcdir)/t_cve-2013-1417.py $(PYTESTFLAGS) ++ $(RUNPYTEST) $(srcdir)/t_cve-2021-36222.py $(PYTESTFLAGS) + $(RM) au.log + $(RUNPYTEST) $(srcdir)/t_audit.py $(PYTESTFLAGS) + $(RUNPYTEST) $(srcdir)/jsonwalker.py -d $(srcdir)/au_dict.json \ +diff --git a/src/tests/t_cve-2021-36222.py b/src/tests/t_cve-2021-36222.py +new file mode 100644 +index 000000000..57e04993b +--- /dev/null ++++ b/src/tests/t_cve-2021-36222.py +@@ -0,0 +1,46 @@ ++import socket ++from k5test import * ++ ++realm = K5Realm() ++ ++# CVE-2021-36222 KDC null dereference on encrypted challenge preauth ++# without FAST ++ ++s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) ++a = (hostname, realm.portbase) ++ ++m = ('6A81A0' '30819D' # [APPLICATION 10] SEQUENCE ++ 'A103' '0201' '05' # [1] pvno = 5 ++ 'A203' '0201' '0A' # [2] msg-type = 10 ++ 'A30E' '300C' # [3] padata = SEQUENCE OF ++ '300A' # SEQUENCE ++ 'A104' '0202' '008A' # [1] padata-type = PA-ENCRYPTED-CHALLENGE ++ 'A202' '0400' # [2] padata-value = "" ++ 'A48180' '307E' # [4] req-body = SEQUENCE ++ 'A007' '0305' '0000000000' # [0] kdc-options = 0 ++ 'A120' '301E' # [1] cname = SEQUENCE ++ 'A003' '0201' '01' # [0] name-type = NT-PRINCIPAL ++ 'A117' '3015' # [1] name-string = SEQUENCE-OF ++ '1B06' '6B7262746774' # krbtgt ++ '1B0B' '4B5242544553542E434F4D' ++ # KRBTEST.COM ++ 'A20D' '1B0B' '4B5242544553542E434F4D' ++ # [2] realm = KRBTEST.COM ++ 'A320' '301E' # [3] sname = SEQUENCE ++ 'A003' '0201' '01' # [0] name-type = NT-PRINCIPAL ++ 'A117' '3015' # [1] name-string = SEQUENCE-OF ++ '1B06' '6B7262746774' # krbtgt ++ '1B0B' '4B5242544553542E434F4D' ++ # KRBTEST.COM ++ 'A511' '180F' '31393934303631303036303331375A' ++ # [5] till = 19940610060317Z ++ 'A703' '0201' '00' # [7] nonce = 0 ++ 'A808' '3006' # [8] etype = SEQUENCE OF ++ '020112' '020111') # aes256-cts aes128-cts ++ ++s.sendto(bytes.fromhex(m), a) ++ ++# Make sure kinit still works. ++realm.kinit(realm.user_princ, password('user')) ++ ++success('CVE-2021-36222 regression test') diff --git a/krb5.spec b/krb5.spec index f1f9360..48ff4fb 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.1 -Release: %{?zdpd}13%{?dist} +Release: %{?zdpd}14%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -92,6 +92,7 @@ Patch26: Use-asan-in-one-of-the-CI-builds.patch Patch27: Using-locking-in-MEMORY-krb5_cc_get_principal.patch Patch28: Fix-use-after-free-during-krad-remote_shutdown.patch Patch29: Clean-up-gssapi_krb5-ccache-name-functions.patch +Patch30: Fix-KDC-null-deref-on-bad-encrypted-challenge.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -654,6 +655,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Mon Jul 12 2021 Robbie Harwood - 1.19.1-14 +- Fix KDC null deref on bad encrypted challenge (CVE-2021-36222) + * Thu Jul 01 2021 Robbie Harwood - 1.19.1-13 - Fix use-after-free during krad remote_shutdown() From 2484569caa84eada42a9de64783cc56e89e1515d Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Wed, 21 Jul 2021 12:44:26 -0400 Subject: [PATCH 044/103] Fix defcred leak in krb5 gss_inquire_cred() --- ...efcred-leak-in-krb5-gss_inquire_cred.patch | 85 +++++++++++++++++++ krb5.spec | 6 +- 2 files changed, 90 insertions(+), 1 deletion(-) create mode 100644 Fix-defcred-leak-in-krb5-gss_inquire_cred.patch diff --git a/Fix-defcred-leak-in-krb5-gss_inquire_cred.patch b/Fix-defcred-leak-in-krb5-gss_inquire_cred.patch new file mode 100644 index 0000000..9b11bc7 --- /dev/null +++ b/Fix-defcred-leak-in-krb5-gss_inquire_cred.patch @@ -0,0 +1,85 @@ +From 7e6cdffd47559be61a8c26c4ed3c500c536d5368 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Fri, 16 Jul 2021 13:39:39 -0400 +Subject: [PATCH] Fix defcred leak in krb5 gss_inquire_cred() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Commit 1cd2821c19b2b95e39d5fc2f451a035585a40fa5 altered the memory +management of krb5_gss_inquire_cred(), introducing defcred to act as +an owner pointer when the function must acquire a default credential. +The commit neglected to update the code to release the default cred +along the successful path. The old code does not trigger because +cred_handle is now reassigned, so the default credential is leaked. + +Unify the success and failure cleanup for this function so that +defcred is properly released on success. + +Reported by Pavel BÅ™ezina. + +ticket: 9016 +tags: pullup +target_version: 1.19-next +target_version: 1.18-next + +(cherry picked from commit 593e16448e1af23eef74689afe06a7bcc86e79c7) +--- + src/lib/gssapi/krb5/inq_cred.c | 16 ++++++---------- + 1 file changed, 6 insertions(+), 10 deletions(-) + +diff --git a/src/lib/gssapi/krb5/inq_cred.c b/src/lib/gssapi/krb5/inq_cred.c +index a8f254110..bb63b726c 100644 +--- a/src/lib/gssapi/krb5/inq_cred.c ++++ b/src/lib/gssapi/krb5/inq_cred.c +@@ -127,7 +127,7 @@ krb5_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret, + if ((code = krb5_timeofday(context, &now))) { + *minor_status = code; + ret = GSS_S_FAILURE; +- goto fail; ++ goto cleanup; + } + + if (cred->expire != 0) { +@@ -158,7 +158,7 @@ krb5_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret, + *minor_status = code; + save_error_info(*minor_status, context); + ret = GSS_S_FAILURE; +- goto fail; ++ goto cleanup; + } + } + +@@ -174,7 +174,7 @@ krb5_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret, + if (ret_name) + kg_release_name(context, &ret_name); + /* *minor_status set above */ +- goto fail; ++ goto cleanup; + } + } + +@@ -190,20 +190,16 @@ krb5_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret, + + if (cred_usage) + *cred_usage = cred->usage; +- k5_mutex_unlock(&cred->lock); + + if (mechanisms) { + *mechanisms = mechs; + mechs = GSS_C_NO_OID_SET; + } + +- if (cred_handle == GSS_C_NO_CREDENTIAL) +- krb5_gss_release_cred(minor_status, (gss_cred_id_t *)&cred); +- +- krb5_free_context(context); + *minor_status = 0; +- return((lifetime == 0)?GSS_S_CREDENTIALS_EXPIRED:GSS_S_COMPLETE); +-fail: ++ ret = (lifetime == 0) ? GSS_S_CREDENTIALS_EXPIRED : GSS_S_COMPLETE; ++ ++cleanup: + k5_mutex_unlock(&cred->lock); + krb5_gss_release_cred(&tmpmin, &defcred); + krb5_free_context(context); diff --git a/krb5.spec b/krb5.spec index 48ff4fb..d27bf68 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.1 -Release: %{?zdpd}14%{?dist} +Release: %{?zdpd}15%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -93,6 +93,7 @@ Patch27: Using-locking-in-MEMORY-krb5_cc_get_principal.patch Patch28: Fix-use-after-free-during-krad-remote_shutdown.patch Patch29: Clean-up-gssapi_krb5-ccache-name-functions.patch Patch30: Fix-KDC-null-deref-on-bad-encrypted-challenge.patch +Patch31: Fix-defcred-leak-in-krb5-gss_inquire_cred.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -655,6 +656,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Wed Jul 21 2021 Robbie Harwood - 1.19.1-15 +- Fix defcred leak in krb5 gss_inquire_cred() + * Mon Jul 12 2021 Robbie Harwood - 1.19.1-14 - Fix KDC null deref on bad encrypted challenge (CVE-2021-36222) From c4016b4e4cb2510246b6bbe186acd5784592e9ff Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Mon, 26 Jul 2021 14:49:39 -0400 Subject: [PATCH 045/103] New upstream version (1.19.2) --- Add-APIs-for-marshalling-credentials.patch | 2 +- ...P_GET_CRED_LIST-for-faster-iteration.patch | 2 +- ...canonicalization-helper-to-k5test.py.patch | 2 +- ...ith-keytab-to-defer-canonicalization.patch | 2 +- ...context-after-failed-open-in-libkdb5.patch | 2 +- ...up-gssapi_krb5-ccache-name-functions.patch | 2 +- ...CM-flag-transmission-for-remove_cred.patch | 2 +- Fix-KCM-retrieval-support-for-sssd.patch | 2 +- ...ull-deref-on-bad-encrypted-challenge.patch | 113 ------------- ...efcred-leak-in-krb5-gss_inquire_cred.patch | 85 ---------- Fix-doc-build-for-Sphinx-4.0.patch | 152 ------------------ Fix-k5tls-module-for-OpenSSL-3.patch | 2 +- ...in-k-with-fallback-or-referral-realm.patch | 2 +- ...aks-on-error-in-kadm5-init-functions.patch | 2 +- ...pkcs11-build-issues-with-openssl-3.0.patch | 2 +- ...incipal-realm-canonicalization-cases.patch | 2 +- ...ter-free-during-krad-remote_shutdown.patch | 38 ----- ...teration-fallback-work-with-sssd-kcm.patch | 2 +- ...dejagnu-kadmin-tests-to-Python-tests.patch | 4 +- ...ecated-OpenSSL-calls-from-softpkcs11.patch | 2 +- Support-host-based-GSS-initiator-names.patch | 2 +- Use-KCM_OP_RETRIEVE-in-KCM-client.patch | 2 +- Use-asan-in-one-of-the-CI-builds.patch | 2 +- ...king-in-MEMORY-krb5_cc_get_principal.patch | 47 ------ ...am-FIPS-with-PRNG-and-RADIUS-and-MD4.patch | 4 +- downstream-Remove-3des-support.patch | 10 +- downstream-SELinux-integration.patch | 2 +- ...ackported-version-of-OpenSSL-3-KDF-i.patch | 2 +- downstream-fix-debuginfo-with-y.tab.c.patch | 2 +- downstream-ksu-pam-integration.patch | 2 +- downstream-netlib-and-dns.patch | 2 +- krb5.spec | 12 +- 32 files changed, 37 insertions(+), 474 deletions(-) delete mode 100644 Fix-KDC-null-deref-on-bad-encrypted-challenge.patch delete mode 100644 Fix-defcred-leak-in-krb5-gss_inquire_cred.patch delete mode 100644 Fix-doc-build-for-Sphinx-4.0.patch delete mode 100644 Fix-use-after-free-during-krad-remote_shutdown.patch delete mode 100644 Using-locking-in-MEMORY-krb5_cc_get_principal.patch diff --git a/Add-APIs-for-marshalling-credentials.patch b/Add-APIs-for-marshalling-credentials.patch index da613e9..8578721 100644 --- a/Add-APIs-for-marshalling-credentials.patch +++ b/Add-APIs-for-marshalling-credentials.patch @@ -1,4 +1,4 @@ -From c1fe1c8fa3df7f50c7e28d52263d0d24afb4b3a1 Mon Sep 17 00:00:00 2001 +From 3a99832252755cf7e5fef2bd824459cea3eb823e Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Thu, 14 Jan 2021 18:13:09 -0500 Subject: [PATCH] Add APIs for marshalling credentials diff --git a/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch b/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch index 060b039..455e3e0 100644 --- a/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch +++ b/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch @@ -1,4 +1,4 @@ -From a0ee8b02e56c65e5dcd569caed0e151cef004ef4 Mon Sep 17 00:00:00 2001 +From 8772d8f47b7460a0eef48366881483fd9b3acfd3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20B=C5=99ezina?= Date: Thu, 11 Feb 2021 15:33:10 +0100 Subject: [PATCH] Add KCM_OP_GET_CRED_LIST for faster iteration diff --git a/Add-hostname-canonicalization-helper-to-k5test.py.patch b/Add-hostname-canonicalization-helper-to-k5test.py.patch index 75c3e87..58179a2 100644 --- a/Add-hostname-canonicalization-helper-to-k5test.py.patch +++ b/Add-hostname-canonicalization-helper-to-k5test.py.patch @@ -1,4 +1,4 @@ -From 3e78bc5d48513fe38f3bc4228b12abcdc0733ee2 Mon Sep 17 00:00:00 2001 +From e88f0319427cee7245fb05c97a25473297c9d2d6 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Fri, 15 Jan 2021 14:43:34 -0500 Subject: [PATCH] Add hostname canonicalization helper to k5test.py diff --git a/Allow-kinit-with-keytab-to-defer-canonicalization.patch b/Allow-kinit-with-keytab-to-defer-canonicalization.patch index 9315f66..eee7d1d 100644 --- a/Allow-kinit-with-keytab-to-defer-canonicalization.patch +++ b/Allow-kinit-with-keytab-to-defer-canonicalization.patch @@ -1,4 +1,4 @@ -From 090c7319652466339e3e6482bdd1b5a294638dff Mon Sep 17 00:00:00 2001 +From fb4d9fa851b1d0d3375556d1cdc1fce72176df1e Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Thu, 3 Jun 2021 16:03:07 -0400 Subject: [PATCH] Allow kinit with keytab to defer canonicalization diff --git a/Clean-up-context-after-failed-open-in-libkdb5.patch b/Clean-up-context-after-failed-open-in-libkdb5.patch index a892a14..fca6a71 100644 --- a/Clean-up-context-after-failed-open-in-libkdb5.patch +++ b/Clean-up-context-after-failed-open-in-libkdb5.patch @@ -1,4 +1,4 @@ -From 78c03a9b5ef3e3f894bea11c89e575b9bb4d1b0f Mon Sep 17 00:00:00 2001 +From 95547c12b39e62df55cef05cae890302834b7f98 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Wed, 23 Jun 2021 16:57:39 -0400 Subject: [PATCH] Clean up context after failed open in libkdb5 diff --git a/Clean-up-gssapi_krb5-ccache-name-functions.patch b/Clean-up-gssapi_krb5-ccache-name-functions.patch index 32f3fc4..207f186 100644 --- a/Clean-up-gssapi_krb5-ccache-name-functions.patch +++ b/Clean-up-gssapi_krb5-ccache-name-functions.patch @@ -1,4 +1,4 @@ -From 8285f21d40e30477436128ae2c28403cd5575074 Mon Sep 17 00:00:00 2001 +From 5e5ea8e8345c8b2f3254b0d346b8e0de0df3a696 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Wed, 26 May 2021 18:22:10 -0400 Subject: [PATCH] Clean up gssapi_krb5 ccache name functions diff --git a/Fix-KCM-flag-transmission-for-remove_cred.patch b/Fix-KCM-flag-transmission-for-remove_cred.patch index 951be10..77c383e 100644 --- a/Fix-KCM-flag-transmission-for-remove_cred.patch +++ b/Fix-KCM-flag-transmission-for-remove_cred.patch @@ -1,4 +1,4 @@ -From 04f0de4420508161ce439f262f2761ff51a07ab0 Mon Sep 17 00:00:00 2001 +From 1528c264d0e1eebff34132c01f4f770f01f1d1c2 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Mon, 29 Mar 2021 14:32:56 -0400 Subject: [PATCH] Fix KCM flag transmission for remove_cred diff --git a/Fix-KCM-retrieval-support-for-sssd.patch b/Fix-KCM-retrieval-support-for-sssd.patch index 5fb7c2b..9c09507 100644 --- a/Fix-KCM-retrieval-support-for-sssd.patch +++ b/Fix-KCM-retrieval-support-for-sssd.patch @@ -1,4 +1,4 @@ -From a5b2cff51808cd86fe8195e7ac074ecd25c3344d Mon Sep 17 00:00:00 2001 +From 43be8fba5301d08fc4d5ddef14f8ae3d9655b0ba Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Tue, 11 May 2021 14:04:07 -0400 Subject: [PATCH] Fix KCM retrieval support for sssd diff --git a/Fix-KDC-null-deref-on-bad-encrypted-challenge.patch b/Fix-KDC-null-deref-on-bad-encrypted-challenge.patch deleted file mode 100644 index 4a7c7ae..0000000 --- a/Fix-KDC-null-deref-on-bad-encrypted-challenge.patch +++ /dev/null @@ -1,113 +0,0 @@ -From 791211b00a53b394376d096c881b725ee739a936 Mon Sep 17 00:00:00 2001 -From: Joseph Sutton -Date: Wed, 7 Jul 2021 11:47:44 +1200 -Subject: [PATCH] Fix KDC null deref on bad encrypted challenge - -The function ec_verify() in src/kdc/kdc_preauth_ec.c contains a check -to avoid further processing if the armor key is NULL. However, this -check is bypassed by a call to k5memdup0() which overwrites retval -with 0 if the allocation succeeds. If the armor key is NULL, a call -to krb5_c_fx_cf2_simple() will then dereference it, resulting in a -crash. Add a check before the k5memdup0() call to avoid overwriting -retval. - -CVE-2021-36222: - -In MIT krb5 releases 1.16 and later, an unauthenticated attacker can -cause a null dereference in the KDC by sending a request containing a -PA-ENCRYPTED-CHALLENGE padata element without using FAST. - -[ghudson@mit.edu: trimmed patch; added test case; edited commit -message] - -ticket: 9007 (new) -tags: pullup -target_version: 1.19-next -target_version: 1.18-next - -(cherry picked from commit fc98f520caefff2e5ee9a0026fdf5109944b3562) ---- - src/kdc/kdc_preauth_ec.c | 3 ++- - src/tests/Makefile.in | 1 + - src/tests/t_cve-2021-36222.py | 46 +++++++++++++++++++++++++++++++++++ - 3 files changed, 49 insertions(+), 1 deletion(-) - create mode 100644 src/tests/t_cve-2021-36222.py - -diff --git a/src/kdc/kdc_preauth_ec.c b/src/kdc/kdc_preauth_ec.c -index 7e636b3f9..43a9902cc 100644 ---- a/src/kdc/kdc_preauth_ec.c -+++ b/src/kdc/kdc_preauth_ec.c -@@ -87,7 +87,8 @@ ec_verify(krb5_context context, krb5_data *req_pkt, krb5_kdc_req *request, - } - - /* Check for a configured FAST ec auth indicator. */ -- realmstr = k5memdup0(realm.data, realm.length, &retval); -+ if (retval == 0) -+ realmstr = k5memdup0(realm.data, realm.length, &retval); - if (realmstr != NULL) - retval = profile_get_string(context->profile, KRB5_CONF_REALMS, - realmstr, -diff --git a/src/tests/Makefile.in b/src/tests/Makefile.in -index ab416cc5f..20f27d748 100644 ---- a/src/tests/Makefile.in -+++ b/src/tests/Makefile.in -@@ -159,6 +159,7 @@ check-pytests: unlockiter s4u2self - $(RUNPYTEST) $(srcdir)/t_cve-2012-1015.py $(PYTESTFLAGS) - $(RUNPYTEST) $(srcdir)/t_cve-2013-1416.py $(PYTESTFLAGS) - $(RUNPYTEST) $(srcdir)/t_cve-2013-1417.py $(PYTESTFLAGS) -+ $(RUNPYTEST) $(srcdir)/t_cve-2021-36222.py $(PYTESTFLAGS) - $(RM) au.log - $(RUNPYTEST) $(srcdir)/t_audit.py $(PYTESTFLAGS) - $(RUNPYTEST) $(srcdir)/jsonwalker.py -d $(srcdir)/au_dict.json \ -diff --git a/src/tests/t_cve-2021-36222.py b/src/tests/t_cve-2021-36222.py -new file mode 100644 -index 000000000..57e04993b ---- /dev/null -+++ b/src/tests/t_cve-2021-36222.py -@@ -0,0 +1,46 @@ -+import socket -+from k5test import * -+ -+realm = K5Realm() -+ -+# CVE-2021-36222 KDC null dereference on encrypted challenge preauth -+# without FAST -+ -+s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) -+a = (hostname, realm.portbase) -+ -+m = ('6A81A0' '30819D' # [APPLICATION 10] SEQUENCE -+ 'A103' '0201' '05' # [1] pvno = 5 -+ 'A203' '0201' '0A' # [2] msg-type = 10 -+ 'A30E' '300C' # [3] padata = SEQUENCE OF -+ '300A' # SEQUENCE -+ 'A104' '0202' '008A' # [1] padata-type = PA-ENCRYPTED-CHALLENGE -+ 'A202' '0400' # [2] padata-value = "" -+ 'A48180' '307E' # [4] req-body = SEQUENCE -+ 'A007' '0305' '0000000000' # [0] kdc-options = 0 -+ 'A120' '301E' # [1] cname = SEQUENCE -+ 'A003' '0201' '01' # [0] name-type = NT-PRINCIPAL -+ 'A117' '3015' # [1] name-string = SEQUENCE-OF -+ '1B06' '6B7262746774' # krbtgt -+ '1B0B' '4B5242544553542E434F4D' -+ # KRBTEST.COM -+ 'A20D' '1B0B' '4B5242544553542E434F4D' -+ # [2] realm = KRBTEST.COM -+ 'A320' '301E' # [3] sname = SEQUENCE -+ 'A003' '0201' '01' # [0] name-type = NT-PRINCIPAL -+ 'A117' '3015' # [1] name-string = SEQUENCE-OF -+ '1B06' '6B7262746774' # krbtgt -+ '1B0B' '4B5242544553542E434F4D' -+ # KRBTEST.COM -+ 'A511' '180F' '31393934303631303036303331375A' -+ # [5] till = 19940610060317Z -+ 'A703' '0201' '00' # [7] nonce = 0 -+ 'A808' '3006' # [8] etype = SEQUENCE OF -+ '020112' '020111') # aes256-cts aes128-cts -+ -+s.sendto(bytes.fromhex(m), a) -+ -+# Make sure kinit still works. -+realm.kinit(realm.user_princ, password('user')) -+ -+success('CVE-2021-36222 regression test') diff --git a/Fix-defcred-leak-in-krb5-gss_inquire_cred.patch b/Fix-defcred-leak-in-krb5-gss_inquire_cred.patch deleted file mode 100644 index 9b11bc7..0000000 --- a/Fix-defcred-leak-in-krb5-gss_inquire_cred.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 7e6cdffd47559be61a8c26c4ed3c500c536d5368 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Fri, 16 Jul 2021 13:39:39 -0400 -Subject: [PATCH] Fix defcred leak in krb5 gss_inquire_cred() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Commit 1cd2821c19b2b95e39d5fc2f451a035585a40fa5 altered the memory -management of krb5_gss_inquire_cred(), introducing defcred to act as -an owner pointer when the function must acquire a default credential. -The commit neglected to update the code to release the default cred -along the successful path. The old code does not trigger because -cred_handle is now reassigned, so the default credential is leaked. - -Unify the success and failure cleanup for this function so that -defcred is properly released on success. - -Reported by Pavel BÅ™ezina. - -ticket: 9016 -tags: pullup -target_version: 1.19-next -target_version: 1.18-next - -(cherry picked from commit 593e16448e1af23eef74689afe06a7bcc86e79c7) ---- - src/lib/gssapi/krb5/inq_cred.c | 16 ++++++---------- - 1 file changed, 6 insertions(+), 10 deletions(-) - -diff --git a/src/lib/gssapi/krb5/inq_cred.c b/src/lib/gssapi/krb5/inq_cred.c -index a8f254110..bb63b726c 100644 ---- a/src/lib/gssapi/krb5/inq_cred.c -+++ b/src/lib/gssapi/krb5/inq_cred.c -@@ -127,7 +127,7 @@ krb5_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret, - if ((code = krb5_timeofday(context, &now))) { - *minor_status = code; - ret = GSS_S_FAILURE; -- goto fail; -+ goto cleanup; - } - - if (cred->expire != 0) { -@@ -158,7 +158,7 @@ krb5_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret, - *minor_status = code; - save_error_info(*minor_status, context); - ret = GSS_S_FAILURE; -- goto fail; -+ goto cleanup; - } - } - -@@ -174,7 +174,7 @@ krb5_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret, - if (ret_name) - kg_release_name(context, &ret_name); - /* *minor_status set above */ -- goto fail; -+ goto cleanup; - } - } - -@@ -190,20 +190,16 @@ krb5_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret, - - if (cred_usage) - *cred_usage = cred->usage; -- k5_mutex_unlock(&cred->lock); - - if (mechanisms) { - *mechanisms = mechs; - mechs = GSS_C_NO_OID_SET; - } - -- if (cred_handle == GSS_C_NO_CREDENTIAL) -- krb5_gss_release_cred(minor_status, (gss_cred_id_t *)&cred); -- -- krb5_free_context(context); - *minor_status = 0; -- return((lifetime == 0)?GSS_S_CREDENTIALS_EXPIRED:GSS_S_COMPLETE); --fail: -+ ret = (lifetime == 0) ? GSS_S_CREDENTIALS_EXPIRED : GSS_S_COMPLETE; -+ -+cleanup: - k5_mutex_unlock(&cred->lock); - krb5_gss_release_cred(&tmpmin, &defcred); - krb5_free_context(context); diff --git a/Fix-doc-build-for-Sphinx-4.0.patch b/Fix-doc-build-for-Sphinx-4.0.patch deleted file mode 100644 index ae3972c..0000000 --- a/Fix-doc-build-for-Sphinx-4.0.patch +++ /dev/null @@ -1,152 +0,0 @@ -From 0bf023bdbb8335f48a6a4dcf8bd5dac9c2cd7fb6 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Wed, 26 May 2021 15:08:28 -0400 -Subject: [PATCH] Fix doc build for Sphinx 4.0 - -Use app.add_css_file() to register krb5.css if possible (it was added -in Sphinx 1.8), since the old name app.add_stylesheet() was removed in -Sphinx 4.0. - -Use the highlight directive instead of the highlightlang directive, -which was removed in Sphinx 4.0. - -Remove two duplicate table of contents entries to fix warnings. - -In the Github Actions configuration, add a second doc build using the -newest version of Sphinx. - -ticket: 9006 -tags: pullup -target_version: 1.19-next - -(cherry picked from commit 3fa40a32e22cb9de91fa1d18deddcba446515855) ---- - .github/workflows/doc.yml | 16 +++++++++++++++- - doc/appdev/refs/macros/index.rst | 1 - - doc/appdev/refs/types/index.rst | 1 - - doc/appdev/refs/types/krb5_int32.rst | 2 +- - doc/appdev/refs/types/krb5_ui_4.rst | 2 +- - doc/conf.py | 9 ++++++++- - doc/tools/define_document.tmpl | 2 +- - doc/tools/type_document.tmpl | 2 +- - 8 files changed, 27 insertions(+), 8 deletions(-) - -diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml -index 292df4cfe..75f467cde 100644 ---- a/.github/workflows/doc.yml -+++ b/.github/workflows/doc.yml -@@ -5,7 +5,7 @@ on: - pull_request: {paths: [doc/**, src/doc/*, src/include/krb5/krb5.hin, .github/workflows/doc.yml]} - - jobs: -- doc: -+ doc-older-sphinx: - runs-on: ubuntu-18.04 - steps: - - name: Checkout repository -@@ -19,6 +19,20 @@ jobs: - run: | - cd src/doc - make -f Makefile.in SPHINX_ARGS=-W htmlsrc -+ doc-newest-sphinx: -+ runs-on: ubuntu-18.04 -+ steps: -+ - name: Checkout repository -+ uses: actions/checkout@v1 -+ - name: Linux setup -+ run: | -+ sudo apt-get update -qq -+ sudo apt-get install -y doxygen python3-lxml python3-pip -+ pip3 install Cheetah3 sphinx -+ - name: Build documentation -+ run: | -+ cd src/doc -+ make -f Makefile.in SPHINX_ARGS=-W htmlsrc - - name: Upload HTML - uses: actions/upload-artifact@v2 - with: -diff --git a/doc/appdev/refs/macros/index.rst b/doc/appdev/refs/macros/index.rst -index 4d51e795c..0cb2e81bd 100644 ---- a/doc/appdev/refs/macros/index.rst -+++ b/doc/appdev/refs/macros/index.rst -@@ -54,7 +54,6 @@ Public - ENCTYPE_DES3_CBC_RAW.rst - ENCTYPE_DES3_CBC_SHA.rst - ENCTYPE_DES3_CBC_SHA1.rst -- ENCTYPE_DES3_CBC_SHA1.rst - ENCTYPE_DES_CBC_CRC.rst - ENCTYPE_DES_CBC_MD4.rst - ENCTYPE_DES_CBC_MD5.rst -diff --git a/doc/appdev/refs/types/index.rst b/doc/appdev/refs/types/index.rst -index dc414cfde..d8d2a8f3c 100644 ---- a/doc/appdev/refs/types/index.rst -+++ b/doc/appdev/refs/types/index.rst -@@ -62,7 +62,6 @@ Public - krb5_preauthtype.rst - krb5_principal.rst - krb5_principal_data.rst -- krb5_const_principal.rst - krb5_prompt.rst - krb5_prompt_type.rst - krb5_prompter_fct.rst -diff --git a/doc/appdev/refs/types/krb5_int32.rst b/doc/appdev/refs/types/krb5_int32.rst -index 2bc914b3c..28baafa38 100644 ---- a/doc/appdev/refs/types/krb5_int32.rst -+++ b/doc/appdev/refs/types/krb5_int32.rst -@@ -1,4 +1,4 @@ --.. highlightlang:: c -+.. highlight:: c - - .. _krb5-int32-struct: - -diff --git a/doc/appdev/refs/types/krb5_ui_4.rst b/doc/appdev/refs/types/krb5_ui_4.rst -index de79bafe1..73eb38cf4 100644 ---- a/doc/appdev/refs/types/krb5_ui_4.rst -+++ b/doc/appdev/refs/types/krb5_ui_4.rst -@@ -1,4 +1,4 @@ --.. highlightlang:: c -+.. highlight:: c - - .. _krb5-ui4-struct: - -diff --git a/doc/conf.py b/doc/conf.py -index 4fb6aae14..a876fd633 100644 ---- a/doc/conf.py -+++ b/doc/conf.py -@@ -98,8 +98,15 @@ pygments_style = 'sphinx' - - # -- Options for HTML output --------------------------------------------------- - -+# When we can rely on Sphinx 1.8 (released Sep 2018) we can just set: -+# html_css_files = ['kerb.css'] -+# But in the meantime, we add this file using either a way that works -+# after 1.8 or a way that works before 4.0. - def setup(app): -- app.add_stylesheet('kerb.css') -+ if callable(getattr(app, 'add_css_file', None)): -+ app.add_css_file('kerb.css') -+ else: -+ app.add_stylesheet('kerb.css') - - # The theme to use for HTML and HTML Help pages. See the documentation for - # a list of builtin themes. -diff --git a/doc/tools/define_document.tmpl b/doc/tools/define_document.tmpl -index ca56d866c..8e74dc302 100644 ---- a/doc/tools/define_document.tmpl -+++ b/doc/tools/define_document.tmpl -@@ -1,4 +1,4 @@ --.. highlightlang:: c -+.. highlight:: c - - .. $composite.macro_reference($composite.name): - -diff --git a/doc/tools/type_document.tmpl b/doc/tools/type_document.tmpl -index 5987fa762..11aafb818 100644 ---- a/doc/tools/type_document.tmpl -+++ b/doc/tools/type_document.tmpl -@@ -1,4 +1,4 @@ --.. highlightlang:: c -+.. highlight:: c - - .. $composite.struct_reference($composite.name): - diff --git a/Fix-k5tls-module-for-OpenSSL-3.patch b/Fix-k5tls-module-for-OpenSSL-3.patch index fd425b8..f53a23c 100644 --- a/Fix-k5tls-module-for-OpenSSL-3.patch +++ b/Fix-k5tls-module-for-OpenSSL-3.patch @@ -1,4 +1,4 @@ -From 201e38845e9f70234bcaa9ba7c25b28e38169b0a Mon Sep 17 00:00:00 2001 +From 7e4429640f69acdd5d4f9caa655c011d8bd736f0 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Sat, 29 May 2021 12:05:49 -0400 Subject: [PATCH] Fix k5tls module for OpenSSL 3 diff --git a/Fix-kadmin-k-with-fallback-or-referral-realm.patch b/Fix-kadmin-k-with-fallback-or-referral-realm.patch index 3e03da1..a5162e7 100644 --- a/Fix-kadmin-k-with-fallback-or-referral-realm.patch +++ b/Fix-kadmin-k-with-fallback-or-referral-realm.patch @@ -1,4 +1,4 @@ -From cd8ff035f5b4720a8fc457355726f7bd0eab5eaa Mon Sep 17 00:00:00 2001 +From 2d2bb9a14613b3283dabdd40c3ee28e5b680cf93 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Mon, 7 Jun 2021 15:00:41 -0400 Subject: [PATCH] Fix kadmin -k with fallback or referral realm diff --git a/Fix-leaks-on-error-in-kadm5-init-functions.patch b/Fix-leaks-on-error-in-kadm5-init-functions.patch index ef12052..bdacecb 100644 --- a/Fix-leaks-on-error-in-kadm5-init-functions.patch +++ b/Fix-leaks-on-error-in-kadm5-init-functions.patch @@ -1,4 +1,4 @@ -From 6b2f7995ab23cffcababe537d57540236f99f0e3 Mon Sep 17 00:00:00 2001 +From a14e0fd3c1d00ba625e6d9eb72829f31527c6ad8 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Wed, 23 Jun 2021 16:53:16 -0400 Subject: [PATCH] Fix leaks on error in kadm5 init functions diff --git a/Fix-softpkcs11-build-issues-with-openssl-3.0.patch b/Fix-softpkcs11-build-issues-with-openssl-3.0.patch index d7a0a5c..184c1bf 100644 --- a/Fix-softpkcs11-build-issues-with-openssl-3.0.patch +++ b/Fix-softpkcs11-build-issues-with-openssl-3.0.patch @@ -1,4 +1,4 @@ -From a86b780ef275b35e8dc1e6d1886ec8e8d941f7c4 Mon Sep 17 00:00:00 2001 +From 391379bff864751262dbcedb897f2c2dd394345f Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Sat, 15 May 2021 17:35:25 -0400 Subject: [PATCH] Fix softpkcs11 build issues with openssl 3.0 diff --git a/Fix-some-principal-realm-canonicalization-cases.patch b/Fix-some-principal-realm-canonicalization-cases.patch index 2c6c915..81fde7f 100644 --- a/Fix-some-principal-realm-canonicalization-cases.patch +++ b/Fix-some-principal-realm-canonicalization-cases.patch @@ -1,4 +1,4 @@ -From 5ae9bc98f23aeaa2ce17debe5a9b0cf1130e54ed Mon Sep 17 00:00:00 2001 +From 0779309f52f4c05bb1f01f638261ef1b8ca82488 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Mon, 7 Jun 2021 13:27:29 -0400 Subject: [PATCH] Fix some principal realm canonicalization cases diff --git a/Fix-use-after-free-during-krad-remote_shutdown.patch b/Fix-use-after-free-during-krad-remote_shutdown.patch deleted file mode 100644 index fb9c56d..0000000 --- a/Fix-use-after-free-during-krad-remote_shutdown.patch +++ /dev/null @@ -1,38 +0,0 @@ -From bcd7b5e8aa0d325e9b178d9be3459759d39b631e Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Sat, 29 May 2021 13:25:59 -0400 -Subject: [PATCH] Fix use-after-free during krad remote_shutdown() - -Since elements of the queue can be removed on out-of-memory errors, -the correct call is K5_TAILQ_FOREACH_SAFE, not K5_TAILQ_FOREACH. -Reported by Coverity. - -ticket: 9015 (new) -tags: pullup -target_version: 1.19-next -target_version: 1.18-next - -(cherry picked from commit 8c88defb16b34937d5b72b4832c854ce2dbe32d1) ---- - src/lib/krad/remote.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c -index eca432424..7b5804b1d 100644 ---- a/src/lib/krad/remote.c -+++ b/src/lib/krad/remote.c -@@ -220,12 +220,12 @@ static void - remote_shutdown(krad_remote *rr) - { - krb5_error_code retval; -- request *r; -+ request *r, *next; - - remote_disconnect(rr); - - /* Start timers for all unsent packets. */ -- K5_TAILQ_FOREACH(r, &rr->list, list) { -+ K5_TAILQ_FOREACH_SAFE(r, &rr->list, list, next) { - if (r->timer == NULL) { - retval = request_start_timer(r, rr->vctx); - if (retval != 0) diff --git a/Make-KCM-iteration-fallback-work-with-sssd-kcm.patch b/Make-KCM-iteration-fallback-work-with-sssd-kcm.patch index 5fa3106..a0e28a9 100644 --- a/Make-KCM-iteration-fallback-work-with-sssd-kcm.patch +++ b/Make-KCM-iteration-fallback-work-with-sssd-kcm.patch @@ -1,4 +1,4 @@ -From 2dbca7e14c945d6394e0e05f285a068dcd541295 Mon Sep 17 00:00:00 2001 +From 32ee800fa31d3bbda660bb9270f9aa20718ab202 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20B=C5=99ezina?= Date: Tue, 30 Mar 2021 14:35:28 +0200 Subject: [PATCH] Make KCM iteration fallback work with sssd-kcm diff --git a/Move-some-dejagnu-kadmin-tests-to-Python-tests.patch b/Move-some-dejagnu-kadmin-tests-to-Python-tests.patch index 9334c19..1c97190 100644 --- a/Move-some-dejagnu-kadmin-tests-to-Python-tests.patch +++ b/Move-some-dejagnu-kadmin-tests-to-Python-tests.patch @@ -1,4 +1,4 @@ -From 9b3d8b9c395bf1a889ea6d6439dc3543c680480d Mon Sep 17 00:00:00 2001 +From 2fd38805a159020722395e79213540d9bcfa6c71 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Thu, 22 Apr 2021 15:51:36 -0400 Subject: [PATCH] Move some dejagnu kadmin tests to Python tests @@ -32,7 +32,7 @@ and the ticket 2841 regression tests from pwhist.exp. create mode 100644 src/tests/t_kadmin.py diff --git a/src/tests/Makefile.in b/src/tests/Makefile.in -index 6b7749129..ab416cc5f 100644 +index fd714eedb..20f27d748 100644 --- a/src/tests/Makefile.in +++ b/src/tests/Makefile.in @@ -147,6 +147,7 @@ check-pytests: unlockiter s4u2self diff --git a/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch b/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch index 23f21a5..429cf4d 100644 --- a/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch +++ b/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch @@ -1,4 +1,4 @@ -From 5072bfdfaddae762680d0f9d97afa6dbf8274760 Mon Sep 17 00:00:00 2001 +From 0a2778833d2f04a29fe9d7122913abe42299044a Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Sat, 15 May 2021 18:04:58 -0400 Subject: [PATCH] Remove deprecated OpenSSL calls from softpkcs11 diff --git a/Support-host-based-GSS-initiator-names.patch b/Support-host-based-GSS-initiator-names.patch index 25b074f..cd7450c 100644 --- a/Support-host-based-GSS-initiator-names.patch +++ b/Support-host-based-GSS-initiator-names.patch @@ -1,4 +1,4 @@ -From 3133e5e24e94bf060e23a4d97cbdf74e934d010f Mon Sep 17 00:00:00 2001 +From 818a777822658d44ce647fe975011a5ea25e8250 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Fri, 15 Jan 2021 13:51:34 -0500 Subject: [PATCH] Support host-based GSS initiator names diff --git a/Use-KCM_OP_RETRIEVE-in-KCM-client.patch b/Use-KCM_OP_RETRIEVE-in-KCM-client.patch index 401b363..2af5676 100644 --- a/Use-KCM_OP_RETRIEVE-in-KCM-client.patch +++ b/Use-KCM_OP_RETRIEVE-in-KCM-client.patch @@ -1,4 +1,4 @@ -From c56d4b87de0f30a38dc61d374ad225d02d581eb3 Mon Sep 17 00:00:00 2001 +From 336f744403baa5dfaffcc5bd226fdd8f14a0200b Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Fri, 26 Mar 2021 23:38:54 -0400 Subject: [PATCH] Use KCM_OP_RETRIEVE in KCM client diff --git a/Use-asan-in-one-of-the-CI-builds.patch b/Use-asan-in-one-of-the-CI-builds.patch index e6b1e86..4964d2f 100644 --- a/Use-asan-in-one-of-the-CI-builds.patch +++ b/Use-asan-in-one-of-the-CI-builds.patch @@ -1,4 +1,4 @@ -From 5457242ca6742ace42f1f7dbe37208752c6f26f4 Mon Sep 17 00:00:00 2001 +From 37e1fe755c6e976253a7f40ec7a9e740e4329789 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Mon, 21 Jun 2021 19:15:26 -0400 Subject: [PATCH] Use asan in one of the CI builds diff --git a/Using-locking-in-MEMORY-krb5_cc_get_principal.patch b/Using-locking-in-MEMORY-krb5_cc_get_principal.patch deleted file mode 100644 index 2ae1967..0000000 --- a/Using-locking-in-MEMORY-krb5_cc_get_principal.patch +++ /dev/null @@ -1,47 +0,0 @@ -From d9a6607d47ff6449d1cad2a9a5b4d3b9b2768ddd Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Sun, 20 Jun 2021 19:24:07 -0400 -Subject: [PATCH] Using locking in MEMORY krb5_cc_get_principal() - -Without locking, the principal pointer could be freed out from under -krb5_copy_principal() by another thread calling krb5_cc_initialize() -or krb5_cc_destroy(). - -ticket: 9014 (new) -tags: pullup -target_version: 1.19-next -target_version: 1.18-next - -(cherry picked from commit 1848447291c68e21311f441b0458ae53471d00d3) ---- - src/lib/krb5/ccache/cc_memory.c | 17 +++++++++++------ - 1 file changed, 11 insertions(+), 6 deletions(-) - -diff --git a/src/lib/krb5/ccache/cc_memory.c b/src/lib/krb5/ccache/cc_memory.c -index 610091a25..e4c795d25 100644 ---- a/src/lib/krb5/ccache/cc_memory.c -+++ b/src/lib/krb5/ccache/cc_memory.c -@@ -575,12 +575,17 @@ krb5_mcc_get_name (krb5_context context, krb5_ccache id) - krb5_error_code KRB5_CALLCONV - krb5_mcc_get_principal(krb5_context context, krb5_ccache id, krb5_principal *princ) - { -- krb5_mcc_data *ptr = (krb5_mcc_data *)id->data; -- if (!ptr->prin) { -- *princ = 0L; -- return KRB5_FCC_NOFILE; -- } -- return krb5_copy_principal(context, ptr->prin, princ); -+ krb5_error_code ret; -+ krb5_mcc_data *d = id->data; -+ -+ *princ = NULL; -+ k5_cc_mutex_lock(context, &d->lock); -+ if (d->prin == NULL) -+ ret = KRB5_FCC_NOFILE; -+ else -+ ret = krb5_copy_principal(context, d->prin, princ); -+ k5_cc_mutex_unlock(context, &d->lock); -+ return ret; - } - - krb5_error_code KRB5_CALLCONV diff --git a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch b/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch index d48b1cd..553dec9 100644 --- a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch +++ b/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch @@ -1,4 +1,4 @@ -From 852e9efad17e3ef6ea54f91044a279bb34020ecf Mon Sep 17 00:00:00 2001 +From 91e1d43858d90f59f5d9f45987cfca02c3175feb Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 9 Nov 2018 15:12:21 -0500 Subject: [PATCH] [downstream] FIPS with PRNG and RADIUS and MD4 @@ -477,7 +477,7 @@ index c597174b6..fc2d24800 100644 } diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c -index c96a9b4ee..eca432424 100644 +index a938665f6..7b5804b1d 100644 --- a/src/lib/krad/remote.c +++ b/src/lib/krad/remote.c @@ -263,7 +263,7 @@ on_io_write(krad_remote *rr) diff --git a/downstream-Remove-3des-support.patch b/downstream-Remove-3des-support.patch index 2bc2479..9c29cdd 100644 --- a/downstream-Remove-3des-support.patch +++ b/downstream-Remove-3des-support.patch @@ -1,4 +1,4 @@ -From fef4e551d3d2dcb55e58cc182304254c36aa8949 Mon Sep 17 00:00:00 2001 +From defa8816e26ab9f5a8f0b61e7bebad67175c433e Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 26 Mar 2019 18:51:10 -0400 Subject: [PATCH] [downstream] Remove 3des support @@ -195,7 +195,7 @@ index 1dc958d62..3a72aabef 100644 While **aes128-cts** and **aes256-cts** are supported for all Kerberos diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst -index 047185afb..b08d954d9 100644 +index 694922c0d..c4d5499d3 100644 --- a/doc/admin/enctypes.rst +++ b/doc/admin/enctypes.rst @@ -129,7 +129,7 @@ enctype weak? krb5 Windows @@ -243,7 +243,7 @@ index ade5e1f87..e4dc54f7e 100644 .. _err_cert_chain_cert_expired: diff --git a/doc/appdev/refs/macros/index.rst b/doc/appdev/refs/macros/index.rst -index cebb6644c..4d51e795c 100644 +index 5542d9850..0cb2e81bd 100644 --- a/doc/appdev/refs/macros/index.rst +++ b/doc/appdev/refs/macros/index.rst @@ -36,7 +36,6 @@ Public @@ -255,10 +255,10 @@ index cebb6644c..4d51e795c 100644 CKSUMTYPE_NIST_SHA.rst CKSUMTYPE_RSA_MD4.rst diff --git a/doc/conf.py b/doc/conf.py -index 543202bf4..4fb6aae14 100644 +index 14158ae81..a876fd633 100644 --- a/doc/conf.py +++ b/doc/conf.py -@@ -271,7 +271,7 @@ else: +@@ -278,7 +278,7 @@ else: rst_epilog += ''' .. |krb5conf| replace:: ``/etc/krb5.conf`` .. |defkeysalts| replace:: ``aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal`` diff --git a/downstream-SELinux-integration.patch b/downstream-SELinux-integration.patch index 0ba8b6c..48b058b 100644 --- a/downstream-SELinux-integration.patch +++ b/downstream-SELinux-integration.patch @@ -1,4 +1,4 @@ -From e787771b618a344d45ac515927e914602f48946f Mon Sep 17 00:00:00 2001 +From 97966ffaac6bf9f2e09ac33a16b15794b31d51de Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:30:53 -0400 Subject: [PATCH] [downstream] SELinux integration diff --git a/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch b/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch index 84551d1..4a9f664 100644 --- a/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch +++ b/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch @@ -1,4 +1,4 @@ -From 687bb26cb0877fa5497e90f7d325de42b456da2a Mon Sep 17 00:00:00 2001 +From 86d606e33439fd0511c5154be7f32b0df2c72e54 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 15 Nov 2019 20:05:16 +0000 Subject: [PATCH] [downstream] Use backported version of OpenSSL-3 KDF diff --git a/downstream-fix-debuginfo-with-y.tab.c.patch b/downstream-fix-debuginfo-with-y.tab.c.patch index 172a093..494152c 100644 --- a/downstream-fix-debuginfo-with-y.tab.c.patch +++ b/downstream-fix-debuginfo-with-y.tab.c.patch @@ -1,4 +1,4 @@ -From d5ea86ef491feb38f12e6aa53b7579ac02675df6 Mon Sep 17 00:00:00 2001 +From 98b50683165089bf7bd9d91f953abbd79a8b1b08 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:49:25 -0400 Subject: [PATCH] [downstream] fix debuginfo with y.tab.c diff --git a/downstream-ksu-pam-integration.patch b/downstream-ksu-pam-integration.patch index 7490bf2..bebe946 100644 --- a/downstream-ksu-pam-integration.patch +++ b/downstream-ksu-pam-integration.patch @@ -1,4 +1,4 @@ -From 90ba715be48c2e1b6c7ca53cb1d75f3af2c388d6 Mon Sep 17 00:00:00 2001 +From 659b3b4a654b879ce84ad8fb4621dde5ae693385 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:29:58 -0400 Subject: [PATCH] [downstream] ksu pam integration diff --git a/downstream-netlib-and-dns.patch b/downstream-netlib-and-dns.patch index de4f9bf..d3ae129 100644 --- a/downstream-netlib-and-dns.patch +++ b/downstream-netlib-and-dns.patch @@ -1,4 +1,4 @@ -From ad123366e5fb2694cf6d9f4f292a001a761b78fa Mon Sep 17 00:00:00 2001 +From 2d7e197fa88dccd3ca051f9f7cb97937c35c55a8 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:46:21 -0400 Subject: [PATCH] [downstream] netlib and dns diff --git a/krb5.spec b/krb5.spec index d27bf68..930a581 100644 --- a/krb5.spec +++ b/krb5.spec @@ -41,8 +41,8 @@ Summary: The Kerberos network authentication system Name: krb5 -Version: 1.19.1 -Release: %{?zdpd}15%{?dist} +Version: 1.19.2 +Release: %{?zdpd}1%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -78,7 +78,6 @@ Patch12: Fix-KCM-flag-transmission-for-remove_cred.patch Patch13: Make-KCM-iteration-fallback-work-with-sssd-kcm.patch Patch14: Use-KCM_OP_RETRIEVE-in-KCM-client.patch Patch15: Fix-KCM-retrieval-support-for-sssd.patch -Patch16: Fix-doc-build-for-Sphinx-4.0.patch Patch17: Move-some-dejagnu-kadmin-tests-to-Python-tests.patch Patch18: Fix-some-principal-realm-canonicalization-cases.patch Patch19: Allow-kinit-with-keytab-to-defer-canonicalization.patch @@ -89,11 +88,7 @@ Patch23: Fix-k5tls-module-for-OpenSSL-3.patch Patch24: Fix-leaks-on-error-in-kadm5-init-functions.patch Patch25: Clean-up-context-after-failed-open-in-libkdb5.patch Patch26: Use-asan-in-one-of-the-CI-builds.patch -Patch27: Using-locking-in-MEMORY-krb5_cc_get_principal.patch -Patch28: Fix-use-after-free-during-krad-remote_shutdown.patch Patch29: Clean-up-gssapi_krb5-ccache-name-functions.patch -Patch30: Fix-KDC-null-deref-on-bad-encrypted-challenge.patch -Patch31: Fix-defcred-leak-in-krb5-gss_inquire_cred.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -656,6 +651,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Mon Jul 26 2021 Robbie Harwood - 1.19.2-1 +- New upstream version (1.19.2) + * Wed Jul 21 2021 Robbie Harwood - 1.19.1-15 - Fix defcred leak in krb5 gss_inquire_cred() From 03e8c698378c01b1c18019b35288f005fd4be69d Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Mon, 26 Jul 2021 14:50:12 -0400 Subject: [PATCH 046/103] Add sources --- .gitignore | 2 ++ sources | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 01d1000..c3c3cb9 100644 --- a/.gitignore +++ b/.gitignore @@ -197,3 +197,5 @@ krb5-1.8.3-pdf.tar.gz /krb5-1.19.tar.gz.asc /krb5-1.19.1.tar.gz /krb5-1.19.1.tar.gz.asc +/krb5-1.19.2.tar.gz +/krb5-1.19.2.tar.gz.asc diff --git a/sources b/sources index e74f7db..16c7a8d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (krb5-1.19.1.tar.gz) = 36bf33802119ada4650a8f69f1daca95aaf882dc96bfa7061f0340a5decd588c31fc10108ddadf1042934e0e2c3bbd975deec565b0a7f0fc2baf8b8cc6d97491 -SHA512 (krb5-1.19.1.tar.gz.asc) = 078924730ce441630b4ac553a76ba0ebacb09b67dd057a53e3cf42185dd80bf423e875bddd306e4e91873797a9c013a7b0cae66134976abdea2c9752028e66c7 +SHA512 (krb5-1.19.2.tar.gz) = b90d6ed0e1e8a87eb5cb2c36d88b823a6a6caabf85e5d419adb8a930f7eea09a5f8491464e7e454cca7ba88be09d19415962fe0036ad2e31fc584f9fc0bbd470 +SHA512 (krb5-1.19.2.tar.gz.asc) = 87c4d096dbb6821401125b8f8a315ce1aac029744ba9670a4f8a2a680e6dd5798e1c6d5d2b68b17fd9a4b3b9c6ff111cd1dcac42f934d48fb20381b3765e0f64 From ca196a9d6b85240361be460c4bcd731286919a54 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Thu, 19 Aug 2021 12:29:56 -0400 Subject: [PATCH 047/103] Fix KDC null deref on TGS inner body null server (CVE-2021-37750) --- ...-deref-on-TGS-inner-body-null-server.patch | 45 +++++++++++++++++++ krb5.spec | 6 ++- 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch diff --git a/Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch b/Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch new file mode 100644 index 0000000..24b9d95 --- /dev/null +++ b/Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch @@ -0,0 +1,45 @@ +From bb8fa495d00ccd931eec87a01b8920636cf7903e Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Tue, 3 Aug 2021 01:15:27 -0400 +Subject: [PATCH] Fix KDC null deref on TGS inner body null server + +After the KDC decodes a FAST inner body, it does not check for a null +server. Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this +would typically result in an error from krb5_unparse_name(), but with +the addition of get_local_tgt() it results in a null dereference. Add +a null check. + +Reported by Joseph Sutton of Catalyst. + +CVE-2021-37750: + +In MIT krb5 releases 1.14 and later, an authenticated attacker can +cause a null dereference in the KDC by sending a FAST TGS request with +no server field. + +ticket: 9008 (new) +tags: pullup +target_version: 1.19-next +target_version: 1.18-next + +(cherry picked from commit d775c95af7606a51bf79547a94fa52ddd1cb7f49) +--- + src/kdc/do_tgs_req.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c +index 6d244ffd4..39a504ca1 100644 +--- a/src/kdc/do_tgs_req.c ++++ b/src/kdc/do_tgs_req.c +@@ -207,6 +207,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt, + status = "FIND_FAST"; + goto cleanup; + } ++ if (sprinc == NULL) { ++ status = "NULL_SERVER"; ++ errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN; ++ goto cleanup; ++ } + + errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server, + &local_tgt, &local_tgt_storage, &local_tgt_key); diff --git a/krb5.spec b/krb5.spec index 930a581..37c3b90 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.2 -Release: %{?zdpd}1%{?dist} +Release: %{?zdpd}2%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -89,6 +89,7 @@ Patch24: Fix-leaks-on-error-in-kadm5-init-functions.patch Patch25: Clean-up-context-after-failed-open-in-libkdb5.patch Patch26: Use-asan-in-one-of-the-CI-builds.patch Patch29: Clean-up-gssapi_krb5-ccache-name-functions.patch +Patch30: Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -651,6 +652,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Thu Aug 19 2021 Robbie Harwood - 1.19.2-2 +- Fix KDC null deref on TGS inner body null server (CVE-2021-37750) + * Mon Jul 26 2021 Robbie Harwood - 1.19.2-1 - New upstream version (1.19.2) From 91c904e5dff1a257fe4f04a32271ac52e9cb6043 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 24 Aug 2021 17:13:22 +0000 Subject: [PATCH 048/103] Remove -specs= from krb5-config output --- krb5.spec | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/krb5.spec b/krb5.spec index 37c3b90..97aaf81 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.2 -Release: %{?zdpd}2%{?dist} +Release: %{?zdpd}3%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -428,14 +428,9 @@ install -pdm 755 $RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/authdata # list of link flags, and it helps prevent file conflicts on multilib systems. sed -r -i -e 's|^libdir=/usr/lib(64)?$|libdir=/usr/lib|g' $RPM_BUILD_ROOT%{_bindir}/krb5-config -# Temporay workaround for krb5-config reading too much from LDFLAGS. -# Upstream: http://krbdev.mit.edu/rt/Ticket/Display.html?id=8159 -sed -r -i -e "s/-specs=\/.+?\/redhat-hardened-ld//g" $RPM_BUILD_ROOT%{_bindir}/krb5-config - -if [[ "$(< $RPM_BUILD_ROOT%{_bindir}/krb5-config )" == *redhat-hardened-ld* ]] ; then - printf '# redhat-hardened-ld for krb5-config failed' 1>&2 - exit 1 -fi +# Workaround krb5-config reading too much from LDFLAGS. +# https://bugzilla.redhat.com/show_bug.cgi?id=1997021 +sed -i -e "s/-specs=[^ ]*//g" $RPM_BUILD_ROOT%{_bindir}/krb5-config # Install processed man pages. for section in 1 5 8 ; do @@ -652,6 +647,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Tue Aug 24 2021 Robbie Harwood - 1.19.2-3 +- Remove -specs= from krb5-config output + * Thu Aug 19 2021 Robbie Harwood - 1.19.2-2 - Fix KDC null deref on TGS inner body null server (CVE-2021-37750) From 70255ea5b0b01697348072a05daa776297ecd9a7 Mon Sep 17 00:00:00 2001 From: Sahana Prasad Date: Tue, 14 Sep 2021 19:05:45 +0200 Subject: [PATCH 049/103] Rebuilt with OpenSSL 3.0.0 --- krb5.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/krb5.spec b/krb5.spec index 97aaf81..82c7d8a 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.2 -Release: %{?zdpd}3%{?dist} +Release: %{?zdpd}3%{?dist}.1 # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -647,6 +647,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Tue Sep 14 2021 Sahana Prasad - 1.19.2-3.1 +- Rebuilt with OpenSSL 3.0.0 + * Tue Aug 24 2021 Robbie Harwood - 1.19.2-3 - Remove -specs= from krb5-config output From ad88d4fd50a31f6cfe4de56d387f1a6f1aa5468c Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Fri, 3 Dec 2021 11:25:46 +0100 Subject: [PATCH 050/103] Add patches to support OpenSSL 3.0.0 Signed-off-by: Antonio Torres --- ...detection-of-the-OpenSSL-3-KDF-inter.patch | 25 + Fix-k5tls-module-for-OpenSSL-3.patch | 3 +- ...pkcs11-build-issues-with-openssl-3.0.patch | 3 +- Handle-OpenSSL-3-s-providers.patch | 301 + Remove-TCL-based-libkadm5-API-tests.patch | 18229 ++++++++++++++++ ...ecated-OpenSSL-calls-from-softpkcs11.patch | 7 +- ...KDF-and-KRB5KDF-for-deriving-long-te.patch | 482 + ...SSL-s-SSKDF-in-PKINIT-when-available.patch | 408 + downstream-Remove-3des-support.patch | 68 +- krb5.spec | 25 +- 10 files changed, 19474 insertions(+), 77 deletions(-) create mode 100644 Add-buildsystem-detection-of-the-OpenSSL-3-KDF-inter.patch create mode 100644 Handle-OpenSSL-3-s-providers.patch create mode 100644 Remove-TCL-based-libkadm5-API-tests.patch create mode 100644 Use-OpenSSL-s-KBKDF-and-KRB5KDF-for-deriving-long-te.patch create mode 100644 Use-OpenSSL-s-SSKDF-in-PKINIT-when-available.patch diff --git a/Add-buildsystem-detection-of-the-OpenSSL-3-KDF-inter.patch b/Add-buildsystem-detection-of-the-OpenSSL-3-KDF-inter.patch new file mode 100644 index 0000000..269a457 --- /dev/null +++ b/Add-buildsystem-detection-of-the-OpenSSL-3-KDF-inter.patch @@ -0,0 +1,25 @@ +From 2f039fc910022c9569fe6941a194f0b26bd6c894 Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Fri, 20 Sep 2019 16:11:29 -0400 +Subject: [PATCH] Add buildsystem detection of the OpenSSL-3 KDF interface + +(cherry picked from commit a3e03dfd40928c4615bd9b8546eac0c104377850) +--- + src/configure.ac | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/configure.ac b/src/configure.ac +index eb6307468..9c2e816fe 100644 +--- a/src/configure.ac ++++ b/src/configure.ac +@@ -282,6 +282,10 @@ AC_SUBST(CRYPTO_IMPL) + AC_SUBST(CRYPTO_IMPL_CFLAGS) + AC_SUBST(CRYPTO_IMPL_LIBS) + ++if test "$CRYPTO_IMPL" = openssl; then ++ AC_CHECK_FUNCS(EVP_KDF_fetch) ++fi ++ + AC_ARG_WITH([prng-alg], + AC_HELP_STRING([--with-prng-alg=ALG], [use specified PRNG algorithm. @<:@fortuna@:>@]), + [PRNG_ALG=$withval diff --git a/Fix-k5tls-module-for-OpenSSL-3.patch b/Fix-k5tls-module-for-OpenSSL-3.patch index f53a23c..a2b9e34 100644 --- a/Fix-k5tls-module-for-OpenSSL-3.patch +++ b/Fix-k5tls-module-for-OpenSSL-3.patch @@ -1,4 +1,4 @@ -From 7e4429640f69acdd5d4f9caa655c011d8bd736f0 Mon Sep 17 00:00:00 2001 +From 51938a8b731740299fe47d132b8840edba4141bc Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Sat, 29 May 2021 12:05:49 -0400 Subject: [PATCH] Fix k5tls module for OpenSSL 3 @@ -16,6 +16,7 @@ doesn't clear existing options. [ghudson@mit.edu: edited commit message and comment] (cherry picked from commit aa9b4a2a64046afd2fab7cb49c346295874a5fb6) +(cherry picked from commit 201e38845e9f70234bcaa9ba7c25b28e38169b0a) --- src/plugins/tls/k5tls/openssl.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/Fix-softpkcs11-build-issues-with-openssl-3.0.patch b/Fix-softpkcs11-build-issues-with-openssl-3.0.patch index 184c1bf..ba5a8b5 100644 --- a/Fix-softpkcs11-build-issues-with-openssl-3.0.patch +++ b/Fix-softpkcs11-build-issues-with-openssl-3.0.patch @@ -1,4 +1,4 @@ -From 391379bff864751262dbcedb897f2c2dd394345f Mon Sep 17 00:00:00 2001 +From f85a818fe1a7438db7e1ea579818da67e0be017d Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Sat, 15 May 2021 17:35:25 -0400 Subject: [PATCH] Fix softpkcs11 build issues with openssl 3.0 @@ -17,6 +17,7 @@ Move several argument validation checks to the top of their functions. Fix some incorrect/inconsistent log messages. (cherry picked from commit 00de1aad7b3647b91017c7009b0bc65cd0c8b2e0) +(cherry picked from commit a86b780ef275b35e8dc1e6d1886ec8e8d941f7c4) --- src/tests/softpkcs11/main.c | 360 ++++++++++++++---------------------- 1 file changed, 141 insertions(+), 219 deletions(-) diff --git a/Handle-OpenSSL-3-s-providers.patch b/Handle-OpenSSL-3-s-providers.patch new file mode 100644 index 0000000..d7b0d90 --- /dev/null +++ b/Handle-OpenSSL-3-s-providers.patch @@ -0,0 +1,301 @@ +From e3f3d31a3db23f6c8437cd0efe45f67a7f4fc6aa Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Sat, 15 May 2021 21:18:06 -0400 +Subject: [PATCH] Handle OpenSSL 3's providers + +OpenSSL 3 compartmentalizes what algorithms it uses, which for us means +another hoop to jump through to use dubious cryptography. (Right now, +we need to load "legacy" in order to access MD4 and RC4.) + +Use our normal initializer logic to set up providers both in the OpenSSL +provider an the PKINIT plugin. Since DT_FINI is too late, release them +using atexit() as OpenSSL does. + +(cherry picked from commit bea5a703a06da1f1ab56821b77a2d3661cb0dda4) +[rharwood@redhat.com: work around des3 removal and rc4 fips changes] +--- + src/configure.ac | 1 + + src/lib/crypto/openssl/enc_provider/aes.c | 16 ++++++ + .../crypto/openssl/enc_provider/camellia.c | 16 ++++++ + src/lib/crypto/openssl/enc_provider/rc4.c | 4 ++ + .../crypto/openssl/hash_provider/hash_evp.c | 5 ++ + src/lib/crypto/openssl/init.c | 53 +++++++++++++++++++ + src/plugins/preauth/pkinit/Makefile.in | 1 + + .../preauth/pkinit/pkinit_crypto_openssl.c | 33 ++++++++++-- + 8 files changed, 126 insertions(+), 3 deletions(-) + +diff --git a/src/configure.ac b/src/configure.ac +index 9c2e816fe..20066918b 100644 +--- a/src/configure.ac ++++ b/src/configure.ac +@@ -284,6 +284,7 @@ AC_SUBST(CRYPTO_IMPL_LIBS) + + if test "$CRYPTO_IMPL" = openssl; then + AC_CHECK_FUNCS(EVP_KDF_fetch) ++ AC_CHECK_FUNCS(OSSL_PROVIDER_load) + fi + + AC_ARG_WITH([prng-alg], +diff --git a/src/lib/crypto/openssl/enc_provider/aes.c b/src/lib/crypto/openssl/enc_provider/aes.c +index 6b4622fe9..31c90a69d 100644 +--- a/src/lib/crypto/openssl/enc_provider/aes.c ++++ b/src/lib/crypto/openssl/enc_provider/aes.c +@@ -68,6 +68,10 @@ cbc_enc(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, + EVP_CIPHER_CTX *ctx; + struct iov_cursor cursor; + ++ ret = krb5int_crypto_init(); ++ if (ret) ++ return ret; ++ + ctx = EVP_CIPHER_CTX_new(); + if (ctx == NULL) + return ENOMEM; +@@ -102,6 +106,10 @@ cbc_decr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, + EVP_CIPHER_CTX *ctx; + struct iov_cursor cursor; + ++ ret = krb5int_crypto_init(); ++ if (ret) ++ return ret; ++ + ctx = EVP_CIPHER_CTX_new(); + if (ctx == NULL) + return ENOMEM; +@@ -137,6 +145,10 @@ cts_encr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, + struct iov_cursor cursor; + AES_KEY enck; + ++ ret = krb5int_crypto_init(); ++ if (ret) ++ return ret; ++ + memset(iv_cts,0,sizeof(iv_cts)); + if (ivec && ivec->data){ + if (ivec->length != sizeof(iv_cts)) +@@ -190,6 +202,10 @@ cts_decr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, + struct iov_cursor cursor; + AES_KEY deck; + ++ ret = krb5int_crypto_init(); ++ if (ret) ++ return ret; ++ + memset(iv_cts,0,sizeof(iv_cts)); + if (ivec && ivec->data){ + if (ivec->length != sizeof(iv_cts)) +diff --git a/src/lib/crypto/openssl/enc_provider/camellia.c b/src/lib/crypto/openssl/enc_provider/camellia.c +index f79679a0b..7cc7fc6fb 100644 +--- a/src/lib/crypto/openssl/enc_provider/camellia.c ++++ b/src/lib/crypto/openssl/enc_provider/camellia.c +@@ -92,6 +92,10 @@ cbc_enc(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, + EVP_CIPHER_CTX *ctx; + struct iov_cursor cursor; + ++ ret = krb5int_crypto_init(); ++ if (ret) ++ return ret; ++ + ctx = EVP_CIPHER_CTX_new(); + if (ctx == NULL) + return ENOMEM; +@@ -126,6 +130,10 @@ cbc_decr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, + EVP_CIPHER_CTX *ctx; + struct iov_cursor cursor; + ++ ret = krb5int_crypto_init(); ++ if (ret) ++ return ret; ++ + ctx = EVP_CIPHER_CTX_new(); + if (ctx == NULL) + return ENOMEM; +@@ -161,6 +169,10 @@ cts_encr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, + struct iov_cursor cursor; + CAMELLIA_KEY enck; + ++ ret = krb5int_crypto_init(); ++ if (ret) ++ return ret; ++ + memset(iv_cts,0,sizeof(iv_cts)); + if (ivec && ivec->data){ + if (ivec->length != sizeof(iv_cts)) +@@ -214,6 +226,10 @@ cts_decr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, + struct iov_cursor cursor; + CAMELLIA_KEY deck; + ++ ret = krb5int_crypto_init(); ++ if (ret) ++ return ret; ++ + memset(iv_cts,0,sizeof(iv_cts)); + if (ivec && ivec->data){ + if (ivec->length != sizeof(iv_cts)) +diff --git a/src/lib/crypto/openssl/enc_provider/rc4.c b/src/lib/crypto/openssl/enc_provider/rc4.c +index 9bf407899..a10cb5192 100644 +--- a/src/lib/crypto/openssl/enc_provider/rc4.c ++++ b/src/lib/crypto/openssl/enc_provider/rc4.c +@@ -66,6 +66,10 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data, + EVP_CIPHER_CTX *ctx = NULL; + struct arcfour_state *arcstate; + ++ ret = krb5int_crypto_init(); ++ if (ret) ++ return ret; ++ + if (FIPS_mode()) + return KRB5_CRYPTO_INTERNAL; + +diff --git a/src/lib/crypto/openssl/hash_provider/hash_evp.c b/src/lib/crypto/openssl/hash_provider/hash_evp.c +index 2eb5139c0..09d7b3896 100644 +--- a/src/lib/crypto/openssl/hash_provider/hash_evp.c ++++ b/src/lib/crypto/openssl/hash_provider/hash_evp.c +@@ -41,6 +41,11 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data, + const krb5_data *d; + size_t i; + int ok; ++ krb5_error_code ret; ++ ++ ret = krb5int_crypto_init(); ++ if (ret) ++ return ret; + + if (output->length != (unsigned int)EVP_MD_size(type)) + return KRB5_CRYPTO_INTERNAL; +diff --git a/src/lib/crypto/openssl/init.c b/src/lib/crypto/openssl/init.c +index 1139bce53..f72dbfe81 100644 +--- a/src/lib/crypto/openssl/init.c ++++ b/src/lib/crypto/openssl/init.c +@@ -26,12 +26,65 @@ + + #include "crypto_int.h" + ++#ifdef HAVE_OSSL_PROVIDER_LOAD ++ ++/* ++ * Starting in OpenSSL 3, algorithms are grouped into containers called ++ * "providers", not all of which are loaded by default. At time of writing, ++ * we need MD4 and RC4 from the legacy provider. Oddly, 3DES is not in ++ * legacy. ++ */ ++ ++#include ++ ++static OSSL_PROVIDER *legacy_provider = NULL; ++static OSSL_PROVIDER *default_provider = NULL; ++ ++static void ++unload_providers(void) ++{ ++ if (default_provider != NULL) ++ (void)OSSL_PROVIDER_unload(default_provider); ++ if (legacy_provider != NULL) ++ (void)OSSL_PROVIDER_unload(legacy_provider); ++ default_provider = NULL; ++ legacy_provider = NULL; ++} ++ ++int ++krb5int_crypto_impl_init(void) ++{ ++ legacy_provider = OSSL_PROVIDER_load(NULL, "legacy"); ++ default_provider = OSSL_PROVIDER_load(NULL, "default"); ++ ++ /* ++ * Someone might build openssl without the legacy provider. They will ++ * have a bad time, but some things will still work. I don't know think ++ * this configuration is worth supporting. ++ */ ++ if (legacy_provider == NULL || default_provider == NULL) ++ abort(); ++ ++ /* ++ * If we attempt to do this with our normal LIBFINIFUNC logic (DT_FINI), ++ * OpenSSL will have cleaned itself up by the time we're invoked. OpenSSL ++ * registers its cleanup (OPENSSL_cleanup) with atexit() - do the same and ++ * we'll be higher on the stack. ++ */ ++ atexit(unload_providers); ++ return 0; ++} ++ ++#else /* !HAVE_OSSL_PROVIDER_LOAD */ ++ + int + krb5int_crypto_impl_init(void) + { + return 0; + } + ++#endif ++ + void + krb5int_crypto_impl_cleanup(void) + { +diff --git a/src/plugins/preauth/pkinit/Makefile.in b/src/plugins/preauth/pkinit/Makefile.in +index 15ca0eb48..d20fb18a8 100644 +--- a/src/plugins/preauth/pkinit/Makefile.in ++++ b/src/plugins/preauth/pkinit/Makefile.in +@@ -5,6 +5,7 @@ MODULE_INSTALL_DIR = $(KRB5_PA_MODULE_DIR) + LIBBASE=pkinit + LIBMAJOR=0 + LIBMINOR=0 ++LIBINITFUNC=pkinit_openssl_init + RELDIR=../plugins/preauth/pkinit + # Depends on libk5crypto and libkrb5 + SHLIB_EXPDEPS = \ +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index 350c2118a..42e5c581d 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -44,6 +44,13 @@ + #include + #endif + ++#ifdef HAVE_OSSL_PROVIDER_LOAD ++#include ++ ++static OSSL_PROVIDER *legacy_provider = NULL; ++static OSSL_PROVIDER *default_provider = NULL; ++#endif ++ + static krb5_error_code pkinit_init_pkinit_oids(pkinit_plg_crypto_context ); + static void pkinit_fini_pkinit_oids(pkinit_plg_crypto_context ); + +@@ -2937,12 +2944,32 @@ cleanup: + return retval; + } + ++/* pkinit_openssl_init() and unload_providers() are largely duplicated from ++ * lib/crypto/openssl/init.c - see explanations there. */ ++static void ++unload_providers(void) ++{ ++ if (default_provider != NULL) ++ (void)OSSL_PROVIDER_unload(default_provider); ++ if (legacy_provider != NULL) ++ (void)OSSL_PROVIDER_unload(legacy_provider); ++ default_provider = NULL; ++ legacy_provider = NULL; ++} ++ + int + pkinit_openssl_init() + { +- /* Initialize OpenSSL. */ +- ERR_load_crypto_strings(); +- OpenSSL_add_all_algorithms(); ++#ifdef HAVE_OSSL_PROVIDER_LOAD ++ legacy_provider = OSSL_PROVIDER_load(NULL, "legacy"); ++ default_provider = OSSL_PROVIDER_load(NULL, "default"); ++ ++ if (legacy_provider == NULL || default_provider == NULL) ++ abort(); ++ ++ atexit(unload_providers); ++#endif ++ + return 0; + } + diff --git a/Remove-TCL-based-libkadm5-API-tests.patch b/Remove-TCL-based-libkadm5-API-tests.patch new file mode 100644 index 0000000..7819198 --- /dev/null +++ b/Remove-TCL-based-libkadm5-API-tests.patch @@ -0,0 +1,18229 @@ +From ddb189ff95350afc0e3e063016a0f0dd5213dc4c Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Fri, 16 Apr 2021 10:24:04 -0400 +Subject: [PATCH] Remove TCL-based libkadm5 API tests + +[antorres@redhat.com: remove diff for .gitignore] +--- + .gitignore | 20 - + doc/kadm5/api-unit-test.tex | 2680 ----------------- + src/config/pre.in | 18 +- + src/configure.ac | 31 +- + src/kadmin/Makefile.in | 2 +- + src/kadmin/testing/Makefile.in | 8 - + src/kadmin/testing/deps | 1 - + src/kadmin/testing/proto/kdc.conf.proto | 16 - + src/kadmin/testing/proto/krb5.conf.proto | 32 - + src/kadmin/testing/proto/ovsec_adm.dict | 3 - + src/kadmin/testing/scripts/Makefile.in | 18 - + src/kadmin/testing/scripts/deps | 1 - + src/kadmin/testing/scripts/env-setup.shin | 104 - + src/kadmin/testing/scripts/init_db | 229 -- + src/kadmin/testing/scripts/start_servers | 69 - + .../testing/scripts/start_servers_local | 157 - + src/kadmin/testing/scripts/stop_servers | 60 - + src/kadmin/testing/scripts/stop_servers_local | 44 - + src/kadmin/testing/tcl/util.t | 58 - + src/kadmin/testing/util/Makefile.in | 42 - + src/kadmin/testing/util/bsddb_dump.c | 65 - + src/kadmin/testing/util/deps | 16 - + src/kadmin/testing/util/tcl_kadm5.c | 2566 ---------------- + src/kadmin/testing/util/tcl_kadm5.h | 3 - + src/kadmin/testing/util/tcl_kadm5_syntax | 57 - + src/kadmin/testing/util/tcl_krb5_hash.c | 167 - + src/kadmin/testing/util/test.c | 38 - + src/lib/kadm5/Makefile.in | 3 +- + src/lib/kadm5/unit-test/Makefile.in | 143 - + src/lib/kadm5/unit-test/api.2/crte-policy.exp | 927 ------ + src/lib/kadm5/unit-test/api.2/get-policy.exp | 199 -- + src/lib/kadm5/unit-test/api.2/mod-policy.exp | 675 ----- + .../api.current/chpass-principal-v2.exp | 68 - + .../api.current/chpass-principal.exp | 176 -- + .../unit-test/api.current/crte-policy.exp | 927 ------ + .../unit-test/api.current/crte-principal.exp | 1336 -------- + .../kadm5/unit-test/api.current/destroy.exp | 203 -- + .../unit-test/api.current/dlte-policy.exp | 208 -- + .../unit-test/api.current/dlte-principal.exp | 253 -- + .../unit-test/api.current/get-policy.exp | 199 -- + .../api.current/get-principal-v2.exp | 250 -- + .../unit-test/api.current/get-principal.exp | 346 --- + .../kadm5/unit-test/api.current/init-v2.exp | 506 ---- + src/lib/kadm5/unit-test/api.current/init.exp | 699 ----- + .../unit-test/api.current/mod-policy.exp | 711 ----- + .../api.current/mod-principal-v2.exp | 115 - + .../unit-test/api.current/mod-principal.exp | 1606 ---------- + .../api.current/randkey-principal-v2.exp | 61 - + .../api.current/randkey-principal.exp | 297 -- + src/lib/kadm5/unit-test/config/unix.exp | 222 -- + src/lib/kadm5/unit-test/deps | 86 - + src/lib/kadm5/unit-test/destroy-test.c | 48 - + src/lib/kadm5/unit-test/diff-files/destroy-1 | 2 - + src/lib/kadm5/unit-test/diff-files/no-diffs | 2 - + src/lib/kadm5/unit-test/handle-test.c | 140 - + src/lib/kadm5/unit-test/init-test.c | 39 - + src/lib/kadm5/unit-test/iter-test.c | 51 - + src/lib/kadm5/unit-test/lib/lib.t | 306 -- + src/lib/kadm5/unit-test/lock-test.c | 105 - + src/lib/kadm5/unit-test/randkey-test.c | 42 - + src/lib/kadm5/unit-test/setkey-test.c | 246 -- + src/lib/kadm5/unit-test/site.exp | 2 - + 62 files changed, 7 insertions(+), 17697 deletions(-) + delete mode 100644 doc/kadm5/api-unit-test.tex + delete mode 100644 src/kadmin/testing/Makefile.in + delete mode 100644 src/kadmin/testing/deps + delete mode 100644 src/kadmin/testing/proto/kdc.conf.proto + delete mode 100644 src/kadmin/testing/proto/krb5.conf.proto + delete mode 100644 src/kadmin/testing/proto/ovsec_adm.dict + delete mode 100644 src/kadmin/testing/scripts/Makefile.in + delete mode 100644 src/kadmin/testing/scripts/deps + delete mode 100755 src/kadmin/testing/scripts/env-setup.shin + delete mode 100755 src/kadmin/testing/scripts/init_db + delete mode 100755 src/kadmin/testing/scripts/start_servers + delete mode 100755 src/kadmin/testing/scripts/start_servers_local + delete mode 100755 src/kadmin/testing/scripts/stop_servers + delete mode 100755 src/kadmin/testing/scripts/stop_servers_local + delete mode 100644 src/kadmin/testing/tcl/util.t + delete mode 100644 src/kadmin/testing/util/Makefile.in + delete mode 100644 src/kadmin/testing/util/bsddb_dump.c + delete mode 100644 src/kadmin/testing/util/deps + delete mode 100644 src/kadmin/testing/util/tcl_kadm5.c + delete mode 100644 src/kadmin/testing/util/tcl_kadm5.h + delete mode 100644 src/kadmin/testing/util/tcl_kadm5_syntax + delete mode 100644 src/kadmin/testing/util/tcl_krb5_hash.c + delete mode 100644 src/kadmin/testing/util/test.c + delete mode 100644 src/lib/kadm5/unit-test/Makefile.in + delete mode 100644 src/lib/kadm5/unit-test/api.2/crte-policy.exp + delete mode 100644 src/lib/kadm5/unit-test/api.2/get-policy.exp + delete mode 100644 src/lib/kadm5/unit-test/api.2/mod-policy.exp + delete mode 100644 src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp + delete mode 100644 src/lib/kadm5/unit-test/api.current/chpass-principal.exp + delete mode 100644 src/lib/kadm5/unit-test/api.current/crte-policy.exp + delete mode 100644 src/lib/kadm5/unit-test/api.current/crte-principal.exp + delete mode 100644 src/lib/kadm5/unit-test/api.current/destroy.exp + delete mode 100644 src/lib/kadm5/unit-test/api.current/dlte-policy.exp + delete mode 100644 src/lib/kadm5/unit-test/api.current/dlte-principal.exp + delete mode 100644 src/lib/kadm5/unit-test/api.current/get-policy.exp + delete mode 100644 src/lib/kadm5/unit-test/api.current/get-principal-v2.exp + delete mode 100644 src/lib/kadm5/unit-test/api.current/get-principal.exp + delete mode 100644 src/lib/kadm5/unit-test/api.current/init-v2.exp + delete mode 100644 src/lib/kadm5/unit-test/api.current/init.exp + delete mode 100644 src/lib/kadm5/unit-test/api.current/mod-policy.exp + delete mode 100644 src/lib/kadm5/unit-test/api.current/mod-principal-v2.exp + delete mode 100644 src/lib/kadm5/unit-test/api.current/mod-principal.exp + delete mode 100644 src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp + delete mode 100644 src/lib/kadm5/unit-test/api.current/randkey-principal.exp + delete mode 100644 src/lib/kadm5/unit-test/config/unix.exp + delete mode 100644 src/lib/kadm5/unit-test/deps + delete mode 100644 src/lib/kadm5/unit-test/destroy-test.c + delete mode 100644 src/lib/kadm5/unit-test/diff-files/destroy-1 + delete mode 100644 src/lib/kadm5/unit-test/diff-files/no-diffs + delete mode 100644 src/lib/kadm5/unit-test/handle-test.c + delete mode 100644 src/lib/kadm5/unit-test/init-test.c + delete mode 100644 src/lib/kadm5/unit-test/iter-test.c + delete mode 100644 src/lib/kadm5/unit-test/lib/lib.t + delete mode 100644 src/lib/kadm5/unit-test/lock-test.c + delete mode 100644 src/lib/kadm5/unit-test/randkey-test.c + delete mode 100644 src/lib/kadm5/unit-test/setkey-test.c + delete mode 100644 src/lib/kadm5/unit-test/site.exp + +diff --git a/doc/kadm5/api-unit-test.tex b/doc/kadm5/api-unit-test.tex +deleted file mode 100644 +index 014242037..000000000 +--- a/doc/kadm5/api-unit-test.tex ++++ /dev/null +@@ -1,2680 +0,0 @@ +-% This document is included for historical purposes only, and does not +-% apply to krb5 today. +- +-\documentstyle[times,fullpage]{article} +- +-%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +-%% Make _ actually generate an _, and allow line-breaking after it. +-\let\underscore=\_ +-\catcode`_=13 +-\def_{\underscore\penalty75\relax} +-%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +- +-\newcommand{\test}[1]{\begin{description} +-\setlength{\itemsep}{0pt} +-#1 +-\end{description} +- +-} +- +-\newcommand{\numtest}[2]{\begin{description} +-\setlength{\itemsep}{0pt} +-\Number{#1} +-#2 +-\end{description} +- +-} +- +-\newcommand{\Number}[1]{\item[Number:] #1} +-\newcommand{\Reason}[1]{\item[Reason:] #1} +-\newcommand{\Expected}[1]{\item[Expected:] #1} +-\newcommand{\Conditions}[1]{\item[Conditions:] #1} +-\newcommand{\Priority}[1]{\item[Priority:] #1} +-\newcommand{\Status}[1]{\item[Status:] #1} +-\newcommand{\Vtwonote}[1]{\item[V2 note:] #1} +-\newcommand{\Version}[1]{\item[Version:] #1} +-\newcommand{\Call}[1]{} +-%\newcommand{\Call}[1]{\item[Call:] #1} +-%\newcommand{\Number}[1]{} +-%\newcommand{\Reason}[1]{} +-%\newcommand{\Expected}[1]{} +-%\newcommand{\Conditions}[1]{} +-%\newcommand{\Priority}[1]{} +- +-\title{KADM5 Admin API\\ +-Unit Test Description} +-\author{Jonathan I. Kamens} +- +-\begin{document} +- +-\maketitle +- +-%\tableofcontents +- +-\section{Introduction} +- +-The following is a description of a black-box unit test of the KADM5 +-API. Each API function is listed, followed by the tests that should be +-performed on it. +- +-The tests described here are based on the ``Kerberos Administration +-System KADM5 API Functional Specifications'', revision 1.68. This +-document was originally written based on the OpenVision API functional +-specifications, version 1.41, dated August 18, 1994, and many +-indications of the original version remain. +- +-All tests which test for success should verify, using some means other +-than the return value of the function being tested, that the requested +-operation was successfully performed. For example: for init, test +-that other operations can be performed after init; for destroy, test +-that other operations can't be performed after destroy; for modify +-functions, verify that all modifications to the database which should +-have taken place did, and that the new, modified data is in effect; +-for get operations, verify that the data retrieved is the data that +-should actually be in the database. +- +-The tests would be better if they compared the actual contents of the +-database before and after each test, rather than relying on the KADM5 +-API to report the results of changes. +- +-Similarly, all tests which test for failure should verify that the +-no component of the requested operation took place. For example: if +-init fails, other operations should not work. If a modify fails, all +-data in the database should be the same as it was before the attempt +-to modify, and the old data should still be what is enforced. +-Furthermore, tests which test for failure should verify that the +-failure code returned is correct for the specific failure condition +-tested. +- +-Most of the tests listed below should be run twice -- once locally on +-the server after linking against the server API library, and once +-talking to the server via authenticated Sun RPC after linking against +-the client API library. Tests which should only be run locally or via +-RPC are labelled with a ``local'' or ``RPC''. +- +-Furthermore, in addition to the tests labelled below, a test should be +-implemented to verify that a client can't perform operations on the +-server through the client API library when it's linked against +-standard Sun RPC instead of OpenV*Secure's authenticated Sun RPC. +-This will require a client with a modified version of ovsec_kadm_init +-which doesn't call auth_gssapi_create. This client should call this +-modified ovsec_kadm_init and then call some other admin API function, +-specifying arguments to both functions that would work if the +-authenticated Sun RPC had been used, but shouldn't if authentication +-wasn't used. The test should verify that the API function call after +-the init doesn't succeed. +- +-There is also another test to see if all the API functions handle getting an +-invalid server handle correctly. This is not done as part of the tests that +-are run through the TCL program cause the TCL program has no way of +-invalidating a server handle. So there is a program that calls init and +-changes the handle magic number, and then attempts to call each API function +-with the corrupted server handle. +- +-A number of tests have been added or changed to correspond with KADM5 +-API version 2. Tests which are only performed against the newer +-version specify the version number in the test description. +- +-\section{ovsec_kadm_init} +- +-\numtest{1}{ +-\Reason{An empty string realm is rejected.} +-\Status{Implemented} +-\Vtwonote{The empty string is now passed as the realm field of the +-parameters structure.} +-} +- +-\numtest{2}{ +-\Reason{A realm containing invalid characters is rejected.} +-\Status{Implemented} +-\Vtwonote{The invalid character is now passed as the realm field of the +-parameters structure.} +-} +- +-\numtest{2.5}{ +-\Reason{A non-existent realm is rejected.} +-\Status{Implemented} +-\Vtwonote{The non-existent realm is now passed as the realm field of the +-parameters structure.} +-} +- +-\numtest{3}{ +-\Reason{A bad service name representing an existing principal +- (different from the client principal) is rejected.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{4}{ +-\Reason{A bad service name representing a non-existent +- principal is rejected.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{5}{ +-\Reason{A bad service name identical to the (existing) client +- name is rejected.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{6}{ +-\Reason{A null password causes password prompting.} +-\Status{Implemented} +-} +- +-\numtest{7}{ +-\Reason{An empty-string causes password prompting} +-\Status{Implemented} +-} +- +-\numtest{8}{ +-\Reason{An incorrect password which is the password of another +- user is rejected.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{9}{ +-\Reason{An incorrect password which isn't the password of any +- user is rejected.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{10}{ +-\Reason{A null client_name is rejected.} +-\Status{Implemented} +-} +- +-% Empty string client name is legal. +-%\numtest{11}{ +-%\Reason{An empty-string client_name is rejected.} +-%} +- +-\numtest{12}{ +-\Reason{A client_name referring to a non-existent principal in +- the default realm is rejected.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{13}{ +-\Reason{A client_name referring to a non-existent principal +- with the local realm specified explicitly is rejected.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{14}{ +-\Reason{A client_name referring to a non-existent principal in +- a nonexistent realm is rejected.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{15}{ +-\Reason{A client_name referring to an existing principal in a +- nonexistent realm is rejected.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{16}{ +-\Reason{Valid invocation.} +-\Status{Implemented} +-} +- +-\numtest{17}{ +-\Reason{Valid invocation (explicit client realm).} +-\Status{Implemented} +-} +- +-\numtest{18}{ +-\Reason{Valid invocation (CHANGEPW_SERVICE).} +-\Status{Implemented} +-} +- +-\numtest{19}{ +-\Reason{Valid invocation (explicit service realm).} +-\Status{Implemented} +-\Vtwonote{The explicit realm is now passed as the realm field of the +-configuration parameters.} +-} +- +-\numtest{20}{ +-\Reason{Valid invocation (database access allowed after init).} +-\Status{Implemented} +-} +- +-%\numtest{21}{ +-%\Reason{Init fails when called twice in a row.} +-%\Status{Implemented} +-%} +- +-\numtest{22}{ +-\Reason{A null password causes master-key prompting.} +-\Conditions{local} +-\Status{Implemented} +-\Vtwonote{Obsolete.} +-} +- +-\numtest{22.5}{ +-\Reason{A empty string password causes master-key prompting.} +-\Conditions{local} +-\Status{Implemented} +-\Vtwonote{Obsolete.} +-} +- +-%\numtest{23}{ +-%\Reason{A non-null password causes reading from the kstash.} +-%\Conditions{local} +-%\Status{Implemented} +-%} +- +-\numtest{24}{ +-\Reason{Null service name is ignored in local invocation.} +-\Conditions{local} +-\Status{Implemented} +-} +- +-\numtest{25}{ +-\Reason{Non-null service name is ignored in local invocation.} +-\Conditions{local} +-\Status{Implemented} +-} +- +-%\numtest{26}{ +-%\Reason{Can't do ``get'' operation before calling init.} +-%\Status{Implemented} +-%} +- +-%\numtest{27}{ +-%\Reason{Can't do ``add'' operation before calling init.} +-%\Status{Implemented} +-%} +- +-%\numtest{28}{ +-%\Reason{Can't do ``modify'' operation before calling init.} +-%\Status{Implemented} +-%} +- +-%\numtest{29}{ +-%\Reason{Can't do ``delete'' operation before calling init.} +-%\Status{Implemented} +-%} +- +-\numtest{30}{ +-\Reason{Can init after failed init attempt.} +-\Conditions{local} +-\Status{Implemented} +-} +- +-\numtest{31}{ +-\Priority{High} +-\Reason{Return BAD_STRUCT_VERSION when the mask bits are set to invalid values} +-\Status{Implemented} +-} +- +-\numtest{32}{ +-\Priority{High} +-\Reason{Return BAD_STRUCT_VERSION when the mask bits are not set} +-\Status{Implemented} +-} +- +-\numtest{33}{ +-\Priority{High} +-\Reason{Return OLD_STRUCT_VERSION when attempting to use an old/unsupported +- structure version} +-\Status{Implemented} +-} +- +-\numtest{34}{ +-\Priority{High} +-\Reason{Return NEW_STRUCT_VERSION when attempting to use a newer version of +- of the structure then what is supported} +-\Status{Implemented} +-} +- +-\numtest{35}{ +-\Priority{High} +-\Reason{Return BAD_API_VERSION when the mask bits are set to invalid values} +-\Status{Implemented} +-} +- +-\numtest{36}{ +-\Priority{High} +-\Reason{Return BAD_API_VERSION when the mask bits are not set} +-\Status{Implemented} +-} +- +-\numtest{37}{ +-\Priority{High} +-\Reason{Return OLD_LIB_API_VERSION when using an old/unsuppored +- api version number} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{38}{ +-\Priority{High} +-\Reason{Return OLD_SERVER_API_VERSION attempting to use an +- old/unsupported api version number} +-\Conditions{local} +-\Status{Implemented} +-} +- +-\numtest{39}{ +-\Priority{High} +-\Reason{Return NEW_LIB_API_VERSION when using a newer api +- version number then supported} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{40}{ +-\Priority{High} +-\Reason{Return NEW_SERVER_API_VERSION when using a newer api version +- number then supported} +-\Conditions{local} +-\Status{Implemented} +-} +- +-\numtest{41}{ +-\Priority{High} +-\Reason{Return BAD_XXX_VERSION when the API and the structure +- version numbers are reversed} +-\Status{Implemented} +-} +- +-\numtest{42}{ +-\Priority{High} +-\Reason{Succeeds when using valid api and struct version numbers and masks} +-\Status{Implemented} +-} +- +-\numtest{43}{ +-\Priority{Low} +-\Reason{Returns two different server handle when called twice with same info} +-} +- +-\numtest{44}{ +-\Priority{Low} +-\Reason{Returns two different server handles when called twice with +- different info} +-} +- +-\numtest{45}{ +-\Priority{Bug fix, secure-install/3390} +-\Reason{Returns SECURE_PRINC_MISSING when ADMIN_SERVICE does not +-exist.} +-\Status{Implemented} +-} +- +-\numtest{46}{ +-\Priority{Bug fix, secure-install/3390} +-\Reason{Returns SECURE_PRINC_MISSING when CHANGEPW_SERVICE does not +-exist.} +-\Status{Implemented} +-} +- +-\numtest{100}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Obeys the profile field of the configuration parameters, if +-set.} +-\Status{Implemented} +-} +- +-\numtest{101}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Obeys the kadmind_port field of the configuration parameters, +-if set.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{102}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Obeys the admin_server field of the configuration parameters, +-if set with only an admin server name.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{102.5}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Obeys the admin_server field of the configuration parameters, +-if set with a host name and port number.} +-\Conditions{RPC} +-} +- +-\numtest{103}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Obeys the dbname field of the configuration parameters, if +-set.} +-\Conditions{local} +-\Status{Implemented} +-} +- +-\numtest{104}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Obeys the admin_dbname field of the configuration parameters, if +-set.} +-\Conditions{local} +-\Status{Implemented} +-} +- +-\numtest{105}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Obeys the admin_lockfile field of the configuration parameters, if +-set.} +-\Conditions{local} +-\Status{Implemented} +-} +- +-\numtest{106}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Obeys the mkey_from_kbd field of the configuration parameters, if +-set.} +-\Conditions{local} +-\Status{Implemented} +-} +- +-\numtest{107}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Obeys the stash_file field of the configuration parameters, if +-set.} +-\Conditions{local} +-\Status{Implemented} +-} +- +-\numtest{108}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Obeys the mkey_name field of the configuration parameters, if +-set.} +-\Conditions{local} +-\Status{Implemented} +-} +- +-\numtest{109}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Obeys the max_life field of the configuration parameters, if +-set.} +-\Conditions{local} +-\Status{Implemented} +-} +- +-\numtest{110}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Obeys the max_rlife field of the configuration parameters, if +-set.} +-\Conditions{local} +-\Status{Implemented} +-} +- +-\numtest{111}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Obeys the expiration field of the configuration parameters, if +-set.} +-\Status{Implemented} +-\Conditions{local} +-} +- +-\numtest{112}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Obeys the flags field of the configuration parameters, if +-set.} +-\Conditions{local} +-\Status{Implemented} +-} +- +-\numtest{113}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Obeys the keysalts and num_keysalts field of the configuration +-parameters, if set.} +-\Conditions{local} +-\Status{Implemented} +-} +- +-\numtest{114}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Returns KADM5_BAD_SERVER_PARAMS if any client-only parameters +-are specified to server-side init.} +-\Conditions{local} +-\Status{Implemented} +-} +- +-\numtest{115}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Returns KADM5_BAD_CLIENT_PARAMS if any client-only parameters +-are specified to server-side init.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{116}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Two calls to init with clients having different privileges +-succeeds, and both clients maintain their correct privileges.} +-\Priority{Bug fix} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{117}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{The max_life field defaults to value specified in the API +-Functional Specification when kdc.conf is unreadable.} +-\Priority{Bug fix, krb5-admin/18} +-\Conditions{local} +-\Status{Implemented} +-} +- +-\numtest{150}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{init_with_creds works when given an open ccache with a valid +-credential for ADMIN_SERVICE.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{151}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{init_with_creds works when given an open ccache with a valid +-credential for CHANGEPW_SERVICE.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{152}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{init_with_creds fails with KRB5_FCC_NOFILE (was +- KADM5_GSS_ERROR) when given an open +-ccache with no credentials.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{153}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{init_with_creds fails with KRB5_CC_NOTFOUND (was +- KADM5_GSS_ERROR) when given an open +-ccache without credentials for ADMIN_SERVICE or CHANGEPW_SERVICE.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{154}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{If the KRB5_KDC_PROFILE environment variable is set to a filename +-that does not exist, init fails with ENOENT.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\section{ovsec_kadm_destroy} +- +-\numtest{1}{ +-\Reason{Valid invocation.} +-\Status{Implemented} +-} +- +-%\numtest{2}{ +-%\Reason{Valid invocation (``get'' not allowed after destroy).} +-%\Status{Implemented} +-%} +- +-%\numtest{3}{ +-%\Reason{Valid invocation (``add'' not allowed after destroy).} +-%\Status{Implemented} +-%} +- +-%\numtest{4}{ +-%\Reason{Valid invocation (``modify'' not allowed after destroy).} +-%\Status{Implemented} +-%} +- +-%\numtest{5}{ +-%\Reason{Valid invocation (``delete'' not allowed after destroy).} +-%\Status{Implemented} +-%} +- +-%\numtest{6}{ +-%\Reason{Fails if database not initialized.} +-%\Status{Implemented} +-%} +- +-%\numtest{7}{ +-%\Reason{Fails if invoked twice in a row.} +-%\Status{Implemented} +-%} +- +-\numtest{8}{ +-\Reason{Database can be reinitialized after destroy.} +-\Status{Implemented} +-} +- +-\numtest{9}{ +-\Priority{High} +-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} +-\Status{Implemented} +-} +- +-\numtest{10}{ +-\Priority{Low} +-\Reason{Connects to correct server when multiple handles exist} +-\Conditions{client} +-} +- +-\section{ovsec_kadm_create_principal} +- +-%In the tests below, ``getu'' refers to a user who has only ``get'' access, +-%''addu'' refers to a user who has only ``add'' access, ``modifyu'' refers to +-%a user who has only ``modify'' access, and ``deleteu'' refers to a user +-%who has only ``delete'' access. ``amu'' refers to a user with ``add'' and +-%''modify'' access. ``new_princ'' refers to a principal entry structure +-%filled in as follows: +-% +-% krb5_parse_name("newuser", \&new_princ.principal); +-% krb5_timeofday(\&new_princ.princ_expire_time); +-% new_princ.princ_expire_time += 130; +-% krb5_timeofday(\&new_princ.last_pwd_change); +-% new_princ.last_pwd_change += 140; +-% krb5_timeofday(\&new_princ.pw_expiration); +-% new_princ.pw_expiration += 150; +-% new_princ.max_life = 160; +-% krb5_parse_name("usera", \&new_princ.mod_name); +-% krb5_timeofday(\&new_princ.mod_date); +-% new_princ.mod_date += 170; +-% new_princ.attributes = 0xabcdabcd; +-% new_princ.kvno = 180; +-% new_princ.mkvno = 190; +-% new_princ.policy = null; +-% new_princ.aux_attributes = 0xdeadbeef; +-% +-%The offsets of 130 through 190 above are used to ensure that the +-%fields are all known to be different from each other, so that +-%accidentally switched fields can be detected. Some of the fields in +-%this structure may be changed by the tests, but they should clean up +-%after themselves. +- +-%\numtest{1}{ +-%\Reason{Fails if database not initialized.} +-%\Status{Implemented} +-%} +- +-\numtest{2}{ +-\Reason{Fails on null princ argument.} +-\Status{Implemented} +-} +- +-\numtest{3}{ +-\Reason{Fails on null password argument.} +-\Status{Implemented} +-} +- +-\numtest{4}{ +-\Reason{Fails on empty-string password argument.} +-\Status{Implemented} +-} +- +-\numtest{5}{ +-\Reason{Fails when mask contains undefined bit.} +-\Status{Implemented} +-} +- +-\numtest{6}{ +-\Reason{Fails when mask contains LAST_PWD_CHANGE bit.} +-\Status{Implemented} +-} +- +-\numtest{7}{ +-\Reason{Fails when mask contains MOD_TIME bit.} +-\Status{Implemented} +-} +- +-\numtest{8}{ +-\Reason{Fails when mask contains MOD_NAME bit.} +-\Status{Implemented} +-} +- +-\numtest{9}{ +-\Reason{Fails when mask contains MKVNO bit.} +-\Status{Implemented} +-} +- +-\numtest{10}{ +-\Reason{Fails when mask contains AUX_ATTRIBUTES bit.} +-\Status{Implemented} +-} +- +-\numtest{11}{ +-\Reason{Fails when mask contains POLICY_CLR bit.} +-\Status{Implemented} +-} +- +-\numtest{12}{ +-\Reason{Fails for caller with no access bits.} +-\Status{Implemented} +-} +- +-\numtest{13}{ +-\Reason{Fails when caller has ``get'' access and not ``add''.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{14}{ +-\Reason{Fails when caller has ``modify'' access and not ``add''.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{15}{ +-\Reason{Fails when caller has ``delete'' access and not ``add''.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{16}{ +-\Reason{Fails when caller connected with CHANGEPW_SERVICE.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{17}{ +-\Reason{Fails on attempt to create existing principal.} +-\Status{Implemented} +-} +- +-\numtest{18}{ +-\Reason{Fails when password is too short.} +-\Status{Implemented} +-} +- +-\numtest{19}{ +-\Reason{Fails when password has too few classes.} +-\Status{Implemented} +-} +- +-\numtest{20}{ +-\Reason{Fails when password is in dictionary.} +-\Status{Implemented} +-} +- +-\numtest{21}{ +-\Reason{Nonexistent policy is rejected.} +-\Status{Implemented} +-} +- +-\numtest{22}{ +-\Reason{Fails on invalid principal name.} +-\Status{Implemented} +-} +- +-\numtest{23}{ +-\Reason{Valid invocation.} +-\Status{Implemented} +-} +- +-\numtest{24}{ +-\Reason{Succeeds when caller has ``add'' access and another one.} +-\Status{Implemented} +-} +- +-%\numtest{25}{ +-%\Reason{Fails when password is too short, when override_qual is true.} +-%} +- +-%\numtest{26}{ +-%\Reason{Fails when password has too few classes, when +-% override_qual is true.} +-%} +- +-%\numtest{27}{ +-%\Reason{Fails when password is in dictionary, when override_qual is +-% true.} +-%} +- +-\numtest{28}{ +-\Reason{Succeeds when assigning policy.} +-\Status{Implemented} +-} +- +-\numtest{29}{ +-\Priority{High} +-\Reason{Allows 0 (never) for princ_expire_time.} +-\Status{Implemented} +-} +- +-\numtest{30}{ +-\Reason{Allows 0 (never) for pw_expiration when there's no policy.} +-\Status{Implemented} +-} +- +-\numtest{31}{ +-\Reason{Allows 0 (never) for pw_expiration when there's a policy with +- 0 for pw_max_life.} +-\Status{Implemented} +-} +- +-\numtest{32}{ +-\Reason{Accepts 0 (never) for pw_expiration when there's a policy with +- non-zero pw_max_life, and sets pw_expiration to zero.} +-\Status{Implemented} +-} +- +-\numtest{33}{ +-\Reason{Accepts and sets non-zero pw_expiration when no policy.} +-\Status{Implemented} +-} +- +-\numtest{34}{ +-\Reason{Accepts and sets non-zero pw_expiration when there's a policy +- with zero pw_max_life.} +-\Status{Implemented} +-} +- +-\numtest{35}{ +-\Reason{Accepts and sets non-zero pw_expiration when there's a policy +- with pw_max_life later than the specified pw_expiration.} +-\Status{Implemented} +-} +- +-\numtest{36}{ +-\Reason{Accepts and sets non-zero pw_expiration greater than now_pw_max_life.} +-\Status{Implemented} +-} +- +-\numtest{37}{ +-\Priority{High} +-\Reason{Sets pw_expiration to 0 (never) if there's no policy and no +- specified pw_expiration.} +-\Status{Implemented} +-} +- +-\numtest{38}{ +-\Priority{High} +-\Reason{Sets pw_expiration to 0 (never) if it isn't specified and the +- policy has a 0 (never) pw_max_life.} +-\Status{Implemented} +-} +- +-\numtest{39}{ +-\Priority{High} +-\Reason{Sets pw_expiration to now + pw_max_life if it isn't specified +- and the policy has a non-zero pw_max_life.} +-\Status{Implemented} +-} +- +-\numtest{40}{ +-\Priority{High} +-\Reason{Allows 0 (forever) for max_life.} +-\Status{Implemented} +-} +- +-\numtest{41}{ +-\Priority{High} +-\Reason{Doesn't modify or free mod_name on success.} +-} +- +-\numtest{42}{ +-\Priority{High} +-\Reason{Doesn't modify or free mod_name on failure.} +-} +- +-\numtest{43}{ +-\Priority{High} +-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} +-\Status{Implemented} +-} +- +-\numtest{44}{ +-\Priority{Low} +-\Reason{Connects to correct server when multiple handles exist} +-\Conditions{RPC} +-} +- +- +-\section{ovsec_kadm_delete_principal} +- +-%\numtest{1}{ +-%\Reason{Fails if database not initialized.} +-%\Status{Implemented} +-%} +- +-\numtest{2}{ +-\Reason{Fails on null principal.} +-\Status{Implemented} +-} +- +-% Empty string principal is legal. +-%\numtest{3}{ +-%\Reason{Fails on empty-string principal.} +-%} +- +-% There is not invalid principal names +-%\numtest{4}{ +-%\Reason{Fails on invalid principal name.} +-%} +- +-\numtest{5}{ +-\Priority{High} +-\Reason{Fails on nonexistent principal.} +-\Status{Implemented} +-} +- +-\numtest{6}{ +-\Priority{High} +-\Reason{Fails when caller connected with CHANGEPW_SERVICE.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{7}{ +-\Priority{High} +-\Reason{Fails if caller has ``add'' access and not ``delete''.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{8}{ +-\Priority{High} +-\Reason{Fails if caller has ``modify'' access and not ``delete''.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{9}{ +-\Priority{High} +-\Reason{Fails if caller has ``get'' access and not ``delete''.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{10}{ +-\Priority{High} +-\Reason{Fails if caller has no access bits.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{11}{ +-\Priority{High} +-\Reason{Valid invocation.} +-\Status{Implemented} +-} +- +-\numtest{12}{ +-\Priority{High} +-\Reason{Valid invocation (on principal with policy).} +-\Status{Implemented} +-} +- +-\numtest{13}{ +-\Priority{High} +-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} +-\Status{Implemented} +-} +- +-\numtest{14}{ +-\Priority{Low} +-\Reason{Connects to correct server when multiple handles exist} +-\Conditions{RPC} +-} +- +- +-\section{ovsec_kadm_modify_principal} +- +-%\numtest{1}{ +-%\Reason{Fails if database not initialized.} +-%\Status{Implemented} +-%} +- +-\numtest{2}{ +-\Priority{High} +-\Reason{Fails if user connected with CHANGEPW_SERVICE.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{3}{ +-\Reason{Fails on mask with undefined bit set.} +-\Status{Implemented} +-} +- +-\numtest{4}{ +-\Reason{Fails on mask with PRINCIPAL set.} +-\Status{Implemented} +-} +- +-\numtest{5}{ +-\Priority{High} +-\Reason{Fails on mask with LAST_PWD_CHANGE set.} +-\Status{Implemented} +-} +- +-\numtest{6}{ +-\Reason{Fails on mask with MOD_TIME set.} +-\Status{Implemented} +-} +- +-\numtest{7}{ +-\Reason{Fails on mask with MOD_NAME set.} +-\Status{Implemented} +-} +- +-\numtest{8}{ +-\Reason{Fails on mask with MKVNO set.} +-\Status{Implemented} +-} +- +-\numtest{9}{ +-\Priority{High} +-\Reason{Fails on mask with AUX_ATTRIBUTES set.} +-\Status{Implemented} +-} +- +-\numtest{10}{ +-\Reason{Fails on nonexistent principal.} +-\Status{Implemented} +-} +- +-\numtest{11}{ +-\Priority{High} +-\Reason{Fails for user with no access bits.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{12}{ +-\Priority{High} +-\Reason{Fails for user with ``get'' access.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{13}{ +-\Priority{High} +-\Reason{Fails for user with ``add'' access.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{14}{ +-\Priority{High} +-\Reason{Fails for user with ``delete'' access.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{15}{ +-\Priority{High} +-\Reason{Succeeds for user with ``modify'' access.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{16}{ +-\Reason{Succeeds for user with ``modify'' and another access.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{17}{ +-\Priority{High} +-\Reason{Fails when nonexistent policy is specified.} +-\Status{Implemented} +-} +- +-\numtest{18}{ +-\Priority{High} +-\Reason{Succeeds when existent policy is specified.} +-\Status{Implemented} +-} +- +-\numtest{19}{ +-\Reason{Updates policy count when setting policy from none.} +-\Status{Implemented} +-} +- +-\numtest{20}{ +-\Reason{Updates policy count when clearing policy from set.} +-\Status{Implemented} +-} +- +-\numtest{21}{ +-\Reason{Updates policy count when setting policy from other policy.} +-\Status{Implemented} +-} +- +-\numtest{21.5}{ +-\Reason{Policy reference count remains unchanged when policy is +- changed to itself.} +-\Status{Implemented.} +-} +- +-\numtest{22}{ +-\Reason{Allows 0 (never) for pw_expiration when there's no policy.} +-\Status{Implemented} +-} +- +-\numtest{23}{ +-\Reason{Allows 0 (never) for pw_expiration when there's a policy with +- 0 for pw_max_life.} +-\Status{Implemented} +-} +- +-\numtest{24}{ +-\Reason{Accepts 0 (never) for pw_expiration when there's a policy with +- non-zero pw_max_life, but actually sets pw_expiration to +- last_pwd_change + pw_max_life.} +-\Status{Implemented} +-} +- +-\numtest{25}{ +-\Reason{Accepts and sets non-zero pw_expiration when no policy.} +-\Status{Implemented} +-} +- +-\numtest{26}{ +-\Reason{Accepts and sets non-zero pw_expiration when there's a policy +- with zero pw_max_life.} +-\Status{Implemented} +-} +- +-\numtest{27}{ +-\Reason{Accepts and sets non-zero pw_expiration when there's a policy +- with pw_max_life later than the specified pw_expiration.} +-\Status{Implemented} +-} +- +-\numtest{28}{ +-\Reason{Accepts non-zero pw_expiration and limits it to last_pwd_change + +- pw_max_life when it's later than last_pwd_change + non-zero +- pw_max_life in policy.} +-\Status{Implemented} +-} +- +-\numtest{29}{ +-\Priority{High} +-\Reason{Sets pw_expiration to 0 (never) when a policy is cleared and +-no pw_expiration is specified.} +-\Status{Implemented} +-} +- +-\numtest{30}{ +-\Priority{High} +-\Reason{Sets pw_expiration to 0 (never) if it isn't specified and the +- new policy has a 0 (never) pw_max_life.} +-\Status{Implemented} +-} +- +-\numtest{31}{ +-\Priority{High} +-\Reason{Sets pw_expiration to now + pw_max_life if it isn't specified +- and the new policy has a non-zero pw_max_life.} +-\Status{Implemented} +-} +- +-\numtest{32}{ +-\Priority{High} +-\Reason{Accepts princ_expire_time change.} +-\Status{Implemented} +-} +- +- +- +-\numtest{33}{ +-\Priority{High} +-\Reason{Accepts attributes change.} +-\Status{Implemented} +-} +- +-\numtest{33.25}{ +-\Priority{High} +-\Reason{Accepts attributes change (KRB5_KDB_REQUIRES_PW_CHANGE).} +-\Status{Implemented} +-} +- +-\numtest{33.5}{ +-\Priority{High} +-\Reason{Accepts attributes change (KRB5_DISALLOW_TGT_BASE).} +-\Status{Implemented} +-} +- +-\numtest{33.75}{ +-\Priority{High} +-\Reason{Accepts attributes change (KRB5_PW_CHANGE_SERVICE).} +-\Status{Implemented} +-} +- +-\numtest{34}{ +-\Priority{High} +-\Reason{Accepts max_life change.} +-\Status{Implemented} +-} +- +-\numtest{35}{ +-\Priority{High} +-\Reason{Accepts kvno change.} +-\Status{Implemented} +-} +- +-\numtest{36}{ +-\Reason{Behaves correctly when policy is set to the same as it was +- before.} +-\Status{Implemented} +-} +- +-\numtest{37}{ +-\Reason{Behaves properly when POLICY_CLR is specified and there was no +- policy before.} +-\Status{Implemented} +-} +- +-\numtest{38}{ +-\Priority{High} +-\Reason{Accepts 0 (never) for princ_expire_time.} +-\Status{Implemented} +-} +- +-\numtest{39}{ +-\Priority{High} +-\Reason{Accepts 0 for max_life.} +-\Status{Implemented} +-} +- +-\numtest{40}{ +-\Reason{Rejects null principal argument.} +-\Status{Implemented} +-} +- +-\numtest{41}{ +-\Priority{High} +-\Reason{Doesn't modify or free mod_name on success.} +-} +- +-\numtest{42}{ +-\Priority{High} +-\Reason{Doesn't modify or free mod_name on failure.} +-} +- +-\numtest{43}{ +-\Priority{High} +-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} +-\Status{Implemented} +-} +- +-\numtest{44}{ +-\Priority{Low} +-\Reason{Connects to correct server when multiple handles exist} +-\Conditions{RPC} +-} +- +-\numtest{100}{ +-\Version{KADM5_API_VERSION_2} +-\Priority{bug-fix} +-\Reason{Accepts max_rlife change.} +-\Status{Implemented} +-} +- +-\numtest{101}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Rejects last_success change.} +-\Status{Implemented} +-} +- +-\numtest{102}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Rejects last_failed change.} +-\Status{Implemented} +-} +- +-\numtest{103}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Rejects fail_auth_count change.} +-\Status{Implemented} +-} +- +-\numtest{103.5}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Rejects key_data change.} +-\Status{Implemented} +-} +- +-\numtest{104}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Accepts tl_data change when all types are greater than 256.} +-\Status{Implemented} +-} +- +-\numtest{105}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Returns KADM5_BAD_TL_TYPE when given tl_data with a type less +-than 256.} +-\Status{Implemented} +-} +- +-\section{ovsec_kadm_rename_principal} +- +-%\numtest{1}{ +-%\Reason{Fails if database not initialized.} +-%\Status{Implemented} +-%} +- +-\numtest{2}{ +-\Priority{High} +-\Reason{Fails if user connected with CHANGEPW_SERVICE.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{3}{ +-\Priority{High} +-\Reason{Fails for user with no access bits.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{4}{ +-\Reason{Fails for user with ``modify'' access and not ``add'' or +-``delete''.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{5}{ +-\Reason{Fails for user with ``get'' access and not ``add'' or +-``delete''.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{6}{ +-\Reason{Fails for user with ``modify'' and ``add'' but not ``delete''.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{7}{ +-\Reason{Fails for user with ``modify'' and ``delete'' but not ``add''.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{8}{ +-\Reason{Fails for user with ``get'' and ``add'' but not ``delete''.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{9}{ +-\Reason{Fails for user with ``get'' and ``delete'' but not ``add.''} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{10}{ +-\Reason{Fails for user with ``modify'', ``get'' and ``add'', but not +- ``delete''.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{11}{ +-\Reason{Fails for user with ``modify'', ``get'' and ``delete'', but +- not ``add''.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{12}{ +-\Priority{High} +-\Reason{Fails for user with ``add'' but not ``delete''.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{13}{ +-\Priority{High} +-\Reason{Fails for user with ``delete'' but not ``add''.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{14}{ +-\Priority{High} +-\Reason{Succeeds for user with ``add'' and ``delete'', when that user +-has non-name-based salt.} +-\Status{Implemented} +-} +- +-\numtest{15}{ +-\Priority{High} +-\Reason{Fails if target principal name exists.} +-\Status{Implemented} +-} +- +-\numtest{16}{ +-\Priority{High} +-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} +-\Status{Implemented} +-} +- +-\numtest{17}{ +-\Priority{Low} +-\Reason{Connects to correct server when multiple handles exist} +-\Conditions{RPC} +-} +- +-\numtest{18}{ +-\Priority{bug fix} +-\Reason{Returns NO_RENAME_SALT when asked to rename a principal whose +-salt depends on the principal name.} +-\Status{Implemented} +-} +- +-\section{ovsec_kadm_chpass_principal} +-\label{ovseckadmchpassprincipal} +- +-\subsection{Quality/history enforcement tests} +- +-This section lists a series of tests which will be run a number of +-times, with various parameter settings (e.g., which access bits user +-has, whether user connected with ADMIN_SERVICE or CHANGEPW_SERVICE, +-etc.). The table following the +-list of tests gives the various parameter settings under which the +-tests should be run, as well which should succeed and which should +-fail for each choice of parameter settings. +- +-\subsubsection{List of tests} +- +-The test number of each of these tests is an offset from the base +-given in the table below. +- +-\numtest{1}{ +-\Priority{High} +-\Reason{With history setting of 1, change password to itself.} +-} +- +-\numtest{2}{ +-\Reason{With history setting of 2 but no password changes since +- principal creation, change password to itself.} +-} +- +-\numtest{3}{ +-\Reason{With history setting of 2 and one password change since +- principal creation, change password to itself +- and directly previous password.} +-} +- +-\numtest{4}{ +-\Priority{High} +-\Reason{With a history setting of 3 and no password changes, +- change password to itself.} +-} +- +-\numtest{5}{ +-\Priority{High} +-\Reason{With a history setting of 3 and 1 password change, +- change password to itself or previous password.} +-} +- +-\numtest{6}{ +-\Priority{High} +-\Reason{With a history setting of 3 and 2 password changes, +- change password to itself and the two previous passwords.} +-} +- +-\numtest{7}{ +-\Priority{High} +-\Reason{Change to previously unused password when now - +- last_pwd_change $<$ pw_min_life.} +-} +- +-\numtest{8}{ +-\Priority{High} +-\Reason{Change to previously unused password that doesn't contain enough +- character classes.} +-} +- +-\numtest{9}{ +-\Priority{High} +-\Reason{Change to previously unused password that's too short.} +-} +- +-\numtest{10}{ +-\Priority{High} +-\Reason{Change to previously unused password that's in the dictionary.} +-} +- +-\subsubsection{List of parameter settings} +- +-In the table below, ``7 passes'' means that test 7 above passes and +-the rest of the tests fail. +- +-\begin{tabular}{llllll} +-Base & Modify access? & Own password? & Service & Pass/Fail \\ \hline +-0 & No & Yes & ADMIN & all fail \\ +-20 & No & Yes & CHANGEPW & all fail \\ +-40 & No & No & ADMIN & all fail \\ +-60 & No & No & CHANGEPW & all fail \\ +-80 & Yes & Yes & ADMIN & 7 passes \\ +-100 & Yes & Yes & CHANGEPW & all fail \\ +-120 & Yes & No & ADMIN & 7 passes \\ +-140 & Yes & No & CHANGEPW & all fail \\ +-\end{tabular} +- +-\subsection{Other quality/history tests} +- +-\numtest{161}{ +-\Priority{High} +-\Reason{With history of 1, can change password to anything other than +- itself that doesn't conflict with other quality +- rules.} +-} +- +-\numtest{162}{ +-\Reason{With history of 2 and 2 password changes, can change password +- to original password.} +-} +- +-\numtest{163}{ +-\Priority{High} +-\Reason{With history of 3 and 3 password changes, can change password +- to original password.} +-} +- +-\numtest{164}{ +-\Priority{High} +-\Reason{Can change password when now - last_pwd_change $>$ pw_min_life.} +-} +- +-\numtest{165}{ +-\Priority{High} +-\Reason{Can change password when it contains exactly the number of +- classes required by the policy.} +-} +- +-\numtest{166}{ +-\Priority{High} +-\Reason{Can change password when it is exactly the length required by +- the policy.} +-} +- +-\numtest{167}{ +-\Priority{High} +-\Reason{Can change password to a word that isn't in the dictionary.} +-} +- +- +-\subsection{Other tests} +- +-%\numtest{168}{ +-%\Reason{Fails if database not initialized.} +-%} +- +-\numtest{169}{ +-\Reason{Fails for non-existent principal.} +-} +- +-\numtest{170}{ +-\Reason{Fails for null password.} +-} +- +-\numtest{171}{ +-\Priority{High} +-\Reason{Fails for empty-string password.} +-} +- +-\numtest{172}{ +-\Priority{High} +-\Reason{Pw_expiration is set to now + max_pw_life if policy exists and +- has non-zero max_pw_life.} +-} +- +-\numtest{173}{ +-\Priority{High} +-\Reason{Pw_expiration is set to 0 if policy exists and has zero +- max_pw_life.} +-} +- +-\numtest{174}{ +-\Priority{High} +-\Reason{Pw_expiration is set to 0 if no policy.} +-} +- +-\numtest{175}{ +-\Priority{High} +-\Reason{KRB5_KDC_REQUIRES_PWCHANGE bit is cleared when password is +- successfully changed.} +-} +- +-\numtest{176}{ +-\Priority{High} +-\Reason{Fails for user with no access bits, on other's password.} +-} +- +-\numtest{177}{ +-\Priority{High} +-\Reason{Fails for user with ``get'' but not ``modify'' access, on +- other's password.} +-} +- +-\numtest{178}{ +-\Reason{Fails for user with ``delete'' but not ``modify'' access, on +- other's password.} +-} +- +-\numtest{179}{ +-\Reason{Fails for user with ``add'' but not ``modify'' access, on +- other's password.} +-} +- +-\numtest{180}{ +-\Reason{Succeeds for user with ``get'' and ``modify'' access, on +- other's password.} +-\Status{Implemented} +-} +- +-\numtest{180.5}{ +-\Priority{High} +-\Reason{Succeeds for user with ``modify'' but not ``get'' access, on +- other's password.} +-\Conditions{RPC} +-\Status{Implemented} +-} +-\numtest{180.625}{ +-\Priority{High} +-\Reason{Fails for user with modify when connecting with CHANGEPW_SERVICE on +- others password} +-\Conditions{RPC} +-\Status{Implemented} +-} +-\numtest{180.75}{ +-\Priority{High} +-\Reason{Fails for user with modify when connecting with CHANGEPW_SERVICE +- on other's password which has expired} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-%\numtest{181}{ +-%\Reason{Password that would succeed if override_qual were false fails +-% if override_qual is true.} +-%\Expected{Returns CANNOT_OVERRIDE.} +-%} +- +-\numtest{182}{ +-\Priority{High} +-\Reason{Can not change key of ovsec_adm/history principal.} +-\Status{Implemented} +-} +- +-\numtest{183}{ +-\Priority{High} +-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} +-\Status{Implemented} +-} +- +-\numtest{184}{ +-\Priority{Low} +-\Reason{Connects to correct server when multiple handles exist} +-\Conditions{RPC} +-} +- +-\numtest{200}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Creates a key for the principal for each unique encryption +-type/salt type in use.} +-\Status{Implemented} +-} +- +-\section{ovsec_kadm_chpass_principal_util} +- +-Rerun all the tests listed for ovsec_kadm_chpass_principal above in +-Section \ref{ovseckadmchpassprincipal}. Verify that they succeed +-and fail in the same circumstances. Also verify that in each failure +-case, the error message returned in msg_ret is as specified in the +-functional specification. +- +-Also, run the following additional tests. +- +-\numtest{1}{ +-\Reason{Null msg_ret is rejected.} +-} +- +-\numtest{2}{ +-\Priority{High} +-\Reason{New password is put into pw_ret, when it's prompted for.} +-} +- +-\numtest{3}{ +-\Priority{High} +-Reason{New password is put into pw_ret, when it's supplied by the +- caller.} +-} +- +-\numtest{4}{ +-\Priority{High} +-\Reason{Successful invocation when pw_ret is null.} +-} +- +- +- +-\section{ovsec_kadm_randkey_principal} +- +-\subsection{TOOSOON enforcement tests} +- +-This test should be run a number of times, as indicated in the table +-following it. The table also indicates the expected result of each +-run of the test. +- +-\test{ +-\Reason{Change key when now - last_pwd_change $<$ pw_min_life.} +-} +- +-\subsubsection{List of parameter settings} +- +-\begin{tabular}{llllll} +-Number & Modify Access? & Own Key? & Service & Pass/Fail & Implemented? \\ \hline +-1 & No & Yes & ADMIN & fail & Yes \\ +-3 & No & Yes & CHANGEPW & fail & Yes \\ +-5 & No & No & ADMIN & fail \\ +-7 & No & No & CHANGEPW & fail \\ +-9 & Yes & Yes & ADMIN & pass \\ +-11 & Yes & Yes & CHANGEPW & fail \\ +-13 & Yes & No & ADMIN & pass & Yes \\ +-15 & Yes & No & CHANGEPW & fail & Yes \\ +-\end{tabular} +- +-\subsection{Other tests} +- +-\numtest{17}{ +-\Reason{Fails if database not initialized.} +-} +- +-\numtest{18}{ +-\Reason{Fails for non-existent principal.} +-} +- +-\numtest{19}{ +-\Reason{Fails for null keyblock pointer.} +-} +- +-\numtest{20}{ +-\Priority{High} +-\Reason{Pw_expiration is set to now + max_pw_life if policy exists and +- has non-zero max_pw_life.} +-} +- +-\numtest{21}{ +-\Priority{High} +-\Reason{Pw_expiration is set to 0 if policy exists and has zero +- max_pw_life.} +-} +- +-\numtest{22}{ +-\Priority{High} +-\Reason{Pw_expiration is set to 0 if no policy.} +-} +- +-\numtest{23}{ +-\Priority{High} +-\Reason{KRB5_KDC_REQUIRES_PWCHANGE bit is cleared when key is +- successfully changed.} +-} +- +-\numtest{24}{ +-\Priority{High} +-\Reason{Fails for user with no access bits, on other's password.} +-} +- +-\numtest{25}{ +-\Priority{High} +-\Reason{Fails for user with ``get'' but not ``modify'' access, on +- other's password.} +-\Vtwonote{Change-password instead of modify access.} +-} +- +-\numtest{26}{ +-\Reason{Fails for user with ``delete'' but not ``modify'' access, on +- other's password.} +-\Vtwonote{Change-password instead of modify access.} +-} +- +-\numtest{27}{ +-\Reason{Fails for user with ``add'' but not ``modify'' access, on +- other's password.} +-\Vtwonote{Change-password instead of modify access.} +-} +- +-\numtest{28}{ +-\Reason{Succeeds for user with ``get'' and ``modify'' access, on +- other's password.} +-\Status{Implemented} +-\Vtwonote{Change-password instead of modify access.} +-} +- +-\numtest{28.25}{ +-\Priority{High} +-\Reason{Fails for user with get and modify access on others password +- When conneceted with CHANGEPW_SERVICE} +-\Status{Implemented} +-\Vtwonote{Change-password instead of modify access.} +-} +- +-\numtest{28.5}{ +-\Priority{High} +-\Reason{Succeeds for user with ``modify'' but not ``get'' access, on +- other's password.} +-\Status{Implemented} +-\Vtwonote{Change-password instead of modify access.} +-} +- +-\numtest{29}{ +-\Reason{The new key that's assigned is truly random. XXX not sure how +- to test this.} +-} +- +-\numtest{30}{ +-\Reason{Succeeds for own key, no other access bits when connecting with CHANGEPW service} +-\Status{Implemented} +-} +-\numtest{31}{ +-\Reason{Succeeds for own key, no other access bits when connecting with ADMIM service} +-\Status{Implemented} +-} +- +-\numtest{32}{ +-\Reason{Cannot change ovsec_adm/history key} +-\Status{Implemented} +-} +- +-\numtest{33}{ +-\Priority{High} +-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} +-\Status{Implemented} +-} +- +-\numtest{34}{ +-\Priority{Low} +-\Reason{Connects to correct server when multiple handles exist} +-\Conditions{RPC} +-} +- +-\numtest{100}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{Returns a key for each unique encryption type specified in the +-keysalts.} +-} +- +-\section{ovsec_kadm_get_principal} +- +-\numtest{1}{ +-\Reason{Fails for null ent.} +-\Status{Implemented} +-} +- +-\numtest{2}{ +-\Reason{Fails for non-existent principal.} +-\Status{Implemented} +-} +- +-\numtest{3}{ +-\Priority{High} +-\Reason{Fails for user with no access bits, retrieving other principal.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{4}{ +-\Priority{High} +-\Reason{Fails for user with ``add'' but not ``get'', getting principal +- other than his own, using ADMIN_SERVICE.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{5}{ +-\Reason{Fails for user with ``modify'' but not ``get'', getting +- principal other than his own, using ADMIN_SERVICE.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{6}{ +-\Reason{Fails for user with ``delete'' but not ``get'', getting +- principal other than his own, using ADMIN_SERVICE.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{7}{ +-\Reason{Fails for user with ``delete'' but not ``get'', getting +- principal other than his own, using CHANGEPW_SERVICE.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{8}{ +-\Priority{High} +-\Reason{Fails for user with ``get'', getting principal other than his +- own, using CHANGEPW_SERVICE.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{9}{ +-\Priority{High} +-\Reason{Succeeds for user without ``get'', retrieving self, using +- ADMIN_SERVICE.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{10}{ +-\Reason{Succeeds for user without ``get'', retrieving self, using +- CHANGEPW_SERVICE.} +-\Status{Implemented} +-} +- +-\numtest{11}{ +-\Reason{Succeeds for user with ``get'', retrieving self, using +- ADMIN_SERVICE.} +-\Status{Implemented} +-} +- +-\numtest{12}{ +-\Reason{Succeeds for user with ``get'', retrieving self, using +- CHANGEPW_SERVICE.} +-\Status{Implemented} +-} +- +-\numtest{13}{ +-\Priority{High} +-\Reason{Succeeds for user with ``get'', retrieving other user, using +- ADMIN_SERVICE.} +-\Status{Implemented} +-} +- +-\numtest{14}{ +-\Reason{Succeeds for user with ``get'' and ``modify'', retrieving +- other principal, using ADMIN_SERVICE.} +-\Status{Implemented} +-} +- +-\numtest{15}{ +-\Priority{High} +-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} +-\Status{Implemented} +-} +- +-\numtest{16}{ +-\Priority{Low} +-\Reason{Connects to correct server when multiple handles exist} +-\Conditions{RPC} +-} +- +-\numtest{100}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{If KADM5_PRINCIPAL_NORMAL_MASK is specified, the key_data and +-tl_data fields are NULL/zero.} +-\Status{Implemented} +-} +- +-\numtest{101}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{If KADM5_KEY_DATA is specified, the key_data fields contain +-data but the contents are all NULL.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{102}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{If KADM5_KEY_DATA is specified, the key_data fields contain +-data and the contents are all non-NULL.} +-\Conditions{local} +-\Status{Implemented} +-} +- +-\numtest{103}{ +-\Version{KADM5_API_VERSION_2} +-\Reason{If KADM5_TL_DATA is specified, the tl_data field contains the +-correct tl_data and no entries whose type is less than 256.} +-\Status{Implemented} +-} +- +- +-\section{ovsec_kadm_create_policy} +- +-\numtest{1}{ +-\Reason{Fails for mask with undefined bit set.} +-\Status{Implemented - untested} +-} +- +-\numtest{2}{ +-\Priority{High} +-\Reason{Fails if caller connected with CHANGEPW_SERVICE.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{3}{ +-\Reason{Fails for mask without POLICY bit set.} +-\Status{Implemented - untested} +-} +- +-\numtest{4}{ +-\Reason{Fails for mask with REF_COUNT bit set.} +-\Status{Implemented} +-} +- +-\numtest{5}{ +-\Reason{Fails for invalid policy name.} +-\Status{Implemented - untested} +-} +- +-\numtest{6}{ +-\Priority{High} +-\Reason{Fails for existing policy name.} +-\Status{Implemented} +-} +- +-\numtest{7}{ +-\Reason{Fails for null policy name.} +-\Status{Implemented - untested} +-} +- +-\numtest{8}{ +-\Priority{High} +-\Reason{Fails for empty-string policy name.} +-\Status{Implemented} +-} +- +-\numtest{9}{ +-\Priority{High} +-\Reason{Accepts 0 for pw_min_life.} +-\Status{Implemented} +-} +- +-\numtest{10}{ +-\Priority{High} +-\Reason{Accepts non-zero for pw_min_life.} +-\Status{Implemented} +-} +- +-\numtest{11}{ +-\Priority{High} +-\Reason{Accepts 0 for pw_max_life.} +-\Status{Implemented} +-} +- +-\numtest{12}{ +-\Priority{High} +-\Reason{Accepts non-zero for pw_max_life.} +-\Status{Implemented} +-} +- +-\numtest{13}{ +-\Priority{High} +-\Reason{Rejects 0 for pw_min_length.} +-\Status{Implemented} +-} +- +-\numtest{14}{ +-\Priority{High} +-\Reason{Accepts non-zero for pw_min_length.} +-\Status{Implemented} +-} +- +-\numtest{15}{ +-\Priority{High} +-\Reason{Rejects 0 for pw_min_classes.} +-\Status{Implemented} +-} +- +-\numtest{16}{ +-\Priority{High} +-\Reason{Accepts 1 for pw_min_classes.} +-\Status{Implemented} +-} +- +-\numtest{17}{ +-\Priority{High} +-\Reason{Accepts 4 for pw_min_classes.} +-\Status{Implemented} +-} +- +-\numtest{18}{ +-\Priority{High} +-\Reason{Rejects 5 for pw_min_classes.} +-\Status{Implemented} +-} +- +-\numtest{19}{ +-\Priority{High} +-\Reason{Rejects 0 for pw_history_num.} +-\Status{Implemented} +-} +- +-\numtest{20}{ +-\Priority{High} +-\Reason{Accepts 1 for pw_history_num.} +-\Status{Implemented} +-} +- +-\numtest{21}{ +-\Priority{High} +-\Reason{Accepts 10 for pw_history_num.} +-\Status{Implemented} +-} +- +-\numtest{21.5}{ +-\Reason{Rejects 11 for pw_history_num.} +-\Status{Implemented - untested} +-} +- +-\numtest{22}{ +-\Priority{High} +-\Reason{Fails for user with no access bits.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{23}{ +-\Priority{High} +-\Reason{Fails for user with ``get'' but not ``add''.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{24}{ +-\Reason{Fails for user with ``modify'' but not ``add.''} +-\Conditions{RPC} +-\Status{Implemented - untested} +-} +- +-\numtest{25}{ +-\Reason{Fails for user with ``delete'' but not ``add.''} +-\Conditions{RPC} +-\Status{Implemented - untested} +-} +- +-\numtest{26}{ +-\Priority{High} +-\Reason{Succeeds for user with ``add.''} +-\Status{Implemented} +-} +- +-\numtest{27}{ +-\Reason{Succeeds for user with ``get'' and ``add.''} +-\Status{Implemented - untested} +-} +- +-\numtest{28}{ +-\Reason{Rejects null policy argument.} +-\Status{Implemented - untested} +-} +- +-\numtest{29}{ +-\Reason{Rejects pw_min_life greater than pw_max_life.} +-} +- +-\numtest{30}{ +-\Priority{High} +-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} +-\Status{Implemented} +-} +- +-\numtest{31}{ +-\Priority{Low} +-\Reason{Connects to correct server when multiple handles exist} +-\Conditions{RPC} +-} +- +- +-\section{ovsec_kadm_delete_policy} +- +-\numtest{1}{ +-\Reason{Fails for null policy name.} +-} +- +-\numtest{2}{ +-\Priority{High} +-\Reason{Fails for empty-string policy name.} +-\Status{Implemented} +-} +- +-\numtest{3}{ +-\Reason{Fails for non-existent policy name.} +-} +- +-\numtest{4}{ +-\Reason{Fails for bad policy name.} +-} +- +-\numtest{5}{ +-\Priority{High} +-\Reason{Fails if caller connected with CHANGEPW_SERVICE.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{6}{ +-\Priority{High} +-\Reason{Fails for user with no access bits.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{7}{ +-\Priority{High} +-\Reason{Fails for user with ``add'' but not ``delete''.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{8}{ +-\Reason{Fails for user with ``modify'' but not ``delete''.} +-\Conditions{RPC} +-} +- +-\numtest{9}{ +-\Reason{Fails for user with ``get'' but not ``delete.''} +-\Conditions{RPC} +-} +- +-\numtest{10}{ +-\Priority{High} +-\Reason{Succeeds for user with only ``delete''.} +-\Status{Implemented} +-} +- +-\numtest{11}{ +-\Reason{Succeeds for user with ``delete'' and ``add''.} +-} +- +-\numtest{12}{ +-\Priority{High} +-\Reason{Fails for policy with non-zero reference count.} +-\Status{Implemented} +-} +- +-\numtest{13}{ +-\Priority{High} +-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} +-\Status{Implemented} +-} +- +-\numtest{14}{ +-\Priority{Low} +-\Reason{Connects to correct server when multiple handles exist} +-\Conditions{RPC} +-} +- +- +-\section{ovsec_kadm_modify_policy} +- +-\numtest{1}{ +-\Reason{Fails for mask with undefined bit set.} +-\Conditions{RPC} +-} +- +-\numtest{2}{ +-\Priority{High} +-\Reason{Fails if caller connected with CHANGEPW_SERVICE.} +-\Status{Implemented} +-} +- +-\numtest{3}{ +-\Reason{Fails for mask with POLICY bit set.} +-} +- +-\numtest{4}{ +-\Reason{Fails for mask with REF_COUNT bit set.} +-\Status{Implemented} +-} +- +-\numtest{5}{ +-\Reason{Fails for invalid policy name.} +-} +- +-\numtest{6}{ +-\Reason{Fails for non-existent policy name.} +-} +- +-\numtest{7}{ +-\Reason{Fails for null policy name.} +-} +- +-\numtest{8}{ +-\Priority{High} +-\Reason{Fails for empty-string policy name.} +-\Status{Implemented} +-} +- +-\numtest{9}{ +-\Priority{High} +-\Reason{Accepts 0 for pw_min_life.} +-\Status{Implemented} +-} +- +-\numtest{10}{ +-\Priority{High} +-\Reason{Accepts non-zero for pw_min_life.} +-\Status{Implemented} +-} +- +-\numtest{11}{ +-\Priority{High} +-\Reason{Accepts 0 for pw_max_life.} +-\Status{Implemented} +-} +- +-\numtest{12}{ +-\Priority{High} +-\Reason{Accepts non-zero for pw_max_life.} +-\Status{Implemented} +-} +- +-\numtest{13}{ +-\Priority{High} +-\Reason{Accepts 0 for pw_min_length.} +-\Status{Implemented} +-} +- +-\numtest{14}{ +-\Priority{High} +-\Reason{Accepts non-zero for pw_min_length.} +-\Status{Implemented} +-} +- +-\numtest{15}{ +-\Priority{High} +-\Reason{Rejects 0 for pw_min_classes.} +-\Status{Implemented} +-} +- +-\numtest{16}{ +-\Priority{High} +-\Reason{Accepts 1 for pw_min_classes.} +-\Status{Implemented} +-} +- +-\numtest{17}{ +-\Priority{High} +-\Reason{Accepts 4 for pw_min_classes.} +-\Status{Implemented} +-} +- +-\numtest{18}{ +-\Priority{High} +-\Reason{Rejects 5 for pw_min_classes.} +-\Status{Implemented} +-} +- +-\numtest{19}{ +-\Priority{High} +-\Reason{Rejects 0 for pw_history_num.} +-\Status{Implemented} +-} +- +-\numtest{20}{ +-\Priority{High} +-\Reason{Accepts 1 for pw_history_num.} +-\Status{Implemented} +-} +- +-\numtest{21}{ +-\Priority{High} +-\Reason{Accepts 10 for pw_history_num.} +-\Status{Implemented} +-} +- +-\numtest{22}{ +-\Priority{High} +-\Reason{Fails for user with no access bits.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{23}{ +-\Priority{High} +-\Reason{Fails for user with ``get'' but not ``modify''.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{24}{ +-\Reason{Fails for user with ``add'' but not ``modify.''} +-\Conditions{RPC} +-} +- +-\numtest{25}{ +-\Reason{Fails for user with ``delete'' but not ``modify.''} +-\Conditions{RPC} +-} +- +-\numtest{26}{ +-\Priority{High} +-\Reason{Succeeds for user with ``modify.''} +-\Status{Implemented} +-} +- +-\numtest{27}{ +-\Reason{Succeeds for user with ``get'' and ``modify.''} +-} +- +-\numtest{28}{ +-\Reason{Rejects null policy argument.} +-} +- +-\numtest{29}{ +-\Reason{Rejects change which makes pw_min_life greater than +- pw_max_life.} +-} +- +-\numtest{30}{ +-\Priority{High} +-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} +-\Status{Implemented} +-} +- +-\numtest{31}{ +-\Priority{Low} +-\Reason{Connects to correct server when multiple handles exist} +-\Conditions{RPC} +-} +- +-\section{ovsec_kadm_get_policy} +- +-\numtest{1}{ +-\Reason{Fails for null policy.} +-} +- +-\numtest{2}{ +-\Reason{Fails for invalid policy name.} +-} +- +-\numtest{3}{ +-\Priority{High} +-\Reason{Fails for empty-string policy name.} +-\Status{Implemented} +-} +- +-\numtest{4}{ +-\Reason{Fails for non-existent policy name.} +-} +- +-\numtest{5}{ +-\Reason{Fails for null ent.} +-} +- +-\numtest{6}{ +-\Priority{High} +-\Reason{Fails for user with no access bits trying to get other's +- policy, using ADMIN_SERVICE.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{7}{ +-\Priority{High} +-\Reason{Fails for user with ``add'' but not ``get'' trying to get +- other's policy, using ADMIN_SERVICE.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{8}{ +-\Reason{Fails for user with ``modify'' but not ``get'' trying to get +- other's policy, using ADMIN_SERVICE.} +-\Conditions{RPC} +-} +- +-\numtest{9}{ +-\Reason{Fails for user with ``delete'' but not ``get'' trying to get +- other's policy, using ADMIN_SERVICE.} +-\Conditions{RPC} +-} +- +-\numtest{10}{ +-\Reason{Fails for user with ``delete'' but not ``get'' trying to get +- other's policy, using CHANGEPW_SERVICE.} +-\Conditions{RPC} +-} +- +-\numtest{11}{ +-\Priority{High} +-\Reason{Succeeds for user with only ``get'', trying to get own policy, +- using ADMIN_SERVICE.} +-\Status{Implemented} +-} +- +-\numtest{12}{ +-\Priority{High} +-\Reason{Succeeds for user with only ``get'', trying to get own policy, +- using CHANGEPW_SERVICE.} +-\Status{Implemented} +-} +- +-\numtest{13}{ +-\Reason{Succeeds for user with ``add'' and ``get'', trying to get own +- policy, using ADMIN_SERVICE.} +-} +- +-\numtest{14}{ +-\Reason{Succeeds for user with ``add'' and ``get'', trying to get own +- policy, using CHANGEPW_SERVICE.} +-} +- +-\numtest{15}{ +-\Reason{Succeeds for user without ``get'', trying to get own policy, +- using ADMIN_SERVICE.} +-} +- +-\numtest{16}{ +-\Priority{High} +-\Reason{Succeeds for user without ``get'', trying to get own policy, +- using CHANGEPW_SERVICE.} +-\Status{Implemented} +-} +- +-\numtest{17}{ +-\Priority{High} +-\Reason{Succeeds for user with ``get'', trying to get other's policy, +- using ADMIN_SERVICE.} +-\Status{Implemented} +-} +- +-\numtest{18}{ +-\Priority{High} +-\Reason{Fails for user with ``get'', trying to get other's policy, +- using CHANGEPW_SERVICE.} +-\Conditions{RPC} +-\Status{Implemented} +-} +- +-\numtest{19}{ +-\Reason{Succeeds for user with ``modify'' and ``get'', trying to get +- other's policy, using ADMIN_SERVICE.} +-} +- +-\numtest{20}{ +-\Reason{Fails for user with ``modify'' and ``get'', trying to get +- other's policy, using CHANGEPW_SERVICE.} +-} +- +-\numtest{21}{ +-\Priority{High} +-\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} +-\Status{Implemented} +-} +- +-\numtest{22}{ +-\Priority{Low} +-\Reason{Connects to correct server when multiple handles exist} +-\Conditions{RPC} +-} +- +- +-\section{ovsec_kadm_free_principal_ent} +- +-In addition to the tests listed here, a memory-leak detector such as +-TestCenter, Purify or dbmalloc should be used to verify that the +-memory freed by this function is really freed. +- +-\numtest{1}{ +-\Reason{Null princ succeeds.} +-} +- +-\numtest{2}{ +-\Reason{Non-null princ succeeds.} +-} +- +- +-\section{ovsec_kadm_free_policy_ent} +- +-In addition to the tests listed here, a memory-leak detector such as +-TestCenter, Purify or dbmalloc should be used to verify that the +-memory freed by this function is really freed. +- +-\numtest{1}{ +-\Reason{Null policy succeeds.} +-} +- +-\numtest{2}{ +-\Reason{Non-null policy succeeds.} +-} +- +- +- +-\section{ovsec_kadm_get_privs} +- +-\numtest{1}{ +-\Reason{Fails for null pointer argument.} +-} +- +-This test should be run with the 16 possible combinations of access +-bits (since there are 4 access bits, there are $2^4 = 16$ possible +-combinations of them): +- +-\numtest{2}{ +-\Priority{High} +-\Reason{Returns correct bit mask for access bits of user.} +-\Conditions{RPC} +-} +- +-This test should be run locally: +- +-\numtest{3}{ +-\Priority{High} +-\Reason{Returns 0x0f.} +-\Conditions{local} +-} +- +-\end{document} +diff --git a/src/config/pre.in b/src/config/pre.in +index 3752174c7..b2d17b077 100644 +--- a/src/config/pre.in ++++ b/src/config/pre.in +@@ -228,16 +228,8 @@ KRB5_INCSUBDIRS = \ + $(KRB5_INCDIR)/gssapi \ + $(KRB5_INCDIR)/gssrpc + +-# +-# Macros used by the KADM5 (OV-based) unit test system. +-# XXX check which of these are actually used! +-# + SKIPTESTS = $(BUILDTOP)/skiptests +-TESTDIR = $(BUILDTOP)/kadmin/testing +-STESTDIR = $(top_srcdir)/kadmin/testing +-ENV_SETUP = $(TESTDIR)/scripts/env-setup.sh +-CLNTTCL = $(TESTDIR)/util/kadm5_clnt_tcl +-SRVTCL = $(TESTDIR)/util/kadm5_srv_tcl ++ + # Dejagnu variables. + # We have to set the host with --host so that setup_xfail will work. + # If we don't set it, then the host type used is "native", which +@@ -249,14 +241,6 @@ RUNTEST = runtest $(DEJAFLAGS) + RUNPYTEST = PYTHONPATH=$(top_srcdir)/util VALGRIND="$(VALGRIND)" \ + $(PYTHON) + +-START_SERVERS = $(STESTDIR)/scripts/start_servers $(TEST_SERVER) $(TEST_PATH) +-START_SERVERS_LOCAL = $(STESTDIR)/scripts/start_servers_local +- +-STOP_SERVERS = $(STESTDIR)/scripts/stop_servers $(TEST_SERVER) $(TEST_PATH) +-STOP_SERVERS_LOCAL = $(STESTDIR)/scripts/stop_servers_local +-# +-# End of macros for the KADM5 unit test system. +-# + + transform = @program_transform_name@ + +diff --git a/src/configure.ac b/src/configure.ac +index 61778dcd0..4f16fee45 100644 +--- a/src/configure.ac ++++ b/src/configure.ac +@@ -991,33 +991,9 @@ ath_compat= + AC_ARG_ENABLE([athena], + [ --enable-athena build with MIT Project Athena configuration], + ath_compat=compat,) +-# The following are tests for the presence of programs required for +-# kadmin testing. +-AC_CHECK_PROG(have_RUNTEST,runtest,runtest) +-AC_CHECK_PROG(have_PERL,perl,perl) +-if test "$have_PERL" = perl -a "$have_RUNTEST" = runtest -a "$TCL_LIBS" != ""; then +- DO_TEST=ok +-fi +-AC_SUBST(DO_TEST) +- +-# The following are substituted into kadmin/testing/scripts/env-setup.sh +-RBUILD=`pwd` +-AC_SUBST(RBUILD) +-case "$srcdir" in +-/*) S_TOP=$srcdir ;; +-*) S_TOP=`pwd`/$srcdir ;; +-esac +-AC_SUBST(S_TOP) +-AC_PATH_PROG(EXPECT,expect) +-# For kadmin/testing/util/Makefile.in +-if test "$TCL_LIBS" != "" ; then +- DO_ALL=tcl +-fi +-AC_SUBST(DO_ALL) ++ + KRB5_AC_PRIOCNTL_HACK +-K5_GEN_FILE(kadmin/testing/scripts/env-setup.sh:kadmin/testing/scripts/env-setup.shin) +-# for lib/kadm5 +-AC_CHECK_PROG(RUNTEST,runtest,runtest) ++ + AC_CHECK_PROG(PERL,perl,perl) + + # lib/gssapi +@@ -1552,7 +1528,7 @@ V5_AC_OUTPUT_MAKEFILE(. + + lib/rpc lib/rpc/unit-test + +- lib/kadm5 lib/kadm5/clnt lib/kadm5/srv lib/kadm5/unit-test ++ lib/kadm5 lib/kadm5/clnt lib/kadm5/srv + lib/krad + lib/apputils + +@@ -1588,7 +1564,6 @@ V5_AC_OUTPUT_MAKEFILE(. + clients/kdestroy clients/kpasswd clients/ksu clients/kswitch + + kadmin kadmin/cli kadmin/dbutil kadmin/ktutil kadmin/server +- kadmin/testing kadmin/testing/scripts kadmin/testing/util + + appl + appl/sample appl/sample/sclient appl/sample/sserver +diff --git a/src/kadmin/Makefile.in b/src/kadmin/Makefile.in +index f4061f4f7..87cfa43fd 100644 +--- a/src/kadmin/Makefile.in ++++ b/src/kadmin/Makefile.in +@@ -1,6 +1,6 @@ + mydir=kadmin + BUILDTOP=$(REL).. +-SUBDIRS = cli dbutil ktutil server testing ++SUBDIRS = cli dbutil ktutil server + + all: + +diff --git a/src/kadmin/testing/Makefile.in b/src/kadmin/testing/Makefile.in +deleted file mode 100644 +index 5b803cb23..000000000 +--- a/src/kadmin/testing/Makefile.in ++++ /dev/null +@@ -1,8 +0,0 @@ +-mydir=kadmin$(S)testing +-BUILDTOP=$(REL)..$(S).. +-SUBDIRS = scripts util +- +-all: +- +-clean: +- -$(RM) -r krb5-test-root admin_* init-* *.rcache2 ovsec-* +diff --git a/src/kadmin/testing/deps b/src/kadmin/testing/deps +deleted file mode 100644 +index 2feac3c9d..000000000 +--- a/src/kadmin/testing/deps ++++ /dev/null +@@ -1 +0,0 @@ +-# No dependencies here. +diff --git a/src/kadmin/testing/proto/kdc.conf.proto b/src/kadmin/testing/proto/kdc.conf.proto +deleted file mode 100644 +index 8a4b87de1..000000000 +--- a/src/kadmin/testing/proto/kdc.conf.proto ++++ /dev/null +@@ -1,16 +0,0 @@ +-[kdcdefaults] +- kdc_listen = 1750 +- kdc_tcp_listen = 1750 +- +-[realms] +- __REALM__ = { +- profile = __K5ROOT__/krb5.conf +- database_name = __K5ROOT__/kdb5 +- key_stash_file = __K5ROOT__/.k5.__REALM__ +- acl_file = __K5ROOT__/ovsec_adm.acl +- dict_file = __K5ROOT__/ovsec_adm.dict +- kadmind_port = 1751 +- kpasswd_port = 1752 +- master_key_type = des3-hmac-sha1 +- supported_enctypes = des3-hmac-sha1:normal aes256-cts:normal aes128-cts:normal aes256-sha2:normal aes128-sha2:normal +- } +diff --git a/src/kadmin/testing/proto/krb5.conf.proto b/src/kadmin/testing/proto/krb5.conf.proto +deleted file mode 100644 +index a1c57119c..000000000 +--- a/src/kadmin/testing/proto/krb5.conf.proto ++++ /dev/null +@@ -1,32 +0,0 @@ +-[libdefaults] +- default_realm = __REALM__ +- default_keytab_name = FILE:__K5ROOT__/keytab +- dns_fallback = no +- dns_canonicalize_hostname = fallback +- qualify_shortname = "" +- plugin_base_dir = __PLUGIN_DIR__ +- allow_weak_crypto = true +- +-[realms] +- __REALM__ = { +- kdc = __HOSTNAME__:1750 +- admin_server = __HOSTNAME__:1751 +- database_module = foobar_db2_module_blah +- } +- +-[domain_realm] +- __HOSTNAME__ = __REALM__ +- +-[logging] +- admin_server = FILE:__K5ROOT__/syslog +- kdc = FILE:__K5ROOT__/syslog +- default = FILE:__K5ROOT__/syslog +- +- +-# THIS SHOULD BE IN KDC.CONF INSTEAD! +-[dbmodules] +- db_module_dir = __MODDIR__ +- foobar_db2_module_blah = { +- db_library = db2 +- database_name = __K5ROOT__/kdb5 +- } +diff --git a/src/kadmin/testing/proto/ovsec_adm.dict b/src/kadmin/testing/proto/ovsec_adm.dict +deleted file mode 100644 +index b54e3a85e..000000000 +--- a/src/kadmin/testing/proto/ovsec_adm.dict ++++ /dev/null +@@ -1,3 +0,0 @@ +-Abyssinia +-Discordianism +-foo +diff --git a/src/kadmin/testing/scripts/Makefile.in b/src/kadmin/testing/scripts/Makefile.in +deleted file mode 100644 +index 635930511..000000000 +--- a/src/kadmin/testing/scripts/Makefile.in ++++ /dev/null +@@ -1,18 +0,0 @@ +-mydir=kadmin$(S)testing$(S)scripts +-BUILDTOP=$(REL)..$(S)..$(S).. +- +-all: env-setup.sh runenv.sh $(GEN_SCRIPTS) +- +-# Should only rebuild env_setup.sh here (use CONFIG_FILES=), but the weird krb5 +-# makefile post-processing is unconditional and would trash the makefile. +-env-setup.sh: env-setup.stamp +-env-setup.stamp: $(srcdir)/env-setup.shin $(BUILDTOP)/config.status \ +- Makefile +- (cd $(BUILDTOP) && \ +- CONFIG_FILES=$(mydir)/env-setup.sh:$(mydir)/env-setup.shin $(SHELL) \ +- config.status) +- chmod +x env-setup.sh +- touch env-setup.stamp +- +-clean: +- -rm -f env-setup.sh env-setup.stamp +diff --git a/src/kadmin/testing/scripts/deps b/src/kadmin/testing/scripts/deps +deleted file mode 100644 +index 2feac3c9d..000000000 +--- a/src/kadmin/testing/scripts/deps ++++ /dev/null +@@ -1 +0,0 @@ +-# No dependencies here. +diff --git a/src/kadmin/testing/scripts/env-setup.shin b/src/kadmin/testing/scripts/env-setup.shin +deleted file mode 100755 +index 88f8ad1aa..000000000 +--- a/src/kadmin/testing/scripts/env-setup.shin ++++ /dev/null +@@ -1,104 +0,0 @@ +-#!/bin/sh +-# +-# The KADM5 unit tests were developed to work under gmake. As a +-# result, they expect to inherit a number of environment variables. +-# Rather than rewrite the tests, we simply use this script as an +-# execution wrapper that sets all the necessary environment variables +-# before running the program specified on its command line. +-# +-# The variable settings all came from OV's config.mk. +-# +-# Usage: env-setup.sh +-# +- +-TOP=@RBUILD@/kadmin +-STOP=@S_TOP@/kadmin +-export TOP +-export STOP +-# These two may be needed in case $libdir references them. +-prefix=@prefix@ +-exec_prefix=@exec_prefix@ +-libdir=@libdir@ ; eval "libdir=$libdir"; export libdir +- +-# The shared library run time setup +-TOPLIBD=@RBUILD@/lib +-PROG_LIBPATH=-L@RBUILD@/lib +-BUILDTOP=@RBUILD@ +-# XXX kludge! +-PROG_RPATH=@RBUILD@/lib +-# This converts $(TOPLIBD) to $TOPLIBD +-cat > /tmp/env_setup$$ <<\EOF +-@KRB5_RUN_ENV@ +-EOF +- +-foo=`sed -e 's/(//g' -e 's/)//g' -e 's/\\\$\\\$/\$/g' /tmp/env_setup$$` +-eval $foo +-export @KRB5_RUN_VARS@ +- +-# This will get put in setup.csh for convenience +-KRB5_RUN_ENV_CSH=`eval echo "$foo" | \ +- sed -e 's/\([^=]*\)=\(.*\)/setenv \1 \2/g'` +-export KRB5_RUN_ENV_CSH +-rm /tmp/env_setup$$ +- +-TESTDIR=$TOP/testing; export TESTDIR +-STESTDIR=$STOP/testing; export STESTDIR +-if [ "$K5ROOT" = "" ]; then +- K5ROOT="`cd $TESTDIR; pwd`/krb5-test-root" +- export K5ROOT +-fi +- +-# If $VERBOSE_TEST is non-null, enter verbose mode. Set $VERBOSE to +-# true or false so its exit status identifies the mode. +-if test x$VERBOSE_TEST = x; then +- VERBOSE=false +-else +- VERBOSE=true +-fi +-export VERBOSE +- +-REALM=SECURE-TEST.OV.COM; export REALM +- +-if test x$EXPECT = x; then +- EXPECT=@EXPECT@; export EXPECT +-fi +- +-COMPARE_DUMP=$TESTDIR/scripts/compare_dump.pl; export COMPARE_DUMP +-INITDB=$STESTDIR/scripts/init_db; export INITDB +-SIMPLE_DUMP=$TESTDIR/scripts/simple_dump.pl; export SIMPLE_DUMP +-TCLUTIL=$STESTDIR/tcl/util.t; export TCLUTIL +-BSDDB_DUMP=$TESTDIR/util/bsddb_dump; export BSDDB_DUMP +-CLNTTCL=$TESTDIR/util/kadm5_clnt_tcl; export CLNTTCL +-SRVTCL=$TESTDIR/util/kadm5_srv_tcl; export SRVTCL +- +-HOSTNAME=`hostname | tr '[A-Z]' '[a-z]'` +-export HOSTNAME +- +-KRB5_CONFIG=$K5ROOT/krb5.conf; export KRB5_CONFIG +-KRB5_KDC_PROFILE=$K5ROOT/kdc.conf; export KRB5_KDC_PROFILE +-KRB5_KTNAME=$K5ROOT/ovsec_adm.keytab; export KRB5_KTNAME +-KRB5_CLIENT_KTNAME=$K5ROOT/client_keytab; export KRB5_CLIENT_KTNAME +-KRB5CCNAME=$K5ROOT/krb5cc_unit-test; export KRB5CCNAME +-GSS_MECH_CONFIG=$K5ROOT/mech.conf; export GSS_MECH_CONFIG +- +-# Make sure we don't get confused by translated messages +-# or localized times. +-LC_ALL=C; export LC_ALL +- +-if [ "x$PS_ALL" = "x" ]; then +- if ps auxww >/dev/null 2>&1; then +- PS_ALL="ps auxww" +- PS_PID="ps uwwp" +- elif ps -ef >/dev/null 2>&1; then +- PS_ALL="ps -ef" +- PS_PID="ps -fp" +- else +- PS_ALL="ps auxww" +- PS_PID="ps uwwp" +- echo "WARNING! Cannot auto-detect ps type, assuming BSD." +- fi +- +- export PS_ALL PS_PID +-fi +- +-exec ${1+"$@"} +diff --git a/src/kadmin/testing/scripts/init_db b/src/kadmin/testing/scripts/init_db +deleted file mode 100755 +index 216f62793..000000000 +--- a/src/kadmin/testing/scripts/init_db ++++ /dev/null +@@ -1,229 +0,0 @@ +-#!/bin/sh +- +-if $VERBOSE; then +- REDIRECT= +-else +- REDIRECT='>/dev/null' +-fi +- +-# Requires that $K5ROOT, /etc/krb.conf, and .k5.$REALM be world-writeable. +- +-if [ "$TOP" = "" ]; then +- echo "init_db: Environment variable \$TOP must point to top of build tree" 1>&2 +- exit 1 +-fi +- +-if [ "$STOP" = "" ]; then +- echo "init_db: Environment variable \$STOP must point to top of source tree" 1>&2 +- exit 1 +-fi +- +-if [ "$libdir" = "" ]; then +- echo "init_db: Environment variable \$libdir must point to library install directory" 1>&2 +- exit 1 +-fi +- +-IROOT=$TOP/.. +-ADMIN=$TOP/dbutil +-BIN=$IROOT/bin +-ETC=$IROOT/etc +-MODDIR=$TOP/../plugins/kdb +-SBIN=$TOP/keytab:$TOP/server +-DUMMY=${REALM=SECURE-TEST.OV.COM}; export REALM +- +-. ./runenv.sh +- +-if [ ! -d $MODDIR ]; then +- echo "+++" 1>&2 +- echo "+++ Error! $MODDIR does not exist!" 1>&2 +- echo "+++ The MODDIR variable should point to the directory in which" 1>&2 +- echo "+++ database modules have been installed for testing." 1>&2 +- echo "+++" 1>&2 +- exit 1 +-fi +- +-DUMMY=${TESTDIR=$TOP/testing}; export TESTDIR +-DUMMY=${STESTDIR=$STOP/testing} +-DUMMY=${SRVTCL=$TESTDIR/util/kadm5_srv_tcl}; export SRVTCL +-DUMMY=${TCLUTIL=$STESTDIR/tcl/util.t}; export TCLUTIL +- +-PATH=$ADMIN:$BIN:$ETC:$SBIN:$PATH; export PATH +- +-if [ ! -x $SRVTCL ]; then +- echo "+++" 1>&2 +- echo "+++ Error! $SRVTCL does not exist!" 1>&2 +- echo "+++ It was probably not compiled because TCL was not available. If you" 1>&2 +- echo "+++ now have TCL installed, cd into that directory, re-run configure" 1>&2 +- echo "+++ with the --with-tcl option, and then re-run make." 1>&2 +- echo "+++" 1>&2 +- +- exit 1 +-fi +- +-rm -rf $K5ROOT/* +-if [ -d $K5ROOT ]; then +- true +-else +- mkdir $K5ROOT +-fi +- +-# touch $K5ROOT/syslog +-# for pid in `$PS_ALL | awk '/syslogd/ && !/awk/ {print $2}'` ; do +-# case "$pid" in +-# xxx) ;; +-# *) +-# if $VERBOSE; then $PS_PID$pid | grep -v COMMAND; fi +-# kill -1 $pid +-# ;; +-# esac +-# done +- +-sed -e "s/__REALM__/$REALM/g" -e "s#__K5ROOT__#$K5ROOT#g" \ +- -e "s/__HOSTNAME__/$HOSTNAME/g" \ +- -e "s#__MODDIR__#$MODDIR#g" \ +- < $STESTDIR/proto/krb5.conf.proto > $K5ROOT/krb5.conf +-sed -e "s/__REALM__/$REALM/g" -e "s#__K5ROOT__#$K5ROOT#g" \ +- < $STESTDIR/proto/kdc.conf.proto > $K5ROOT/kdc.conf +- +-eval kdb5_util -r $REALM create -W -P mrroot -s $REDIRECT || exit 1 +- +-cp $STESTDIR/proto/ovsec_adm.dict $K5ROOT/ovsec_adm.dict +- +-cat - > /tmp/init_db$$ <<\EOF +-source $env(TCLUTIL) +-set r $env(REALM) +-if {[info exists env(USER)]} { +- set whoami $env(USER) +-} else { +- set whoami [exec whoami] +-} +- +-set cmds { +- {kadm5_init $env(SRVTCL) mrroot null \ +- [config_params {KADM5_CONFIG_REALM} $r] $KADM5_STRUCT_VERSION \ +- $KADM5_API_VERSION_3 server_handle} +- +- {kadm5_create_policy $server_handle "test-pol 0 10000 8 2 3 0 2 90 180" \ +- {KADM5_POLICY KADM5_PW_MIN_LENGTH KADM5_PW_MIN_CLASSES KADM5_PW_MAX_LIFE KADM5_PW_HISTORY_NUM KADM5_PW_MAX_FAILURE KADM5_PW_FAILURE_COUNT_INTERVAL KADM5_PW_LOCKOUT_DURATION}} +- {kadm5_create_policy $server_handle "once-a-min 10 0 0 0 0 0 0 0 0" \ +- {KADM5_POLICY KADM5_PW_MIN_LIFE}} +- {kadm5_create_policy $server_handle "dict-only 0 0 0 0 0 0 0 0 0" \ +- {KADM5_POLICY}} +- {kadm5_create_policy $server_handle [simple_policy test-pol-nopw] \ +- {KADM5_POLICY}} +- +- {kadm5_create_principal $server_handle \ +- [simple_principal testuser@$r] {KADM5_PRINCIPAL} notathena} +- {kadm5_create_principal $server_handle \ +- [simple_principal test1@$r] {KADM5_PRINCIPAL} test1} +- {kadm5_create_principal $server_handle \ +- [simple_principal test2@$r] {KADM5_PRINCIPAL} test2} +- {kadm5_create_principal $server_handle \ +- [simple_principal test3@$r] {KADM5_PRINCIPAL} test3} +- {kadm5_create_principal $server_handle \ +- [simple_principal admin@$r] {KADM5_PRINCIPAL} admin} +- {kadm5_create_principal $server_handle \ +- [simple_principal admin/get@$r] {KADM5_PRINCIPAL} admin} +- {kadm5_create_principal $server_handle \ +- [simple_principal admin/modify@$r] {KADM5_PRINCIPAL} admin} +- {kadm5_create_principal $server_handle \ +- [simple_principal admin/delete@$r] {KADM5_PRINCIPAL} admin} +- {kadm5_create_principal $server_handle \ +- [simple_principal admin/add@$r] {KADM5_PRINCIPAL} admin} +- {kadm5_create_principal $server_handle \ +- [simple_principal admin/none@$r] {KADM5_PRINCIPAL} admin} +- {kadm5_create_principal $server_handle \ +- [simple_principal admin/rename@$r] {KADM5_PRINCIPAL} admin} +- {kadm5_create_principal $server_handle \ +- [simple_principal admin/mod-add@$r] {KADM5_PRINCIPAL} admin} +- {kadm5_create_principal $server_handle \ +- [simple_principal admin/mod-delete@$r] {KADM5_PRINCIPAL} \ +- admin} +- {kadm5_create_principal $server_handle \ +- [simple_principal admin/get-add@$r] {KADM5_PRINCIPAL} admin} +- {kadm5_create_principal $server_handle \ +- [simple_principal admin/get-delete@$r] {KADM5_PRINCIPAL} \ +- admin} +- {kadm5_create_principal $server_handle \ +- [simple_principal admin/get-mod@$r] {KADM5_PRINCIPAL} admin} +- {kadm5_create_principal $server_handle \ +- [simple_principal admin/no-add@$r] {KADM5_PRINCIPAL} admin} +- {kadm5_create_principal $server_handle \ +- [simple_principal admin/no-delete@$r] {KADM5_PRINCIPAL} admin} +- {kadm5_create_principal $server_handle \ +- [princ_w_pol pol1@$r test-pol] {KADM5_PRINCIPAL \ +- KADM5_POLICY} pol111111} +- {kadm5_create_principal $server_handle \ +- [princ_w_pol pol2@$r once-a-min] {KADM5_PRINCIPAL \ +- KADM5_POLICY} pol222222} +- {kadm5_create_principal $server_handle \ +- [princ_w_pol pol3@$r dict-only] {KADM5_PRINCIPAL \ +- KADM5_POLICY} pol333333} +- {kadm5_create_principal $server_handle \ +- [princ_w_pol admin/get-pol@$r test-pol-nopw] \ +- {KADM5_PRINCIPAL KADM5_POLICY} StupidAdmin} +- {kadm5_create_principal $server_handle \ +- [princ_w_pol admin/pol@$r test-pol-nopw] {KADM5_PRINCIPAL \ +- KADM5_POLICY} StupidAdmin} +- +- {kadm5_create_principal $server_handle \ +- [simple_principal changepw/kerberos] \ +- {KADM5_PRINCIPAL} {XXX THIS IS WRONG}} +- +- {kadm5_create_principal $server_handle \ +- [simple_principal $whoami] \ +- {KADM5_PRINCIPAL} $whoami} +- +- {kadm5_create_principal $server_handle \ +- [simple_principal testkeys@$r] {KADM5_PRINCIPAL} testkeys} +- +- {kadm5_destroy $server_handle} +-} +- +-foreach cmd $cmds { +- if {[catch $cmd output]} { +- puts stderr "Error! Command: $cmd\nError: $output" +- exit 1 +- } else { +- puts stdout $output +- } +-} +-EOF +-eval "$SRVTCL < /tmp/init_db$$ $REDIRECT" +-rm /tmp/init_db$$ +- +-if [ $? -ne 0 ]; then +- echo "Error in $SRVTCL!" 1>&2 +- exit 1 +-fi +- +-cat > $K5ROOT/ovsec_adm.acl < $K5ROOT/setup.csh <&2 +- exit 1 +- fi +- +- local=0 +- hostname=$1 +- if [ $# = 1 ]; then +- rempath=`sh -c "cd $TOP && pwd"` +- else +- rempath=$2 +- fi +-fi +- +-if [ $local = 0 ]; then +- +- # Fix up the local krb5.conf to point to the remote +- sed -e "s/__REALM__/$REALM/g" -e "s#__K5ROOT__#$K5ROOT#g" \ +- -e "s/__HOSTNAME__/$HOSTNAME/g" \ +- -e "s#__MODDIR__#$TOP/../plugins/kdb#g"\ +- -e "s#__PLUGIN_DIR__#$TOP/../plugins#g"\ +- < $STESTDIR/proto/krb5.conf.proto > $K5ROOT/krb5.conf +- +-# Using /usr/ucb/rsh and getting rid of "-k $REALM" until we get +-# around to fixing the fact that Kerberos rsh doesn't strip out "-k +-# REALM" when falling back. +- +- START_SERVERS_LOCAL=`echo $START_SERVERS_LOCAL|sed "s%$TOP%$rempath%"` +- CMD="$RSH_CMD $hostname -n \ +- \"sh -c 'VERBOSE_TEST=$VERBOSE_TEST TOP=$rempath \ +- $rempath/testing/scripts/env-setup.sh \ +- $START_SERVERS_LOCAL $rempath'\"" +- +- if $VERBOSE; then +- echo "+++" +- echo "+++ Begin execution of start_servers_local on $hostname" +- echo "+++" +- echo $CMD +- fi +- eval $CMD +- if $VERBOSE; then +- echo "+++" +- echo "+++ End execution of start_servers_local on $hostname" +- echo "+++" +- fi +-else +- $START_SERVERS_LOCAL +-fi +- +diff --git a/src/kadmin/testing/scripts/start_servers_local b/src/kadmin/testing/scripts/start_servers_local +deleted file mode 100755 +index 858e88031..000000000 +--- a/src/kadmin/testing/scripts/start_servers_local ++++ /dev/null +@@ -1,157 +0,0 @@ +-#!/bin/sh +- +-DUMMY=${TESTDIR=$TOP/testing} +-DUMMY=${STESTDIR=$STOP/testing} +-DUMMY=${INITDB=$STESTDIR/scripts/init_db} +-DUMMY=${SRVTCL=$TESTDIR/util/kadm5_srv_tcl}; export SRVTCL +-DUMMY=${STOP_SERVERS_LOCAL=$STESTDIR/scripts/stop_servers_local} +-DUMMY=${KRB5RCACHEDIR=$TESTDIR} ; export KRB5RCACHEDIR +- +-. ./runenv.sh +- +-if [ -d /usr/tmp ]; then +- usrtmp=/usr/tmp +-else +- usrtmp=/var/tmp +-fi +- +-$STOP_SERVERS_LOCAL -start_servers +- +-if $VERBOSE; then +- REDIRECT= +-else +- REDIRECT='>/dev/null' +-fi +- +-while :; do +- case $1 in +- -keysalt) +- shift +- if [ $# -gt 0 ]; then +- keysalts="$keysalts $1" +- else +- break +- fi +- ;; +- -kdcport) +- shift +- if [ $# -gt 0 ]; then +- kdcport=$1 +- else +- break +- fi +- ;; +- *) +- break +- ;; +- esac +- shift +-done +- +-if [ $# -gt 1 ]; then +- echo "Usage: $0 [-kdcport port] [-keysalts tuple] ... [top]" 1>&2 +- exit 1 +-elif [ $# = 1 ]; then +- TOP=$1 +- export TOP +-fi +- +-# create a fresh db +- +-$INITDB "$keysalts" || exit 1 +- +-# Post-process the config files based on our arguments +-if [ "$keysalts" != "" ]; then +- sedcmd="s/\([ ]*supported_enctypes =\).*/\1 $keysalts/" +- sed -e "$sedcmd" < $K5ROOT/kdc.conf > $K5ROOT/kdc.conf.new +- mv $K5ROOT/kdc.conf.new $K5ROOT/kdc.conf +-fi +-if [ "$kdcport" != "" ] ; then +- sedcmd="s/\(kdc_ports = .*\)[ ]*/\1, $kdcport/" +- sed -e "$sedcmd" < $K5ROOT/kdc.conf > $K5ROOT/kdc.conf.new +- mv $K5ROOT/kdc.conf.new $K5ROOT/kdc.conf +-fi +- +-# allow admin to krlogin as root (for cleanup) +-DUMMY=${REALM=SECURE-TEST.OV.COM}; export REALM +- +-cat - > /tmp/start_servers_local$$ <<\EOF +-if { [catch { +- source $env(STOP)/testing/tcl/util.t +- set r $env(REALM) +- set q $env(HOSTNAME) +- puts stdout [kadm5_init $env(SRVTCL) mrroot null \ +- [config_params {KADM5_CONFIG_REALM} $r] \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 server_handle] +- puts stdout [kadm5_create_principal $server_handle \ +- [simple_principal host/$q@$r] {KADM5_PRINCIPAL} notathena] +- puts stdout [kadm5_destroy $server_handle] +-} err]} { +- puts stderr "initialization error: $err" +- exit 1 +-} +-exit 0 +-EOF +-eval "$SRVTCL < /tmp/start_servers_local$$ $REDIRECT" +-x=$? +-rm /tmp/start_servers_local$$ +-if test $x != 0 ; then exit 1 ; fi +- +-# run the servers (from the build tree) +- +-adm_start_file=/tmp/adm_server_start.$$ +-kdc_start_file=/tmp/kdc_server_start.$$ +- +-rm -f $kdc_start_file +- +-if test "x$USER" = x ; then +- USER=$LOGNAME ; export USER +-fi +- +-kdc_args="-R dfl:kdc_rcache.$USER" +- +-(trap "" 2; $TOP/../kdc/krb5kdc $kdc_args; touch $kdc_start_file) \ +- < /dev/null > $usrtmp/kdc-log.$USER 2>&1 & +- +-s=1 +-max_s=60 +-sofar_s=0 +-timewait_s=300 +- +-ovadm_args=-W +- +-rm -f $adm_start_file +- +-(sleep 1; $TOP/server/kadmind $ovadm_args; \ +- touch $adm_start_file) < /dev/null > $usrtmp/kadm-log.$USER 2>&1 & +- +-# wait until they start +- +-while [ $sofar_s -le $max_s ]; do +- if $VERBOSE; then +- echo "Sleeping for $s seconds to allow servers" \ +- "to start..." +- fi +- +- sofar_s=`expr $sofar_s + $s` +- +- sleep $s +- +- if [ -f $adm_start_file -a -f $kdc_start_file ]; then +- break +- fi +-done +- +-if [ $sofar_s -gt $max_s ]; then +- echo "Admin server or KDC failed to start after $sofar_s" \ +- "seconds." 1>&2 +- if [ ! -f $adm_start_file ]; then +- echo " No admin server start file $adm_start_file." 1>&2 +- fi +- if [ ! -f $kdc_start_file ]; then +- echo " No KDC start file $adm_start_file." 1>&2 +- fi +- exit 1 +-fi +- +-rm -f $kdc_start_file $adm_start_file +diff --git a/src/kadmin/testing/scripts/stop_servers b/src/kadmin/testing/scripts/stop_servers +deleted file mode 100755 +index b7f8384ca..000000000 +--- a/src/kadmin/testing/scripts/stop_servers ++++ /dev/null +@@ -1,60 +0,0 @@ +-#!/bin/sh +-# +-# Usage: stop_servers [hostname [path]] +-# +-# This script turns a host into a OpenV*Secure primary server for the +-# realm SECURE-TEST.OV.COM. If no arguments are specified, +-# the local host is affected. Otherwise, the host hostname is +-# affected; the path argument is the top of the Secure install tree on +-# that host, and if it is not specified the current canonical value of +-# TOP is used. +- +-DUMMY=${TESTDIR=$TOP/testing} +-DUMMY=${STESTDIR=$STOP/testing} +-DUMMY=${STOP_SERVERS_LOCAL=$STESTDIR/scripts/stop_servers_local} +-# This'll be wrong sometimes +-DUMMY=${RSH_CMD=rsh} +- +-local=1 +- +-if [ $# -gt 0 ]; then +- if [ $# != 1 -a $# != 2 ]; then +- echo "Usage: $0 [hostname [path]]" 1>&2 +- exit 1 +- fi +- +- local=0 +- hostname=$1 +- if [ $# = 1 ]; then +- rempath=`sh -c "cd $TOP && pwd"` +- else +- rempath=$2 +- fi +-fi +- +-if [ $local = 0 ]; then +- if $VERBOSE; then +- echo "+++ Stopping servers on remote host $hostname..." +- fi +- +- STOP_SERVERS_LOCAL=`echo $STOP_SERVERS_LOCAL | sed "s%$TOP%$rempath%"` +- CMD="$RSH_CMD $hostname -n \ +- \"sh -c 'VERBOSE_TEST=$VERBOSE_TEST TOP=$rempath \ +- $rempath/testing/scripts/env-setup.sh \ +- $STOP_SERVERS_LOCAL $rempath'\"" +- +- if $VERBOSE; then +- echo "+++" +- echo "+++ Begin execution of stop_servers_local on $hostname" +- echo "+++" +- echo $CMD +- fi +- eval $CMD +- if $VERBOSE; then +- echo "+++" +- echo "+++ End execution of stop_servers_local on $hostname" +- echo "+++" +- fi +-else +- $STOP_SERVERS_LOCAL +-fi +diff --git a/src/kadmin/testing/scripts/stop_servers_local b/src/kadmin/testing/scripts/stop_servers_local +deleted file mode 100755 +index 24a9de7b3..000000000 +--- a/src/kadmin/testing/scripts/stop_servers_local ++++ /dev/null +@@ -1,44 +0,0 @@ +-#!/bin/sh +- +-DUMMY=${TESTDIR=$TOP/testing} +-DUMMY=${KRB5RCACHEDIR=$TESTDIR} +- +-while [ $# -gt 0 ] ; do +- case $1 in +- -start_servers) +- start_servers=$1 +- ;; +- *) +- TOP=$1 +- export TOP +- ;; +- esac +- shift +-done +- +-# kill any running servers. +- +-if $VERBOSE; then echo "Killing servers:"; fi +- +-for pid in xxx \ +- `$PS_ALL | grep krb5kdc | grep -v grep | awk '{print $2}'` \ +- `$PS_ALL | grep kadmind | grep -v grep | awk '{print $2}'` \ +- ; do +- case "$pid" in +- xxx) +- ;; +- *) +- if $VERBOSE; then $PS_PID$pid | grep -v COMMAND; fi +- kill $pid +- ;; +- esac +-done +- +-# Destroy the kdc replay cache so we don't lose if we try to run the +-# KDC as another unix user. +-if test "x$USER" = x ; then +- USER=$LOGNAME +-fi +-rm -f $KRB5RCACHEDIR/krb5kdc_rcache.$USER +- +-exit 0 +diff --git a/src/kadmin/testing/tcl/util.t b/src/kadmin/testing/tcl/util.t +deleted file mode 100644 +index 6751f89e6..000000000 +--- a/src/kadmin/testing/tcl/util.t ++++ /dev/null +@@ -1,58 +0,0 @@ +-proc simple_principal {name} { +- return "{$name} 0 0 0 0 {$name} 0 0 0 0 null 0" +-} +- +-proc princ_w_pol {name policy} { +- return "{$name} 0 0 0 0 {$name} 0 0 0 0 {$policy} 0" +-} +- +-proc simple_policy {name} { +- return "{$name} 0 0 0 0 0 0 0 0 0" +-} +- +-proc config_params {masks values} { +- if {[llength $masks] != [llength $values]} { +- error "config_params: length of mask and values differ" +- } +- +- set params [list $masks 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 {}] +- for {set i 0} {$i < [llength $masks]} {incr i} { +- set mask [lindex $masks $i] +- set value [lindex $values $i] +- switch -glob -- $mask { +- "KADM5_CONFIG_REALM" {set params [lreplace $params 1 1 $value]} +- "KADM5_CONFIG_KADMIND_PORT" { +- set params [lreplace $params 2 2 $value]} +- "KADM5_CONFIG_ADMIN_SERVER" { +- set params [lreplace $params 3 3 $value]} +- "KADM5_CONFIG_DBNAME" {set params [lreplace $params 4 4 $value]} +- "KADM5_CONFIG_ADBNAME" {set params [lreplace $params 5 5 $value]} +- "KADM5_CONFIG_ADB_LOCKFILE" { +- set params [lreplace $params 6 6 $value]} +- "KADM5_CONFIG_ACL_FILE" {set params [lreplace $params 8 8 $value]} +- "KADM5_CONFIG_DICT_FILE" { +- set params [lreplace $params 9 9 $value]} +- "KADM5_CONFIG_MKEY_FROM_KBD" { +- set params [lreplace $params 10 10 $value]} +- "KADM5_CONFIG_STASH_FILE" { +- set params [lreplace $params 11 11 $value]} +- "KADM5_CONFIG_MKEY_NAME" { +- set params [lreplace $params 12 12 $value]} +- "KADM5_CONFIG_ENCTYPE" {set params [lreplace $params 13 13 $value]} +- "KADM5_CONFIG_MAX_LIFE" { +- set params [lreplace $params 14 14 $value]} +- "KADM5_CONFIG_MAX_RLIFE" { +- set params [lreplace $params 15 15 $value]} +- "KADM5_CONFIG_EXPIRATION" { +- set params [lreplace $params 16 16 $value]} +- "KADM5_CONFIG_FLAGS" {set params [lreplace $params 17 17 $value]} +- "KADM5_CONFIG_ENCTYPES" { +- set params [lreplace $params 18 19 [llength $value] $value]} +- "*" {error "config_params: unknown mask $mask"} +- } +- } +- return $params +-} +- +- +- +diff --git a/src/kadmin/testing/util/Makefile.in b/src/kadmin/testing/util/Makefile.in +deleted file mode 100644 +index 7785c742e..000000000 +--- a/src/kadmin/testing/util/Makefile.in ++++ /dev/null +@@ -1,42 +0,0 @@ +-mydir=kadmin$(S)testing$(S)util +-BUILDTOP=$(REL)..$(S)..$(S).. +-LOCALINCLUDES = $(TCL_INCLUDES) -I$(BUILDTOP)/lib/kdb/ +-# Force Tcl headers to use stdarg.h, because krb5 does too, and if +-# Tcl uses varargs.h it'll just mess things up. +-DEFINES= -DHAS_STDARG +-KRB5_PTHREAD_LIB=$(THREAD_LINKOPTS) +- +-PROG_LIBPATH=-L$(TOPLIBD) $(TCL_LIBPATH) +-PROG_RPATH=$(KRB5_LIBDIR)$(TCL_RPATH) +- +-SRCS = $(srcdir)/tcl_kadm5.c $(srcdir)/test.c +-OBJS = tcl_kadm5.o test.o +- +-CLNTPROG= kadm5_clnt_tcl +-SRVPROG = kadm5_srv_tcl +- +-DO_ALL=@DO_ALL@ +- +-all: all-$(DO_ALL) +- +-all-: +- @echo "+++" +- @echo "+++ WARNING: Tcl not available. The kadm5 tests will not be run." +- @echo "+++" +- @echo 'Skipped kadm5 tests: Tcl not found' >> $(SKIPTESTS) +- +-all-tcl: $(CLNTPROG) $(SRVPROG) +- +-$(SRVPROG): $(OBJS) $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS) +- $(CC_LINK) -o $(SRVPROG) $(OBJS) $(TCL_MAYBE_RPATH) \ +- $(KADMSRV_LIBS) $(KRB5_PTHREAD_LIB) $(KRB5_BASE_LIBS) $(TCL_LIBS) +- +-$(CLNTPROG): $(OBJS) $(KADMCLNT_DEPLIBS) $(KRB5_BASE_DEPLIBS) +- $(CC_LINK) -o $(CLNTPROG) $(OBJS) $(TCL_MAYBE_RPATH) \ +- $(KRB5_PTHREAD_LIB) $(KADMCLNT_LIBS) $(KRB5_BASE_LIBS) $(TCL_LIBS) +- +-bsddb_dump: bsddb_dump.o +- $(CC_LINK) -o bsddb_dump bsddb_dump.o $(KADMSRV_LIBS) +- +-clean: +- $(RM) $(CLNTPROG) $(SRVPROG) +diff --git a/src/kadmin/testing/util/bsddb_dump.c b/src/kadmin/testing/util/bsddb_dump.c +deleted file mode 100644 +index 5dbe7ae9c..000000000 +--- a/src/kadmin/testing/util/bsddb_dump.c ++++ /dev/null +@@ -1,65 +0,0 @@ +-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ +-/* +- * $Id$ +- */ +- +-#include +-#include +-#include +-#include +- +-main(int argc, char *argv[]) +-{ +- char *file; +- DB *db; +- DBT dbkey, dbdata; +- int code, i; +- +- HASHINFO info; +- +- info.hash = NULL; +- info.bsize = 256; +- info.ffactor = 8; +- info.nelem = 25000; +- info.lorder = 0; +- +- if (argc != 2) { +- fprintf(stderr, "usage: argv[0] dbfile\n"); +- exit(2); +- } +- +- file = argv[1]; +- +- if((db = dbopen(file, O_RDWR, 0666, DB_HASH, &info)) == NULL) { +- perror("Opening db file"); +- exit(1); +- } +- +- if ((code = (*db->seq)(db, &dbkey, &dbdata, R_FIRST)) == -1) { +- perror("starting db iteration"); +- exit(1); +- } +- +- while (code == 0) { +- for (i=0; iseq)(db, &dbkey, &dbdata, R_NEXT); +- } +- +- if (code == -1) { +- perror("during db iteration"); +- exit(1); +- } +- +- if ((*db->close)(db) == -1) { +- perror("closing db"); +- exit(1); +- } +- +- exit(0); +-} +diff --git a/src/kadmin/testing/util/deps b/src/kadmin/testing/util/deps +deleted file mode 100644 +index ca828a85c..000000000 +--- a/src/kadmin/testing/util/deps ++++ /dev/null +@@ -1,16 +0,0 @@ +-# +-# Generated makefile dependencies follow. +-# +-$(OUTPRE)tcl_kadm5.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ +- $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssrpc/types.h \ +- $(BUILDTOP)/include/kadm5/admin.h $(BUILDTOP)/include/kadm5/chpass_util_strings.h \ +- $(BUILDTOP)/include/kadm5/kadm_err.h $(BUILDTOP)/include/krb5/krb5.h \ +- $(BUILDTOP)/lib/kdb/adb_err.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ +- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ +- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ +- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ +- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ +- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \ +- $(top_srcdir)/include/krb5.h tcl_kadm5.c tcl_kadm5.h +-$(OUTPRE)test.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ +- tcl_kadm5.h test.c +diff --git a/src/kadmin/testing/util/tcl_kadm5.c b/src/kadmin/testing/util/tcl_kadm5.c +deleted file mode 100644 +index 864a929c8..000000000 +--- a/src/kadmin/testing/util/tcl_kadm5.c ++++ /dev/null +@@ -1,2566 +0,0 @@ +-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ +-#include "autoconf.h" +-#include +-#include +-#if HAVE_TCL_H +-#include +-#elif HAVE_TCL_TCL_H +-#include +-#endif +-#define USE_KADM5_API_VERSION 2 +-#include +-#include +-#include +-#include +-#include +-#include "tcl_kadm5.h" +- +-struct flagval { +- char *name; +- krb5_flags val; +-}; +- +-/* XXX This should probably be in the hash table like server_handle */ +-static krb5_context context; +- +-static struct flagval krb5_flags_array[] = { +- {"KRB5_KDB_DISALLOW_POSTDATED", KRB5_KDB_DISALLOW_POSTDATED}, +- {"KRB5_KDB_DISALLOW_FORWARDABLE", KRB5_KDB_DISALLOW_FORWARDABLE}, +- {"KRB5_KDB_DISALLOW_TGT_BASED", KRB5_KDB_DISALLOW_TGT_BASED}, +- {"KRB5_KDB_DISALLOW_RENEWABLE", KRB5_KDB_DISALLOW_RENEWABLE}, +- {"KRB5_KDB_DISALLOW_PROXIABLE", KRB5_KDB_DISALLOW_PROXIABLE}, +- {"KRB5_KDB_DISALLOW_DUP_SKEY", KRB5_KDB_DISALLOW_DUP_SKEY}, +- {"KRB5_KDB_DISALLOW_ALL_TIX", KRB5_KDB_DISALLOW_ALL_TIX}, +- {"KRB5_KDB_REQUIRES_PRE_AUTH", KRB5_KDB_REQUIRES_PRE_AUTH}, +- {"KRB5_KDB_REQUIRES_HW_AUTH", KRB5_KDB_REQUIRES_HW_AUTH}, +- {"KRB5_KDB_REQUIRES_PWCHANGE", KRB5_KDB_REQUIRES_PWCHANGE}, +- {"KRB5_KDB_DISALLOW_SVR", KRB5_KDB_DISALLOW_SVR}, +- {"KRB5_KDB_PWCHANGE_SERVICE", KRB5_KDB_PWCHANGE_SERVICE} +-}; +- +-static struct flagval aux_attributes[] = { +- {"KADM5_POLICY", KADM5_POLICY} +-}; +- +-static struct flagval principal_mask_flags[] = { +- {"KADM5_PRINCIPAL", KADM5_PRINCIPAL}, +- {"KADM5_PRINC_EXPIRE_TIME", KADM5_PRINC_EXPIRE_TIME}, +- {"KADM5_PW_EXPIRATION", KADM5_PW_EXPIRATION}, +- {"KADM5_LAST_PWD_CHANGE", KADM5_LAST_PWD_CHANGE}, +- {"KADM5_ATTRIBUTES", KADM5_ATTRIBUTES}, +- {"KADM5_MAX_LIFE", KADM5_MAX_LIFE}, +- {"KADM5_MOD_TIME", KADM5_MOD_TIME}, +- {"KADM5_MOD_NAME", KADM5_MOD_NAME}, +- {"KADM5_KVNO", KADM5_KVNO}, +- {"KADM5_MKVNO", KADM5_MKVNO}, +- {"KADM5_AUX_ATTRIBUTES", KADM5_AUX_ATTRIBUTES}, +- {"KADM5_POLICY", KADM5_POLICY}, +- {"KADM5_POLICY_CLR", KADM5_POLICY_CLR}, +- {"KADM5_MAX_RLIFE", KADM5_MAX_RLIFE}, +- {"KADM5_LAST_SUCCESS", KADM5_LAST_SUCCESS}, +- {"KADM5_LAST_FAILED", KADM5_LAST_FAILED}, +- {"KADM5_FAIL_AUTH_COUNT", KADM5_FAIL_AUTH_COUNT}, +- {"KADM5_KEY_DATA", KADM5_KEY_DATA}, +- {"KADM5_TL_DATA", KADM5_TL_DATA}, +- {"KADM5_PRINCIPAL_NORMAL_MASK", KADM5_PRINCIPAL_NORMAL_MASK} +-}; +- +-static struct flagval policy_mask_flags[] = { +- {"KADM5_POLICY", KADM5_POLICY}, +- {"KADM5_PW_MAX_LIFE", KADM5_PW_MAX_LIFE}, +- {"KADM5_PW_MIN_LIFE", KADM5_PW_MIN_LIFE}, +- {"KADM5_PW_MIN_LENGTH", KADM5_PW_MIN_LENGTH}, +- {"KADM5_PW_MIN_CLASSES", KADM5_PW_MIN_CLASSES}, +- {"KADM5_PW_HISTORY_NUM", KADM5_PW_HISTORY_NUM}, +- {"KADM5_REF_COUNT", KADM5_REF_COUNT}, +- {"KADM5_PW_MAX_FAILURE", KADM5_PW_MAX_FAILURE}, +- {"KADM5_PW_FAILURE_COUNT_INTERVAL", KADM5_PW_FAILURE_COUNT_INTERVAL}, +- {"KADM5_PW_LOCKOUT_DURATION", KADM5_PW_LOCKOUT_DURATION}, +-}; +- +-static struct flagval config_mask_flags[] = { +- {"KADM5_CONFIG_REALM", KADM5_CONFIG_REALM}, +- {"KADM5_CONFIG_DBNAME", KADM5_CONFIG_DBNAME}, +- {"KADM5_CONFIG_MKEY_NAME", KADM5_CONFIG_MKEY_NAME}, +- {"KADM5_CONFIG_MAX_LIFE", KADM5_CONFIG_MAX_LIFE}, +- {"KADM5_CONFIG_MAX_RLIFE", KADM5_CONFIG_MAX_RLIFE}, +- {"KADM5_CONFIG_EXPIRATION", KADM5_CONFIG_EXPIRATION}, +- {"KADM5_CONFIG_FLAGS", KADM5_CONFIG_FLAGS}, +- {"KADM5_CONFIG_STASH_FILE", KADM5_CONFIG_STASH_FILE}, +- {"KADM5_CONFIG_ENCTYPE", KADM5_CONFIG_ENCTYPE}, +- {"KADM5_CONFIG_ADBNAME", KADM5_CONFIG_ADBNAME}, +- {"KADM5_CONFIG_ADB_LOCKFILE", KADM5_CONFIG_ADB_LOCKFILE}, +- {"KADM5_CONFIG_ACL_FILE", KADM5_CONFIG_ACL_FILE}, +- {"KADM5_CONFIG_KADMIND_PORT", KADM5_CONFIG_KADMIND_PORT}, +- {"KADM5_CONFIG_ENCTYPES", KADM5_CONFIG_ENCTYPES}, +- {"KADM5_CONFIG_ADMIN_SERVER", KADM5_CONFIG_ADMIN_SERVER}, +- {"KADM5_CONFIG_DICT_FILE", KADM5_CONFIG_DICT_FILE}, +- {"KADM5_CONFIG_MKEY_FROM_KBD", KADM5_CONFIG_MKEY_FROM_KBD}, +-}; +- +-static struct flagval priv_flags[] = { +- {"KADM5_PRIV_GET", KADM5_PRIV_GET}, +- {"KADM5_PRIV_ADD", KADM5_PRIV_ADD}, +- {"KADM5_PRIV_MODIFY", KADM5_PRIV_MODIFY}, +- {"KADM5_PRIV_DELETE", KADM5_PRIV_DELETE} +-}; +- +- +-static char *arg_error = "wrong # args"; +- +-static Tcl_HashTable *struct_table = 0; +- +-static int put_server_handle(Tcl_Interp *interp, void *handle, char **name) +-{ +- int i = 1, newPtr = 0; +- static char buf[20]; +- Tcl_HashEntry *entry; +- +- if (! struct_table) { +- if (! (struct_table = +- malloc(sizeof(*struct_table)))) { +- fprintf(stderr, "Out of memory!\n"); +- exit(1); /* XXX */ +- } +- Tcl_InitHashTable(struct_table, TCL_STRING_KEYS); +- } +- +- do { +- sprintf(buf, "kadm5_handle%d", i); +- entry = Tcl_CreateHashEntry(struct_table, buf, &newPtr); +- i++; +- } while (! newPtr); +- +- Tcl_SetHashValue(entry, handle); +- +- *name = buf; +- +- return TCL_OK; +-} +- +-static int get_server_handle(Tcl_Interp *interp, const char *name, +- void **handle) +-{ +- Tcl_HashEntry *entry; +- +- if(!strcasecmp(name, "null")) +- *handle = 0; +- else { +- if (! (struct_table && +- (entry = Tcl_FindHashEntry(struct_table, name)))) { +- Tcl_AppendResult(interp, "unknown server handle ", name, 0); +- return TCL_ERROR; +- } +- *handle = (void *) Tcl_GetHashValue(entry); +- } +- return TCL_OK; +-} +- +-static int remove_server_handle(Tcl_Interp *interp, const char *name) +-{ +- Tcl_HashEntry *entry; +- +- if (! (struct_table && +- (entry = Tcl_FindHashEntry(struct_table, name)))) { +- Tcl_AppendResult(interp, "unknown server handle ", name, 0); +- return TCL_ERROR; +- } +- +- Tcl_SetHashValue(entry, NULL); +- return TCL_OK; +-} +- +-#define GET_HANDLE(num_args, ignored) \ +- void *server_handle; \ +- const char *whoami = argv[0]; \ +- argv++, argc--; \ +- if (argc != num_args + 1) { \ +- Tcl_AppendResult(interp, whoami, ": ", arg_error, 0); \ +- return TCL_ERROR; \ +- } \ +- { \ +- int ltcl_ret; \ +- if ((ltcl_ret = get_server_handle(interp, argv[0], &server_handle)) \ +- != TCL_OK) { \ +- return ltcl_ret; \ +- } \ +- } \ +- argv++, argc--; +- +-static Tcl_HashTable *create_flag_table(struct flagval *flags, int size) +-{ +- Tcl_HashTable *table; +- Tcl_HashEntry *entry; +- int i; +- +- if (! (table = (Tcl_HashTable *) malloc(sizeof(Tcl_HashTable)))) { +- fprintf(stderr, "Out of memory!\n"); +- exit(1); /* XXX */ +- } +- +- Tcl_InitHashTable(table, TCL_STRING_KEYS); +- +- for (i = 0; i < size; i++) { +- int newPtr; +- +- if (! (entry = Tcl_CreateHashEntry(table, flags[i].name, &newPtr))) { +- fprintf(stderr, "Out of memory!\n"); +- exit(1); /* XXX */ +- } +- +- Tcl_SetHashValue(entry, &flags[i].val); +- } +- +- return table; +-} +- +- +-static Tcl_DString *unparse_str(char *in_str) +-{ +- Tcl_DString *str; +- +- if (! (str = malloc(sizeof(*str)))) { +- fprintf(stderr, "Out of memory!\n"); +- exit(1); /* XXX */ +- } +- +- Tcl_DStringInit(str); +- +- if (! in_str) { +- Tcl_DStringAppend(str, "null", -1); +- } +- else { +- Tcl_DStringAppend(str, in_str, -1); +- } +- +- return str; +-} +- +- +- +-static int parse_str(Tcl_Interp *interp, const char *in_str, char **out_str) +-{ +- if (! in_str) { +- *out_str = 0; +- } +- else if (! strcasecmp(in_str, "null")) { +- *out_str = 0; +- } +- else { +- *out_str = (char *) in_str; +- } +- return TCL_OK; +-} +- +- +-static void set_ok(Tcl_Interp *interp, char *string) +-{ +- Tcl_SetResult(interp, "OK", TCL_STATIC); +- Tcl_AppendElement(interp, "KADM5_OK"); +- Tcl_AppendElement(interp, string); +-} +- +- +- +-static Tcl_DString *unparse_err(kadm5_ret_t code) +-{ +- char *code_string; +- const char *error_string; +- Tcl_DString *dstring; +- +- switch (code) { +- case KADM5_FAILURE: code_string = "KADM5_FAILURE"; break; +- case KADM5_AUTH_GET: code_string = "KADM5_AUTH_GET"; break; +- case KADM5_AUTH_ADD: code_string = "KADM5_AUTH_ADD"; break; +- case KADM5_AUTH_MODIFY: +- code_string = "KADM5_AUTH_MODIFY"; break; +- case KADM5_AUTH_DELETE: +- code_string = "KADM5_AUTH_DELETE"; break; +- case KADM5_AUTH_INSUFFICIENT: +- code_string = "KADM5_AUTH_INSUFFICIENT"; break; +- case KADM5_BAD_DB: code_string = "KADM5_BAD_DB"; break; +- case KADM5_DUP: code_string = "KADM5_DUP"; break; +- case KADM5_RPC_ERROR: code_string = "KADM5_RPC_ERROR"; break; +- case KADM5_NO_SRV: code_string = "KADM5_NO_SRV"; break; +- case KADM5_BAD_HIST_KEY: +- code_string = "KADM5_BAD_HIST_KEY"; break; +- case KADM5_NOT_INIT: code_string = "KADM5_NOT_INIT"; break; +- case KADM5_INIT: code_string = "KADM5_INIT"; break; +- case KADM5_BAD_PASSWORD: +- code_string = "KADM5_BAD_PASSWORD"; break; +- case KADM5_UNK_PRINC: code_string = "KADM5_UNK_PRINC"; break; +- case KADM5_UNK_POLICY: code_string = "KADM5_UNK_POLICY"; break; +- case KADM5_BAD_MASK: code_string = "KADM5_BAD_MASK"; break; +- case KADM5_BAD_CLASS: code_string = "KADM5_BAD_CLASS"; break; +- case KADM5_BAD_LENGTH: code_string = "KADM5_BAD_LENGTH"; break; +- case KADM5_BAD_POLICY: code_string = "KADM5_BAD_POLICY"; break; +- case KADM5_BAD_HISTORY: code_string = "KADM5_BAD_HISTORY"; break; +- case KADM5_BAD_PRINCIPAL: +- code_string = "KADM5_BAD_PRINCIPAL"; break; +- case KADM5_BAD_AUX_ATTR: +- code_string = "KADM5_BAD_AUX_ATTR"; break; +- case KADM5_PASS_Q_TOOSHORT: +- code_string = "KADM5_PASS_Q_TOOSHORT"; break; +- case KADM5_PASS_Q_CLASS: +- code_string = "KADM5_PASS_Q_CLASS"; break; +- case KADM5_PASS_Q_DICT: +- code_string = "KADM5_PASS_Q_DICT"; break; +- case KADM5_PASS_REUSE: code_string = "KADM5_PASS_REUSE"; break; +- case KADM5_PASS_TOOSOON: +- code_string = "KADM5_PASS_TOOSOON"; break; +- case KADM5_POLICY_REF: +- code_string = "KADM5_POLICY_REF"; break; +- case KADM5_PROTECT_PRINCIPAL: +- code_string = "KADM5_PROTECT_PRINCIPAL"; break; +- case KADM5_BAD_SERVER_HANDLE: +- code_string = "KADM5_BAD_SERVER_HANDLE"; break; +- case KADM5_BAD_STRUCT_VERSION: +- code_string = "KADM5_BAD_STRUCT_VERSION"; break; +- case KADM5_OLD_STRUCT_VERSION: +- code_string = "KADM5_OLD_STRUCT_VERSION"; break; +- case KADM5_NEW_STRUCT_VERSION: +- code_string = "KADM5_NEW_STRUCT_VERSION"; break; +- case KADM5_BAD_API_VERSION: +- code_string = "KADM5_BAD_API_VERSION"; break; +- case KADM5_OLD_LIB_API_VERSION: +- code_string = "KADM5_OLD_LIB_API_VERSION"; break; +- case KADM5_OLD_SERVER_API_VERSION: +- code_string = "KADM5_OLD_SERVER_API_VERSION"; break; +- case KADM5_NEW_LIB_API_VERSION: +- code_string = "KADM5_NEW_LIB_API_VERSION"; break; +- case KADM5_NEW_SERVER_API_VERSION: +- code_string = "KADM5_NEW_SERVER_API_VERSION"; break; +- case KADM5_SECURE_PRINC_MISSING: +- code_string = "KADM5_SECURE_PRINC_MISSING"; break; +- case KADM5_NO_RENAME_SALT: +- code_string = "KADM5_NO_RENAME_SALT"; break; +- case KADM5_BAD_CLIENT_PARAMS: +- code_string = "KADM5_BAD_CLIENT_PARAMS"; break; +- case KADM5_BAD_SERVER_PARAMS: +- code_string = "KADM5_BAD_SERVER_PARAMS"; break; +- case KADM5_AUTH_LIST: +- code_string = "KADM5_AUTH_LIST"; break; +- case KADM5_AUTH_CHANGEPW: +- code_string = "KADM5_AUTH_CHANGEPW"; break; +- case KADM5_GSS_ERROR: code_string = "KADM5_GSS_ERROR"; break; +- case KADM5_BAD_TL_TYPE: code_string = "KADM5_BAD_TL_TYPE"; break; +- case KADM5_MISSING_CONF_PARAMS: +- code_string = "KADM5_MISSING_CONF_PARAMS"; break; +- case KADM5_BAD_SERVER_NAME: +- code_string = "KADM5_BAD_SERVER_NAME"; break; +- case KADM5_MISSING_KRB5_CONF_PARAMS: +- code_string = "KADM5_MISSING_KRB5_CONF_PARAMS"; break; +- case KADM5_XDR_FAILURE: code_string = "KADM5_XDR_FAILURE"; break; +- case KADM5_CANT_RESOLVE: code_string = "KADM5_CANT_RESOLVE"; break; +- +- +- case OSA_ADB_DUP: code_string = "OSA_ADB_DUP"; break; +- case OSA_ADB_NOENT: code_string = "ENOENT"; break; +- case OSA_ADB_DBINIT: code_string = "OSA_ADB_DBINIT"; break; +- case OSA_ADB_BAD_POLICY: code_string = "Bad policy name"; break; +- case OSA_ADB_BAD_PRINC: code_string = "Bad principal name"; break; +- case OSA_ADB_BAD_DB: code_string = "Invalid database."; break; +- case OSA_ADB_XDR_FAILURE: code_string = "OSA_ADB_XDR_FAILURE"; break; +- case OSA_ADB_BADLOCKMODE: code_string = "OSA_ADB_BADLOCKMODE"; break; +- case OSA_ADB_CANTLOCK_DB: code_string = "OSA_ADB_CANTLOCK_DB"; break; +- case OSA_ADB_NOTLOCKED: code_string = "OSA_ADB_NOTLOCKED"; break; +- case OSA_ADB_NOLOCKFILE: code_string = "OSA_ADB_NOLOCKFILE"; break; +- case OSA_ADB_NOEXCL_PERM: code_string = "OSA_ADB_NOEXCL_PERM"; break; +- +- case KRB5_KDB_INUSE: code_string = "KRB5_KDB_INUSE"; break; +- case KRB5_KDB_UK_SERROR: code_string = "KRB5_KDB_UK_SERROR"; break; +- case KRB5_KDB_UK_RERROR: code_string = "KRB5_KDB_UK_RERROR"; break; +- case KRB5_KDB_UNAUTH: code_string = "KRB5_KDB_UNAUTH"; break; +- case KRB5_KDB_NOENTRY: code_string = "KRB5_KDB_NOENTRY"; break; +- case KRB5_KDB_ILL_WILDCARD: code_string = "KRB5_KDB_ILL_WILDCARD"; break; +- case KRB5_KDB_DB_INUSE: code_string = "KRB5_KDB_DB_INUSE"; break; +- case KRB5_KDB_DB_CHANGED: code_string = "KRB5_KDB_DB_CHANGED"; break; +- case KRB5_KDB_TRUNCATED_RECORD: +- code_string = "KRB5_KDB_TRUNCATED_RECORD"; break; +- case KRB5_KDB_RECURSIVELOCK: +- code_string = "KRB5_KDB_RECURSIVELOCK"; break; +- case KRB5_KDB_NOTLOCKED: code_string = "KRB5_KDB_NOTLOCKED"; break; +- case KRB5_KDB_BADLOCKMODE: code_string = "KRB5_KDB_BADLOCKMODE"; break; +- case KRB5_KDB_DBNOTINITED: code_string = "KRB5_KDB_DBNOTINITED"; break; +- case KRB5_KDB_DBINITED: code_string = "KRB5_KDB_DBINITED"; break; +- case KRB5_KDB_ILLDIRECTION: code_string = "KRB5_KDB_ILLDIRECTION"; break; +- case KRB5_KDB_NOMASTERKEY: code_string = "KRB5_KDB_NOMASTERKEY"; break; +- case KRB5_KDB_BADMASTERKEY: code_string = "KRB5_KDB_BADMASTERKEY"; break; +- case KRB5_KDB_INVALIDKEYSIZE: +- code_string = "KRB5_KDB_INVALIDKEYSIZE"; break; +- case KRB5_KDB_CANTREAD_STORED: +- code_string = "KRB5_KDB_CANTREAD_STORED"; break; +- case KRB5_KDB_BADSTORED_MKEY: +- code_string = "KRB5_KDB_BADSTORED_MKEY"; break; +- case KRB5_KDB_CANTLOCK_DB: code_string = "KRB5_KDB_CANTLOCK_DB"; break; +- case KRB5_KDB_DB_CORRUPT: code_string = "KRB5_KDB_DB_CORRUPT"; break; +- +- case KRB5_PARSE_ILLCHAR: code_string = "KRB5_PARSE_ILLCHAR"; break; +- case KRB5_PARSE_MALFORMED: code_string = "KRB5_PARSE_MALFORMED"; break; +- case KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN: code_string = "KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN"; break; +- case KRB5_REALM_UNKNOWN: code_string = "KRB5_REALM_UNKNOWN"; break; +- case KRB5_KDC_UNREACH: code_string = "KRB5_KDC_UNREACH"; break; +- case KRB5_KDCREP_MODIFIED: code_string = "KRB5_KDCREP_MODIFIED"; break; +- case KRB5KRB_AP_ERR_BAD_INTEGRITY: code_string = "KRB5KRB_AP_ERR_BAD_INTEGRITY"; break; +- case KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN: code_string = "KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN"; break; +- case KRB5_CONFIG_BADFORMAT: code_string = "KRB5_CONFIG_BADFORMAT"; break; +- +- case KRB5_CC_NOTFOUND: code_string = "KRB5_CC_NOTFOUND"; break; +- case KRB5_FCC_NOFILE: code_string = "KRB5_FCC_NOFILE"; break; +- +- case EINVAL: code_string = "EINVAL"; break; +- case ENOENT: code_string = "ENOENT"; break; +- +- default: +- fprintf(stderr, "**** CODE %ld (%s) ***\n", (long) code, +- error_message (code)); +- code_string = "UNKNOWN"; +- break; +- } +- +- error_string = error_message(code); +- +- if (! (dstring = (Tcl_DString *) malloc(sizeof(Tcl_DString)))) { +- fprintf(stderr, "Out of memory!\n"); +- exit(1); /* XXX Do we really want to exit? Ok if this is */ +- /* just a test program, but what about if it gets */ +- /* used for other things later? */ +- } +- +- Tcl_DStringInit(dstring); +- +- if (! (Tcl_DStringAppendElement(dstring, "ERROR") && +- Tcl_DStringAppendElement(dstring, code_string) && +- Tcl_DStringAppendElement(dstring, error_string))) { +- fprintf(stderr, "Out of memory!\n"); +- exit(1); /* XXX */ +- } +- +- return dstring; +-} +- +- +- +-static void stash_error(Tcl_Interp *interp, krb5_error_code code) +-{ +- Tcl_DString *dstring = unparse_err(code); +- Tcl_DStringResult(interp, dstring); +- Tcl_DStringFree(dstring); +- free(dstring); +-} +- +-static Tcl_DString *unparse_key_data(krb5_key_data *key_data, int n_key_data) +-{ +- Tcl_DString *str; +- char buf[2048]; +- int i, j; +- +- if (! (str = malloc(sizeof(*str)))) { +- fprintf(stderr, "Out of memory!\n"); +- exit(1); /* XXX */ +- } +- +- Tcl_DStringInit(str); +- for (i = 0; i < n_key_data; i++) { +- krb5_key_data *key = &key_data[i]; +- +- Tcl_DStringStartSublist(str); +- sprintf(buf, "%d", key->key_data_type[0]); +- Tcl_DStringAppendElement(str, buf); +- sprintf(buf, "%d", key->key_data_ver > 1 ? +- key->key_data_type[1] : -1); +- Tcl_DStringAppendElement(str, buf); +- if (key->key_data_contents[0]) { +- sprintf(buf, "0x"); +- for (j = 0; j < key->key_data_length[0]; j++) { +- sprintf(buf + 2*(j+1), "%02x", +- key->key_data_contents[0][j]); +- } +- } else *buf = '\0'; +- Tcl_DStringAppendElement(str, buf); +- Tcl_DStringEndSublist(str); +- } +- +- return str; +-} +- +-static Tcl_DString *unparse_tl_data(krb5_tl_data *tl_data, int n_tl_data) +-{ +- Tcl_DString *str; +- char buf[2048]; +- +- if (! (str = malloc(sizeof(*str)))) { +- fprintf(stderr, "Out of memory!\n"); +- exit(1); /* XXX */ +- } +- +- Tcl_DStringInit(str); +- Tcl_DStringStartSublist(str); +- for (; tl_data; tl_data = tl_data->tl_data_next) { +- Tcl_DStringStartSublist(str); +- sprintf(buf, "%d", tl_data->tl_data_type); +- Tcl_DStringAppendElement(str, buf); +- sprintf(buf, "%d", tl_data->tl_data_length); +- Tcl_DStringAppendElement(str, buf); +- Tcl_DStringAppend(str, " ", 1); +- Tcl_DStringAppend(str, (char *) tl_data->tl_data_contents, +- tl_data->tl_data_length); +- Tcl_DStringEndSublist(str); +- } +- Tcl_DStringEndSublist(str); +- +- return str; +-} +- +-static Tcl_DString *unparse_flags(struct flagval *array, int size, +- krb5_int32 flags) +-{ +- int i; +- Tcl_DString *str; +- +- if (! (str = malloc(sizeof(*str)))) { +- fprintf(stderr, "Out of memory!\n"); +- exit(1); /* XXX */ +- } +- +- Tcl_DStringInit(str); +- +- for (i = 0; i < size; i++) { +- if (flags & array[i].val) { +- Tcl_DStringAppendElement(str, array[i].name); +- } +- } +- +- return str; +-} +- +- +-static int parse_flags(Tcl_Interp *interp, Tcl_HashTable *table, +- struct flagval *array, int size, const char *str, +- krb5_flags *flags) +-{ +- int tmp, argc, i, retcode = TCL_OK; +- const char **argv; +- Tcl_HashEntry *entry; +- +- if (Tcl_GetInt(interp, str, &tmp) == TCL_OK) { +- *flags = tmp; +- return TCL_OK; +- } +- Tcl_ResetResult(interp); +- +- if (Tcl_SplitList(interp, str, &argc, &argv) != TCL_OK) { +- return TCL_ERROR; +- } +- +- if (! table) { +- table = create_flag_table(array, size); +- } +- +- *flags = 0; +- +- for (i = 0; i < argc; i++) { +- if (! (entry = Tcl_FindHashEntry(table, argv[i]))) { +- Tcl_AppendResult(interp, "unknown krb5 flag ", argv[i], 0); +- retcode = TCL_ERROR; +- break; +- } +- *flags |= *(krb5_flags *) Tcl_GetHashValue(entry); +- } +- +- Tcl_Free((char *) argv); +- return(retcode); +-} +- +-static Tcl_DString *unparse_privs(krb5_flags flags) +-{ +- return unparse_flags(priv_flags, sizeof(priv_flags) / +- sizeof(struct flagval), flags); +-} +- +- +-static Tcl_DString *unparse_krb5_flags(krb5_flags flags) +-{ +- return unparse_flags(krb5_flags_array, sizeof(krb5_flags_array) / +- sizeof(struct flagval), flags); +-} +- +-static int parse_krb5_flags(Tcl_Interp *interp, const char *str, +- krb5_flags *flags) +-{ +- krb5_flags tmp; +- static Tcl_HashTable *table = 0; +- int tcl_ret; +- +- if ((tcl_ret = parse_flags(interp, table, krb5_flags_array, +- sizeof(krb5_flags_array) / +- sizeof(struct flagval), +- str, &tmp)) != TCL_OK) { +- return tcl_ret; +- } +- +- *flags = tmp; +- return TCL_OK; +-} +- +-static Tcl_DString *unparse_aux_attributes(krb5_int32 flags) +-{ +- return unparse_flags(aux_attributes, sizeof(aux_attributes) / +- sizeof(struct flagval), flags); +-} +- +- +-static int parse_aux_attributes(Tcl_Interp *interp, const char *str, +- long *flags) +-{ +- krb5_flags tmp; +- static Tcl_HashTable *table = 0; +- int tcl_ret; +- +- if ((tcl_ret = parse_flags(interp, table, aux_attributes, +- sizeof(aux_attributes) / +- sizeof(struct flagval), +- str, &tmp)) != TCL_OK) { +- return tcl_ret; +- } +- +- *flags = tmp; +- return TCL_OK; +-} +- +-static int parse_principal_mask(Tcl_Interp *interp, const char *str, +- krb5_int32 *flags) +-{ +- krb5_flags tmp; +- static Tcl_HashTable *table = 0; +- int tcl_ret; +- +- if ((tcl_ret = parse_flags(interp, table, principal_mask_flags, +- sizeof(principal_mask_flags) / +- sizeof(struct flagval), +- str, &tmp)) != TCL_OK) { +- return tcl_ret; +- } +- +- *flags = tmp; +- return TCL_OK; +-} +- +-static int parse_policy_mask(Tcl_Interp *interp, const char *str, +- krb5_int32 *flags) +-{ +- krb5_flags tmp; +- static Tcl_HashTable *table = 0; +- int tcl_ret; +- +- if ((tcl_ret = parse_flags(interp, table, policy_mask_flags, +- sizeof(policy_mask_flags) / +- sizeof(struct flagval), +- str, &tmp)) != TCL_OK) { +- return tcl_ret; +- } +- +- *flags = tmp; +- return TCL_OK; +-} +- +- +-static Tcl_DString *unparse_principal_ent(kadm5_principal_ent_t princ, +- krb5_int32 mask) +-{ +- Tcl_DString *str, *tmp_dstring; +- char *tmp; +- char buf[20]; +- krb5_error_code krb5_ret; +- +- if (! (str = malloc(sizeof(*str)))) { +- fprintf(stderr, "Out of memory!\n"); +- exit(1); /* XXX */ +- } +- +- Tcl_DStringInit(str); +- +- tmp = 0; /* It looks to me from looking at the library source */ +- /* code for krb5_parse_name that the pointer passed into */ +- /* it should be initialized to 0 if I want it do be */ +- /* allocated automatically. */ +- if (mask & KADM5_PRINCIPAL) { +- krb5_ret = krb5_unparse_name(context, princ->principal, &tmp); +- if (krb5_ret) { +- /* XXX Do we want to return an error? Not sure. */ +- Tcl_DStringAppendElement(str, "[unparsable principal]"); +- } +- else { +- Tcl_DStringAppendElement(str, tmp); +- free(tmp); +- } +- } else +- Tcl_DStringAppendElement(str, "null"); +- +- sprintf(buf, "%u", (unsigned int)princ->princ_expire_time); +- Tcl_DStringAppendElement(str, buf); +- +- sprintf(buf, "%u", (unsigned int)princ->last_pwd_change); +- Tcl_DStringAppendElement(str, buf); +- +- sprintf(buf, "%u", (unsigned int)princ->pw_expiration); +- Tcl_DStringAppendElement(str, buf); +- +- sprintf(buf, "%d", princ->max_life); +- Tcl_DStringAppendElement(str, buf); +- +- tmp = 0; +- if (mask & KADM5_MOD_NAME) { +- if ((krb5_ret = krb5_unparse_name(context, princ->mod_name, &tmp))) { +- /* XXX */ +- Tcl_DStringAppendElement(str, "[unparsable principal]"); +- } +- else { +- Tcl_DStringAppendElement(str, tmp); +- free(tmp); +- } +- } else +- Tcl_DStringAppendElement(str, "null"); +- +- sprintf(buf, "%u", (unsigned int)princ->mod_date); +- Tcl_DStringAppendElement(str, buf); +- +- if (mask & KADM5_ATTRIBUTES) { +- tmp_dstring = unparse_krb5_flags(princ->attributes); +- Tcl_DStringAppendElement(str, tmp_dstring->string); +- Tcl_DStringFree(tmp_dstring); +- free(tmp_dstring); +- } else +- Tcl_DStringAppendElement(str, "null"); +- +- sprintf(buf, "%d", princ->kvno); +- Tcl_DStringAppendElement(str, buf); +- +- sprintf(buf, "%d", princ->mkvno); +- Tcl_DStringAppendElement(str, buf); +- +- /* XXX This may be dangerous, because the contents of the policy */ +- /* field are undefined if the POLICY bit isn't set. However, I */ +- /* think it's a bug for the field not to be null in that case */ +- /* anyway, so we should assume that it will be null so that we'll */ +- /* catch it if it isn't. */ +- +- tmp_dstring = unparse_str(princ->policy); +- Tcl_DStringAppendElement(str, tmp_dstring->string); +- Tcl_DStringFree(tmp_dstring); +- free(tmp_dstring); +- +- tmp_dstring = unparse_aux_attributes(princ->aux_attributes); +- Tcl_DStringAppendElement(str, tmp_dstring->string); +- Tcl_DStringFree(tmp_dstring); +- free(tmp_dstring); +- +- sprintf(buf, "%d", princ->max_renewable_life); +- Tcl_DStringAppendElement(str, buf); +- +- sprintf(buf, "%u", (unsigned int)princ->last_success); +- Tcl_DStringAppendElement(str, buf); +- +- sprintf(buf, "%u", (unsigned int)princ->last_failed); +- Tcl_DStringAppendElement(str, buf); +- +- sprintf(buf, "%d", princ->fail_auth_count); +- Tcl_DStringAppendElement(str, buf); +- +- sprintf(buf, "%d", princ->n_key_data); +- Tcl_DStringAppendElement(str, buf); +- +- sprintf(buf, "%d", princ->n_tl_data); +- Tcl_DStringAppendElement(str, buf); +- +- tmp_dstring = unparse_key_data(princ->key_data, princ->n_key_data); +- Tcl_DStringAppendElement(str, tmp_dstring->string); +- Tcl_DStringFree(tmp_dstring); +- free(tmp_dstring); +- +- tmp_dstring = unparse_tl_data(princ->tl_data, princ->n_tl_data); +- Tcl_DStringAppendElement(str, tmp_dstring->string); +- Tcl_DStringFree(tmp_dstring); +- free(tmp_dstring); +- +- return str; +-} +- +-static int parse_keysalts(Tcl_Interp *interp, const char *list, +- krb5_key_salt_tuple **keysalts, +- int num_keysalts) +-{ +- const char **argv, **argv1 = NULL; +- int i, tmp, argc, argc1, retcode; +- +- *keysalts = NULL; +- if (list == NULL) +- return TCL_OK; +- +- if ((retcode = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) { +- return retcode; +- } +- if (argc != num_keysalts) { +- Tcl_SetResult(interp, "wrong number of keysalts", TCL_STATIC); +- retcode = TCL_ERROR; +- goto finished; +- } +- *keysalts = (krb5_key_salt_tuple *) +- malloc(sizeof(krb5_key_salt_tuple)*num_keysalts); +- for (i = 0; i < num_keysalts; i++) { +- if ((retcode = Tcl_SplitList(interp, argv[i], &argc1, &argv1)) != +- TCL_OK) { +- goto finished; +- } +- if (argc1 != 2) { +- Tcl_SetResult(interp, "wrong # of fields in keysalt", TCL_STATIC); +- retcode = TCL_ERROR; +- goto finished; +- } +- /* XXX this used to be argv1[1] too! */ +- if ((retcode = Tcl_GetInt(interp, argv1[0], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing ks_enctype"); +- retcode = TCL_ERROR; +- goto finished; +- } +- (*keysalts)[i].ks_enctype = tmp; +- if ((retcode = Tcl_GetInt(interp, argv1[1], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing ks_salttype"); +- goto finished; +- } +- (*keysalts)[i].ks_salttype = tmp; +- +- Tcl_Free((char *) argv1); +- argv1 = NULL; +- } +- +-finished: +- if (argv1) { +- Tcl_Free((char *) argv1); +- } +- Tcl_Free((char *) argv); +- return retcode; +-} +- +-static int parse_key_data(Tcl_Interp *interp, const char *list, +- krb5_key_data **key_data, +- int n_key_data) +-{ +- const char **argv = NULL; +- int argc, retcode; +- +- *key_data = NULL; +- if (list == NULL) { +- if (n_key_data != 0) { +- Tcl_SetResult(interp, "wrong number of key_datas", TCL_STATIC); +- retcode = TCL_ERROR; +- goto finished; +- } else +- return TCL_OK; +- } +- +- if ((retcode = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) { +- return retcode; +- } +- if (argc != n_key_data) { +- Tcl_SetResult(interp, "wrong number of key_datas", TCL_STATIC); +- retcode = TCL_ERROR; +- goto finished; +- } +- +- if (argc != 0) { +- Tcl_SetResult(interp, "cannot parse key_data yet", TCL_STATIC); +- retcode = TCL_ERROR; +- goto finished; +- } +- +-finished: +- Tcl_Free((char *) argv); +- return retcode; +-} +- +-static int parse_tl_data(Tcl_Interp *interp, const char *list, +- krb5_tl_data **tlp, +- int n_tl_data) +-{ +- krb5_tl_data *tl, *tl2; +- const char **argv = NULL, **argv1 = NULL; +- int i, tmp, argc, argc1, retcode; +- +- *tlp = NULL; +- if (list == NULL) { +- if (n_tl_data != 0) { +- Tcl_SetResult(interp, "wrong number of tl_datas", TCL_STATIC); +- retcode = TCL_ERROR; +- goto finished; +- } else +- return TCL_OK; +- } +- +- if ((retcode = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) { +- return retcode; +- } +- if (argc != n_tl_data) { +- Tcl_SetResult(interp, "wrong number of tl_datas", TCL_STATIC); +- retcode = TCL_ERROR; +- goto finished; +- } +- +- tl = tl2 = NULL; +- for (i = 0; i < n_tl_data; i++) { +- tl2 = (krb5_tl_data *) malloc(sizeof(krb5_tl_data)); +- memset(tl2, 0, sizeof(krb5_tl_data)); +- tl2->tl_data_next = tl; +- tl = tl2; +- } +- tl2 = tl; +- +- for (i = 0; i < n_tl_data; i++) { +- if ((retcode = Tcl_SplitList(interp, argv[i], &argc1, &argv1)) != +- TCL_OK) { +- goto finished; +- } +- if (argc1 != 3) { +- Tcl_SetResult(interp, "wrong # of fields in tl_data", TCL_STATIC); +- retcode = TCL_ERROR; +- goto finished; +- } +- if ((retcode = Tcl_GetInt(interp, argv1[0], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing tl_data_type"); +- retcode = TCL_ERROR; +- goto finished; +- } +- tl->tl_data_type = tmp; +- if ((retcode = Tcl_GetInt(interp, argv1[1], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing tl_data_length"); +- retcode = TCL_ERROR; +- goto finished; +- } +- tl->tl_data_length = tmp; +- if (tl->tl_data_length != strlen(argv1[2])) { +- Tcl_SetResult(interp, "length != string length", TCL_STATIC); +- retcode = TCL_ERROR; +- goto finished; +- } +- tl->tl_data_contents = (krb5_octet *) strdup(argv1[2]); +- +- Tcl_Free((char *) argv1); +- argv1 = NULL; +- tl = tl->tl_data_next; +- } +- if (tl != NULL) { +- Tcl_SetResult(interp, "tl is not NULL!", TCL_STATIC); +- retcode = TCL_ERROR; +- goto finished; +- } +- *tlp = tl2; +- +-finished: +- if (argv1) { +- Tcl_Free((char *) argv1); +- } +- Tcl_Free((char *) argv); +- return retcode; +-} +- +-static int parse_config_params(Tcl_Interp *interp, char *list, +- kadm5_config_params *params) +-{ +- static Tcl_HashTable *table = 0; +- const char **argv = NULL; +- int tmp, argc, retcode; +- +- memset(params, 0, sizeof(kadm5_config_params)); +- if (list == NULL) +- return TCL_OK; +- +- if ((retcode = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) { +- return retcode; +- } +- +- if (argc != 20) { +- Tcl_SetResult(interp, "wrong # args in config params structure", +- TCL_STATIC); +- retcode = TCL_ERROR; +- goto finished; +- } +- +- if ((retcode = parse_flags(interp, table, config_mask_flags, +- sizeof(config_mask_flags) / +- sizeof(struct flagval), +- argv[0], &tmp)) != TCL_OK) { +- goto finished; +- } +- params->mask = tmp; +- +- if ((retcode = parse_str(interp, argv[1], ¶ms->realm)) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing realm name"); +- retcode = TCL_ERROR; +- goto finished; +- } +- if ((retcode = Tcl_GetInt(interp, argv[2], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing kadmind_port"); +- retcode = TCL_ERROR; +- goto finished; +- } +- params->kadmind_port = tmp; +- if ((retcode = parse_str(interp, argv[3], ¶ms->admin_server)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing profile name"); +- retcode = TCL_ERROR; +- goto finished; +- } +- if ((retcode = parse_str(interp, argv[4], ¶ms->dbname)) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing profile name"); +- retcode = TCL_ERROR; +- goto finished; +- } +- /* Ignore argv[5], which used to set the admin_dbname field. */ +- /* Ignore argv[6], which used to set the admin_lockfile field. */ +- /* Ignore argv[7], which used to set the admin_keytab field. */ +- if ((retcode = parse_str(interp, argv[8], ¶ms->acl_file)) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing acl_file name"); +- retcode = TCL_ERROR; +- goto finished; +- } +- if ((retcode = parse_str(interp, argv[9], ¶ms->dict_file)) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing dict_file name"); +- retcode = TCL_ERROR; +- goto finished; +- } +- if ((retcode = Tcl_GetInt(interp, argv[10], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing mkey_from_kbd"); +- retcode = TCL_ERROR; +- goto finished; +- } +- params->mkey_from_kbd = tmp; +- if ((retcode = parse_str(interp, argv[11], ¶ms->stash_file)) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing stash_file name"); +- retcode = TCL_ERROR; +- goto finished; +- } +- if ((retcode = parse_str(interp, argv[12], ¶ms->mkey_name)) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing mkey_name name"); +- retcode = TCL_ERROR; +- goto finished; +- } +- if ((retcode = Tcl_GetInt(interp, argv[13], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing enctype"); +- retcode = TCL_ERROR; +- goto finished; +- } +- params->enctype = tmp; +- if ((retcode = Tcl_GetInt(interp, argv[14], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing max_life"); +- retcode = TCL_ERROR; +- goto finished; +- } +- params->max_life = tmp; +- if ((retcode = Tcl_GetInt(interp, argv[15], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing max_rlife"); +- retcode = TCL_ERROR; +- goto finished; +- } +- params->max_rlife = tmp; +- if ((retcode = Tcl_GetInt(interp, argv[16], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing expiration"); +- retcode = TCL_ERROR; +- goto finished; +- } +- params->expiration = tmp; +- if ((retcode = parse_krb5_flags(interp, argv[17], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing flags"); +- retcode = TCL_ERROR; +- goto finished; +- } +- params->flags = tmp; +- if ((retcode = Tcl_GetInt(interp, argv[18], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing num_keysalts"); +- retcode = TCL_ERROR; +- goto finished; +- } +- params->num_keysalts = tmp; +- if ((retcode = parse_keysalts(interp, argv[19], ¶ms->keysalts, +- params->num_keysalts)) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing keysalts"); +- retcode = TCL_ERROR; +- goto finished; +- } +- +-finished: +- return retcode; +-} +- +-static int parse_principal_ent(Tcl_Interp *interp, char *list, +- kadm5_principal_ent_t *out_princ) +-{ +- kadm5_principal_ent_t princ = 0; +- krb5_error_code krb5_ret; +- int tcl_ret; +- int argc; +- const char **argv; +- int tmp; +- int retcode = TCL_OK; +- +- if ((tcl_ret = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) { +- return tcl_ret; +- } +- +- if (argc != 12 && argc != 20) { +- Tcl_SetResult(interp, "wrong # args in principal structure", +- TCL_STATIC); +- retcode = TCL_ERROR; +- goto finished; +- } +- +- if (! (princ = malloc(sizeof *princ))) { +- fprintf(stderr, "Out of memory!\n"); +- exit(1); /* XXX */ +- } +- memset(princ, 0, sizeof(*princ)); +- +- if ((krb5_ret = krb5_parse_name(context, argv[0], &princ->principal)) != 0) { +- stash_error(interp, krb5_ret); +- Tcl_AppendElement(interp, "while parsing principal"); +- retcode = TCL_ERROR; +- goto finished; +- } +- +- /* +- * All of the numerical values parsed here are parsed into an +- * "int" and then assigned into the structure in case the actual +- * width of the field in the Kerberos structure is different from +- * the width of an integer. +- */ +- +- if ((tcl_ret = Tcl_GetInt(interp, argv[1], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing princ_expire_time"); +- retcode = TCL_ERROR; +- goto finished; +- } +- princ->princ_expire_time = tmp; +- +- if ((tcl_ret = Tcl_GetInt(interp, argv[2], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing last_pwd_change"); +- retcode = TCL_ERROR; +- goto finished; +- } +- princ->last_pwd_change = tmp; +- +- if ((tcl_ret = Tcl_GetInt(interp, argv[3], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing pw_expiration"); +- retcode = TCL_ERROR; +- goto finished; +- } +- princ->pw_expiration = tmp; +- +- if ((tcl_ret = Tcl_GetInt(interp, argv[4], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing max_life"); +- retcode = TCL_ERROR; +- goto finished; +- } +- princ->max_life = tmp; +- +- if ((krb5_ret = krb5_parse_name(context, argv[5], &princ->mod_name)) != 0) { +- stash_error(interp, krb5_ret); +- Tcl_AppendElement(interp, "while parsing mod_name"); +- retcode = TCL_ERROR; +- goto finished; +- } +- +- if ((tcl_ret = Tcl_GetInt(interp, argv[6], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing mod_date"); +- retcode = TCL_ERROR; +- goto finished; +- } +- princ->mod_date = tmp; +- +- if ((tcl_ret = parse_krb5_flags(interp, argv[7], &princ->attributes)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing attributes"); +- retcode = TCL_ERROR; +- goto finished; +- } +- +- if ((tcl_ret = Tcl_GetInt(interp, argv[8], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing kvno"); +- retcode = TCL_ERROR; +- goto finished; +- } +- princ->kvno = tmp; +- +- if ((tcl_ret = Tcl_GetInt(interp, argv[9], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing mkvno"); +- retcode = TCL_ERROR; +- goto finished; +- } +- princ->mkvno = tmp; +- +- if ((tcl_ret = parse_str(interp, argv[10], &princ->policy)) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing policy"); +- retcode = TCL_ERROR; +- goto finished; +- } +- if(princ->policy != NULL) { +- if(!(princ->policy = strdup(princ->policy))) { +- fprintf(stderr, "Out of memory!\n"); +- exit(1); +- } +- } +- +- if ((tcl_ret = parse_aux_attributes(interp, argv[11], +- &princ->aux_attributes)) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing aux_attributes"); +- retcode = TCL_ERROR; +- goto finished; +- } +- +- if (argc == 12) goto finished; +- +- if ((tcl_ret = Tcl_GetInt(interp, argv[12], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing max_renewable_life"); +- retcode = TCL_ERROR; +- goto finished; +- } +- princ->max_renewable_life = tmp; +- +- if ((tcl_ret = Tcl_GetInt(interp, argv[13], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing last_success"); +- retcode = TCL_ERROR; +- goto finished; +- } +- princ->last_success = tmp; +- +- if ((tcl_ret = Tcl_GetInt(interp, argv[14], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing last_failed"); +- retcode = TCL_ERROR; +- goto finished; +- } +- princ->last_failed = tmp; +- +- if ((tcl_ret = Tcl_GetInt(interp, argv[15], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing fail_auth_count"); +- retcode = TCL_ERROR; +- goto finished; +- } +- princ->fail_auth_count = tmp; +- +- if ((tcl_ret = Tcl_GetInt(interp, argv[16], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing n_key_data"); +- retcode = TCL_ERROR; +- goto finished; +- } +- princ->n_key_data = tmp; +- +- if ((tcl_ret = Tcl_GetInt(interp, argv[17], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing n_tl_data"); +- retcode = TCL_ERROR; +- goto finished; +- } +- princ->n_tl_data = tmp; +- +- if ((tcl_ret = parse_key_data(interp, argv[18], +- &princ->key_data, +- princ->n_key_data)) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing key_data"); +- retcode = TCL_ERROR; +- goto finished; +- } +- +- if ((tcl_ret = parse_tl_data(interp, argv[19], +- &princ->tl_data, +- princ->n_tl_data)) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing tl_data"); +- retcode = TCL_ERROR; +- goto finished; +- } +- princ->n_tl_data = tmp; +- +-finished: +- Tcl_Free((char *) argv); +- *out_princ = princ; +- return retcode; +-} +- +- +-static void free_principal_ent(kadm5_principal_ent_t *princ) +-{ +- krb5_free_principal(context, (*princ)->principal); +- krb5_free_principal(context, (*princ)->mod_name); +- free((*princ)->policy); +- free(*princ); +- *princ = 0; +-} +- +-static Tcl_DString *unparse_policy_ent(kadm5_policy_ent_t policy) +-{ +- Tcl_DString *str, *tmp_dstring; +- char buf[20]; +- +- if (! (str = malloc(sizeof(*str)))) { +- fprintf(stderr, "Out of memory!\n"); +- exit(1); /* XXX */ +- } +- +- Tcl_DStringInit(str); +- +- tmp_dstring = unparse_str(policy->policy); +- Tcl_DStringAppendElement(str, tmp_dstring->string); +- Tcl_DStringFree(tmp_dstring); +- free(tmp_dstring); +- +- sprintf(buf, "%ld", policy->pw_min_life); +- Tcl_DStringAppendElement(str, buf); +- +- sprintf(buf, "%ld", policy->pw_max_life); +- Tcl_DStringAppendElement(str, buf); +- +- sprintf(buf, "%ld", policy->pw_min_length); +- Tcl_DStringAppendElement(str, buf); +- +- sprintf(buf, "%ld", policy->pw_min_classes); +- Tcl_DStringAppendElement(str, buf); +- +- sprintf(buf, "%ld", policy->pw_history_num); +- Tcl_DStringAppendElement(str, buf); +- +- sprintf(buf, "%ld", policy->policy_refcnt); +- Tcl_DStringAppendElement(str, buf); +- +- sprintf(buf, "%d", policy->pw_max_fail); +- Tcl_DStringAppendElement(str, buf); +- +- sprintf(buf, "%d", policy->pw_failcnt_interval); +- Tcl_DStringAppendElement(str, buf); +- +- sprintf(buf, "%d", policy->pw_lockout_duration); +- Tcl_DStringAppendElement(str, buf); +- +- return str; +-} +- +- +- +-static int parse_policy_ent(Tcl_Interp *interp, char *list, +- kadm5_policy_ent_t *out_policy) +-{ +- kadm5_policy_ent_t policy = 0; +- int tcl_ret; +- int argc; +- const char **argv; +- int tmp; +- int retcode = TCL_OK; +- +- if ((tcl_ret = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) { +- return tcl_ret; +- } +- +- if (argc != 7 && argc != 10) { +- Tcl_SetResult(interp, "wrong # args in policy structure", TCL_STATIC); +- retcode = TCL_ERROR; +- goto finished; +- } +- +- if (! (policy = malloc(sizeof *policy))) { +- fprintf(stderr, "Out of memory!\n"); +- exit(1); /* XXX */ +- } +- +- if ((tcl_ret = parse_str(interp, argv[0], &policy->policy)) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing policy name"); +- retcode = TCL_ERROR; +- goto finished; +- } +- +- if(policy->policy != NULL) { +- if (! (policy->policy = strdup(policy->policy))) { +- fprintf(stderr, "Out of memory!\n"); +- exit(1); /* XXX */ +- } +- } +- +- /* +- * All of the numerical values parsed here are parsed into an +- * "int" and then assigned into the structure in case the actual +- * width of the field in the Kerberos structure is different from +- * the width of an integer. +- */ +- +- if ((tcl_ret = Tcl_GetInt(interp, argv[1], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing pw_min_life"); +- retcode = TCL_ERROR; +- goto finished; +- } +- policy->pw_min_life = tmp; +- +- if ((tcl_ret = Tcl_GetInt(interp, argv[2], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing pw_max_life"); +- retcode = TCL_ERROR; +- goto finished; +- } +- policy->pw_max_life = tmp; +- +- if ((tcl_ret = Tcl_GetInt(interp, argv[3], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing pw_min_length"); +- retcode = TCL_ERROR; +- goto finished; +- } +- policy->pw_min_length = tmp; +- +- if ((tcl_ret = Tcl_GetInt(interp, argv[4], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing pw_min_classes"); +- retcode = TCL_ERROR; +- goto finished; +- } +- policy->pw_min_classes = tmp; +- +- if ((tcl_ret = Tcl_GetInt(interp, argv[5], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing pw_history_num"); +- retcode = TCL_ERROR; +- goto finished; +- } +- policy->pw_history_num = tmp; +- +- if ((tcl_ret = Tcl_GetInt(interp, argv[6], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing policy_refcnt"); +- retcode = TCL_ERROR; +- goto finished; +- } +- policy->policy_refcnt = tmp; +- +- if (argc == 7) goto finished; +- +- if ((tcl_ret = Tcl_GetInt(interp, argv[7], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing pw_max_fail"); +- retcode = TCL_ERROR; +- goto finished; +- } +- policy->pw_max_fail = tmp; +- +- if ((tcl_ret = Tcl_GetInt(interp, argv[8], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing pw_failcnt_interval"); +- retcode = TCL_ERROR; +- goto finished; +- } +- policy->pw_failcnt_interval = tmp; +- +- if ((tcl_ret = Tcl_GetInt(interp, argv[9], &tmp)) +- != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing pw_lockout_duration"); +- retcode = TCL_ERROR; +- goto finished; +- } +- policy->pw_lockout_duration = tmp; +- +-finished: +- Tcl_Free((char *) argv); +- *out_policy = policy; +- return retcode; +-} +- +- +-static void free_policy_ent(kadm5_policy_ent_t *policy) +-{ +- free((*policy)->policy); +- free(*policy); +- *policy = 0; +-} +- +-static Tcl_DString *unparse_keytype(krb5_enctype enctype) +-{ +- Tcl_DString *str; +- char buf[50]; +- +- if (! (str = malloc(sizeof(*str)))) { +- fprintf(stderr, "Out of memory!\n"); +- exit(1); /* XXX */ +- } +- +- Tcl_DStringInit(str); +- +- switch (enctype) { +- /* XXX is this right? */ +- case ENCTYPE_NULL: Tcl_DStringAppend(str, "ENCTYPE_NULL", -1); break; +- default: +- sprintf(buf, "UNKNOWN KEYTYPE (0x%x)", enctype); +- Tcl_DStringAppend(str, buf, -1); +- break; +- } +- +- return str; +-} +- +- +-static Tcl_DString *unparse_keyblocks(krb5_keyblock *keyblocks, int num_keys) +-{ +- Tcl_DString *str; +- Tcl_DString *keytype; +- unsigned int i; +- int j; +- +- if (! (str = malloc(sizeof(*str)))) { +- fprintf(stderr, "Out of memory!\n"); +- exit(1); /* XXX */ +- } +- +- Tcl_DStringInit(str); +- +- for (j = 0; j < num_keys; j++) { +- krb5_keyblock *keyblock = &keyblocks[j]; +- +- Tcl_DStringStartSublist(str); +- +- keytype = unparse_keytype(keyblock->enctype); +- Tcl_DStringAppendElement(str, keytype->string); +- Tcl_DStringFree(keytype); +- free(keytype); +- if (keyblock->length == 0) { +- Tcl_DStringAppendElement(str, "0x00"); +- } +- else { +- Tcl_DStringAppendElement(str, "0x"); +- for (i = 0; i < keyblock->length; i++) { +- char buf[3]; +- sprintf(buf, "%02x", (int) keyblock->contents[i]); +- Tcl_DStringAppend(str, buf, -1); +- } +- } +- +- Tcl_DStringEndSublist(str); +- } +- +- +- return str; +-} +- +-enum init_type { INIT_NONE, INIT_PASS, INIT_CREDS }; +- +-static int _tcl_kadm5_init_any(enum init_type init_type, ClientData clientData, +- Tcl_Interp *interp, int argc, const char *argv[]) +-{ +- kadm5_ret_t ret; +- char *client_name, *pass, *service_name; +- int tcl_ret; +- krb5_ui_4 struct_version, api_version; +- const char *handle_var; +- void *server_handle; +- char *handle_name, *params_str; +- const char *whoami = argv[0]; +- kadm5_config_params params; +- +- argv++, argc--; +- +- kadm5_init_krb5_context(&context); +- +- if (argc != 7) { +- Tcl_AppendResult(interp, whoami, ": ", arg_error, 0); +- return TCL_ERROR; +- } +- +- if (((tcl_ret = parse_str(interp, argv[0], &client_name)) != TCL_OK) || +- ((tcl_ret = parse_str(interp, argv[1], &pass)) != TCL_OK) || +- ((tcl_ret = parse_str(interp, argv[2], &service_name)) != TCL_OK) || +- ((tcl_ret = parse_str(interp, argv[3], ¶ms_str)) != TCL_OK) || +- ((tcl_ret = parse_config_params(interp, params_str, ¶ms)) +- != TCL_OK) || +- ((tcl_ret = Tcl_GetInt(interp, argv[4], (int *) &struct_version)) != +- TCL_OK) || +- ((tcl_ret = Tcl_GetInt(interp, argv[5], (int *) &api_version)) != +- TCL_OK)) { +- return tcl_ret; +- } +- +- handle_var = argv[6]; +- +- if (! (handle_var && *handle_var)) { +- Tcl_SetResult(interp, "must specify server handle variable name", +- TCL_STATIC); +- return TCL_ERROR; +- } +- +- if (init_type == INIT_CREDS) { +- krb5_ccache cc; +- +- if (pass == NULL) { +- if ((ret = krb5_cc_default(context, &cc))) { +- stash_error(interp, ret); +- return TCL_ERROR; +- } +- } else { +- if ((ret = krb5_cc_resolve(context, pass, &cc))) { +- stash_error(interp, ret); +- return TCL_ERROR; +- } +- } +- +- ret = kadm5_init_with_creds(context, client_name, cc, service_name, +- ¶ms, struct_version, +- api_version, NULL, &server_handle); +- +- (void) krb5_cc_close(context, cc); +- } else +- ret = kadm5_init(context, client_name, pass, service_name, ¶ms, +- struct_version, api_version, NULL, &server_handle); +- +- /* The string fields of params are aliases into argv[3], but +- * params.keysalts is allocated, so clean it up. */ +- free(params.keysalts); +- +- if (ret != KADM5_OK) { +- stash_error(interp, ret); +- return TCL_ERROR; +- } +- +- if ((tcl_ret = put_server_handle(interp, server_handle, &handle_name)) +- != TCL_OK) { +- return tcl_ret; +- } +- +- if (! Tcl_SetVar(interp, handle_var, handle_name, TCL_LEAVE_ERR_MSG)) { +- return TCL_ERROR; +- } +- +- set_ok(interp, "KADM5 API initialized."); +- return TCL_OK; +-} +- +-static int tcl_kadm5_init(ClientData clientData, Tcl_Interp *interp, +- int argc, const char *argv[]) +-{ +- return _tcl_kadm5_init_any(INIT_PASS, clientData, interp, argc, argv); +-} +- +-static int tcl_kadm5_init_with_creds(ClientData clientData, Tcl_Interp *interp, +- int argc, const char *argv[]) +-{ +- return _tcl_kadm5_init_any(INIT_CREDS, clientData, interp, argc, argv); +-} +- +-static int tcl_kadm5_destroy(ClientData clientData, Tcl_Interp *interp, +- int argc, const char *argv[]) +-{ +- kadm5_ret_t ret; +- int tcl_ret; +- +- GET_HANDLE(0, 0); +- +- ret = kadm5_destroy(server_handle); +- +- if (ret != KADM5_OK) { +- stash_error(interp, ret); +- return TCL_ERROR; +- } +- +- if ((tcl_ret = remove_server_handle(interp, argv[-1])) != TCL_OK) { +- return tcl_ret; +- } +- +- set_ok(interp, "KADM5 API deinitialized."); +- return TCL_OK; +-} +- +-static int tcl_kadm5_create_principal(ClientData clientData, +- Tcl_Interp *interp, +- int argc, const char *argv[]) +-{ +- int tcl_ret; +- kadm5_ret_t ret; +- int retcode = TCL_OK; +- char *princ_string; +- kadm5_principal_ent_t princ = 0; +- krb5_int32 mask; +- char *pw; +-#ifdef OVERRIDE +- int override_qual; +-#endif +- +- GET_HANDLE(3, 0); +- +- if ((tcl_ret = parse_str(interp, argv[0], &princ_string)) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing principal"); +- return tcl_ret; +- } +- +- if (princ_string && +- ((tcl_ret = parse_principal_ent(interp, princ_string, &princ)) +- != TCL_OK)) { +- return tcl_ret; +- } +- +- if ((tcl_ret = parse_principal_mask(interp, argv[1], &mask)) != TCL_OK) { +- retcode = tcl_ret; +- goto finished; +- } +- +- if ((tcl_ret = parse_str(interp, argv[2], &pw)) != TCL_OK) { +- retcode = tcl_ret; +- goto finished; +- } +-#ifdef OVERRIDE +- if ((tcl_ret = Tcl_GetBoolean(interp, argv[3], &override_qual)) != +- TCL_OK) { +- retcode = tcl_ret; +- goto finished; +- } +-#endif +- +-#ifdef OVERRIDE +- ret = kadm5_create_principal(server_handle, princ, mask, pw, +- override_qual); +-#else +- ret = kadm5_create_principal(server_handle, princ, mask, pw); +-#endif +- +- if (ret != KADM5_OK) { +- stash_error(interp, ret); +- retcode = TCL_ERROR; +- goto finished; +- } +- else { +- set_ok(interp, "Principal created."); +- } +- +-finished: +- if (princ) { +- free_principal_ent(&princ); +- } +- return retcode; +-} +- +- +- +-static int tcl_kadm5_delete_principal(ClientData clientData, +- Tcl_Interp *interp, +- int argc, const char *argv[]) +-{ +- krb5_principal princ; +- krb5_error_code krb5_ret; +- kadm5_ret_t ret; +- int tcl_ret; +- char *name; +- +- GET_HANDLE(1, 0); +- +- if((tcl_ret = parse_str(interp, argv[0], &name)) != TCL_OK) +- return tcl_ret; +- if(name != NULL) { +- if ((krb5_ret = krb5_parse_name(context, name, &princ))) { +- stash_error(interp, krb5_ret); +- Tcl_AppendElement(interp, "while parsing principal"); +- return TCL_ERROR; +- } +- } else princ = NULL; +- ret = kadm5_delete_principal(server_handle, princ); +- +- if(princ != NULL) +- krb5_free_principal(context, princ); +- +- if (ret != KADM5_OK) { +- stash_error(interp, ret); +- return TCL_ERROR; +- } +- else { +- set_ok(interp, "Principal deleted."); +- return TCL_OK; +- } +-} +- +- +- +-static int tcl_kadm5_modify_principal(ClientData clientData, +- Tcl_Interp *interp, +- int argc, const char *argv[]) +-{ +- char *princ_string; +- kadm5_principal_ent_t princ = 0; +- int tcl_ret; +- krb5_int32 mask; +- int retcode = TCL_OK; +- kadm5_ret_t ret; +- +- GET_HANDLE(2, 0); +- +- if ((tcl_ret = parse_str(interp, argv[0], &princ_string)) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing principal"); +- return tcl_ret; +- } +- +- if (princ_string && +- ((tcl_ret = parse_principal_ent(interp, princ_string, &princ)) +- != TCL_OK)) { +- return tcl_ret; +- } +- +- if ((tcl_ret = parse_principal_mask(interp, argv[1], &mask)) != TCL_OK) { +- retcode = TCL_ERROR; +- goto finished; +- } +- +- ret = kadm5_modify_principal(server_handle, princ, mask); +- +- if (ret != KADM5_OK) { +- stash_error(interp, ret); +- retcode = TCL_ERROR; +- } +- else { +- set_ok(interp, "Principal modified."); +- } +- +-finished: +- if (princ) { +- free_principal_ent(&princ); +- } +- return retcode; +-} +- +- +-static int tcl_kadm5_rename_principal(ClientData clientData, +- Tcl_Interp *interp, +- int argc, const char *argv[]) +-{ +- krb5_principal source, target; +- krb5_error_code krb5_ret; +- kadm5_ret_t ret; +- int retcode = TCL_OK; +- +- GET_HANDLE(2, 0); +- +- if ((krb5_ret = krb5_parse_name(context, argv[0], &source)) != 0) { +- stash_error(interp, krb5_ret); +- Tcl_AppendElement(interp, "while parsing source"); +- return TCL_ERROR; +- } +- +- if ((krb5_ret = krb5_parse_name(context, argv[1], &target)) != 0) { +- stash_error(interp, krb5_ret); +- Tcl_AppendElement(interp, "while parsing target"); +- krb5_free_principal(context, source); +- return TCL_ERROR; +- } +- +- ret = kadm5_rename_principal(server_handle, source, target); +- +- if (ret == KADM5_OK) { +- set_ok(interp, "Principal renamed."); +- } +- else { +- stash_error(interp, ret); +- retcode = TCL_ERROR; +- } +- +- krb5_free_principal(context, source); +- krb5_free_principal(context, target); +- return retcode; +-} +- +- +- +-static int tcl_kadm5_chpass_principal(ClientData clientData, +- Tcl_Interp *interp, +- int argc, const char *argv[]) +-{ +- krb5_principal princ; +- char *pw; +-#ifdef OVERRIDE +- int override_qual; +-#endif +- krb5_error_code krb5_ret; +- int retcode = TCL_OK; +- kadm5_ret_t ret; +- +- GET_HANDLE(2, 0); +- +- if ((krb5_ret = krb5_parse_name(context, argv[0], &princ)) != 0) { +- stash_error(interp, krb5_ret); +- Tcl_AppendElement(interp, "while parsing principal name"); +- return TCL_ERROR; +- } +- +- if (parse_str(interp, argv[1], &pw) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing password"); +- retcode = TCL_ERROR; +- goto finished; +- } +- +-#ifdef OVERRIDE +- if (Tcl_GetBoolean(interp, argv[2], &override_qual) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing override_qual"); +- retcode = TCL_ERROR; +- goto finished; +- } +- +- ret = kadm5_chpass_principal(server_handle, +- princ, pw, override_qual); +-#else +- ret = kadm5_chpass_principal(server_handle, princ, pw); +-#endif +- +- if (ret == KADM5_OK) { +- set_ok(interp, "Password changed."); +- goto finished; +- } +- else { +- stash_error(interp, ret); +- retcode = TCL_ERROR; +- } +- +-finished: +- krb5_free_principal(context, princ); +- return retcode; +-} +- +- +- +-static int tcl_kadm5_chpass_principal_util(ClientData clientData, +- Tcl_Interp *interp, +- int argc, const char *argv[]) +-{ +- krb5_principal princ; +- char *new_pw; +-#ifdef OVERRIDE +- int override_qual; +-#endif +- char *pw_ret, *pw_ret_var; +- char msg_ret[1024], *msg_ret_var; +- krb5_error_code krb5_ret; +- kadm5_ret_t ret; +- int retcode = TCL_OK; +- +- GET_HANDLE(4, 0); +- +- if ((krb5_ret = krb5_parse_name(context, argv[0], &princ)) != 0) { +- stash_error(interp, krb5_ret); +- Tcl_AppendElement(interp, "while parsing principal name"); +- return TCL_ERROR; +- } +- +- if (parse_str(interp, argv[1], &new_pw) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing new password"); +- retcode = TCL_ERROR; +- goto finished; +- } +-#ifdef OVERRIDE +- if (Tcl_GetBoolean(interp, argv[2], &override_qual) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing override_qual"); +- retcode = TCL_ERROR; +- goto finished; +- } +-#endif +- if (parse_str(interp, argv[3], &pw_ret_var) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing pw_ret variable name"); +- retcode = TCL_ERROR; +- goto finished; +- } +- +- if (parse_str(interp, argv[4], &msg_ret_var) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing msg_ret variable name"); +- retcode = TCL_ERROR; +- goto finished; +- } +- +- ret = kadm5_chpass_principal_util(server_handle, princ, new_pw, +-#ifdef OVERRIDE +- override_qual, +-#endif +- pw_ret_var ? &pw_ret : 0, +- msg_ret_var ? msg_ret : 0, +- msg_ret_var ? sizeof(msg_ret) : 0); +- +- if (ret == KADM5_OK) { +- if (pw_ret_var && +- (! Tcl_SetVar(interp, pw_ret_var, pw_ret, +- TCL_LEAVE_ERR_MSG))) { +- Tcl_AppendElement(interp, "while setting pw_ret variable"); +- retcode = TCL_ERROR; +- goto finished; +- } +- if (msg_ret_var && +- (! Tcl_SetVar(interp, msg_ret_var, msg_ret, +- TCL_LEAVE_ERR_MSG))) { +- Tcl_AppendElement(interp, +- "while setting msg_ret variable"); +- retcode = TCL_ERROR; +- goto finished; +- } +- set_ok(interp, "Password changed."); +- } +- else { +- stash_error(interp, ret); +- retcode = TCL_ERROR; +- } +- +-finished: +- krb5_free_principal(context, princ); +- return retcode; +-} +- +- +- +-static int tcl_kadm5_randkey_principal(ClientData clientData, +- Tcl_Interp *interp, +- int argc, const char *argv[]) +-{ +- krb5_principal princ; +- krb5_keyblock *keyblocks; +- int num_keys; +- char *keyblock_var, *num_var, buf[50]; +- Tcl_DString *keyblock_dstring = 0; +- krb5_error_code krb5_ret; +- kadm5_ret_t ret; +- int retcode = TCL_OK; +- +- GET_HANDLE(3, 0); +- +- if ((krb5_ret = krb5_parse_name(context, argv[0], &princ)) != 0) { +- stash_error(interp, krb5_ret); +- Tcl_AppendElement(interp, "while parsing principal name"); +- return TCL_ERROR; +- } +- +- if (parse_str(interp, argv[1], &keyblock_var) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing keyblock variable name"); +- retcode = TCL_ERROR; +- goto finished; +- } +- if (parse_str(interp, argv[2], &num_var) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing keyblock variable name"); +- retcode = TCL_ERROR; +- goto finished; +- } +- +- ret = kadm5_randkey_principal(server_handle, +- princ, keyblock_var ? &keyblocks : 0, +- &num_keys); +- +- if (ret == KADM5_OK) { +- if (keyblock_var) { +- keyblock_dstring = unparse_keyblocks(keyblocks, num_keys); +- if (! Tcl_SetVar(interp, keyblock_var, +- keyblock_dstring->string, +- TCL_LEAVE_ERR_MSG)) { +- Tcl_AppendElement(interp, +- "while setting keyblock variable"); +- retcode = TCL_ERROR; +- goto finished; +- } +- } +- if (num_var) { +- sprintf(buf, "%d", num_keys); +- if (! Tcl_SetVar(interp, num_var, buf, +- TCL_LEAVE_ERR_MSG)) { +- Tcl_AppendElement(interp, +- "while setting num_keys variable"); +- } +- } +- set_ok(interp, "Key randomized."); +- } +- else { +- stash_error(interp, ret); +- retcode = TCL_ERROR; +- } +- +-finished: +- krb5_free_principal(context, princ); +- if (keyblock_dstring) { +- Tcl_DStringFree(keyblock_dstring); +- free(keyblock_dstring); +- } +- return retcode; +-} +- +- +- +-static int tcl_kadm5_get_principal(ClientData clientData, Tcl_Interp *interp, +- int argc, const char *argv[]) +-{ +- krb5_principal princ; +- kadm5_principal_ent_rec ent; +- Tcl_DString *ent_dstring = 0; +- char *ent_var; +- char *name; +- krb5_error_code krb5_ret; +- int tcl_ret; +- kadm5_ret_t ret = -1; +- krb5_int32 mask; +- int retcode = TCL_OK; +- +- GET_HANDLE(3, 1); +- +- if((tcl_ret = parse_str(interp, argv[0], &name)) != TCL_OK) +- return tcl_ret; +- if(name != NULL) { +- if ((krb5_ret = krb5_parse_name(context, name, &princ)) != 0) { +- stash_error(interp, krb5_ret); +- Tcl_AppendElement(interp, "while parsing principal name"); +- return TCL_ERROR; +- } +- } else princ = NULL; +- +- if ((tcl_ret = parse_str(interp, argv[1], &ent_var)) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing entry variable name"); +- retcode = TCL_ERROR; +- goto finished; +- } +- if ((tcl_ret = parse_principal_mask(interp, argv[2], &mask)) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing principal mask"); +- retcode = TCL_ERROR; +- goto finished; +- } +- +- ret = kadm5_get_principal(server_handle, princ, ent_var ? &ent : 0, +- mask); +- +- if (ret == KADM5_OK) { +- if (ent_var) { +- ent_dstring = unparse_principal_ent(&ent, mask); +- if (! Tcl_SetVar(interp, ent_var, ent_dstring->string, +- TCL_LEAVE_ERR_MSG)) { +- Tcl_AppendElement(interp, +- "while setting entry variable"); +- retcode = TCL_ERROR; +- goto finished; +- } +- set_ok(interp, "Principal retrieved."); +- } +- } +- else { +- stash_error(interp, ret); +- retcode = TCL_ERROR; +- } +- +-finished: +- if (ent_dstring) { +- Tcl_DStringFree(ent_dstring); +- free(ent_dstring); +- } +- if(princ != NULL) +- krb5_free_principal(context, princ); +- if (ret == KADM5_OK && ent_var && +- (ret = kadm5_free_principal_ent(server_handle, &ent)) && +- (retcode == TCL_OK)) { +- stash_error(interp, ret); +- retcode = TCL_ERROR; +- } +- return retcode; +-} +- +-static int tcl_kadm5_create_policy(ClientData clientData, Tcl_Interp *interp, +- int argc, const char *argv[]) +-{ +- int tcl_ret; +- kadm5_ret_t ret; +- int retcode = TCL_OK; +- char *policy_string; +- kadm5_policy_ent_t policy = 0; +- krb5_int32 mask; +- +- GET_HANDLE(2, 0); +- +- if ((tcl_ret = parse_str(interp, argv[0], &policy_string)) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing policy"); +- return tcl_ret; +- } +- +- if (policy_string && +- ((tcl_ret = parse_policy_ent(interp, policy_string, &policy)) +- != TCL_OK)) { +- return tcl_ret; +- } +- +- if ((tcl_ret = parse_policy_mask(interp, argv[1], &mask)) != TCL_OK) { +- retcode = tcl_ret; +- goto finished; +- } +- +- ret = kadm5_create_policy(server_handle, policy, mask); +- +- if (ret != KADM5_OK) { +- stash_error(interp, ret); +- retcode = TCL_ERROR; +- goto finished; +- } +- else { +- set_ok(interp, "Policy created."); +- } +- +-finished: +- if (policy) { +- free_policy_ent(&policy); +- } +- return retcode; +-} +- +- +- +-static int tcl_kadm5_delete_policy(ClientData clientData, Tcl_Interp *interp, +- int argc, const char *argv[]) +-{ +- kadm5_ret_t ret; +- char *policy; +- +- GET_HANDLE(1, 0); +- +- if (parse_str(interp, argv[0], &policy) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing policy name"); +- return TCL_ERROR; +- } +- +- ret = kadm5_delete_policy(server_handle, policy); +- +- if (ret != KADM5_OK) { +- stash_error(interp, ret); +- return TCL_ERROR; +- } +- else { +- set_ok(interp, "Policy deleted."); +- return TCL_OK; +- } +-} +- +- +- +-static int tcl_kadm5_modify_policy(ClientData clientData, Tcl_Interp *interp, +- int argc, const char *argv[]) +-{ +- char *policy_string; +- kadm5_policy_ent_t policy = 0; +- int tcl_ret; +- krb5_int32 mask; +- int retcode = TCL_OK; +- kadm5_ret_t ret; +- +- GET_HANDLE(2, 0); +- +- if ((tcl_ret = parse_str(interp, argv[0], &policy_string)) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing policy"); +- return tcl_ret; +- } +- +- if (policy_string && +- ((tcl_ret = parse_policy_ent(interp, policy_string, &policy)) +- != TCL_OK)) { +- return tcl_ret; +- } +- +- if ((tcl_ret = parse_policy_mask(interp, argv[1], &mask)) != TCL_OK) { +- retcode = TCL_ERROR; +- goto finished; +- } +- +- ret = kadm5_modify_policy(server_handle, policy, mask); +- +- if (ret != KADM5_OK) { +- stash_error(interp, ret); +- retcode = TCL_ERROR; +- } +- else { +- set_ok(interp, "Policy modified."); +- } +- +-finished: +- if (policy) { +- free_policy_ent(&policy); +- } +- return retcode; +-} +- +- +-static int tcl_kadm5_get_policy(ClientData clientData, Tcl_Interp *interp, +- int argc, const char *argv[]) +-{ +- kadm5_policy_ent_rec ent; +- Tcl_DString *ent_dstring = 0; +- char *policy; +- char *ent_var; +- kadm5_ret_t ret; +- int retcode = TCL_OK; +- +- GET_HANDLE(2, 1); +- +- if (parse_str(interp, argv[0], &policy) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing policy name"); +- return TCL_ERROR; +- } +- +- if (parse_str(interp, argv[1], &ent_var) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing entry variable name"); +- return TCL_ERROR; +- } +- +- ret = kadm5_get_policy(server_handle, policy, ent_var ? &ent : 0); +- +- if (ret == KADM5_OK) { +- if (ent_var) { +- ent_dstring = unparse_policy_ent(&ent); +- if (! Tcl_SetVar(interp, ent_var, ent_dstring->string, +- TCL_LEAVE_ERR_MSG)) { +- Tcl_AppendElement(interp, +- "while setting entry variable"); +- retcode = TCL_ERROR; +- goto finished; +- } +- set_ok(interp, "Policy retrieved."); +- } +- } +- else { +- stash_error(interp, ret); +- retcode = TCL_ERROR; +- } +- +-finished: +- if (ent_dstring) { +- Tcl_DStringFree(ent_dstring); +- free(ent_dstring); +- } +- if (ent_var && ret == KADM5_OK && +- (ret = kadm5_free_policy_ent(server_handle, &ent)) && +- (retcode == TCL_OK)) { +- stash_error(interp, ret); +- retcode = TCL_ERROR; +- } +- return retcode; +-} +- +- +- +-static int tcl_kadm5_free_principal_ent(ClientData clientData, +- Tcl_Interp *interp, +- int argc, const char *argv[]) +-{ +- char *ent_name; +- kadm5_principal_ent_t ent; +- kadm5_ret_t ret; +- +- GET_HANDLE(1, 0); +- +- if (parse_str(interp, argv[0], &ent_name) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing entry name"); +- return TCL_ERROR; +- } +- +- if ((! ent_name) && +- (ret = kadm5_free_principal_ent(server_handle, 0))) { +- stash_error(interp, ret); +- return TCL_ERROR; +- } +- else { +- Tcl_HashEntry *entry; +- +- if (strncmp(ent_name, "principal", sizeof("principal")-1)) { +- Tcl_AppendResult(interp, "invalid principal handle \"", +- ent_name, "\"", 0); +- return TCL_ERROR; +- } +- if (! struct_table) { +- if (! (struct_table = malloc(sizeof(*struct_table)))) { +- fprintf(stderr, "Out of memory!\n"); +- exit(1); /* XXX */ +- } +- Tcl_InitHashTable(struct_table, TCL_STRING_KEYS); +- } +- +- if (! (entry = Tcl_FindHashEntry(struct_table, ent_name))) { +- Tcl_AppendResult(interp, "principal handle \"", ent_name, +- "\" not found", 0); +- return TCL_ERROR; +- } +- +- ent = (kadm5_principal_ent_t) Tcl_GetHashValue(entry); +- +- ret = kadm5_free_principal_ent(server_handle, ent); +- if (ret != KADM5_OK) { +- stash_error(interp, ret); +- return TCL_ERROR; +- } +- Tcl_DeleteHashEntry(entry); +- } +- set_ok(interp, "Principal freed."); +- return TCL_OK; +-} +- +- +-static int tcl_kadm5_free_policy_ent(ClientData clientData, +- Tcl_Interp *interp, +- int argc, const char *argv[]) +-{ +- char *ent_name; +- kadm5_policy_ent_t ent; +- kadm5_ret_t ret; +- +- GET_HANDLE(1, 0); +- +- if (parse_str(interp, argv[0], &ent_name) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing entry name"); +- return TCL_ERROR; +- } +- +- if ((! ent_name) && +- (ret = kadm5_free_policy_ent(server_handle, 0))) { +- stash_error(interp, ret); +- return TCL_ERROR; +- } +- else { +- Tcl_HashEntry *entry; +- +- if (strncmp(ent_name, "policy", sizeof("policy")-1)) { +- Tcl_AppendResult(interp, "invalid principal handle \"", +- ent_name, "\"", 0); +- return TCL_ERROR; +- } +- if (! struct_table) { +- if (! (struct_table = malloc(sizeof(*struct_table)))) { +- fprintf(stderr, "Out of memory!\n"); +- exit(1); /* XXX */ +- } +- Tcl_InitHashTable(struct_table, TCL_STRING_KEYS); +- } +- +- if (! (entry = Tcl_FindHashEntry(struct_table, ent_name))) { +- Tcl_AppendResult(interp, "policy handle \"", ent_name, +- "\" not found", 0); +- return TCL_ERROR; +- } +- +- ent = (kadm5_policy_ent_t) Tcl_GetHashValue(entry); +- +- if ((ret = kadm5_free_policy_ent(server_handle, ent)) != KADM5_OK) { +- stash_error(interp, ret); +- return TCL_ERROR; +- } +- Tcl_DeleteHashEntry(entry); +- } +- set_ok(interp, "Policy freed."); +- return TCL_OK; +-} +- +- +-static int tcl_kadm5_get_privs(ClientData clientData, Tcl_Interp *interp, +- int argc, const char *argv[]) +-{ +- const char *set_ret; +- kadm5_ret_t ret; +- char *priv_var; +- long privs; +- +- GET_HANDLE(1, 0); +- +- if (parse_str(interp, argv[0], &priv_var) != TCL_OK) { +- Tcl_AppendElement(interp, "while parsing privs variable name"); +- return TCL_ERROR; +- } +- +- ret = kadm5_get_privs(server_handle, priv_var ? &privs : 0); +- +- if (ret == KADM5_OK) { +- if (priv_var) { +- Tcl_DString *str = unparse_privs(privs); +- set_ret = Tcl_SetVar(interp, priv_var, str->string, +- TCL_LEAVE_ERR_MSG); +- Tcl_DStringFree(str); +- free(str); +- if (! set_ret) { +- Tcl_AppendElement(interp, "while setting priv variable"); +- return TCL_ERROR; +- } +- } +- set_ok(interp, "Privileges retrieved."); +- return TCL_OK; +- } +- else { +- stash_error(interp, ret); +- return TCL_ERROR; +- } +-} +- +- +-void Tcl_kadm5_init(Tcl_Interp *interp) +-{ +- char buf[20]; +- +- Tcl_SetVar(interp, "KADM5_ADMIN_SERVICE", +- KADM5_ADMIN_SERVICE, TCL_GLOBAL_ONLY); +- Tcl_SetVar(interp, "KADM5_CHANGEPW_SERVICE", +- KADM5_CHANGEPW_SERVICE, TCL_GLOBAL_ONLY); +- (void) sprintf(buf, "%d", KADM5_STRUCT_VERSION); +- Tcl_SetVar(interp, "KADM5_STRUCT_VERSION", buf, TCL_GLOBAL_ONLY); +- (void) sprintf(buf, "%d", KADM5_API_VERSION_2); +- Tcl_SetVar(interp, "KADM5_API_VERSION_2", buf, TCL_GLOBAL_ONLY); +- (void) sprintf(buf, "%d", KADM5_API_VERSION_3); +- Tcl_SetVar(interp, "KADM5_API_VERSION_3", buf, TCL_GLOBAL_ONLY); +- (void) sprintf(buf, "%d", KADM5_API_VERSION_4); +- Tcl_SetVar(interp, "KADM5_API_VERSION_4", buf, TCL_GLOBAL_ONLY); +- (void) sprintf(buf, "%d", KADM5_API_VERSION_MASK); +- Tcl_SetVar(interp, "KADM5_API_VERSION_MASK", buf, TCL_GLOBAL_ONLY); +- (void) sprintf(buf, "%d", KADM5_STRUCT_VERSION_MASK); +- Tcl_SetVar(interp, "KADM5_STRUCT_VERSION_MASK", buf, +- TCL_GLOBAL_ONLY); +- +- Tcl_CreateCommand(interp, "kadm5_init", tcl_kadm5_init, 0, 0); +- Tcl_CreateCommand(interp, "kadm5_init_with_creds", +- tcl_kadm5_init_with_creds, 0, 0); +- Tcl_CreateCommand(interp, "kadm5_destroy", tcl_kadm5_destroy, 0, +- 0); +- Tcl_CreateCommand(interp, "kadm5_create_principal", +- tcl_kadm5_create_principal, 0, 0); +- Tcl_CreateCommand(interp, "kadm5_delete_principal", +- tcl_kadm5_delete_principal, 0, 0); +- Tcl_CreateCommand(interp, "kadm5_modify_principal", +- tcl_kadm5_modify_principal, 0, 0); +- Tcl_CreateCommand(interp, "kadm5_rename_principal", +- tcl_kadm5_rename_principal, 0, 0); +- Tcl_CreateCommand(interp, "kadm5_chpass_principal", +- tcl_kadm5_chpass_principal, 0, 0); +- Tcl_CreateCommand(interp, "kadm5_chpass_principal_util", +- tcl_kadm5_chpass_principal_util, 0, 0); +- Tcl_CreateCommand(interp, "kadm5_randkey_principal", +- tcl_kadm5_randkey_principal, 0, 0); +- Tcl_CreateCommand(interp, "kadm5_get_principal", +- tcl_kadm5_get_principal, 0, 0); +- Tcl_CreateCommand(interp, "kadm5_create_policy", +- tcl_kadm5_create_policy, 0, 0); +- Tcl_CreateCommand(interp, "kadm5_delete_policy", +- tcl_kadm5_delete_policy, 0, 0); +- Tcl_CreateCommand(interp, "kadm5_modify_policy", +- tcl_kadm5_modify_policy, 0, 0); +- Tcl_CreateCommand(interp, "kadm5_get_policy", +- tcl_kadm5_get_policy, 0, 0); +- Tcl_CreateCommand(interp, "kadm5_free_principal_ent", +- tcl_kadm5_free_principal_ent, 0, 0); +- Tcl_CreateCommand(interp, "kadm5_free_policy_ent", +- tcl_kadm5_free_policy_ent, 0, 0); +- Tcl_CreateCommand(interp, "kadm5_get_privs", +- tcl_kadm5_get_privs, 0, 0); +-} +diff --git a/src/kadmin/testing/util/tcl_kadm5.h b/src/kadmin/testing/util/tcl_kadm5.h +deleted file mode 100644 +index 1f91a11a1..000000000 +--- a/src/kadmin/testing/util/tcl_kadm5.h ++++ /dev/null +@@ -1,3 +0,0 @@ +-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ +- +-void Tcl_kadm5_init(Tcl_Interp *interp); +diff --git a/src/kadmin/testing/util/tcl_kadm5_syntax b/src/kadmin/testing/util/tcl_kadm5_syntax +deleted file mode 100644 +index 5f16e58e0..000000000 +--- a/src/kadmin/testing/util/tcl_kadm5_syntax ++++ /dev/null +@@ -1,57 +0,0 @@ +-Here's a brief summary of the syntax of the tcl versions of the +-kadm5 functions: +- +-string Can be a string or "null" which will turn into a null pointer +-principal_ent A 12-field list in the order of the principal_ent +- structure: {string number number number number string +- number mask number number string mask} +- It can also be "null", like a string, to indicate that +- a null structure pointer should be used. +-mask Either a number, representing the actual value of the +- mask, or a sequence of symbols in a list. Example: +- {PRINCIPAL ATTRIBUTES} is a valid principal mask. +-boolean "1", "0", "true", "false", etc. +-varname The name of a Tcl variable, or "null" to not assign. +-policy_ent Similar to principal_ent, but with seven fields, +- instead of 12. The first is a string, and the rest +- are numbers. +- +-init +- client_name:string pass:string service_name:string +- realm:string struct_version:int api_version:int +- server_handle_ret:varname +-destroy +- server_handle:string +-create_principal +- server_handle:string principal:principal_ent +- mask:principal_mask password:string +-delete_principal +- server_handle:string name:string +-modify_principal +- server_handle:string principal_principal_ent +- mask:principal_mask +-rename_principal +- server_handle:string source:string target:string +-chpass_principal +- server_handle:string name:string password:string +-chpass_principal_util +- server_handle:string name:string password:string +- pw_ret:varname msg_ret:varname +-randkey_principal +- server_handle:string name:string keyblock_var:varname +-get_principal [-struct] +- server_handle:string name:string princ_var:varname +-create_policy +- server_handle:string policy:policy_ent mask:policy_mask +-delete_policy +- server_handle:string name:string +-modify_policy +- server_handle:string policy:policy_ent mask:policy_mask +-get_policy [-struct] +- server_handle:string name:string policy_var:varname +-free_principal_ent +- server_handle:string handle:string +-free_policy_ent +- server_handle:string handle:string +-get_privs +- server_handle:string privs:priv_var +diff --git a/src/kadmin/testing/util/tcl_krb5_hash.c b/src/kadmin/testing/util/tcl_krb5_hash.c +deleted file mode 100644 +index 35c6bb0b3..000000000 +--- a/src/kadmin/testing/util/tcl_krb5_hash.c ++++ /dev/null +@@ -1,167 +0,0 @@ +-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ +-/* +- * All of the TCL krb5 functions which return (or place into output +- * variables) structures or pointers to structures that can't be +- * represented as tcl native types, do so by returning a handle for +- * the appropriate structure. The handle is a string of the form +- * "type$id", where "type" is the type of datum represented by the +- * handle and "id" is a unique identifier for it. This handle can +- * then be used later by the caller to refer to the object, and +- * internally to retrieve the actually datum from the appropriate hash +- * table. +- * +- * The functions in this file do four things: +- * +- * 1) Given a pointer to a datum and a string representing the type of +- * datum to which the pointer refers, create a new handle for the +- * datum, store the datum in the hash table using the new handle as +- * its key, and return the new handle. +- * +- * 2) Given a handle, locate and return the appropriate hash table +- * datum. +- * +- * 3) Given a handle, look through a table of types and unparse +- * functions to figure out what function to call to get a string +- * representation of the datum, call it with the appropriate pointer +- * (obtained from the hash table) as an argument, and return the +- * resulting string as the unparsed form of the datum. +- * +- * 4) Given a handle, remove that handle and its associated datum from +- * the hash table (but don't free it -- it's assumed to have already +- * been freed by the caller). +- */ +- +-#if HAVE_TCL_H +-#include +-#elif HAVE_TCL_TCL_H +-#include +-#endif +-#include +- +-#define SEP_STR "$" +- +-static char *memory_error = "out of memory"; +- +-/* +- * Right now, we're only using one hash table. However, at some point +- * in the future, we might decide to use a separate hash table for +- * every type. Therefore, I'm putting this function in as an +- * abstraction so it's the only thing we'll have to change if we +- * decide to do that. +- * +- * Also, this function allows us to put in just one place the code for +- * checking to make sure that the hash table exists and initializing +- * it if it doesn't. +- */ +- +-static TclHashTable *get_hash_table(Tcl_Interp *interp, +- char *type) +-{ +- static Tcl_HashTable *hash_table = 0; +- +- if (! hash_table) { +- if (! (hash_table = malloc(sizeof(*hash_table)))) { +- Tcl_SetResult(interp, memory_error, TCL_STATIC); +- return 0; +- } +- Tcl_InitHashTable(hash_table, TCL_STRING_KEYS); +- } +- return hash_table; +-} +- +-#define MAX_ID 999999999 +-#define ID_BUF_SIZE 10 +- +-static Tcl_HashEntry *get_new_handle(Tcl_Interp *interp, +- char *type) +-{ +- static unsigned long int id_counter = 0; +- Tcl_DString *handle; +- char int_buf[ID_BUF_SIZE]; +- +- if (! (handle = malloc(sizeof(*handle)))) { +- Tcl_SetResult(interp, memory_error, TCL_STATIC); +- return 0; +- } +- Tcl_DStringInit(handle); +- +- assert(id_counter <= MAX_ID); +- +- sprintf(int_buf, "%d", id_counter++); +- +- Tcl_DStringAppend(handle, type, -1); +- Tcl_DStringAppend(handle, SEP_STR, -1); +- Tcl_DStringAppend(handle, int_buf, -1); +- +- return handle; +-} +- +- +-Tcl_DString *tcl_krb5_create_object(Tcl_Interp *interp, +- char *type, +- ClientData datum) +-{ +- Tcl_HashTable *table; +- Tcl_DString *handle; +- Tcl_HashEntry *entry; +- int entry_created = 0; +- +- if (! (table = get_hash_table(interp, type))) { +- return 0; +- } +- +- if (! (handle = get_new_handle(interp, type))) { +- return 0; +- } +- +- if (! (entry = Tcl_CreateHashEntry(table, handle, &entry_created))) { +- Tcl_SetResult(interp, "error creating hash entry", TCL_STATIC); +- Tcl_DStringFree(handle); +- return TCL_ERROR; +- } +- +- assert(entry_created); +- +- Tcl_SetHashValue(entry, datum); +- +- return handle; +-} +- +-ClientData tcl_krb5_get_object(Tcl_Interp *interp, +- char *handle) +-{ +- char *myhandle, *id_ptr; +- Tcl_HashTable *table; +- Tcl_HashEntry *entry; +- +- if (! (myhandle = strdup(handle))) { +- Tcl_SetResult(interp, memory_error, TCL_STATIC); +- return 0; +- } +- +- if (! (id_ptr = index(myhandle, *SEP_STR))) { +- free(myhandle); +- Tcl_ResetResult(interp); +- Tcl_AppendResult(interp, "malformatted handle \"", handle, +- "\"", 0); +- return 0; +- } +- +- *id_ptr = '\0'; +- +- if (! (table = get_hash_table(interp, myhandle))) { +- free(myhandle); +- return 0; +- } +- +- free(myhandle); +- +- if (! (entry = Tcl_FindHashEntry(table, handle))) { +- Tcl_ResetResult(interp); +- Tcl_AppendResult(interp, "no object corresponding to handle \"", +- handle, "\"", 0); +- return 0; +- } +- +- return(Tcl_GetHashValue(entry)); +-} +diff --git a/src/kadmin/testing/util/test.c b/src/kadmin/testing/util/test.c +deleted file mode 100644 +index 37e49d680..000000000 +--- a/src/kadmin/testing/util/test.c ++++ /dev/null +@@ -1,38 +0,0 @@ +-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ +-#include "autoconf.h" +-#if HAVE_TCL_H +-#include +-#elif HAVE_TCL_TCL_H +-#include +-#endif +-#include "tcl_kadm5.h" +- +-#define _TCL_MAIN ((TCL_MAJOR_VERSION * 100 + TCL_MINOR_VERSION) >= 704) +- +-#if _TCL_MAIN +-int +-main(argc, argv) +- int argc; /* Number of command-line arguments. */ +- char **argv; /* Values of command-line arguments. */ +-{ +- Tcl_Main(argc, argv, Tcl_AppInit); +- return 0; /* Needed only to prevent compiler warning. */ +-} +-#else +-/* +- * The following variable is a special hack that allows applications +- * to be linked using the procedure "main" from the Tcl library. The +- * variable generates a reference to "main", which causes main to +- * be brought in from the library (and all of Tcl with it). +- */ +- +-extern int main(); +-int *tclDummyMainPtr = (int *) main; +-#endif +- +-int Tcl_AppInit(Tcl_Interp *interp) +-{ +- Tcl_kadm5_init(interp); +- +- return(TCL_OK); +-} +diff --git a/src/lib/kadm5/Makefile.in b/src/lib/kadm5/Makefile.in +index f94c0a7da..3ff71c42b 100644 +--- a/src/lib/kadm5/Makefile.in ++++ b/src/lib/kadm5/Makefile.in +@@ -1,6 +1,6 @@ + mydir=lib$(S)kadm5 + BUILDTOP=$(REL)..$(S).. +-SUBDIRS = clnt srv unit-test ++SUBDIRS = clnt srv + + ##DOSBUILDTOP = ..\.. + +@@ -98,6 +98,7 @@ generate-files-mac-prerecurse: includes + check-windows: + + clean-unix:: clean-libobjs ++ $(RM) t_kadm5clnt t_kadm5srv t_kadm5.o + + clean-windows:: + +diff --git a/src/lib/kadm5/unit-test/Makefile.in b/src/lib/kadm5/unit-test/Makefile.in +deleted file mode 100644 +index 68fa097ff..000000000 +--- a/src/lib/kadm5/unit-test/Makefile.in ++++ /dev/null +@@ -1,143 +0,0 @@ +-mydir=lib$(S)kadm5$(S)unit-test +-BUILDTOP=$(REL)..$(S)..$(S).. +-KDB_DEP_LIB=$(DL_LIB) $(THREAD_LINKOPTS) +- +-SRCS= init-test.c destroy-test.c handle-test.c iter-test.c setkey-test.c \ +- randkey-test.c lock-test.c +- +-# +-# The client-side test programs. +-# +- +-init-test: init-test.o $(KADMCLNT_DEPLIBS) $(KRB5_BASE_DEPLIBS) +- $(CC_LINK) -o init-test init-test.o \ +- $(KADMCLNT_LIBS) $(KRB5_BASE_LIBS) +- +-destroy-test: destroy-test.o $(KADMCLNT_DEPLIBS) $(KRB5_BASE_DEPLIBS) +- $(CC_LINK) -o destroy-test destroy-test.o \ +- $(KADMCLNT_LIBS) $(KRB5_BASE_LIBS) +- +-client-handle-test: client-handle-test.o $(KADMCLNT_DEPLIBS) $(KRB5_BASE_DEPLIBS) +- $(CC_LINK) -o client-handle-test client-handle-test.o \ +- $(KADMCLNT_LIBS) $(KRB5_BASE_LIBS) +- +-client-handle-test.o: handle-test.c +- $(CC) $(ALL_CFLAGS) -DCLIENT_TEST -o client-handle-test.o -c $(srcdir)/handle-test.c +- +-client-iter-test: iter-test.o $(KADMLCNT_DEPLIBS) $(KRB5_BASE_DEPLIBS) +- $(CC_LINK) -o client-iter-test iter-test.o \ +- $(KADMCLNT_LIBS) $(KRB5_BASE_LIBS) +- +-client-setkey-test: setkey-test.o $(KADMCLNT_DEPLIBS) $(KRB5_BASE_DEPLIBS) +- $(CC_LINK) -o client-setkey-test setkey-test.o \ +- $(KADMCLNT_LIBS) $(KRB5_BASE_LIBS) +- +-# +-# The server-side test programs. +-# +- +-randkey-test: randkey-test.o $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS) +- $(CC_LINK) -o randkey-test randkey-test.o \ +- $(KADMSRV_LIBS) $(KDB_DEP_LIB) $(KRB5_BASE_LIBS) +- +-server-handle-test: handle-test.o $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS) +- $(CC_LINK) -o server-handle-test handle-test.o \ +- $(KADMSRV_LIBS) $(KDB_DEP_LIB) $(KRB5_BASE_LIBS) +- +-lock-test: lock-test.o $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS) +- $(CC_LINK) -o lock-test lock-test.o \ +- $(KADMSRV_LIBS) $(KDB_DEP_LIB) $(KRB5_BASE_LIBS) +- +-server-iter-test: iter-test.o $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS) +- $(CC_LINK) -o server-iter-test iter-test.o \ +- $(KADMSRV_LIBS) $(KDB_DEP_LIB) $(KRB5_BASE_LIBS) +- +-server-setkey-test: setkey-test.o $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS) +- $(CC_LINK) -o server-setkey-test setkey-test.o \ +- $(KADMSRV_LIBS) $(KDB_DEP_LIB) $(KRB5_BASE_LIBS) +- +-runenv.exp: Makefile +- $(RUN_SETUP); for i in $(RUN_VARS); do \ +- eval echo "set env\($$i\) \$$$$i"; done > runenv.exp +- +-# +-# The unit-test targets +-# +- +-check: check-@DO_TEST@ +- +-check-: +- @echo "+++" +- @echo "+++ WARNING: lib/kadm5 unit tests not run." +- @echo "+++ Either tcl, runtest, or Perl is unavailable." +- @echo "+++" +- +-check-ok unit-test: unit-test-client unit-test-server +- +-unit-test-client: unit-test-client-setup unit-test-client-body \ +- unit-test-client-cleanup +- +-unit-test-server: unit-test-server-setup unit-test-server-body \ +- unit-test-server-cleanup +- +-test-randkey: randkey-test +- $(ENV_SETUP) $(VALGRIND) ./randkey-test +- +-test-handle-server: server-handle-test +- $(ENV_SETUP) $(VALGRIND) ./server-handle-test +- +-test-handle-client: client-handle-test +- $(ENV_SETUP) $(VALGRIND) ./client-handle-test +- +-test-noauth: init-test +- $(ENV_SETUP) $(VALGRIND) ./init-test +- +-test-destroy: destroy-test +- $(ENV_SETUP) $(VALGRIND) ./destroy-test +- +-test-setkey-client: client-setkey-test +- $(ENV_SETUP) $(VALGRIND) ./client-setkey-test testkeys admin admin +- +-unit-test-client-setup: runenv.sh +- $(ENV_SETUP) $(VALGRIND) $(START_SERVERS) +- +-unit-test-client-cleanup: +- $(ENV_SETUP) $(STOP_SERVERS) +- +-unit-test-server-setup: runenv.sh +- $(ENV_SETUP) $(VALGRIND) $(START_SERVERS_LOCAL) +- +-unit-test-server-cleanup: +- $(ENV_SETUP) $(STOP_SERVERS_LOCAL) +- +-unit-test-client-body: site.exp test-noauth test-destroy test-handle-client \ +- test-setkey-client runenv.exp +- $(ENV_SETUP) $(RUNTEST) --tool api RPC=1 API=$(CLNTTCL) \ +- KINIT=$(BUILDTOP)/clients/kinit/kinit \ +- KDESTROY=$(BUILDTOP)/clients/kdestroy/kdestroy \ +- KADMIN_LOCAL=$(BUILDTOP)/kadmin/cli/kadmin.local \ +- PRIOCNTL_HACK=@PRIOCNTL_HACK@ VALGRIND="$(VALGRIND)" \ +- $(RUNTESTFLAGS) +- -mv api.log capi.log +- -mv api.sum capi.sum +- +-unit-test-server-body: site.exp test-handle-server lock-test +- $(ENV_SETUP) $(RUNTEST) --tool api RPC=0 API=$(SRVTCL) \ +- LOCKTEST=./lock-test \ +- KADMIN_LOCAL=$(BUILDTOP)/kadmin/cli/kadmin.local \ +- PRIOCNTL_HACK=@PRIOCNTL_HACK@ VALGRIND="$(VALGRIND)" \ +- $(RUNTESTFLAGS) +- -mv api.log sapi.log +- -mv api.sum sapi.sum +- +-clean: +- $(RM) init-test client_init.o init-test.o +- $(RM) destroy-test destroy-test.o +- $(RM) client-handle-test handle-test.o client-handle-test.o +- $(RM) client-iter-test iter-test.o +- $(RM) randkey-test randkey-test.o +- $(RM) server-handle-test handle-test.o +- $(RM) lock-test lock-test.o +- $(RM) server-iter-test iter-test.o +- $(RM) server-setkey-test client-setkey-test setkey-test.o +- $(RM) *.log *.plog *.sum *.psum unit-test-log.* runenv.exp +diff --git a/src/lib/kadm5/unit-test/api.2/crte-policy.exp b/src/lib/kadm5/unit-test/api.2/crte-policy.exp +deleted file mode 100644 +index 4902ea59f..000000000 +--- a/src/lib/kadm5/unit-test/api.2/crte-policy.exp ++++ /dev/null +@@ -1,927 +0,0 @@ +-load_lib lib.t +-api_exit +-api_start +- +-# Description: (1) Fails for mask with undefined bit set. +-# 01/24/94: pshuang: untried. +-test "create-policy 1" +-proc test1 {} { +- global test +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete policy \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- 0xF01000 +- } $test] "BAD_MASK" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test1 +- +-# Description: (2) Fails if caller connected with CHANGEPW_SERVICE. +-test "create-policy 2" +-proc test2 {} { +- global test +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY} +- } $test] "AUTH_ADD" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy"; +- return +- } +-} +-if {$RPC} { test2 } +- +-# Description: (3) Fails for mask without POLICY bit set. +-# 01/24/94: pshuang: untried. +-test "create-policy 3" +-proc test3 {} { +- global test +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete policy \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- 0x000000 +- } $test] "BAD_MASK" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test3 +- +-# Description: (5) Fails for invalid policy name. +-# 01/24/94: pshuang: untried. +-test "create-policy 5" +-proc test5 {} { +- global test +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/"] \ +- {KADM5_POLICY} +- } $test] "BAD_POLICY" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test5 +- +-# Description: (6) Fails for existing policy name. +-test "create-policy 6" +-proc test6 {} { +- global test +-# set prms_id 777 +-# setup_xfail {*-*-*} $prms_id +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test { +- kadm5_create_policy $server_handle [simple_policy test-pol] \ +- {KADM5_POLICY} +- } "DUP" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test6 +- +-# Description: (7) Fails for null policy name. +-# 01/24/94: pshuang: untried. +-test "create-policy 7" +-proc test7 {} { +- global test +-# set prms_id 1977 +-# setup_xfail {*-*-*} $prms_id +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test { +- kadm5_create_policy $server_handle [simple_policy null] \ +- {KADM5_POLICY} +- } "EINVAL" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test7 +- +-# Description: (8) Fails for empty-string policy name. +-test "create-policy 8" +-proc test8 {} { +- global test +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test { +- kadm5_create_policy $server_handle [simple_policy ""] \ +- {KADM5_POLICY} +- } "BAD_POLICY" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test8 +- +-# Description: (9) Accepts 0 for pw_min_life. +-test "create-policy 9" +-proc test9 {} { +- global test +- global prompt +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if { ! [cmd [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY KADM5_PW_MIN_LIFE} +- } $test]]} { +- fail "$test: create failed" +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retrieve policy" +- return +- } +- send "lindex \$policy 1\n" +- expect { +- -re "0\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test9 +- +-# Description: (10) Accepts non-zero for pw_min_life. +-test "create-policy 10" +-proc test10 {} { +- global test +- global prompt +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if { ! [cmd [format { +- kadm5_create_policy $server_handle {"%s/a" 32 0 0 0 0 0 } \ +- {KADM5_POLICY KADM5_PW_MIN_LIFE} +- } $test]]} { +- fail "$test" +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retreuve policy" +- return +- } +- send "lindex \$policy 1\n" +- expect { +- -re "32\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test10 +- +-# Description: (11) Accepts 0 for pw_max_life. +-test "create-policy 11" +-proc test11 {} { +- global test +- global prompt +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY KADM5_PW_MAX_LIFE} +- } $test]]} { +- fail "$test" +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retreuve policy" +- return +- } +- send "lindex \$policy 2\n" +- expect { +- -re "0\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test11 +- +-# Description: (12) Accepts non-zero for pw_max_life. +-test "create-policy 12" +-proc test12 {} { +- global test +- global prompt +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_policy $server_handle {"%s/a" 0 32 0 0 0 0 } \ +- {KADM5_POLICY KADM5_PW_MAX_LIFE} +- } $test]]} { +- fail "$test" +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retreuve policy" +- return +- } +- send "lindex \$policy 2\n" +- expect { +- -re "32\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test12 +- +-# Description: (13) Rejects 0 for pw_min_length. +-test "create-policy 13" +-proc test13 {} { +- global test +- global prompt +- +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY KADM5_PW_MIN_LENGTH} +- } $test] "BAD_LENGTH" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test13 +- +-# Description: (14) Accepts non-zero for pw_min_length. +-test "create-policy 14" +-proc test14 {} { +- global test +- global prompt +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_policy $server_handle {"%s/a" 0 0 8 0 0 0 } \ +- {KADM5_POLICY KADM5_PW_MIN_LENGTH} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retreuve policy" +- return +- } +- send "lindex \$policy 3\n" +- expect { +- -re "8\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test14 +- +-# Description: (15) Rejects 0 for pw_min_classes. +-test "create-policy 15" +-proc test15 {} { +- global test +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY KADM5_PW_MIN_CLASSES} +- } $test] "BAD_CLASS" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test15 +- +-# Description: (16) Accepts 1 for pw_min_classes. +-test "create-policy 16" +-proc test16 {} { +- global test +- global prompt +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_policy $server_handle {"%s/a" 0 0 0 1 0 0 } \ +- {KADM5_POLICY KADM5_PW_MIN_CLASSES} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retreuve policy" +- return +- } +- send "lindex \$policy 4\n" +- expect { +- -re "1\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test16 +- +-# Description: (17) Accepts 4 for pw_min_classes. +-test "create-policy 17" +-proc test17 {} { +- global test +- global prompt +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_policy $server_handle {"%s/a" 0 0 0 5 0 0} \ +- {KADM5_POLICY KADM5_PW_MIN_CLASSES} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retreuve policy" +- return +- } +- send "lindex \$policy 4\n" +- expect { +- -re "5\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test17 +- +-# Description: (18) Rejects 5 for pw_min_classes. +-test "create-policy 18" +-proc test18 {} { +- global test +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle {"%s/a" 0 0 0 6 0 0} \ +- {KADM5_POLICY KADM5_PW_MIN_CLASSES} +- } $test] "BAD_CLASS" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test18 +- +-# Description: (19) Rejects 0 for pw_history_num. +-test "create-policy 19" +-proc test19 {} { +- global test +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY KADM5_PW_HISTORY_NUM} +- } $test] "BAD_HISTORY" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test19 +- +-# Description: (20) Accepts 1 for pw_history_num. +-test "create-policy 20" +-proc test20 {} { +- global test +- global prompt +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_policy $server_handle {"%s/a" 0 0 0 0 1 0} \ +- {KADM5_POLICY KADM5_PW_HISTORY_NUM} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retreuve policy" +- return +- } +- send "lindex \$policy 5\n" +- expect { +- -re "1\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test20 +- +-# Description: (21) Accepts 10 for pw_history_num. +-test "create-policy 21" +-proc test21 {} { +- global test +- global prompt +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_policy $server_handle {"%s/a" 0 0 0 0 10 0} \ +- {KADM5_POLICY KADM5_PW_HISTORY_NUM} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retrieve policy" +- return +- } +- send "lindex \$policy 5\n" +- expect { +- -re "10\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test21 +- +-# Description: (22) Fails for user with no access bits. +-test "create-policy 22" +-proc test22 {} { +- global test +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY} +- } $test] "AUTH_ADD" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} test22 +- +-# Description: (23) Fails for user with "get" but not "add". +-test "create-policy 23" +-proc test23 {} { +- global test +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY} +- } $test] "AUTH_ADD" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} test23 +- +-# Description: (24) Fails for user with "modify" but not "add". +-# 01/24/94: pshuang: untried. +-test "create-policy 24" +-proc test24 {} { +- global test +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY} +- } $test] "AUTH_ADD" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} test24 +- +-# Description: (25) Fails for user with "delete" but not "add". +-# 01/24/94: pshuang: untried. +-test "create-policy 25" +-proc test25 {} { +- global test +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY} +- } $test] "AUTH_ADD" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} test25 +- +-# Description: Succeeds for user with "add". +-test "create-policy 26" +-proc test26 {} { +- global test +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY} +- } $test] +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test26 +- +-# Description: Succeeds for user with "get" and "add". +-# 01/24/94: pshuang: untried. +-test "create-policy 27" +-proc test27 {} { +- global test +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/get-add admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY} +- } $test] +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test27 +- +-# Description: (28) Rejects null policy argument. +-# 01/24/94: pshuang: untried. +-test "create-policy 28" +-proc test28 {} { +- global test +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test { +- kadm5_create_policy $server_handle null {KADM5_POLICY} +- } "EINVAL" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test28 +- +-test "create-policy 30" +-proc test30 {} { +- global test +- one_line_fail_test [format { +- kadm5_create_policy null [simple_policy "%s/a"] \ +- {KADM5_POLICY} +- } $test] "BAD_SERVER_HANDLE" +-} +-test30 +- +-return "" +diff --git a/src/lib/kadm5/unit-test/api.2/get-policy.exp b/src/lib/kadm5/unit-test/api.2/get-policy.exp +deleted file mode 100644 +index 83aef80e8..000000000 +--- a/src/lib/kadm5/unit-test/api.2/get-policy.exp ++++ /dev/null +@@ -1,199 +0,0 @@ +-load_lib lib.t +-api_exit +-api_start +- +-test "get-policy 3" +-proc test3 {} { +- global test +-# set prms_id 744 +-# setup_xfail {*-*-*} $prms_id +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test {kadm5_get_policy $server_handle "" p} "BAD_POLICY" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test3 +- +-test "get-policy 6" +-proc test6 {} { +- global test +- +- if {! [cmd { +- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \ +- "AUTH_GET" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if { $RPC } test6 +- +-test "get-policy 7" +-proc test7 {} { +- global test +- +- if {! [cmd { +- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \ +- "AUTH_GET" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if { $RPC } test7 +- +-test "get-policy 11" +-proc test11 {} { +- global test +- +- if {! [cmd { +- kadm5_init admin/get-pol StupidAdmin $KADM5_ADMIN_SERVICE \ +- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test {kadm5_get_policy $server_handle test-pol p} +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test11 +- +-test "get-policy 12" +-proc test12 {} { +- global test +- +- if {! [cmd { +- kadm5_init admin/get-pol StupidAdmin \ +- $KADM5_CHANGEPW_SERVICE null $KADM5_STRUCT_VERSION \ +- $KADM5_API_VERSION_2 server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test \ +- {kadm5_get_policy $server_handle test-pol-nopw p} +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test12 +- +-test "get-policy 15" +-proc test15 {} { +- global test +- +- if {! [cmd { +- kadm5_init admin/pol StupidAdmin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test \ +- {kadm5_get_policy $server_handle test-pol-nopw p} +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test15 +- +-test "get-policy 16" +-proc test16 {} { +- global test +- +- if {! [cmd { +- kadm5_init admin/pol StupidAdmin $KADM5_CHANGEPW_SERVICE \ +- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test \ +- {kadm5_get_policy $server_handle test-pol-nopw p} +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test16 +- +-test "get-policy 17" +-proc test17 {} { +- global test +- +- if {! [cmd { +- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test {kadm5_get_policy $server_handle test-pol p} +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test17 +- +-test "get-policy 18" +-proc test18 {} { +- global test +- +- if {! [cmd { +- kadm5_init admin/get admin $KADM5_CHANGEPW_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \ +- "AUTH_GET" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if { $RPC } test18 +- +-test "get-policy 21" +-proc test21 {} { +- global test +- +- one_line_fail_test {kadm5_get_policy null "pol1" p} "BAD_SERVER_HANDLE" +-} +-test21 +diff --git a/src/lib/kadm5/unit-test/api.2/mod-policy.exp b/src/lib/kadm5/unit-test/api.2/mod-policy.exp +deleted file mode 100644 +index 904edca8a..000000000 +--- a/src/lib/kadm5/unit-test/api.2/mod-policy.exp ++++ /dev/null +@@ -1,675 +0,0 @@ +-load_lib lib.t +-api_exit +-api_start +- +-test "modify-policy 2" +-proc test2 {} { +- global test +- +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_PW_MAX_LIFE} +- } $test] "AUTH_MODIFY" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} { test2 } +- +-test "modify-policy 8" +-proc test8 {} { +- global test +-# set prms_id 744 +-# setup_xfail {*-*-*} $prms_id +- +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test { +- kadm5_modify_policy $server_handle [simple_policy ""] \ +- {KADM5_PW_MAX_LIFE} +- } "BAD_POLICY" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test8 +- +-test "modify-policy 9" +-proc test9 {} { +- global test +- global prompt +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_PW_MIN_LIFE} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retrieve policy" +- return +- } +- send "lindex \$policy 1\n" +- expect { +- -re "0\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test9 +- +-test "modify-policy 10" +-proc test10 {} { +- global test +- global prompt +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_policy $server_handle {"%s/a" 32 0 0 0 0 0} \ +- {KADM5_PW_MIN_LIFE} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retrieve policy" +- return +- } +- send "lindex \$policy 1\n" +- expect { +- -re "32\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test10 +- +- +-test "modify-policy 11" +-proc test11 {} { +- global test +- global prompt +- +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_PW_MAX_LIFE} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retrieve policy" +- return +- } +- send "lindex \$policy 2\n" +- expect { +- -re "0\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test11 +- +-test "modify-policy 12" +-proc test12 {} { +- global test +- global prompt +- +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_policy $server_handle {"%s/a" 0 32 0 0 0 0} \ +- {KADM5_PW_MAX_LIFE} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retrieve policy" +- return +- } +- send "lindex \$policy 2\n" +- expect { +- -re "32\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test12 +- +-test "modify-policy 13" +-proc test13 {} { +- global test +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_PW_MIN_LENGTH} +- } $test] "BAD_LENGTH" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test13 +- +-test "modify-policy 14" +-proc test14 {} { +- global test +- global prompt +- +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_policy $server_handle {"%s/a" 0 0 8 0 0 0} \ +- {KADM5_PW_MIN_LENGTH} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retrieve policy" +- return +- } +- send "lindex \$policy 3\n" +- expect { +- -re "8\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test14 +- +-test "modify-policy 15" +-proc test15 {} { +- global test +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_PW_MIN_CLASSES} +- } $test] "BAD_CLASS" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test15 +- +-test "modify-policy 16" +-proc test16 {} { +- global test +- global prompt +- +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 1 0 0} \ +- {KADM5_PW_MIN_CLASSES} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retrieve policy" +- return +- } +- send "lindex \$policy 4\n" +- expect { +- -re "1\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test16 +- +-test "modify-policy 17" +-proc test17 {} { +- global test +- global prompt +- +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 5 0 0} \ +- {KADM5_PW_MIN_CLASSES} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retrieve policy" +- return +- } +- send "lindex \$policy 4\n" +- expect { +- -re "5\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test17 +- +-test "modify-policy 18" +-proc test18 {} { +- global test +- global prompt +- +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a" ])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 6 0 0} \ +- {KADM5_PW_MIN_CLASSES} +- } $test] "BAD_CLASS" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test18 +- +-test "modify-policy 19" +-proc test19 {} { +- global test +- +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a" ])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_PW_HISTORY_NUM} +- } $test] "BAD_HISTORY" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test19 +- +-test "modify-policy 20" +-proc test20 {} { +- global test +- global prompt +- +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a" ])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 0 1 0} \ +- {KADM5_PW_HISTORY_NUM} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retrieve policy" +- return +- } +- send "lindex \$policy 5\n" +- expect { +- -re "1\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test20 +- +-test "modify-policy 21" +-proc test21 {} { +- global test +- global prompt +- +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a" ])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 0 10 0} \ +- {KADM5_PW_HISTORY_NUM} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retrieve policy" +- return +- } +- send "lindex \$policy 5\n" +- expect { +- -re "10\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test21 +- +-test "modify-policy 22" +-proc test22 {} { +- global test +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a" ])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_PW_MAX_LIFE} +- } $test] "AUTH_MODIFY" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} test22 +- +-test "modify-policy 23" +-proc test23 {} { +- global test +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a" ])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_PW_MAX_LIFE} +- } $test] "AUTH_MODIFY" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} test23 +- +-test "modify-policy 26" +-proc test26 {} { +- global test +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a" ])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test [format { +- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_PW_MAX_LIFE} +- } $test] +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test26 +- +-test "modify-policy 30" +-proc test30 {} { +- global test +- +- one_line_fail_test [format { +- kadm5_modify_policy null [simple_policy "%s/a"] \ +- {KADM5_PW_MAX_LIFE} +- } $test] "BAD_SERVER_HANDLE" +-} +-test30 +- +-return "" +diff --git a/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp +deleted file mode 100644 +index 740425c69..000000000 +--- a/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp ++++ /dev/null +@@ -1,68 +0,0 @@ +-load_lib lib.t +-api_exit +-api_start +- +-test "chpass-principal 200" +-proc test200 {} { +- global test prompt +- +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [create_principal "$test/a"]} { +- error_and_restart "$test: creating principal" +- return +- } +- +- # I'd like to specify a long list of keysalt tuples and make sure +- # that chpass does the right thing, but we can only use those +- # enctypes that krbtgt has a key for: the AES enctypes, according to +- # the prototype kdc.conf. +- if {! [cmd [format { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_chpass_principal $server_handle "%s/a" newpassword +- } $test]]} { +- perror "$test: unexpected failure in chpass_principal" +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" p \ +- {KADM5_PRINCIPAL_NORMAL_MASK KADM5_KEY_DATA} +- } $test]]} { +- perror "$test: unexpected failure in get_principal" +- } +- send "lindex \$p 16\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" { set num_keys $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting num_keys" +- return +- } +- eof { +- error_and_restart "$test: eof getting num_keys" +- return +- } +- } +- +- # XXX Perhaps I should actually check the key type returned. +- if {$num_keys == 5} { +- pass "$test" +- } else { +- fail "$test: $num_keys keys, should be 5" +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test200 +- +-return "" +diff --git a/src/lib/kadm5/unit-test/api.current/chpass-principal.exp b/src/lib/kadm5/unit-test/api.current/chpass-principal.exp +deleted file mode 100644 +index 47a19dc20..000000000 +--- a/src/lib/kadm5/unit-test/api.current/chpass-principal.exp ++++ /dev/null +@@ -1,176 +0,0 @@ +-load_lib lib.t +-api_exit +-api_start +- +-test "chpass-principal 180" +-proc test180 {} { +- global test +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [create_principal_pol "$test/a" once-a-min]} { +- error_and_restart "$test: creating principal" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test [format { +- kadm5_chpass_principal $server_handle "%s/a" FoobarBax +- } $test] +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if { $RPC } { test180 } +- +-test "chpass-principal 180.5" +-proc test1805 {} { +- global test +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [create_principal_pol "$test/a" once-a-min]} { +- error_and_restart "$test: creating principal" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test [format { +- kadm5_chpass_principal $server_handle "%s/a" FoobarBax +- } $test] +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if { $RPC } { test1805 } +- +-# +-# admin with changepw service tickets try to change other principals +-# password, fails with AUTH error +-test "chpass-principal 180.625" +-proc test180625 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_chpass_principal $server_handle "%s/a" password +- } $test] "AUTH" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} { test180625 } +- +-test "chpass-principal 180.75" +-proc test18075 {} { +- global test +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [create_principal_pol "$test/a" once-a-min]} { +- error_and_restart "$test: creating principal" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_chpass_principal $server_handle "%s/a" Foobar +- } $test] "AUTH_CHANGEPW" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if { $RPC } { test18075 } +- +-test "chpass-principal 182" +-proc test182 {} { +- global test +- +- if { ! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test { +- kadm5_chpass_principal $server_handle kadmin/history password +- } "PROTECT" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test182 +- +-test "chpass-principal 183" +-proc test183 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if { ! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_chpass_principal null "%s/a" password +- } $test] "BAD_SERVER_HANDLE" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test183 +- +-return "" +diff --git a/src/lib/kadm5/unit-test/api.current/crte-policy.exp b/src/lib/kadm5/unit-test/api.current/crte-policy.exp +deleted file mode 100644 +index 7e1eda63f..000000000 +--- a/src/lib/kadm5/unit-test/api.current/crte-policy.exp ++++ /dev/null +@@ -1,927 +0,0 @@ +-load_lib lib.t +-api_exit +-api_start +- +-# Description: (1) Fails for mask with undefined bit set. +-# 01/24/94: pshuang: untried. +-test "create-policy 1" +-proc test1 {} { +- global test +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete policy \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- 0xF01000 +- } $test] "BAD_MASK" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test1 +- +-# Description: (2) Fails if caller connected with CHANGEPW_SERVICE. +-test "create-policy 2" +-proc test2 {} { +- global test +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY} +- } $test] "AUTH_ADD" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy"; +- return +- } +-} +-if {$RPC} { test2 } +- +-# Description: (3) Fails for mask without POLICY bit set. +-# 01/24/94: pshuang: untried. +-test "create-policy 3" +-proc test3 {} { +- global test +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete policy \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- 0x000000 +- } $test] "BAD_MASK" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test3 +- +-# Description: (5) Fails for invalid policy name. +-# 01/24/94: pshuang: untried. +-test "create-policy 5" +-proc test5 {} { +- global test +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/"] \ +- {KADM5_POLICY} +- } $test] "BAD_POLICY" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test5 +- +-# Description: (6) Fails for existing policy name. +-test "create-policy 6" +-proc test6 {} { +- global test +-# set prms_id 777 +-# setup_xfail {*-*-*} $prms_id +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test { +- kadm5_create_policy $server_handle [simple_policy test-pol] \ +- {KADM5_POLICY} +- } "DUP" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test6 +- +-# Description: (7) Fails for null policy name. +-# 01/24/94: pshuang: untried. +-test "create-policy 7" +-proc test7 {} { +- global test +-# set prms_id 1977 +-# setup_xfail {*-*-*} $prms_id +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test { +- kadm5_create_policy $server_handle [simple_policy null] \ +- {KADM5_POLICY} +- } "EINVAL" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test7 +- +-# Description: (8) Fails for empty-string policy name. +-test "create-policy 8" +-proc test8 {} { +- global test +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test { +- kadm5_create_policy $server_handle [simple_policy ""] \ +- {KADM5_POLICY} +- } "BAD_POLICY" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test8 +- +-# Description: (9) Accepts 0 for pw_min_life. +-test "create-policy 9" +-proc test9 {} { +- global test +- global prompt +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if { ! [cmd [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY KADM5_PW_MIN_LIFE} +- } $test]]} { +- fail "$test: create failed" +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retrieve policy" +- return +- } +- send "lindex \$policy 1\n" +- expect { +- -re "0\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test9 +- +-# Description: (10) Accepts non-zero for pw_min_life. +-test "create-policy 10" +-proc test10 {} { +- global test +- global prompt +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if { ! [cmd [format { +- kadm5_create_policy $server_handle {"%s/a" 32 0 0 0 0 0 } \ +- {KADM5_POLICY KADM5_PW_MIN_LIFE} +- } $test]]} { +- fail "$test" +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retreuve policy" +- return +- } +- send "lindex \$policy 1\n" +- expect { +- -re "32\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test10 +- +-# Description: (11) Accepts 0 for pw_max_life. +-test "create-policy 11" +-proc test11 {} { +- global test +- global prompt +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY KADM5_PW_MAX_LIFE} +- } $test]]} { +- fail "$test" +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retreuve policy" +- return +- } +- send "lindex \$policy 2\n" +- expect { +- -re "0\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test11 +- +-# Description: (12) Accepts non-zero for pw_max_life. +-test "create-policy 12" +-proc test12 {} { +- global test +- global prompt +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_policy $server_handle {"%s/a" 0 32 0 0 0 0 } \ +- {KADM5_POLICY KADM5_PW_MAX_LIFE} +- } $test]]} { +- fail "$test" +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retreuve policy" +- return +- } +- send "lindex \$policy 2\n" +- expect { +- -re "32\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test12 +- +-# Description: (13) Rejects 0 for pw_min_length. +-test "create-policy 13" +-proc test13 {} { +- global test +- global prompt +- +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY KADM5_PW_MIN_LENGTH} +- } $test] "BAD_LENGTH" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test13 +- +-# Description: (14) Accepts non-zero for pw_min_length. +-test "create-policy 14" +-proc test14 {} { +- global test +- global prompt +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_policy $server_handle {"%s/a" 0 0 8 0 0 0 } \ +- {KADM5_POLICY KADM5_PW_MIN_LENGTH} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retreuve policy" +- return +- } +- send "lindex \$policy 3\n" +- expect { +- -re "8\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test14 +- +-# Description: (15) Rejects 0 for pw_min_classes. +-test "create-policy 15" +-proc test15 {} { +- global test +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY KADM5_PW_MIN_CLASSES} +- } $test] "BAD_CLASS" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test15 +- +-# Description: (16) Accepts 1 for pw_min_classes. +-test "create-policy 16" +-proc test16 {} { +- global test +- global prompt +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_policy $server_handle {"%s/a" 0 0 0 1 0 0 } \ +- {KADM5_POLICY KADM5_PW_MIN_CLASSES} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retreuve policy" +- return +- } +- send "lindex \$policy 4\n" +- expect { +- -re "1\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test16 +- +-# Description: (17) Accepts 4 for pw_min_classes. +-test "create-policy 17" +-proc test17 {} { +- global test +- global prompt +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_policy $server_handle {"%s/a" 0 0 0 5 0 0} \ +- {KADM5_POLICY KADM5_PW_MIN_CLASSES} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retreuve policy" +- return +- } +- send "lindex \$policy 4\n" +- expect { +- -re "5\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test17 +- +-# Description: (18) Rejects 5 for pw_min_classes. +-test "create-policy 18" +-proc test18 {} { +- global test +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle {"%s/a" 0 0 0 6 0 0} \ +- {KADM5_POLICY KADM5_PW_MIN_CLASSES} +- } $test] "BAD_CLASS" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test18 +- +-# Description: (19) Rejects 0 for pw_history_num. +-test "create-policy 19" +-proc test19 {} { +- global test +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY KADM5_PW_HISTORY_NUM} +- } $test] "BAD_HISTORY" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test19 +- +-# Description: (20) Accepts 1 for pw_history_num. +-test "create-policy 20" +-proc test20 {} { +- global test +- global prompt +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_policy $server_handle {"%s/a" 0 0 0 0 1 0} \ +- {KADM5_POLICY KADM5_PW_HISTORY_NUM} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retreuve policy" +- return +- } +- send "lindex \$policy 5\n" +- expect { +- -re "1\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test20 +- +-# Description: (21) Accepts 10 for pw_history_num. +-test "create-policy 21" +-proc test21 {} { +- global test +- global prompt +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_policy $server_handle {"%s/a" 0 0 0 0 10 0} \ +- {KADM5_POLICY KADM5_PW_HISTORY_NUM} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retrieve policy" +- return +- } +- send "lindex \$policy 5\n" +- expect { +- -re "10\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test21 +- +-# Description: (22) Fails for user with no access bits. +-test "create-policy 22" +-proc test22 {} { +- global test +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY} +- } $test] "AUTH_ADD" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} test22 +- +-# Description: (23) Fails for user with "get" but not "add". +-test "create-policy 23" +-proc test23 {} { +- global test +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY} +- } $test] "AUTH_ADD" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} test23 +- +-# Description: (24) Fails for user with "modify" but not "add". +-# 01/24/94: pshuang: untried. +-test "create-policy 24" +-proc test24 {} { +- global test +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY} +- } $test] "AUTH_ADD" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} test24 +- +-# Description: (25) Fails for user with "delete" but not "add". +-# 01/24/94: pshuang: untried. +-test "create-policy 25" +-proc test25 {} { +- global test +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY} +- } $test] "AUTH_ADD" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} test25 +- +-# Description: Succeeds for user with "add". +-test "create-policy 26" +-proc test26 {} { +- global test +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY} +- } $test] +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test26 +- +-# Description: Succeeds for user with "get" and "add". +-# 01/24/94: pshuang: untried. +-test "create-policy 27" +-proc test27 {} { +- global test +- +- if {! (( ! [policy_exists "$test/a"]) || +- [delete_policy "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/get-add admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test [format { +- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_POLICY} +- } $test] +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test27 +- +-# Description: (28) Rejects null policy argument. +-# 01/24/94: pshuang: untried. +-test "create-policy 28" +-proc test28 {} { +- global test +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test { +- kadm5_create_policy $server_handle null {KADM5_POLICY} +- } "EINVAL" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test28 +- +-test "create-policy 30" +-proc test30 {} { +- global test +- one_line_fail_test [format { +- kadm5_create_policy null [simple_policy "%s/a"] \ +- {KADM5_POLICY} +- } $test] "BAD_SERVER_HANDLE" +-} +-test30 +- +-return "" +diff --git a/src/lib/kadm5/unit-test/api.current/crte-principal.exp b/src/lib/kadm5/unit-test/api.current/crte-principal.exp +deleted file mode 100644 +index d6d6809ec..000000000 +--- a/src/lib/kadm5/unit-test/api.current/crte-principal.exp ++++ /dev/null +@@ -1,1336 +0,0 @@ +-load_lib lib.t +-api_exit +-api_start +- +-#test "create-principal 1" +-# +-#proc test1 {} { +-# global test +-# begin_dump +-# one_line_fail_test [format { +-# kadm5_create_principal $server_handle \ +-# [simple_principal "%s/a"] {KADM5_PRINCIPAL} "%s/a" +-# } $test $test] "NOT_INIT" +-# end_dump_compare "no-diffs" +-#} +-#test1 +- +-# v2 create-principal 3 test, to avoid name conflict +-test "create-principal 1" +-proc test1 {} { +- global test +-# set prms_id 777 +-# setup_xfail {*-*-*} $prms_id +- begin_dump +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test [format { +- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINCIPAL} null +- } $test] +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- end_dump_compare "no-diffs" +-} +-test1 +- +-test "create-principal 2" +- +-proc test2 {} { +- global test +- begin_dump +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test { +- kadm5_create_principal $server_handle null \ +- {KADM5_PRINCIPAL} testpass +- } "EINVAL" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- end_dump_compare "no-diffs" +-} +-test2 +- +-test "create-principal 4" +-proc test4 {} { +- global test +- +- begin_dump +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINCIPAL} "" +- } $test] "_Q_TOOSHORT" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- end_dump_compare "no-diffs" +-} +-test4 +- +-test "create-principal 5" +-proc test5 {} { +- global test +- begin_dump +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_principal $server_handle \ +- [simple_principal "%s/a"] {0x100001} "%s/a" +- } $test $test] "BAD_MASK" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- end_dump_compare "no-diffs" +-} +-test5 +- +-test "create-principal 6" +-proc test6 {} { +- global test +- begin_dump +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_LAST_PWD_CHANGE} "%s/a" +- } $test $test] "BAD_MASK" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- end_dump_compare "no-diffs" +-} +-test6 +- +-test "create-principal 7" +-proc test7 {} { +- global test +- begin_dump +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_MOD_TIME} "%s/a" +- } $test $test] "BAD_MASK" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- end_dump_compare "no-diffs" +-} +-test7 +- +-test "create-principal 8" +-proc test8 {} { +- global test +- begin_dump +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_MOD_NAME} "%s/a" +- } $test $test] "BAD_MASK" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- end_dump_compare "no-diffs" +-} +-test8 +- +-test "create-principal 9" +-proc test9 {} { +- global test +- begin_dump +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_MKVNO} "%s/a" +- } $test $test] "BAD_MASK" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- end_dump_compare "no-diffs" +-} +-test9 +- +-test "create-principal 10" +-proc test10 {} { +- global test +- begin_dump +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_AUX_ATTRIBUTES} "%s/a" +- } $test $test] "BAD_MASK" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- end_dump_compare "no-diffs" +-} +-test10 +- +-test "create-principal 11" +-proc test11 {} { +- global test +- begin_dump +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_POLICY_CLR} "%s/a" +- } $test $test] "BAD_MASK" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- end_dump_compare "no-diffs" +-} +-test11 +- +-test "create-principal 12" +-proc test12 {} { +- global test +- begin_dump +- if {! [cmd { +- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINCIPAL} testpass +- } $test] "AUTH_ADD" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- end_dump_compare "no-diffs" +- +-} +-if {$RPC} { test12 } +- +-test "create-principal 13" +-proc test13 {} { +- global test +- begin_dump +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINCIPAL} testpass +- } $test] "AUTH_ADD" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- end_dump_compare "no-diffs" +-} +-if {$RPC} { test13 } +- +-test "create-principal 14" +-proc test14 {} { +- global test +- begin_dump +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINCIPAL} testpass +- } $test] "AUTH_ADD" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- end_dump_compare "no-diffs" +-} +-if {$RPC} { test14 } +- +-test "create-principal 15" +-proc test15 {} { +- global test +- begin_dump +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINCIPAL} testpass +- } $test] "AUTH_ADD" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- end_dump_compare "no-diffs" +-} +-if {$RPC} { test15 } +- +-test "create-principal 16" +-proc test16 {} { +- global test +- begin_dump +- if {! [cmd { +- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINCIPAL} testpass +- } $test] "AUTH_ADD" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- end_dump_compare "no-diffs" +-} +-if {$RPC} { test16 } +- +-test "create-principal 17" +-proc test17 {} { +- global test +- +- begin_dump +- if {! (( [principal_exists "$test/a"]) || [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINCIPAL} testpass +- } $test] "DUP" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- end_dump_compare "no-diffs" +-} +-test17 +- +-test "create-principal 18" +-proc test18 {} { +- global test +- +- begin_dump +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_principal $server_handle \ +- [princ_w_pol "%s/a" test-pol] \ +- {KADM5_PRINCIPAL KADM5_POLICY} tP +- } $test] "_Q_TOOSHORT" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- end_dump_compare "no-diffs" +-} +-test18 +- +-test "create-principal 19" +-proc test19 {} { +- global test +- +- begin_dump +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_principal $server_handle \ +- [princ_w_pol "%s/a" test-pol] \ +- {KADM5_PRINCIPAL KADM5_POLICY} testpassword +- } $test] "_Q_CLASS" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- end_dump_compare "no-diffs" +-} +-test19 +- +-test "create-principal 20" +-proc test20 {} { +- global test +- +- begin_dump +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_create_principal $server_handle \ +- [princ_w_pol "%s/a" test-pol] \ +- {KADM5_PRINCIPAL KADM5_POLICY} Abyssinia +- } $test] "_Q_DICT" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- end_dump_compare "no-diffs" +-} +-test20 +- +-test "create-principal 21" +-proc test21 {} { +- global test +- +- begin_dump +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test [format { +- kadm5_create_principal $server_handle \ +- [princ_w_pol "%s/a" non-existant-pol] \ +- {KADM5_PRINCIPAL KADM5_POLICY} NotinTheDictionary +- } $test] +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- end_dump_compare "no-diffs" +-} +-test21 +- +-test "create-principal 23" +-proc test23 {} { +- global test +- +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINCIPAL} NotinTheDictionary +- } $test]]} { +- fail "$test: can not create principal" +- return; +- } +- one_line_succeed_test \ +- [format {kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK} $test] +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test23 +- +-test "create-principal 24" +-proc test24 {} { +- global test +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/rename admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINCIPAL} NotinTheDictionary +- } $test]]} { +- fail "$test: can not create principal" +- return; +- } +- one_line_succeed_test \ +- [format {kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK} $test] +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} { test24 } +- +- +-test "create-principal 28" +-proc test28 {} { +- global test +- global prompt +- +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- +- if {! [cmd [format { +- kadm5_create_principal $server_handle \ +- [princ_w_pol "%s/a" test-pol] \ +- {KADM5_PRINCIPAL KADM5_POLICY} NotinTheDictionary +- } $test]]} { +- fail "$test: can not create principal" +- return; +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- fail "$test: can not retrieve principal" +- return +- } +- send "lindex \$principal 10\n" +- expect { +- -re "test-pol.*$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test28 +- +-test "create-principal 29" +-proc test29 {} { +- global test +- global prompt +- +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINCIPAL KADM5_PRINC_EXPIRE_TIME} \ +- inTheDictionary +- } $test]]} { +- fail "$test: can not create principal" +- return; +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- fail "$test: can not retrieve principal" +- return; +- } +- send "lindex \$principal 1\n" +- expect { +- -re "0.*$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test29 +- +-test "create-principal 30" +-proc test30 {} { +- global test +- global prompt +- +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINCIPAL KADM5_PW_EXPIRATION} \ +- NotinTheDictionary +- } $test]]} { +- fail "$test: can not create principal" +- return; +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- fail "$test: can not retrieve principal" +- return; +- } +- send "lindex \$principal 3\n" +- expect { +- -re "0.*$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test30 +- +-test "create-principal 31" +-proc test31 {} { +- global test +- global prompt +- +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_principal $server_handle \ +- [princ_w_pol "%s/a" test-pol-nopw] \ +- {KADM5_PRINCIPAL KADM5_POLICY \ +- KADM5_PW_EXPIRATION} NotinTheDictionary +- } $test]]} { +- fail "$test: can not create principal" +- return; +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- fail "$test: can not retrieve principal" +- return; +- } +- send "lindex \$principal 3\n" +- expect { +- -re "0.*$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test31 +- +-test "create-principal 32" +-proc test32 {} { +- global test +- global prompt +- +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_principal $server_handle \ +- [princ_w_pol "%s/a" test-pol] \ +- {KADM5_PRINCIPAL KADM5_POLICY \ +- KADM5_PW_EXPIRATION} NotinTheDictionary +- } $test]]} { +- fail "$test: can not create principal" +- return; +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- fail "$test: can not retrieve principal" +- return; +- } +- if { ! [cmd {kadm5_get_policy $server_handle test-pol policy}]} { +- error_and_restart "$test: cannot retrieve policy" +- return +- } +- +- send "lindex \$principal 6\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" {set mod_date $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting mod_date" +- return +- } +- eof { +- error_and_restart "$test: eof getting mod_date" +- return +- } +- } +- +- send "lindex \$principal 3\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" {set pw_expire $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting pw_expire" +- return +- } +- eof { +- error_and_restart "$test: eof getting pw_expire" +- return +- } +- } +- +- send "lindex \$policy 2\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" {set pw_max_life $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting pw_max_life" +- return +- } +- eof { +- error_and_restart "$test: eof getting pw_max_life" +- return +- } +- } +- if { $pw_expire != 0 } { +- fail "$test: pw_expire $pw_expire should be 0" +- return +- } else { +- pass "$test" +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test32 +- +-test "create-principal 33" +-proc test33 {} { +- global test +- global prompt +- +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_principal $server_handle \ +- {"%s/a" 0 0 1234 0 null 0 0 0 0 null 0} \ +- {KADM5_PRINCIPAL KADM5_PW_EXPIRATION} \ +- NotinTheDictionary +- } $test]]} { +- fail "$test: can not create principal" +- return; +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- fail "$test: can not retrieve principal" +- return; +- } +- send "lindex \$principal 3\n" +- expect { +- -re "1234.*$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test33 +- +-test "create-principal 34" +-proc test34 {} { +- global test +- global prompt +- +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_principal $server_handle \ +- { "%s/a" 0 0 1234 0 null 0 0 0 0 test-pol-nopw 0} \ +- {KADM5_PRINCIPAL KADM5_POLICY \ +- KADM5_PW_EXPIRATION} NotinTheDictionary +- } $test]]} { +- fail "$test: can not create principal" +- return; +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- fail "$test: can not retrieve principal" +- return; +- } +- send "lindex \$principal 3\n" +- expect { +- -re "1234.*$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test34 +- +-test "create-principal 35" +-proc test35 {} { +- global test +- global prompt +- +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_principal $server_handle \ +- {"%s/a" 0 0 1234 0 null 0 0 0 0 test-pol 0} \ +- {KADM5_PRINCIPAL KADM5_POLICY \ +- KADM5_PW_EXPIRATION} NotinTheDictionary +- } $test]]} { +- fail "$test: can not create principal" +- return; +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- fail "$test: can not retrieve principal" +- return; +- } +- send "lindex \$principal 3\n" +- expect { +- -re "1234.*$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test35 +- +-test "create-principal 36" +-proc test36 {} { +- global test +- global prompt +- +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_principal $server_handle \ +- {"%s/a" 0 0 999999999 0 null 0 0 0 0 test-pol 0} \ +- {KADM5_PRINCIPAL KADM5_POLICY \ +- KADM5_PW_EXPIRATION} NotinTheDictionary +- } $test]]} { +- fail "$test: can not create principal" +- return; +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- fail "$test: can not retrieve principal" +- return; +- } +- if { ! [cmd {kadm5_get_policy $server_handle test-pol policy} ]} { +- error_and_restart "$test: cannot retrieve policy" +- return +- } +- +- send "lindex \$principal 6\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" {set mod_date $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting mod_date" +- return +- } +- eof { +- error_and_restart "$test: eof getting mod_date" +- return +- } +- } +- +- send "lindex \$principal 3\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" {set pw_expire $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting pw_expire" +- return +- } +- eof { +- error_and_restart "$test: eof getting pw_expire" +- return +- } +- } +- +- send "lindex \$policy 2\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" {set pw_max_life $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting pw_max_life" +- return +- } +- eof { +- error_and_restart "$test: eof getting pw_max_life" +- return +- } +- } +- if { $pw_expire != 999999999 } { +- fail "$test: pw_expire is wrong" +- return +- } else { +- pass "$test" +- } +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test36 +- +-test "create-principal 37" +-proc test37 {} { +- global test +- global prompt +- +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINCIPAL} NotinTheDictionary +- } $test]]} { +- fail "$test: can not create principal" +- return; +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- fail "$test: can not retrieve principal" +- return; +- } +- send "lindex \$principal 3\n" +- expect { +- -re "0.*$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test37 +- +-test "create-principal 38" +-proc test38 {} { +- global test +- global prompt +- +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_principal $server_handle [princ_w_pol "%s/a" \ +- test-pol-nopw] {KADM5_PRINCIPAL KADM5_POLICY} \ +- NotinTheDictionary +- } $test]]} { +- fail "$test: can not create principal" +- return; +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- fail "$test: can not retrieve principal" +- return; +- } +- send "lindex \$principal 3\n" +- expect { +- -re "0.*$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test38 +- +-test "create-principal 39" +-proc test39 {} { +- global test +- global prompt +- +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_principal $server_handle [princ_w_pol "%s/a" \ +- test-pol] {KADM5_PRINCIPAL KADM5_POLICY} \ +- NotinTheDictionary +- } $test]]} { +- fail "$test: can not create principal" +- return; +- } +- if { ! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- error_and_restart "$test: cannot not retrieve principal" +- return +- } +- if { ! [cmd {kadm5_get_policy $server_handle test-pol policy}]} { +- error_and_restart "$test: cannot retrieve policy" +- return +- } +- send "lindex \$principal 6\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" {set mod_date $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting mod_date" +- return +- } +- eof { +- error_and_restart "$test: eof getting mod_date" +- return +- } +- } +- +- send "lindex \$principal 3\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" {set pw_expire $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting pw_expire" +- return +- } +- eof { +- error_and_restart "$test: eof getting pw_expire" +- return +- } +- } +- +- send "lindex \$policy 2\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" {set pw_max_life $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting pw_max_life" +- return +- } +- eof { +- error_and_restart "$test: eof getting pw_max_life" +- return +- } +- } +- if { [expr "$mod_date + $pw_max_life - $pw_expire"] > 5 } { +- fail "$test: pw_expire is wrong" +- return +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test39 +- +-test "create-principal 40" +-proc test40 {} { +- global test +- global prompt +- +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINCIPAL KADM5_PW_EXPIRATION} \ +- NotinTheDictionary +- } $test]]} { +- fail "$test: can not create principal" +- return; +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- fail "$test: can not retrieve principal" +- return; +- } +- send "lindex \$principal 4\n" +- expect { +- -re "0.*$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test40 +- +-test "create-principal 43" +-proc test43 {} { +- global test +- one_line_fail_test [format { +- kadm5_create_principal null \ +- [simple_principal "%s/a"] {KADM5_PRINCIPAL} "%s/a" +- } $test $test] "BAD_SERVER_HANDLE" +-} +-test43 +- +-return "" +diff --git a/src/lib/kadm5/unit-test/api.current/destroy.exp b/src/lib/kadm5/unit-test/api.current/destroy.exp +deleted file mode 100644 +index a3e2bfc59..000000000 +--- a/src/lib/kadm5/unit-test/api.current/destroy.exp ++++ /dev/null +@@ -1,203 +0,0 @@ +-load_lib lib.t +-api_exit +-api_start +- +-test "destroy 1" +- +-proc test1 {} { +- global test +- begin_dump +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test {kadm5_destroy $server_handle} +- end_dump_compare "no-diffs" +-} +-test1 +- +-#test "destroy 2" +-# +-#proc test2 {} { +-# global test +-# begin_dump +-# if {! [cmd { +-# kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +-# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +-# server_handle +-# }]} { +-# perror "$test: unexpected failure on init" +-# return +-# } +-# if {! [cmd {kadm5_destroy $server_handle}]} { +-# error_and_restart "$test: couldn't close database" +-# return +-# } +-# one_line_fail_test \ +-# {kadm5_get_principal $server_handle admin principal} \ +-# "NOT_INIT" +-# end_dump_compare "no-diffs" +-#} +-#test2 +- +-#test "destroy 3" +-#proc test3 {} { +-# global test +-# +-# begin_dump +-# if {! (( ! [principal_exists "$test/a"]) || [delete_principal "$test/a"])} { +-# error_and_restart "$test couldn't delete principal \"$test/a\"" +-# return +-# } +-# if {! [cmd { +-# kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +-# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +-# server_handle +-# }]} { +-# perror "$test: unexpected failure on init" +-# return +-# } +-# if {! [cmd {kadm5_destroy $server_handle}]} { +-# error_and_restart "$test: couldn't close database" +-# return +-# } +-# one_line_fail_test [format { +-# kadm5_create_principal $server_handle \ +-# [simple_principal "%s/a"] {KADM5_PRINCIPAL} "%s/a" +-# } $test $test] "NOT_INIT" +-# end_dump_compare "no-diffs" +-#} +-#test3 +- +-#test "destroy 4" +-#proc test4 {} { +-# global test prompt +-# +-# if {! (([principal_exists "$test/a"]) || [create_principal "$test/a"])} { +-# error_and_restart "$test: couldn't create principal \"$test/a\"" +-# return +-# } +-# begin_dump +-# if {! ([cmd { +-# kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +-# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +-# server_handle +-# }] && +-# [cmd [format { +-# kadm5_get_principal $server_handle "%s/a" principal +-# } $test]])} { +-# error_and_restart "$test: error getting principal" +-# return; +-# } +-# if {! [cmd {kadm5_destroy $server_handle}]} { +-# error_and_restart "$test: couldn't close database" +-# return +-# } +-# one_line_fail_test [format { +-# kadm5_modify_principal $server_handle \ +-# {"%s/a" 0 0 0 0 0 0 0 %d 0 0 0} {KADM5_KVNO} +-# } $test "77"] "NOT_INIT" +-# end_dump_compare "no-diffs" +-#} +-#test4 +- +-#test "destroy 5" +-# +-#proc test5 {} { +-# global test +-# +-# if {! ([principal_exists "$test/a"] || [create_principal "$test/a"])} { +-# error_and_restart "$test: couldn't create principal \"$test/a\"" +-# return +-# } +-# begin_dump +-# if {! [cmd { +-# kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +-# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +-# server_handle +-# }]} { +-# perror "$test: unexpected failure on init" +-# return +-# } +-# if {! [cmd {kadm5_destroy $server_handle}]} { +-# error_and_restart "$test: couldn't close database" +-# return +-# } +-# one_line_fail_test [format { +-# kadm5_delete_principal $server_handle "%s/a" +-# } $test] "NOT_INIT" +-# end_dump_compare "no-diffs" +-#} +-#test5 +- +-#test "destroy 6" +-# +-#proc test6 {} { +-# global test +-# begin_dump +-# one_line_fail_test {kadm5_destroy $server_handle} "NOT_INIT" +-# end_dump_compare "no-diffs" +-#} +-#test6 +- +- +-#test "destroy 7" +-# +-#proc test7 {} { +-# global test +-# begin_dump +-# if {! [cmd { +-# kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +-# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +-# server_handle +-# }]} { +-# perror "$test: unexpected failure in init" +-# return +-# } +-# if {! [cmd {kadm5_destroy $server_handle}]} { +-# error_and_restart "$test: couldn't close database" +-# } +-# one_line_fail_test {kadm5_destroy $server_handle} "NOT_INIT" +-# end_dump_compare "no-diffs" +-#} +-#test7 +- +-test "destroy 8" +-proc test8 {} { +- global test +- begin_dump +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd {kadm5_destroy $server_handle}]} { +- error_and_restart "$test: couldn't close database" +- } +- one_line_succeed_test { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } +- if {! [cmd {kadm5_destroy $server_handle}]} { +- error_and_restart "$test: couldn't close database" +- } +- end_dump_compare "no-diffs" +-} +-test8 +- +-test "destroy 9" +-proc test9 {} { +- global test +- one_line_fail_test {kadm5_destroy null} "BAD_SERVER_HANDLE" +-} +-test9 +- +-return "" +diff --git a/src/lib/kadm5/unit-test/api.current/dlte-policy.exp b/src/lib/kadm5/unit-test/api.current/dlte-policy.exp +deleted file mode 100644 +index ad2863d0f..000000000 +--- a/src/lib/kadm5/unit-test/api.current/dlte-policy.exp ++++ /dev/null +@@ -1,208 +0,0 @@ +-load_lib lib.t +-api_exit +-api_start +- +-test "delete-policy 2" +-proc test2 {} { +- global test +-# set prms_id 744 +-# setup_xfail {*-*-*} $prms_id +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test \ +- {kadm5_delete_policy $server_handle ""} "BAD_POL" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test2 +- +-test "delete-policy 5" +-proc test5 {} { +- global test +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_delete_policy $server_handle "%s/a" +- } $test] "AUTH_DELETE" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if ${RPC} test5 +- +-test "delete-policy 6" +-proc test6 {} { +- global test +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_delete_policy $server_handle "%s/a" +- } $test] "AUTH_DELETE" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if ${RPC} test6 +- +-test "delete-policy 7" +-proc test7 {} { +- global test +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_delete_policy $server_handle "%s/a" +- } $test] "AUTH_DELETE" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} test7 +- +-test "delete-policy 10" +-proc test10 {} { +- global test +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if { ! [cmd [format { +- kadm5_delete_policy $server_handle "%s/a" +- } $test]]} { +- fail "$test" +- return +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- if { [policy_exists "$test/a"]} { +- fail "$test" +- return +- } +-} +-test10 +- +-test "delete-policy 12" +-proc test12 {} { +- global test +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_create_principal $server_handle [princ_w_pol "%s/a" \ +- "%s/a"] {KADM5_PRINCIPAL KADM5_POLICY} \ +- NotinTheDictionary +- } $test $test]]} { +- fail "$test: can not create principal" +- return; +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- if {! [cmd { +- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test [format { +- kadm5_delete_policy $server_handle "%s/a" +- } $test] +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test12 +- +-test "delete-policy 13" +-proc test13 {} { +- global test +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- one_line_fail_test [format { +- kadm5_delete_policy null "%s/a" +- } $test] "BAD_SERVER_HANDLE" +-} +-test13 +- +-return "" +diff --git a/src/lib/kadm5/unit-test/api.current/dlte-principal.exp b/src/lib/kadm5/unit-test/api.current/dlte-principal.exp +deleted file mode 100644 +index 660468534..000000000 +--- a/src/lib/kadm5/unit-test/api.current/dlte-principal.exp ++++ /dev/null +@@ -1,253 +0,0 @@ +-load_lib lib.t +- +-api_exit +-api_start +- +-#test "delete-principal 1" +-#proc test1 {} { +-# global test +-# one_line_fail_test [format { +-# kadm5_delete_principal $server_handle "%s/a" +-# } $test] "NOT_INIT" +-#} +-#test1 +- +-test "delete-principal 2" +-proc test2 {} { +- global test +- +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test \ +- {kadm5_delete_principal $server_handle null} "EINVAL" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- error_and_restart "$test: unexpected failure in destroy" +- return +- } +-} +-test2 +- +-test "delete-principal 5" +-proc test5 {} { +- global test +- +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_delete_principal $server_handle "%s/a" +- } $test] "UNK_PRINC" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test5 +- +-test "delete-principal 6" +-proc test6 {} { +- global test +- +- if {! (( [principal_exists "$test/a"]) || +- [create_principal_pol "$test/a" test-pol])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/delete admin $KADM5_CHANGEPW_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_delete_principal $server_handle "%s/a" +- } $test] "AUTH_DELETE" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} { test6 } +- +- +-test "delete-principal 7" +-proc test7 {} { +- global test +- +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_delete_principal $server_handle "%s/a" +- } $test] "AUTH_DELETE" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} { test7 } +- +- +-test "delete-principal 8" +-proc test8 {} { +- global test +- +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_delete_principal $server_handle "%s/a" +- } $test] "AUTH_DELETE" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} { test8 } +- +-test "delete-principal 9" +-proc test9 {} { +- global test +- +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_delete_principal $server_handle "%s/a" +- } $test] "AUTH_DELETE" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} { test9 } +- +-test "delete-principal 10" +-proc test10 {} { +- global test +- +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_delete_principal $server_handle "%s/a" +- } $test] "AUTH_DELETE" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} { test10 } +- +-test "delete-principal 11" +-proc test11 {} { +- global test +- +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if { ! [cmd [format { +- kadm5_delete_principal $server_handle "%s/a" +- } $test]]} { +- fail "$test: delete failed" +- return; +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- if { [principal_exists "$test/a"] } { +- fail "$test" +- return +- } +-} +-test11 +- +-test "delete-principal 13" +-proc test13 {} { +- global test +- one_line_fail_test [format { +- kadm5_delete_principal null "%s/a" +- } $test] "BAD_SERVER_HANDLE" +-} +-test13 +- +-return "" +- +- +- +- +- +diff --git a/src/lib/kadm5/unit-test/api.current/get-policy.exp b/src/lib/kadm5/unit-test/api.current/get-policy.exp +deleted file mode 100644 +index c15ef0ca2..000000000 +--- a/src/lib/kadm5/unit-test/api.current/get-policy.exp ++++ /dev/null +@@ -1,199 +0,0 @@ +-load_lib lib.t +-api_exit +-api_start +- +-test "get-policy 3" +-proc test3 {} { +- global test +-# set prms_id 744 +-# setup_xfail {*-*-*} $prms_id +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test {kadm5_get_policy $server_handle "" p} "BAD_POLICY" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test3 +- +-test "get-policy 6" +-proc test6 {} { +- global test +- +- if {! [cmd { +- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \ +- "AUTH_GET" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if { $RPC } test6 +- +-test "get-policy 7" +-proc test7 {} { +- global test +- +- if {! [cmd { +- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \ +- "AUTH_GET" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if { $RPC } test7 +- +-test "get-policy 11" +-proc test11 {} { +- global test +- +- if {! [cmd { +- kadm5_init admin/get-pol StupidAdmin $KADM5_ADMIN_SERVICE \ +- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test {kadm5_get_policy $server_handle test-pol p} +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test11 +- +-test "get-policy 12" +-proc test12 {} { +- global test +- +- if {! [cmd { +- kadm5_init admin/get-pol StupidAdmin \ +- $KADM5_CHANGEPW_SERVICE null $KADM5_STRUCT_VERSION \ +- $KADM5_API_VERSION_3 server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test \ +- {kadm5_get_policy $server_handle test-pol-nopw p} +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test12 +- +-test "get-policy 15" +-proc test15 {} { +- global test +- +- if {! [cmd { +- kadm5_init admin/pol StupidAdmin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test \ +- {kadm5_get_policy $server_handle test-pol-nopw p} +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test15 +- +-test "get-policy 16" +-proc test16 {} { +- global test +- +- if {! [cmd { +- kadm5_init admin/pol StupidAdmin $KADM5_CHANGEPW_SERVICE \ +- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test \ +- {kadm5_get_policy $server_handle test-pol-nopw p} +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test16 +- +-test "get-policy 17" +-proc test17 {} { +- global test +- +- if {! [cmd { +- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test {kadm5_get_policy $server_handle test-pol p} +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test17 +- +-test "get-policy 18" +-proc test18 {} { +- global test +- +- if {! [cmd { +- kadm5_init admin/get admin $KADM5_CHANGEPW_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \ +- "AUTH_GET" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if { $RPC } test18 +- +-test "get-policy 21" +-proc test21 {} { +- global test +- +- one_line_fail_test {kadm5_get_policy null "pol1" p} "BAD_SERVER_HANDLE" +-} +-test21 +diff --git a/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp +deleted file mode 100644 +index 3ea1ba29b..000000000 +--- a/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp ++++ /dev/null +@@ -1,250 +0,0 @@ +-load_lib lib.t +-api_exit +-api_start +- +-test "get-principal 100" +-proc test100 {} { +- global test prompt +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd { +- kadm5_get_principal $server_handle testuser p \ +- {KADM5_PRINCIPAL_NORMAL_MASK} +- }]} { +- perror "$test: unexpected failure in get_principal" +- } +- send "lindex \$p 16\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" { set num_keys $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting num_keys" +- return +- } +- eof { +- error_and_restart "$test: eof getting num_keys" +- return +- } +- } +- send "lindex \$p 17\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" { set num_tl $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting num_tl" +- return +- } +- eof { +- error_and_restart "$test: eof getting num_tl" +- return +- } +- } +- send "lindex \$p 18\n" +- expect { +- -re "({.*})\n$prompt" {set key_data $expect_out(1,string) } +- -re "\n$prompt" { set key_data {} } +- timeout { +- error_and_restart "$test: timeout getting key_data" +- return +- } +- eof { +- error_and_restart "$test: eof getting key_data" +- return +- } +- } +- send "lindex \$p 19\n" +- expect { +- -re "({.*})\n$prompt" {set tl_data $expect_out(1,string) } +- -re "\n$prompt" { set tl_data {} } +- timeout { +- error_and_restart "$test: timeout getting tl_data" +- return +- } +- eof { +- error_and_restart "$test: eof getting tl_data" +- return +- } +- } +- +- set failed 0 +- if {$num_keys != 0} { +- fail "$test: num_keys $num_keys should be 0" +- set failed 1 +- } +- if {$num_tl != 0} { +- fail "$test: num_tl $num_tl should be 0" +- set failed 1 +- } +- if {$key_data != {}} { +- fail "$test: key_data $key_data should be {}" +- set failed 1 +- } +- if {$tl_data != "{}"} { +- fail "$test: tl_data $tl_data should be empty" +- set failed 1 +- } +- if {$failed == 0} { +- pass "$test" +- } +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test100 +- +-proc test101_102 {rpc} { +- global test prompt +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd { +- kadm5_get_principal $server_handle testuser p \ +- {KADM5_PRINCIPAL_NORMAL_MASK KADM5_KEY_DATA} +- }]} { +- perror "$test: unexpected failure in get_principal" +- } +- send "lindex \$p 16\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" { set num_keys $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting num_keys" +- return +- } +- eof { +- error_and_restart "$test: eof getting num_keys" +- return +- } +- } +- send "lindex \$p 18\n" +- expect { +- -re "({.*})\n$prompt" {set key_data $expect_out(1,string) } +- -re "\n$prompt" { set key_data {} } +- timeout { +- error_and_restart "$test: timeout getting key_data" +- return +- } +- eof { +- error_and_restart "$test: eof getting key_data" +- return +- } +- } +- +- set failed 0 +- if {$num_keys != 5} { +- fail "$test: num_keys $num_keys should be 5" +- set failed 1 +- } +- for {set i 0} {$i < $num_keys} {incr i} { +- set key "[lindex [lindex $key_data $i] 2]" +- if {($rpc && [string compare $key ""] != 0) || +- ((! $rpc) && [string compare $key ""] == 0)} { +- fail "$test: key_data $key is wrong" +- set failed 1 +- +- } +- } +- if {$failed == 0} { pass "$test" } +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test "get-principal 101" +-if {$RPC} {test101_102 $RPC} +-test "get-principal 102" +-if {! $RPC} {test101_102 $RPC} +- +-test "get-principal 103" +-proc test103 {} { +- global test prompt +- +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- +- if { ! [cmd [format { +- kadm5_modify_principal $server_handle \ +- "{%s/a} 0 0 0 0 {%s/a} 0 0 0 0 null 0 0 0 0 0 0 1 {} {{999 6 foobar}}" \ +- {KADM5_TL_DATA} +- } $test $test]]} { +- fail "$test: cannot set TL_DATA" +- return +- } +- +- if {! [cmd [format { +- kadm5_get_principal $server_handle {%s/a} p \ +- {KADM5_PRINCIPAL_NORMAL_MASK KADM5_TL_DATA} +- } $test]]} { +- perror "$test: unexpected failure in get_principal" +- } +- send "lindex \$p 17\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" { set num_tl $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting num_tl" +- return +- } +- eof { +- error_and_restart "$test: eof getting num_tl" +- return +- } +- } +- send "lindex \$p 19\n" +- expect { +- -re "({.*})\n$prompt" {set tl_data $expect_out(1,string) } +- -re "\n$prompt" { set tl_data {} } +- timeout { +- error_and_restart "$test: timeout getting tl_data" +- return +- } +- eof { +- error_and_restart "$test: eof getting tl_data" +- return +- } +- } +- +- if {$num_tl == 0} { +- fail "$test: num_tl $num_tl should not be 0" +- } elseif {$tl_data == "{{999 6 foobar}}"} { +- pass "$test" +- } else { +- fail "$test: tl_data $tl_data should be {{999 6 foobar}}" +- } +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test103 +- +-return "" +- +- +- +- +diff --git a/src/lib/kadm5/unit-test/api.current/get-principal.exp b/src/lib/kadm5/unit-test/api.current/get-principal.exp +deleted file mode 100644 +index a33fdfe8c..000000000 +--- a/src/lib/kadm5/unit-test/api.current/get-principal.exp ++++ /dev/null +@@ -1,346 +0,0 @@ +-load_lib lib.t +-api_exit +-api_start +- +-test "get-principal 1" +-proc test1 {} { +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test \ +- {kadm5_get_principal $server_handle null p KADM5_PRINCIPAL_NORMAL_MASK} "EINVAL" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test1 +- +-test "get-principal 2" +-proc test2 {} { +- global test +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK +- } $test] "UNK_PRINC" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test2 +- +-test "get-principal 3" +-proc test3 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK +- } $test] "AUTH_GET" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} { test3 } +- +-test "get-principal 4" +-proc test4 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK +- } $test] "AUTH_GET" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} { test4 } +- +-test "get-principal 5" +-proc test5 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK +- } $test] "AUTH_GET" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} { test5 } +- +-test "get-principal 6" +-proc test6 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK +- } $test] "AUTH_GET" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} { test6 } +- +-test "get-principal 7" +-proc test7 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/delete admin $KADM5_CHANGEPW_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK +- } $test] "AUTH_GET" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} { test7 } +- +- +-test "get-principal 8" +-proc test8 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/get admin $KADM5_CHANGEPW_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK +- } $test] "AUTH_GET" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} { test8 } +- +- +-test "get-principal 9" +-proc test9 {} { +- global test +- if {! [cmd { +- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test \ +- {kadm5_get_principal $server_handle admin/none p KADM5_PRINCIPAL_NORMAL_MASK} +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test9 +- +-test "get-principal 10" +-proc test10 {} { +- global test +- if {! [cmd { +- kadm5_init admin/none admin $KADM5_CHANGEPW_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test \ +- {kadm5_get_principal $server_handle admin/none p KADM5_PRINCIPAL_NORMAL_MASK} +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test10 +- +-test "get-principal 11" +-proc test11 {} { +- global test +- if {! [cmd { +- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test {kadm5_get_principal $server_handle admin/get p KADM5_PRINCIPAL_NORMAL_MASK} +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test11 +- +-test "get-principal 12" +-proc test12 {} { +- global test +- if {! [cmd { +- kadm5_init admin/get admin $KADM5_CHANGEPW_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test {kadm5_get_principal $server_handle admin/get p KADM5_PRINCIPAL_NORMAL_MASK} +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test12 +- +-test "get-principal 13" +-proc test13 {} { +- global test +- if {! [cmd { +- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test {kadm5_get_principal $server_handle admin/add p KADM5_PRINCIPAL_NORMAL_MASK} +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test13 +- +-test "get-principal 14" +-proc test14 {} { +- global test +- if {! [cmd { +- kadm5_init admin/get-mod admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test {kadm5_get_principal $server_handle admin/add p KADM5_PRINCIPAL_NORMAL_MASK} +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test14 +- +-test "get-principal 15" +-proc test15 {} { +- one_line_fail_test \ +- {kadm5_get_principal null "admin" p KADM5_PRINCIPAL_NORMAL_MASK} "BAD_SERVER_HANDLE" +-} +-test15 +- +-return "" +- +- +- +- +diff --git a/src/lib/kadm5/unit-test/api.current/init-v2.exp b/src/lib/kadm5/unit-test/api.current/init-v2.exp +deleted file mode 100644 +index 47764c212..000000000 +--- a/src/lib/kadm5/unit-test/api.current/init-v2.exp ++++ /dev/null +@@ -1,506 +0,0 @@ +-load_lib lib.t +- +-api_exit +-api_start +- +-proc get_hostname { } { +- global hostname +- +- if {[info exists hostname]} { +- return 1 +- } +- +- catch "exec hostname >myname" exec_output +- if ![string match "" $exec_output] { +- send_log "$exec_output\n" +- verbose $exec_output +- send_error "ERROR: can't get hostname\n" +- return 0 +- } +- set file [open myname r] +- if { [ gets $file hostname ] == -1 } { +- send_error "ERROR: no output from hostname\n" +- return 0 +- } +- close $file +- catch "exec rm -f myname" exec_output +- +- set hostname [string tolower $hostname] +- verbose "hostname: $hostname" +- +- return 1 +-} +- +- +-test "init 101" +-proc test101 {} { +- global test +- global hostname +- +- get_hostname +- tcl_cmd "set hostname $hostname" +- +- # XXX Fix to work with a remote TEST_SERVER. For now, make sure +- # it fails in that case. +- one_line_succeed_test { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ +- [config_params {KADM5_CONFIG_ADMIN_SERVER KADM5_CONFIG_KADMIND_PORT} [list $hostname 1751]] \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } +- one_line_fail_test { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ +- [config_params {KADM5_CONFIG_ADMIN_SERVER KADM5_CONFIG_KADMIND_PORT} [list $hostname 4]] \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } "RPC_ERROR" +-} +-if {$RPC} test101 +- +-test "init 102" +-proc test102 {} { +- global test +- +- one_line_fail_test { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ +- [config_params {KADM5_CONFIG_ADMIN_SERVER} does.not.exist] \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } "CANT_RESOLVE" +-} +-if {$RPC} test102 +- +-test "init 103" +-proc test103 {} { +- global test +- +- one_line_fail_test { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ +- [config_params {KADM5_CONFIG_DBNAME} /does-not-exist] \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } "ENOENT" +-} +-#if {! $RPC} test103 +-if {! $RPC} { +- send_user "UNTESTED: test103: test needs updating for DAL changes (see MIT RT ticket 3202)\n" +- untested "test103: test needs updating for DAL changes (see MIT RT ticket 3202)" +-} +- +- +-test "init 106" +-proc test106 {} { +- global test prompt +- +- set prompting 0 +- send [string trim { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ +- [config_params {KADM5_CONFIG_MKEY_FROM_KBD} 1] \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }] +- send "\n" +- expect { +- -re "\n\[^\n\]+:\[^\n\]*$" { set prompting 1} +- -re "\nOK .*$prompt$" { fail "$test: premature success" } +- -re "\nERROR .*$prompt$" { fail "$test: premature failure" } +- timeout { fail "$test: timeout" } +- eof { fail "$test: eof" } +- } +- if {$prompting} { +- one_line_succeed_test mrroot +- } +- if {! [cmd {kadm5_destroy $server_handle}]} { +- error_and_restart "$test: couldn't close database" +- } +-} +-if {! $RPC} test106 +- +-test "init 107" +-proc test107 {} { +- global test +- +- one_line_fail_test { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ +- [config_params {KADM5_CONFIG_STASH_FILE} /does-not-exist] \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } "KDB_CANTREAD_STORED" +-} +-if {! $RPC} test107 +- +-test "init 108" +-proc test108 {} { +- global test +- +- one_line_fail_test { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ +- [config_params {KADM5_CONFIG_MKEY_NAME} does/not/exist] \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } "KRB5_KDB_CANTREAD_STORED" +-} +-if {! $RPC} test108 +- +-test "init 109-113" +-proc test109 {} { +- global test prompt +- +- delete_principal "$test/a" +- +- # I'd like to specify flags explicitly and check them, as in the +- # following config_params, but tcl gets mighty confused if I do and +- # I have no idea why. +-# [config_params {KADM5_CONFIG_MAX_LIFE KADM5_CONFIG_MAX_RLIFE KADM5_CONFIG_EXPIRATION KADM5_CONFIG_FLAGS KADM5_CONFIG_ENCTYPES} {10 20 30 KRB5_KDB_DISALLOW_TGT_BASED {}} ] +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ +- [config_params {KADM5_CONFIG_MAX_LIFE KADM5_CONFIG_MAX_RLIFE KADM5_CONFIG_EXPIRATION KADM5_CONFIG_ENCTYPES} {10 20 30 {}} ] \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- fail "$test: cannot init with max_life" +- return +- } +- if {! [cmd [format { +- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINCIPAL} testpass +- } $test]]} { +- fail "$test: can not create principal" +- return; +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" p \ +- {KADM5_PRINCIPAL_NORMAL_MASK KADM5_KEY_DATA} +- } $test]]} { +- fail "$test: can not get principal" +- return; +- } +- send "puts \$p\n" +- expect { +- -re "$prompt" { } +- timeout { +- error_and_restart "$test: timeout getting prompt" +- return +- } +- eof { +- error_and_restart "$test: eof getting prompt" +- return +- } +- } +- send "lindex \$p 4\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" {set max_life $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting max_life" +- return +- } +- eof { +- error_and_restart "$test: eof getting max_life" +- return +- } +- } +- send "lindex \$p 12\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" {set max_rlife $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting max_rlife" +- return +- } +- eof { +- error_and_restart "$test: eof getting max_rlife" +- return +- } +- } +- send "lindex \$p 1\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" {set expiration $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting expiration" +- return +- } +- eof { +- error_and_restart "$test: eof getting expiration" +- return +- } +- } +- send "lindex \$p 7\n" +- expect { +- -re "(\[A-Z_\]*)\n$prompt" {set flags $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting flags" +- return +- } +- eof { +- error_and_restart "$test: eof getting flags" +- return +- } +- } +- # This sorta worries me. Since the test is setting ENCTYPES to +- # nothing, the principal has no keys. That means that nothing is +- # printed for the keys in the correct case; but it feels too +- # likely that nothing will be printed in the case of some problem. +- send "lindex \$p 18\n" +- expect { +- -re "({.*})\n$prompt" {set key_data $expect_out(1,string) } +- -re "\n$prompt" { set key_data {} } +- timeout { +- error_and_restart "$test: timeout getting flags" +- return +- } +- eof { +- error_and_restart "$test: eof getting flags" +- return +- } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +- if {$max_life == 10} { +- pass "$test" +- } else { +- fail "$test: $max_life is not 10" +- } +- if {$max_rlife == 20} { +- pass "$test" +- } else { +- fail "$test: $max_rlife is not 20" +- } +- if {$expiration == 30} { +- pass "$test" +- } else { +- fail "$test: $expiration is not 30" +- } +- if {$flags == ""} { +- pass "$test" +- } else { +- fail "$test: flags $flags are wrong" +- } +- if {$key_data == {}} { +- pass "$test" +- } else { +- fail "$test: key_data $key_data is wrong" +- } +-} +-if {! $RPC} test109 +- +-test "init 116" +-proc test116 {} { +- global test +- +- delete_principal "$test/a" +- +- if {! [cmd {kadm5_init admin/get-add admin $KADM5_ADMIN_SERVICE \ +- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- get_add_handle}]} { +- error_and_restart "$test: couldn't init with admin/get-add" +- } +- +- if {! [cmd {kadm5_init admin/mod-delete admin $KADM5_ADMIN_SERVICE \ +- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- mod_delete_handle}]} { +- error_and_restart "$test: couldn't init with admin/get-add" +- } +- +- one_line_succeed_test { +- kadm5_get_principal $get_add_handle testuser p \ +- KADM5_PRINCIPAL_NORMAL_MASK +- } +- one_line_succeed_test [format { +- kadm5_create_principal $get_add_handle [simple_principal "%s/a"] \ +- {KADM5_PRINCIPAL} testpass +- } $test] +- one_line_fail_test { +- kadm5_modify_principal $get_add_handle [simple_principal testuser] \ +- {KADM5_PRINC_EXPIRE_TIME} +- } "AUTH_MODIFY" +- one_line_fail_test { +- kadm5_delete_principal $get_add_handle testuser +- } "AUTH_DELETE" +- +- one_line_fail_test { +- kadm5_get_principal $mod_delete_handle testuser p \ +- KADM5_PRINCIPAL_NORMAL_MASK +- } "AUTH_GET" +- one_line_fail_test [format { +- kadm5_create_principal $mod_delete_handle [simple_principal "%s/a"] \ +- {KADM5_PRINCIPAL} testpass +- } $test] "AUTH_ADD" +- one_line_succeed_test { +- kadm5_modify_principal $mod_delete_handle [simple_principal testuser] \ +- {KADM5_PRINC_EXPIRE_TIME} +- } +- one_line_succeed_test [format { +- kadm5_delete_principal $mod_delete_handle "%s/a" +- } $test] +- +- if {! [cmd {kadm5_destroy $get_add_handle}]} { +- error_and_restart "$test: couldn't close get_add_handle" +- } +- if {! [cmd {kadm5_destroy $mod_delete_handle}]} { +- error_and_restart "$test: couldn't close mod_delete_handle" +- } +-} +-if {$RPC} test116 +- +-test "init 117" +-proc test117 {} { +- global test env prompt +- +- if {[catch "exec grep max_life $env(KRB5_KDC_PROFILE)"] != 1} { +- warning \ +- "$test: max_life in $env(KRB5_KDC_PROFILE), cannot perform test" +- return +- } +- +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- fail "$test: unexpected failure in init" +- return +- } +- +- if {! [cmd [format { +- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINCIPAL} "%s/a" +- } $test $test]]} { +- perror "$test: unexpected failure creating principal" +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_MAX_LIFE +- } $test]]} { +- error_and_restart "$test: could not retrieve principal" +- return +- } +- send "lindex \$principal 4\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" {set max_life $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting max_life" +- return +- } +- eof { +- error_and_restart "$test: eof getting max_life" +- return +- } +- } +- +- if {$max_life == 86400} { +- pass "$test" +- } else { +- fail "$test: max_life $max_life should be 86400" +- } +- +- if {! [cmd {kadm5_destroy $server_handle}]} { +- error_and_restart "$test: couldn't close server_handle" +- } +-} +-test117 +- +-send "puts \$KADM5_ADMIN_SERVICE\n" +-expect { +- -re "(\[a-zA-Z/@\]+)\n$prompt" { +- set KADM5_ADMIN_SERVICE $expect_out(1,string) +- } +- default { +- error_and_restart "$test: timeout/eof getting admin_service" +- return +- } +-} +- +-send "puts \$KADM5_CHANGEPW_SERVICE\n" +-expect { +- -re "(\[a-zA-Z/@\]+)\n$prompt" { +- set KADM5_CHANGEPW_SERVICE $expect_out(1,string) +- } +- default { +- error_and_restart "$test: timeout/eof getting changepw_service" +- return +- } +-} +- +-test "init 150" +-proc test150 {} { +- global test KADM5_ADMIN_SERVICE +- +- kdestroy +- kinit testuser notathena "-S $KADM5_ADMIN_SERVICE" +- one_line_succeed_test { +- kadm5_init_with_creds testuser null $KADM5_ADMIN_SERVICE \ +- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } +- kdestroy +-} +-if {$RPC} test150 +- +-test "init 151" +-proc test151 {} { +- global test KADM5_CHANGEPW_SERVICE +- +- kdestroy +- kinit testuser notathena "-S $KADM5_CHANGEPW_SERVICE" +- one_line_succeed_test { +- kadm5_init_with_creds testuser null $KADM5_CHANGEPW_SERVICE \ +- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } +- kdestroy +-} +-if {$RPC} test151 +- +-test "init 152" +-proc test152 {} { +- global test KADM5_ADMIN_SERVICE +- +- kdestroy +- one_line_fail_test { +- kadm5_init_with_creds testuser null $KADM5_ADMIN_SERVICE \ +- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } "KRB5_FCC_NOFILE" +-} +-if {$RPC} test152 +- +-test "init 153" +-proc test153 {} { +- global test KADM5_ADMIN_SERVICE +- +- kinit testuser notathena +- one_line_fail_test { +- kadm5_init_with_creds testuser null $KADM5_ADMIN_SERVICE \ +- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } "KRB5_CC_NOTFOUND" +-} +-if {$RPC} test153 +- +-test "init 154" +-proc test154 {} { +- global test env +- +- set orig $env(KRB5_KDC_PROFILE) +- set env(KRB5_KDC_PROFILE) /does-not-exist +- api_exit; api_start +- set env(KRB5_KDC_PROFILE) $orig +- +- one_line_fail_test { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } "ENOENT" +- +- api_exit; lib_start_api +-} +-if {0 && ! $RPC} test154 +- +-return "" +diff --git a/src/lib/kadm5/unit-test/api.current/init.exp b/src/lib/kadm5/unit-test/api.current/init.exp +deleted file mode 100644 +index 8390b9cfa..000000000 +--- a/src/lib/kadm5/unit-test/api.current/init.exp ++++ /dev/null +@@ -1,699 +0,0 @@ +-load_lib lib.t +- +-# Assumptions: +-# +-# Principal "admin" exists, with "get", "add", "modify" and "delete" +-# access bits and password "admin". +-# The string "not-the-password" isn't the password of any user in the database. +-# Database master password is "mrroot". +- +-api_exit +-api_start +-test "init 1" +- +-one_line_fail_test_nochk \ +- {kadm5_init admin admin $KADM5_ADMIN_SERVICE \ +- [config_params {KADM5_CONFIG_REALM} {""}] \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 server_handle} +- +-test "init 2" +- +-one_line_fail_test_nochk \ +- {kadm5_init admin admin $KADM5_ADMIN_SERVICE \ +- [config_params {KADM5_CONFIG_REALM} {@}] \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 server_handle} +- +-test "init 2.5" +- +-one_line_fail_test_nochk \ +- {kadm5_init admin admin $KADM5_ADMIN_SERVICE \ +- [config_params {KADM5_CONFIG_REALM} {BAD.REALM}] \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 server_handle} +- +-test "init 3" +- +-proc test3 {} { +- global test +- if {! ([principal_exists "$test/a"] || [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- one_line_fail_test_nochk [format { +- kadm5_init admin admin "%s/a" null $KADM5_STRUCT_VERSION \ +- $KADM5_API_VERSION_3 server_handle +- } $test] +-} +-if {$RPC} { test3 } +- +-test "init 4" +- +-proc test4 {} { +- global test +- if {! ((! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- +- one_line_fail_test_nochk [format { +- kadm5_init admin admin "%s/a" null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } $test] +-} +-if {$RPC} { test4 } +- +-test "init 5" +- +-if {$RPC} { +- one_line_fail_test_nochk { +- kadm5_init admin admin admin null $KADM5_STRUCT_VERSION \ +- $KADM5_API_VERSION_3 server_handle +- } +-} +- +-test "init 6" +- +-proc test6 {} { +- global test +- +- send "kadm5_init admin null \$KADM5_ADMIN_SERVICE null \$KADM5_STRUCT_VERSION \$KADM5_API_VERSION_3 server_handle\n" +- +- expect { +- -re "assword\[^\r\n\]*:" { } +- eof { +- fail "$test: eof instead of password prompt" +- api_exit +- api_start +- return +- } +- timeout { +- fail "$test: timeout instead of password prompt" +- return +- } +- } +- one_line_succeed_test "admin" +- if {! [cmd {kadm5_destroy $server_handle}]} { +- error_and_restart "$test: couldn't close database" +- } +-} +-if { $RPC } { test6 } +- +-test "init 8" +- +-proc test8 {} { +- global test +- if {! ([principal_exists "$test/a"] || [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- one_line_fail_test_nochk [format { +- kadm5_init "%s/a" admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } $test] +-} +-if {$RPC} { test8 } +- +-test "init 9" +- +-if {$RPC} { +- global test +- one_line_fail_test_nochk { +- kadm5_init admin not-the-password $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } +-} +- +-test "init 10" +- +-proc test10 {} { +- global test +-# set prms_id 562 +-# setup_xfail {*-*-*} $prms_id +- one_line_fail_test_nochk { +- kadm5_init null admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } +-} +-test10 +- +-#test "init 11" +-# +-#proc test11 {} { +-# global test +-# set prms_id 563 +-# setup_xfail {*-*-*} $prms_id +-# one_line_fail_test_nochk { +-# kadm5_init "" admin $KADM5_ADMIN_SERVICE null \ +-# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +-# server_handle +-# } +-#} +-#test11 +- +-test "init 12" +- +-proc test12 {} { +- global test +- one_line_fail_test_nochk [format { +- kadm5_init "%s/a" admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } $test] +-} +-if {$RPC} { test12 } +- +-test "init 13" +- +-proc test13 {} { +- global test +- one_line_fail_test_nochk [format { +- kadm5_init "%s/a@SECURE-TEST.OV.COM" admin \ +- $KADM5_ADMIN_SERVICE null $KADM5_STRUCT_VERSION \ +- $KADM5_API_VERSION_3 server_handle +- } $test] +-} +-if {$RPC} { test13 } +- +-test "init 14" +- +-proc test14 {} { +- global test +- one_line_fail_test_nochk [format { +- kadm5_init "%s/a@BAD.REALM" admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } $test] +-} +-if {$RPC} { test14 } +- +-test "init 15" +- +-if {$RPC} { +- one_line_fail_test_nochk { +- kadm5_init admin@BAD.REALM admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } +-} +- +-test "init 16" +- +-proc test16 {} { +- global test +- one_line_succeed_test { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } +- if {! [cmd {kadm5_destroy $server_handle}]} { +- error_and_restart "$test: couldn't close database" +- } +-} +-test16 +- +-test "init 17" +- +-proc test17 {} { +- global test +- one_line_succeed_test { +- kadm5_init admin@SECURE-TEST.OV.COM admin \ +- $KADM5_ADMIN_SERVICE null $KADM5_STRUCT_VERSION \ +- $KADM5_API_VERSION_3 server_handle +- } +- if {! [cmd {kadm5_destroy $server_handle}]} { +- error_and_restart "$test: couldn't close database" +- } +-} +-test17 +- +-test "init 18" +- +-proc test18 {} { +- global test +- one_line_succeed_test { +- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } +- if {! [cmd {kadm5_destroy $server_handle}]} { +- error_and_restart "$test: couldn't close database" +- } +-} +-test18 +- +-test "init 19" +- +-proc test19 {} { +- global test +- one_line_succeed_test { +- kadm5_init admin@SECURE-TEST.OV.COM admin \ +- $KADM5_ADMIN_SERVICE \ +- [config_params {KADM5_CONFIG_REALM} {SECURE-TEST.OV.COM}] \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } +- if {! [cmd {kadm5_destroy $server_handle}]} { +- error_and_restart "$test: couldn't close database" +- } +-} +-test19 +- +-test "init 20" +- +-proc test20 {} { +- global test +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- error_and_restart "$test: couldn't init database" +- return +- } +- one_line_succeed_test \ +- {kadm5_get_principal $server_handle admin principal KADM5_PRINCIPAL_NORMAL_MASK} +- if {! [cmd {kadm5_destroy $server_handle}]} { +- error_and_restart "$test: couldn't close database" +- } +-} +-test20 +- +-#test "init 21" +-# +-#proc test21 {} { +-# global test +-# if {! [cmd { +-# kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ +-# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +-# server_handle +-# }]} { +-# error_and_restart "$test: couldn't init database" +-# return +-# } +-# one_line_fail_test_nochk { +-# kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +-# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +-# server_handle +-# } +-# if {! [cmd {kadm5_destroy $server_handle}]} { +-# error_and_restart "$test: couldn't close database" +-# } +-#} +-#test21 +- +- +-# proc test22 {} { +-# global test prompt +-# set prompting 0 +-# send [string trim { +-# kadm5_init admin null null null $KADM5_STRUCT_VERSION \ +-# $KADM5_API_VERSION_3 server_handle +-# }] +-# send "\n" +-# expect { +-# -re ":$" { set prompting 1} +-# -re "\nOK .*$prompt$" { fail "$test: premature success" } +-# -re "\nERROR .*$prompt$" { fail "$test: premature failure" } +-# timeout { fail "$test: timeout" } +-# eof { fail "$test: eof" } +-# } +-# if {$prompting} { +-# one_line_succeed_test mrroot +-# } +-# if {! [cmd {kadm5_destroy $server_handle}]} { +-# error_and_restart "$test: couldn't close database" +-# } +-# } +-# if {! $RPC} { test22 } +-# +-# test "init 22.5" +-# proc test225 {} { +-# global test prompt +-# set prompting 0 +-# send [string trim { +-# kadm5_init admin null null null $KADM5_STRUCT_VERSION \ +-# $KADM5_API_VERSION_3 server_handle +-# }] +-# send "\n" +-# expect { +-# -re ":$" { set prompting 1} +-# -re "\nOK .*$prompt$" { fail "$test: premature success" } +-# -re "\nERROR .*$prompt$" { fail "$test: premature failure" } +-# timeout { fail "$test: timeout" } +-# eof { fail "$test: eof" } +-# } +-# if {$prompting} { +-# one_line_succeed_test mrroot +-# } +-# if {! [cmd {kadm5_destroy $server_handle}]} { +-# error_and_restart "$test: couldn't close database" +-# } +-# } +-# if {! $RPC} { test225 } +- +-test "init 23" +- +-proc test23 {} { +- global test +- one_line_succeed_test { +- kadm5_init admin not-the-password $KADM5_ADMIN_SERVICE \ +- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } +- if {! [cmd {kadm5_destroy $server_handle}]} { +- error_and_restart "$test: couldn't close database" +- } +-} +-if {! $RPC} { test23 } +- +-test "init 24" +- +-proc test24 {} { +- global test +- one_line_succeed_test { +- kadm5_init admin admin null null $KADM5_STRUCT_VERSION \ +- $KADM5_API_VERSION_3 server_handle +- } +- if {! [cmd {kadm5_destroy $server_handle}]} { +- error_and_restart "$test: couldn't close database" +- } +-} +-if {! $RPC} { test24 } +- +-test "init 25" +- +-proc test25 {} { +- global test +- one_line_succeed_test { +- kadm5_init admin admin foobar null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } +- if {! [cmd {kadm5_destroy $server_handle}]} { +- error_and_restart "$test: couldn't close database" +- } +-} +-if {! $RPC} { test25 } +- +-test "init 26" +- +-#proc test26 {} { +-# global test +-# +-# api_exit +-# api_start +-# one_line_fail_test_nochk { +-# kadm5_get_principal $server_handle admin principal +-# } +-#} +-#test26 +- +-#test "init 27" +-# +-#proc test27 {} { +-# global test +-# +-# if {! ((! [principal_exists "$test/a"]) || [delete_principal "$test/a"])} { +-# error_and_restart "$test: couldn't delete principal \"$test/a\"" +-# return +-# } +-# begin_dump +-# if {[cmd [format { +-# kadm5_create_principal $server_handle [simple_principal \ +-# "%s/a"] {KADM5_PRINCIPAL} "%s/a" +-# } $test $test]]} { +-# fail "$test: unexpected success in add" +-# return +-# } +-# end_dump_compare "no-diffs" +-#} +-#test27 +- +-#test "init 28" +-# +-#proc test28 {} { +-# global test prompt +-# +-# if {! ([principal_exists "$test/a"] || [create_principal "$test/a"])} { +-# error_and_restart "$test: couldn't create principal \"$test/a\"" +-# return +-# } +-# begin_dump +-# if {! ([cmd { +-# kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +-# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +-# server_handle +-# }] && [cmd [format { +-# kadm5_get_principal $server_handle "%s/a" principal +-# } $test]])} { +-# error_and_restart "$test: error getting principal" +-# return; +-# } +-# send "lindex \$principal 8\n" +-# expect { +-# -re "\n(\[0-9\]+).*$prompt$" {set kvno $expect_out(1,string) } +-# timeout { +-# error_and_restart "$test: timeout getting principal kvno" +-# return +-# } +-# eof { +-# error_and_restart "$test: eof getting principal kvno" +-# return +-# } +-# } +-# api_exit +-# api_start +-# set new_kvno [expr "$kvno + 1"] +-# if {[cmd [format { +-# kadm5_modify_principal $server_handle \ +-# {"%s/a" 0 0 0 0 0 0 0 %d 0 0 0} {KADM5_KVNO} +-# } $test $new_kvno]]} { +-# fail "$test: unexpected success in modify" +-# return; +-# } +-# end_dump_compare "no-diffs" +-#} +-#test28 +- +-#test "init 29" +-# +-#proc test29 {} { +-# global test +-# +-# if {! ([principal_exists "$test/a"] || [create_principal "$test/a"])} { +-# error_and_restart "$test: couldn't create principal \"$test/a\"" +-# return +-# } +-# begin_dump +-# if {[cmd [format { +-# kadm5_delete_principal $server_handle "%s/a" +-# } $test]]} { +-# fail "$test: unexpected success in delete" +-# return +-# } +-# end_dump_compare "no-diffs" +-#} +-#test29 +- +-test "init 30" +-proc test30 {} { +- global test +- if {[cmd { +- kadm5_init admin foobar $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- error_and_restart "$test: unexpected success" +- return +- } +- one_line_succeed_test { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } +- if {! [cmd {kadm5_destroy $server_handle}]} { +- error_and_restart "$test: couldn't close database" +- } +-} +-if ${RPC} { test30 } +- +-test "init 31" +-proc test31 {} { +- global test +- one_line_fail_test { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $bad_struct_version_mask $KADM5_API_VERSION_3 \ +- server_handle +- } "BAD_STRUCT_VERSION" +-} +-test31 +- +-test "init 32" +-proc test32 {} { +- global test +- one_line_fail_test { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $no_struct_version_mask $KADM5_API_VERSION_3 \ +- server_handle +- } "BAD_STRUCT_VERSION" +-} +-test32 +- +-test "init 33" +-proc test33 {} { +- global test +- one_line_fail_test { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $old_struct_version $KADM5_API_VERSION_3 \ +- server_handle +- } "OLD_STRUCT_VERSION" +-} +-test33 +- +-test "init 34" +-proc test34 {} { +- global test +- one_line_fail_test { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $new_struct_version $KADM5_API_VERSION_3 \ +- server_handle +- } "NEW_STRUCT_VERSION" +-} +-test34 +- +-test "init 35" +-proc test35 {} { +- global test +- one_line_fail_test { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $bad_api_version_mask \ +- server_handle +- } "BAD_API_VERSION" +-} +-test35 +- +-test "init 36" +-proc test36 {} { +- global test +- one_line_fail_test { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $no_api_version_mask \ +- server_handle +- } "BAD_API_VERSION" +-} +-test36 +- +-test "init 37" +-proc test37 {} { +- global test +- one_line_fail_test { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $old_api_version \ +- server_handle +- } "OLD_LIB_API_VERSION" +-} +-if { $RPC } test37 +- +-test "init 38" +-proc test38 {} { +- global test +- one_line_fail_test { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $old_api_version \ +- server_handle +- } "OLD_SERVER_API_VERSION" +-} +-if { ! $RPC } test38 +- +-test "init 39" +-proc test39 {} { +- global test +- one_line_fail_test { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $new_api_version \ +- server_handle +- } "NEW_LIB_API_VERSION" +-} +-if { $RPC } test39 +- +-test "init 40" +-proc test40 {} { +- global test +- one_line_fail_test { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $new_api_version \ +- server_handle +- } "NEW_SERVER_API_VERSION" +-} +-if { ! $RPC } test40 +- +-test "init 41" +-proc test41 {} { +- global test +- one_line_fail_test { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_API_VERSION_3 $KADM5_STRUCT_VERSION \ +- server_handle +- } "BAD_" +-} +-test41 +- +-test "init 42" +-proc test42 {} { +- global test +- one_line_succeed_test { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } +- if {! [cmd {kadm5_destroy $server_handle}]} { +- error_and_restart "$test: couldn't close database" +- } +-} +-test42 +- +- +-proc test45_46 {service} { +- global test kadmin_local env +- +- spawn $kadmin_local -q "delprinc -force $service" +- expect { +- -re "Principal .* deleted." {} +- default { +- perror "kadmin.local delprinc failed\n"; +- } +- } +- expect eof +- wait +- +- one_line_fail_test [concat {kadm5_init admin admin } \ +- $service \ +- { null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle}] "SECURE_PRINC_MISSING" +- +- # this leaves the keytab with an incorrect entry +- spawn $kadmin_local -q "ank -randkey $service" +- expect eof +- wait +- +- # restart the api so it gets a new ccache +- api_exit +- api_start +-} +- +-if {$RPC} { +- test "init 45" +- +- test45_46 kadmin/admin +- +- test "init 46" +- +- test45_46 kadmin/changepw +-} +- +-return "" +- +diff --git a/src/lib/kadm5/unit-test/api.current/mod-policy.exp b/src/lib/kadm5/unit-test/api.current/mod-policy.exp +deleted file mode 100644 +index 1bf00b524..000000000 +--- a/src/lib/kadm5/unit-test/api.current/mod-policy.exp ++++ /dev/null +@@ -1,711 +0,0 @@ +-load_lib lib.t +-api_exit +-api_start +- +-test "modify-policy 2" +-proc test2 {} { +- global test +- +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_PW_MAX_LIFE} +- } $test] "AUTH_MODIFY" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} { test2 } +- +-test "modify-policy 8" +-proc test8 {} { +- global test +-# set prms_id 744 +-# setup_xfail {*-*-*} $prms_id +- +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test { +- kadm5_modify_policy $server_handle [simple_policy ""] \ +- {KADM5_PW_MAX_LIFE} +- } "BAD_POLICY" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test8 +- +-test "modify-policy 9" +-proc test9 {} { +- global test +- global prompt +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_PW_MIN_LIFE} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retrieve policy" +- return +- } +- send "lindex \$policy 1\n" +- expect { +- -re "0\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test9 +- +-test "modify-policy 10" +-proc test10 {} { +- global test +- global prompt +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_policy $server_handle {"%s/a" 32 0 0 0 0 0 0 0 0} \ +- {KADM5_PW_MIN_LIFE} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retrieve policy" +- return +- } +- send "lindex \$policy 1\n" +- expect { +- -re "32\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test10 +- +- +-test "modify-policy 11" +-proc test11 {} { +- global test +- global prompt +- +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_PW_MAX_LIFE} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retrieve policy" +- return +- } +- send "lindex \$policy 2\n" +- expect { +- -re "0\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test11 +- +-test "modify-policy 12" +-proc test12 {} { +- global test +- global prompt +- +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_policy $server_handle {"%s/a" 0 32 0 0 0 0 0 0 0} \ +- {KADM5_PW_MAX_LIFE} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retrieve policy" +- return +- } +- send "lindex \$policy 2\n" +- expect { +- -re "32\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test12 +- +-test "modify-policy 13" +-proc test13 {} { +- global test +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_PW_MIN_LENGTH} +- } $test] "BAD_LENGTH" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test13 +- +-test "modify-policy 14" +-proc test14 {} { +- global test +- global prompt +- +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_policy $server_handle {"%s/a" 0 0 8 0 0 0 0 0 0} \ +- {KADM5_PW_MIN_LENGTH} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retrieve policy" +- return +- } +- send "lindex \$policy 3\n" +- expect { +- -re "8\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test14 +- +-test "modify-policy 15" +-proc test15 {} { +- global test +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_PW_MIN_CLASSES} +- } $test] "BAD_CLASS" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test15 +- +-test "modify-policy 16" +-proc test16 {} { +- global test +- global prompt +- +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 1 0 0 0 0 0} \ +- {KADM5_PW_MIN_CLASSES} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retrieve policy" +- return +- } +- send "lindex \$policy 4\n" +- expect { +- -re "1\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test16 +- +-test "modify-policy 17" +-proc test17 {} { +- global test +- global prompt +- +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a"])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 5 0 0 0 0 0} \ +- {KADM5_PW_MIN_CLASSES} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retrieve policy" +- return +- } +- send "lindex \$policy 4\n" +- expect { +- -re "5\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test17 +- +-test "modify-policy 18" +-proc test18 {} { +- global test +- global prompt +- +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a" ])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 6 0 0 0 0 0} \ +- {KADM5_PW_MIN_CLASSES} +- } $test] "BAD_CLASS" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test18 +- +-test "modify-policy 19" +-proc test19 {} { +- global test +- +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a" ])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_PW_HISTORY_NUM} +- } $test] "BAD_HISTORY" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test19 +- +-test "modify-policy 20" +-proc test20 {} { +- global test +- global prompt +- +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a" ])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 0 1 0 0 0 0} \ +- {KADM5_PW_HISTORY_NUM} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retrieve policy" +- return +- } +- send "lindex \$policy 5\n" +- expect { +- -re "1\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test20 +- +-test "modify-policy 21" +-proc test21 {} { +- global test +- global prompt +- +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a" ])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 0 10 0 0 0 0} \ +- {KADM5_PW_HISTORY_NUM} +- } $test]]} { +- fail $test +- return +- } +- if {! [cmd [format { +- kadm5_get_policy $server_handle "%s/a" policy +- } $test]]} { +- fail "$test: can not retrieve policy" +- return +- } +- send "lindex \$policy 5\n" +- expect { +- -re "10\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test21 +- +-test "modify-policy 22" +-proc test22 {} { +- global test +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a" ])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_PW_MAX_LIFE} +- } $test] "AUTH_MODIFY" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} test22 +- +-test "modify-policy 23" +-proc test23 {} { +- global test +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a" ])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_PW_MAX_LIFE} +- } $test] "AUTH_MODIFY" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} test23 +- +-test "modify-policy 26" +-proc test26 {} { +- global test +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a" ])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test [format { +- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ +- {KADM5_PW_MAX_LIFE} +- } $test] +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test26 +- +-test "modify-policy 30" +-proc test30 {} { +- global test +- +- one_line_fail_test [format { +- kadm5_modify_policy null [simple_policy "%s/a"] \ +- {KADM5_PW_MAX_LIFE} +- } $test] "BAD_SERVER_HANDLE" +-} +-test30 +- +-test "modify-policy 31" +-proc test31 {} { +- global test +- if {! (( [policy_exists "$test/a"]) || +- [create_policy "$test/a" ])} { +- error_and_restart "$test: couldn't create policy \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test [format { +- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 0 0 0 2 0 0} \ +- {KADM5_PW_MAX_FAILURE} +- } $test] +- one_line_succeed_test [format { +- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 1 0 0 0 90 0} \ +- {KADM5_PW_FAILURE_COUNT_INTERVAL} +- } $test] +- one_line_succeed_test [format { +- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 1 0 0 0 0 180} \ +- {KADM5_PW_LOCKOUT_DURATION} +- } $test] +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test31 +- +-return "" +diff --git a/src/lib/kadm5/unit-test/api.current/mod-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/mod-principal-v2.exp +deleted file mode 100644 +index 4abbeb52d..000000000 +--- a/src/lib/kadm5/unit-test/api.current/mod-principal-v2.exp ++++ /dev/null +@@ -1,115 +0,0 @@ +-load_lib lib.t +-api_exit +-api_start +- +-test "modify-principal 100-105" +-proc test100_104 {} { +- global test +- global prompt +- +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- +- set origtest "$test" +- +- test "modify-principal 100" +- one_line_succeed_test [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_MAX_RLIFE} +- } $origtest] +- +- test "modify-principal 101" +- one_line_fail_test [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_LAST_SUCCESS} +- } $origtest] "BAD_MASK" +- +- test "modify-principal 102" +- one_line_fail_test [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_LAST_FAILED} +- } $origtest] "BAD_MASK" +- +-# This is now permitted to reset lockout count +-# test "modify-principal 103" +-# one_line_fail_test [format { +-# kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +-# {KADM5_FAIL_AUTH_COUNT} +-# } $origtest] "BAD_MASK" +- +- test "modify-principal 103.5" +- one_line_fail_test [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_KEY_DATA} +- } $origtest] "BAD_MASK" +- +- test "modify-principal 105" +- one_line_fail_test [format { +- kadm5_modify_principal $server_handle \ +- "{%s/a} 0 0 0 0 {%s/a} 0 0 0 0 null 0 0 0 0 0 0 1 {} {{1 1 x}}" \ +- {KADM5_TL_DATA} +- } $origtest $origtest] "BAD_TL_TYPE" +- +- test "modify-principal 100,104" +- if { ! [cmd [format { +- kadm5_modify_principal $server_handle \ +- "{%s/a} 0 0 0 0 {%s/a} 0 0 0 0 null 0 88 0 0 0 0 1 {} {{990 6 foobar}}" \ +- {KADM5_MAX_RLIFE KADM5_TL_DATA} +- } $origtest $origtest]]} { +- fail "$test: cannot set MAX_RLIFE or TL_DATA" +- return +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal {KADM5_PRINCIPAL_NORMAL_MASK KADM5_TL_DATA} +- } $origtest]]} { +- error_and_restart "$test: could not retrieve principal" +- return +- } +- send "lindex \$principal 12\n" +- expect { +- -re "(\[0-9\]+)\n$prompt$" {set rlife $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting rlife" +- return +- } +- eof { +- error_and_restart "$test: eof getting rlife" +- return +- } +- } +- send "lindex \$principal 19\n" +- expect { +- -re "\(\{.*\}\)\n$prompt$" {set tl $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting tl_data" +- return +- } +- eof { +- error_and_restart "$test: eof getting tl_data" +- return +- } +- } +- if {($rlife == 88) && ($tl == "{{990 6 foobar}}")} { +- pass "$test" +- } else { +- fail "$test: $rlife should be 88, $tl should be {{990 6 foobar}}" +- } +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test100_104 +diff --git a/src/lib/kadm5/unit-test/api.current/mod-principal.exp b/src/lib/kadm5/unit-test/api.current/mod-principal.exp +deleted file mode 100644 +index ac9f96845..000000000 +--- a/src/lib/kadm5/unit-test/api.current/mod-principal.exp ++++ /dev/null +@@ -1,1606 +0,0 @@ +-load_lib lib.t +-api_exit +-api_start +- +-#test "modify-principal 1" +-#proc test1 {} { +-# global test +-# one_line_fail_test [format { +-# kadm5_modify_principal $server_handle [simple_principal \ +-# "%s/a"] {KADM5_PW_EXPIRATION} +-# } $test] "NOT_INIT" +-#} +-#test1 +- +-test "modify-principal 2" +-proc test2 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINC_EXPIRE_TIME} +- } $test] "AUTH_MODIFY" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} { test2 } +- +-test "modify-principal 4" +-proc test4 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINCIPAL} +- } $test] "BAD_MASK" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test4 +- +- +-test "modify-principal 5" +-proc test5 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_LAST_PWD_CHANGE} +- } $test] "BAD_MASK" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test5 +- +-test "modify-principal 6" +-proc test6 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_MOD_TIME} +- } $test] "BAD_MASK" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test6 +- +-test "modify-principal 7" +-proc test7 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_MOD_NAME} +- } $test] "BAD_MASK" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test7 +- +-test "modify-principal 8" +-proc test8 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_MKVNO} +- } $test] "BAD_MASK" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test8 +- +-test "modify-principal 9" +-proc test9 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_AUX_ATTRIBUTES} +- } $test] "BAD_MASK" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test9 +- +-test "modify-principal 10" +-proc test10 {} { +- global test +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINC_EXPIRE_TIME} +- } $test] "UNK_PRINC" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test10 +- +-test "modify-principal 11" +-proc test11 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINC_EXPIRE_TIME} +- } $test] "AUTH_MOD" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if { $RPC } { test11 } +- +-test "modify-principal 12" +-proc test12 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINC_EXPIRE_TIME} +- } $test] "AUTH_MOD" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if { $RPC } { test12 } +- +-test "modify-principal 13" +-proc test13 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINC_EXPIRE_TIME} +- } $test] "AUTH_MOD" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if { $RPC } { test13 } +- +-test "modify-principal 14" +-proc test14 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINC_EXPIRE_TIME} +- } $test] "AUTH_MOD" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if { $RPC } { test14 } +- +-test "modify-principal 15" +-proc test15 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINC_EXPIRE_TIME} +- } $test] +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test15 +- +-test "modify-principal 17" +-proc test17 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test [format { +- kadm5_modify_principal $server_handle [princ_w_pol "%s/a" \ +- no-policy] {KADM5_POLICY} +- } $test] +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test17 +- +-test "modify-principal 21.5" +-proc test21.5 {} { +- global test +- global prompt +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if { !( [create_principal_pol "$test/a" "test-pol"])} { +- error_and_restart "$test: could not create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if { ! [cmd {kadm5_get_policy $server_handle test-pol old_p1}]} { +- perror "$test: unexpected failure on get policy" +- return +- } +- if {! [cmd [format { +- kadm5_modify_principal $server_handle [princ_w_pol "%s/a" \ +- test-pol] {KADM5_POLICY} +- } $test]]} { +- fail "$test: modify failed" +- return +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- error_and_restart "$test: could not retrieve principal" +- return +- } +- send "lindex \$old_p1 6\n" +- expect { +- -re "(\[0-9\]+)\n$prompt$" {set old_p1_ref $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting principal kvno (second time)" +- return +- } +- eof { +- error_and_restart "$test: eof getting principal kvno (second time)" +- return +- } +- } +- +- if { ! [cmd {kadm5_get_policy $server_handle test-pol new_p1}]} { +- perror "$test: unexpected failure on get policy" +- return +- } +- +- send "lindex \$new_p1 6\n" +- expect { +- -re "(\[0-9\]+)\n$prompt$" {set new_p1_ref $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting principal kvno (second time)" +- return +- } +- eof { +- error_and_restart "$test: eof getting principal kvno (second time)" +- return +- } +- } +- +- if {$old_p1_ref != $new_p1_ref} { +- fail "$test: policy reference count changed ($old_p1_ref to $new_p1_ref)" +- return +- } +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test21.5 +- +-test "modify-principal 22" +-proc test22 {} { +- global test +- global prompt +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if { ! [cmd [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PW_EXPIRATION} +- } $test]]} { +- fail "$test: modify failed" +- return +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- error_and_restart "$test: could not retrieve principal" +- return +- } +- send "lindex \$principal 3\n" +- expect { +- -re "0\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test22 +- +-test "modify-principal 23" +-proc test23 {} { +- global test +- global prompt +- if {! (( [principal_exists "$test/a"]) || +- [create_principal_pol "$test/a" test-pol-nopw])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if { ! [cmd [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PW_EXPIRATION} +- } $test]]} { +- fail "$test: modify failed" +- return +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- error_and_restart "$test: could not retrieve principal" +- return +- } +- send "lindex \$principal 3\n" +- expect { +- -re "0\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test23 +- +-test "modify-principal 24" +-proc test24 {} { +- global test +- global prompt +- +- if {! (( [principal_exists "$test/a"]) || +- [create_principal_pol "$test/a" "test-pol" ])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- error_and_restart "$test: unexpected failure in init" +- return +- } +- if { ! [cmd [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PW_EXPIRATION} +- } $test]]} { +- fail "$test: could not modify principal" +- return +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- error_and_restart "$test: could not retrieve principal" +- return +- } +- if { ! [cmd [format { +- kadm5_get_policy $server_handle %s policy +- } test-pol]]} { +- error_and_restart "$test: cannot retrieve policy" +- return +- } +- send "lindex \$principal 2\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" {set pw_mod_date $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting mod_date" +- return +- } +- eof { +- error_and_restart "$test: eof getting pw_mod_date" +- return +- } +- } +- +- send "lindex \$principal 3\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" {set pw_expire $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting pw_expire" +- return +- } +- eof { +- error_and_restart "$test: eof getting pw_expire" +- return +- } +- } +- +- send "lindex \$policy 2\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" {set pw_max_life $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting pw_max_life" +- return +- } +- eof { +- error_and_restart "$test: eof getting pw_max_life" +- return +- } +- } +- if { $pw_expire != 0 } { +- fail "$test: pw_expire $pw_expire should be 0" +- return +- } else { +- pass "$test" +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test24 +- +-test "modify-principal 25" +-proc test25 {} { +- global test +- global prompt +- +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if { ! [cmd [format { +- kadm5_modify_principal $server_handle \ +- {"%s/a" 0 0 1234 0 0 0 0 0 0 0 0} {KADM5_PW_EXPIRATION} +- } $test]]} { +- fail "$test: modify failed" +- return +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- error_and_restart "$test: could not retrieve principal" +- return +- } +- send "lindex \$principal 3\n" +- expect { +- -re "1234\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test25 +- +-test "modify-principal 26" +-proc test26 {} { +- global test +- global prompt +- +- if {! (( [principal_exists "$test/a"]) || +- [create_principal_pol "$test/a" "test-pol-nopw" ])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if { ! [cmd [format { +- kadm5_modify_principal $server_handle \ +- {"%s/a" 0 0 1234 0 0 0 0 0 0 0 0} {KADM5_PW_EXPIRATION} +- } $test]]} { +- fail "$test: modify failed" +- return +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- error_and_restart "$test: could not retrieve principal" +- return +- } +- send "lindex \$principal 3\n" +- expect { +- -re "1234\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test26 +- +-test "modify-principal 27" +-proc test27 {} { +- global test +- global prompt +- +- if {! (( [principal_exists "$test/a"]) || +- [create_principal_pol "$test/a" "test-pol" ])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if { ! [cmd [format { +- kadm5_modify_principal $server_handle \ +- {"%s/a" 0 0 1234 0 0 0 0 0 0 0 0} {KADM5_PW_EXPIRATION} +- } $test]]} { +- fail "$test: modify failed" +- return +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- error_and_restart "$test: could not retrieve principal" +- return +- } +- send "lindex \$principal 3\n" +- expect { +- -re "1234\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test27 +- +-test "modify-principal 28" +-proc test28 {} { +- global test +- global prompt +-# set prms_id 1358 +-# setup_xfail {*-*-*} $prms_id +- +- if {! (( [principal_exists "$test/a"]) || +- [create_principal_pol "$test/a" "test-pol" ])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if { ! [cmd [format { +- kadm5_modify_principal $server_handle \ +- {"%s/a" 0 0 999999999 0 0 0 0 0 0 0 0} {KADM5_PW_EXPIRATION} +- } $test]]} { +- fail "$test: modify failed" +- return +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- error_and_restart "$test: could not retrieve principal" +- return +- } +- if { ! [cmd {kadm5_get_policy $server_handle test-pol policy}]} { +- error_and_restart "$test: cannot retrieve policy" +- return +- } +- send "lindex \$principal 2\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" {set pw_mod_date $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting pw_mod_date" +- return +- } +- eof { +- error_and_restart "$test: eof getting pw_mod_date" +- return +- } +- } +- +- send "lindex \$principal 3\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" {set pw_expire $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting pw_expire" +- return +- } +- eof { +- error_and_restart "$test: eof getting pw_expire" +- return +- } +- } +- send "lindex \$policy 2\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" {set pw_max_life $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting pw_max_life" +- return +- } +- eof { +- error_and_restart "$test: eof getting pw_max_life" +- return +- } +- } +- if { $pw_expire != 999999999 } { +- fail "$test: pw_expire $pw_expire should be 999999999" +- return +- } +- pass "$test" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test28 +- +-test "modify-principal 29" +-proc test29 {} { +- global test +- global prompt +- +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if { ! ([create_principal_pol "$test/a" test-pol])} { +- perror "$test: unexpected failure in creating principal" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if { ! [cmd [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_POLICY_CLR} +- } $test]]} { +- fail "$test: modify failed" +- return +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- error_and_restart "$test: could not retrieve principal" +- return +- } +- send "lindex \$principal 3\n" +- expect { +- -re "0\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test29 +- +-test "modify-principal 30" +-proc test30 {} { +- global test +- global prompt +- +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! ([create_principal_pol "$test/a" test-pol])} { +- perror "$test: unexpected failure in creating principal" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if { ! [cmd [format { +- kadm5_modify_principal $server_handle [princ_w_pol "%s/a" \ +- test-pol-nopw] {KADM5_POLICY} +- } $test]]} { +- fail "$test: modify failed" +- return +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- error_and_restart "$test: could not retrieve principal" +- return +- } +- send "lindex \$principal 3\n" +- expect { +- -re "0\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test30 +- +-test "modify-principal 31" +-proc test31 {} { +- global test +- global prompt +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! ([create_principal "$test/a"])} { +- perror "$test: unexpected failure in creating principal" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if { ! [cmd [format { +- kadm5_modify_principal $server_handle [princ_w_pol "%s/a" \ +- test-pol] {KADM5_POLICY} +- } $test]]} { +- fail "modify failed" +- return +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- error_and_restart "$test: could not retrieve principal" +- return +- } +- if { ! [cmd {kadm5_get_policy $server_handle test-pol policy}]} { +- error_and_restart "$test: cannot retrieve policy" +- return +- } +- send "lindex \$principal 2\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" {set pw_mod_date $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting pw_mod_date" +- return +- } +- eof { +- error_and_restart "$test: eof getting pw_mod_date" +- return +- } +- } +- +- send "lindex \$principal 3\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" {set pw_expire $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting pw_expire" +- return +- } +- eof { +- error_and_restart "$test: eof getting pw_expire" +- return +- } +- } +- +- send "lindex \$policy 2\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" {set pw_max_life $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting pw_max_life" +- return +- } +- eof { +- error_and_restart "$test: eof getting pw_max_life" +- return +- } +- } +- if { [expr "$pw_mod_date + $pw_max_life"] != $pw_expire } { +- fail "$test: pw_expire is wrong" +- return +- } +- +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test31 +- +-test "modify-principal 32" +-proc test32 {} { +- global test +- global prompt +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! ([create_principal "$test/a"])} { +- perror "$test: unexpected failure in creating principal" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_principal $server_handle \ +- {"%s/a" 1234 0 0 0 0 0 0 0 0 0 0} \ +- {KADM5_PRINC_EXPIRE_TIME} +- } $test]]} { +- fail "$test: modify failed" +- return +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- error_and_restart "$test: could not retrieve principal" +- return +- } +- send "lindex \$principal 1\n" +- expect { +- -re "1234\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test32 +- +-test "modify-principal 33" +-proc test33 {} { +- global test +- global prompt +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! ([create_principal "$test/a"])} { +- perror "$test: unexpected failure in creating principal" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_principal $server_handle \ +- {"%s/a" 0 0 0 0 0 0 KRB5_KDB_DISALLOW_ALL_TIX 0 0 0 0} \ +- {KADM5_ATTRIBUTES} +- } $test]]} { +- fail "$test: modified fail" +- return +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- error_and_restart "$test: could not retrieve principal" +- return +- } +- send "lindex \$principal 7\n" +- expect { +- -re "KRB5_KDB_DISALLOW_ALL_TIX.*$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test33 +- +-test "modify-principal 33.25" +-proc test3325 {} { +- global test +- global prompt +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! ([create_principal "$test/a"])} { +- perror "$test: unexpected failure in creating principal" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_principal $server_handle \ +- {"%s/a" 0 0 0 0 0 0 KRB5_KDB_REQUIRES_PWCHANGE 0 0 0 0} \ +- {KADM5_ATTRIBUTES} +- } $test]]} { +- fail "$test: modified fail" +- return +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- error_and_restart "$test: could not retrieve principal" +- return +- } +- send "lindex \$principal 7\n" +- expect { +- -re "KRB5_KDB_REQUIRES_PWCHANGE.*$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test3325 +- +-test "modify-principal 33.5" +-proc test335 {} { +- global test +- global prompt +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! ([create_principal "$test/a"])} { +- perror "$test: unexpected failure in creating principal" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_principal $server_handle \ +- {"%s/a" 0 0 0 0 0 0 KRB5_KDB_DISALLOW_TGT_BASED 0 0 0 0} \ +- {KADM5_ATTRIBUTES} +- } $test]]} { +- fail "$test: modified fail" +- return +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- error_and_restart "$test: could not retrieve principal" +- return +- } +- send "lindex \$principal 7\n" +- expect { +- -re "KRB5_KDB_DISALLOW_TGT_BASED.*$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test335 +- +- +-test "modify-principal 34" +-proc test34 {} { +- global test +- global prompt +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! ([create_principal "$test/a"])} { +- perror "$test: unexpected failure in creating principal" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if { ! [cmd [format { +- kadm5_modify_principal $server_handle \ +- {"%s/a" 0 0 0 3456 0 0 0 0 0 0 0} {KADM5_MAX_LIFE} +- } $test]]} { +- fail "$test: modify failed" +- return +- } +- +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- error_and_restart "$test: could not retrieve principal" +- return +- } +- send "lindex \$principal 4\n" +- expect { +- -re "3456\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test34 +- +-test "modify-principal 35" +-proc test35 {} { +- global prompt +- global test +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! ([create_principal "$test/a"])} { +- perror "$test: unexpected failure in creating principal" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if { ! [cmd [format { +- kadm5_modify_principal $server_handle \ +- {"%s/a" 0 0 0 0 0 0 0 7 0 0 0} {KADM5_KVNO} +- } $test]]} { +- fail "$test: modify failed" +- return +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- error_and_restart "$test: could not retrieve principal" +- return +- } +- send "lindex \$principal 8\n" +- expect { +- -re "7\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test35 +- +-test "modify-principal 36" +-proc test36 {} { +- global test +- global prompt +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if { !( [create_principal_pol "$test/a" "test-pol"])} { +- error_and_restart "$test: could not create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if { ! [cmd {kadm5_get_policy $server_handle test-pol pol}]} { +- perror "$test: unexpected failure on get policy" +- return +- } +- if {! [cmd [format { +- kadm5_modify_principal $server_handle [princ_w_pol "%s/a" \ +- test-pol] {KADM5_POLICY} +- } $test]]} { +- fail "$test: modify failed" +- return +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- error_and_restart "$test: could not retrieve principal" +- return +- } +- send "lindex \$principal 10\n" +- expect { +- -re "test-pol\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- send "lindex \$pol 6\n" +- expect { +- -re "(\[0-9\]+)\n$prompt$" {set oldref $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting principal kvno (second time)" +- return +- } +- eof { +- error_and_restart "$test: eof getting principal kvno (second time)" +- return +- } +- } +- if { ! [cmd {kadm5_get_policy $server_handle test-pol pol2}]} { +- perror "$test: unexpected failure on get policy" +- return +- } +- send "lindex \$pol2 6\n" +- expect { +- -re "(\[0-9\]+)\n$prompt$" {set newref $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting principal kvno (second time)" +- return +- } +- eof { +- error_and_restart "$test: eof getting principal kvno (second time)" +- return +- } +- } +- if { $oldref != $newref } { +- fail "$test: policy reference count is wrong" +- return; +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test36 +- +-test "modify-principal 37" +-proc test37 {} { +- global test +- global prompt +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if { !( [create_principal "$test/a"])} { +- error_and_restart "$test: could not create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_POLICY_CLR} +- } $test]]} { +- fail "$test: modify failed" +- return +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test37 +- +-test "modify-principal 38" +-proc test38 {} { +- global test +- global prompt +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! ([create_principal "$test/a"])} { +- perror "$test: unexpected failure in creating principal" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_PRINC_EXPIRE_TIME} +- } $test]]} { +- fail "$test: modify failed" +- return +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- error_and_restart "$test: could not retrieve principal" +- return +- } +- send "lindex \$principal 1\n" +- expect { +- -re "0\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test38 +- +-test "modify-principal 39" +-proc test39 {} { +- global test +- global prompt +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! ([create_principal "$test/a"])} { +- perror "$test: unexpected failure in creating principal" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ +- {KADM5_MAX_LIFE} +- } $test]]} { +- fail "$test: modify failed" +- return +- } +- if {! [cmd [format { +- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK +- } $test]]} { +- error_and_restart "$test: could not retrieve principal" +- return +- } +- send "lindex \$principal 4\n" +- expect { +- -re "0\n$prompt$" { pass "$test" } +- timeout { fail "$test" } +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test39 +- +-test "modify-principal 40" +-proc test40 {} { +- global test +- global prompt +- +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test { +- kadm5_modify_principal $server_handle null \ +- {KADM5_PRINC_EXPIRE_TIME} +- } "EINVAL" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test40 +- +-test "modify-principal 43" +-proc test43 {} { +- global test +- one_line_fail_test [format { +- kadm5_modify_principal null [simple_principal \ +- "%s/a"] {KADM5_PW_EXPIRATION} +- } $test] "BAD_SERVER_HANDLE" +-} +-test43 +- +-test "modify-principal 44" +-proc test44 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- # setting fail auth count to a non-zero value must fail +- one_line_fail_test [format { +- kadm5_modify_principal $server_handle \ +- {"%s/a" 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1234 0 0 {} {}} {KADM5_FAIL_AUTH_COUNT} +- } $test] "BAD_SERVER_PARAMS" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test44 +- +-return "" +diff --git a/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp +deleted file mode 100644 +index 2925c1c43..000000000 +--- a/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp ++++ /dev/null +@@ -1,61 +0,0 @@ +-load_lib lib.t +-api_exit +-api_start +- +-test "randkey-principal 100" +-proc test100 {} { +- global test prompt +- +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [create_principal "$test/a"]} { +- error_and_restart "$test: creating principal" +- return +- } +- +- # I'd like to specify a long list of keysalt tuples and make sure that +- # randkey does the right thing, but we can only use those enctypes that +- # krbtgt has a key for: 3DES and AES, according to the prototype kdc.conf. +- if {! [cmd [format { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_randkey_principal $server_handle "%s/a" keys num_keys +- } $test]]} { +- perror "$test: unexpected failure in randkey_principal" +- } +- send "puts \$num_keys\n" +- expect { +- -re "(\[0-9\]+)\n$prompt" { set num_keys $expect_out(1,string) } +- timeout { +- error_and_restart "$test: timeout getting num_keys" +- return +- } +- eof { +- error_and_restart "$test: eof getting num_keys" +- return +- } +- } +- +- # XXX Perhaps I should actually check the key type returned. +- if {$num_keys == 5} { +- pass "$test" +- } else { +- fail "$test: $num_keys keys, should be 5" +- } +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test100 +- +-return "" +diff --git a/src/lib/kadm5/unit-test/api.current/randkey-principal.exp b/src/lib/kadm5/unit-test/api.current/randkey-principal.exp +deleted file mode 100644 +index 1484901fa..000000000 +--- a/src/lib/kadm5/unit-test/api.current/randkey-principal.exp ++++ /dev/null +@@ -1,297 +0,0 @@ +-load_lib lib.t +-api_exit +-api_start +- +-test "randkey-principal 1" +-proc test1 {} { +- global test +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [create_principal_pol "$test/a" once-a-min]} { +- error_and_restart "$test: creating principal" +- return +- } +- +- if {! [cmd [format { +- kadm5_init "%s/a" "%s/a" $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } $test $test]]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_randkey_principal $server_handle "%s/a" keys num_keys +- } $test] "PASS_TOOSOON" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} { test1 } +- +-test "randkey-principal 3" +-proc test3 {} { +- global test +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [create_principal_pol "$test/a" once-a-min]} { +- error_and_restart "$test: creating principal" +- return +- } +- +- if {! [cmd [format { +- kadm5_init "%s/a" "%s/a" $KADM5_CHANGEPW_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } $test $test]]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_randkey_principal $server_handle "%s/a" keys num_keys +- } $test] "PASS_TOOSOON" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if ${RPC} { test3 } +- +-test "randkey-principal 13" +-proc test13 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- if {! [cmd [format { +- kadm5_modify_principal $server_handle [princ_w_pol "%s/a" \ +- once-a-min] KADM5_POLICY +- } $test]]} { +- perror "$test: failed modify" +- return +- } +- one_line_succeed_test [format { +- kadm5_randkey_principal $server_handle "%s/a" keys num_keys +- } $test] +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test13 +- +-test "randkey-principal 15" +-proc test15 {} { +- global test +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [create_principal_pol "$test/a" once-a-min]} { +- error_and_restart "$test: creating principal" +- return +- } +- +- if {! [cmd { +- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_randkey_principal $server_handle "%s/a" keys num_keys +- } $test] "AUTH_CHANGEPW" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if { $RPC } { test15 } +- +-test "randkey-principal 28" +-proc test28 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test [format { +- kadm5_randkey_principal $server_handle "%s/a" keys num_keys +- } $test] +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test28 +- +-test "randkey-principal 28.25" +-proc test2825 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_randkey_principal $server_handle "%s/a" keys num_keys +- } $test] "AUTH" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-if {$RPC} { test2825 } +- +-test "randkey-principal 28.5" +-proc test285 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [cmd { +- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test [format { +- kadm5_randkey_principal $server_handle "%s/a" keys num_keys +- } $test] +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test285 +- +-test "randkey-principal 30" +-proc test30 {} { +- global test +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't delete principal \"$test/a\"" +- return +- } +- if {! [create_principal "$test/a"]} { +- error_and_restart "$test: creating principal" +- return +- } +- if {! [cmd [format { +- kadm5_init "%s/a" "%s/a" $KADM5_CHANGEPW_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } $test $test]]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test [format { +- kadm5_randkey_principal $server_handle "%s/a" keys num_keys +- } $test] +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test30 +- +-test "randkey-principal 31" +-proc test31 {} { +- global test +- if {! (( ! [principal_exists "$test/a"]) || +- [delete_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if {! [create_principal "$test/a"]} { +- error_and_restart "$test: creating principal" +- return +- } +- +- if {! [cmd [format { +- kadm5_init "%s/a" "%s/a" $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- } $test $test]]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_succeed_test [format { +- kadm5_randkey_principal $server_handle "%s/a" keys num_keys +- } $test] +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +-test31 +- +-test "randkey-principal 33" +-proc test33 {} { +- global test +- if {! (( [principal_exists "$test/a"]) || +- [create_principal "$test/a"])} { +- error_and_restart "$test: couldn't create principal \"$test/a\"" +- return +- } +- if { ! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- server_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- one_line_fail_test [format { +- kadm5_randkey_principal null "%s/a" keys num_keys +- } $test] "BAD_SERVER_HANDLE" +- if { ! [cmd {kadm5_destroy $server_handle}]} { +- perror "$test: unexpected failure in destroy" +- return +- } +-} +- +-test33 +- +-return "" +diff --git a/src/lib/kadm5/unit-test/config/unix.exp b/src/lib/kadm5/unit-test/config/unix.exp +deleted file mode 100644 +index d7706ec53..000000000 +--- a/src/lib/kadm5/unit-test/config/unix.exp ++++ /dev/null +@@ -1,222 +0,0 @@ +-source runenv.exp +- +-set prompt "% " +-set stty_init {-onlcr -opost intr \^C kill \^U} +-set kadmin_local $KADMIN_LOCAL +- +-# Backward compatibility until we're using expect 5 everywhere +-if {[info exists exp_version_4]} { +- global wait_error_index wait_errno_index wait_status_index +- set wait_error_index 0 +- set wait_errno_index 1 +- set wait_status_index 1 +-} else { +- set wait_error_index 2 +- set wait_errno_index 3 +- set wait_status_index 3 +-} +- +-if { [string length $VALGRIND] } { +- rename spawn valgrind_aux_spawn +- proc spawn { args } { +- global VALGRIND +- upvar 1 spawn_id spawn_id +- set newargs {} +- set inflags 1 +- set eatnext 0 +- foreach arg $args { +- if { $arg == "-ignore" \ +- || $arg == "-open" \ +- || $arg == "-leaveopen" } { +- lappend newargs $arg +- set eatnext 1 +- continue +- } +- if [string match "-*" $arg] { +- lappend newargs $arg +- continue +- } +- if { $eatnext } { +- set eatnext 0 +- lappend newargs $arg +- continue +- } +- if { $inflags } { +- set inflags 0 +- # Only run valgrind for local programs, not +- # system ones. +-#&&![string match "/bin/sh" $arg] sh is used to start kadmind! +- if [string match "/" [string index $arg 0]]&&![string match "/bin/ls" $arg]&&![regexp {/kshd$} $arg] { +- set newargs [concat $newargs $VALGRIND] +- } +- } +- lappend newargs $arg +- } +- set pid [eval valgrind_aux_spawn $newargs] +- return $pid +- } +-} +- +-# Hack around Solaris 9 kernel race condition that causes last output +-# from a pty to get dropped. +-if { $PRIOCNTL_HACK } { +- catch {exec priocntl -s -c FX -m 30 -p 30 -i pid [getpid]} +- rename spawn oldspawn +- proc spawn { args } { +- upvar 1 spawn_id spawn_id +- set newargs {} +- set inflags 1 +- set eatnext 0 +- foreach arg $args { +- if { $arg == "-ignore" \ +- || $arg == "-open" \ +- || $arg == "-leaveopen" } { +- lappend newargs $arg +- set eatnext 1 +- continue +- } +- if [string match "-*" $arg] { +- lappend newargs $arg +- continue +- } +- if { $eatnext } { +- set eatnext 0 +- lappend newargs $arg +- continue +- } +- if { $inflags } { +- set inflags 0 +- set newargs [concat $newargs {priocntl -e -c FX -p 0}] +- } +- lappend newargs $arg +- } +- set pid [eval oldspawn $newargs] +- return $pid +- } +-} +- +-# Variables for keeping track of api process state +-set api_pid "0" +- +-proc api_exit {} { +- global spawn_id +- global api_pid +- +-# puts stdout "Starting api_exit (spawn_id $spawn_id)." +- catch {close} errMsg +- catch {wait} errMsg +-# puts stdout "Finishing api_exit for $api_pid." +- set api_pid "0" +-} +- +-proc api_isrunning {pid} { +- global api_pid +- +-# puts stdout "testing $pid, api_pid is $api_pid" +- if {$pid == $api_pid} { +- return 1; +- } else { +- return 0; +- } +-} +- +-proc api_version {} { +-} +- +-proc api_start {} { +- global API +- global env +- global spawn_id +- global prompt +- global api_pid +- +- set pid [spawn $API] +- expect { +- -re "$prompt$" {} +- eof { perror "EOF starting API" } +- timeout { perror "Timeout starting API" } +- } +- if {! [info exists env(TCLUTIL)]} { +- perror "TCLUTIL environment variable isn't set" +- } +- # tcl 8.4 for some reason screws up autodetection of output +- # EOL translation. Work around it for now. +- send "if { \[info commands fconfigure\] ne \"\" } { fconfigure stdout -translation lf }\n" +- expect { +- -re "$prompt$" {} +- eof { perror "EOF starting API" } +- timeout { perror "Timeout starting API" } +- } +- send "source $env(TCLUTIL)\n" +- expect { +- -re "$prompt$" {} +- eof { perror "EOF starting API" } +- timeout { perror "Timeout starting API" } +- } +- send "set current_struct_version \[expr \$KADM5_STRUCT_VERSION &~ \$KADM5_STRUCT_VERSION_MASK\]\n" +- expect { +- -re "$prompt$" {} +- eof { perror "EOF setting API variables"} +- timeout { perror "timeout setting API variables"} +- } +- send "set current_api_version \[expr \$KADM5_API_VERSION_3 &~ \$KADM5_API_VERSION_MASK\]\n" +- expect { +- -re "$prompt$" {} +- eof { perror "EOF setting API variables"} +- timeout { perror "timeout setting API variables"} +- } +- send "set bad_struct_version_mask \[expr 0x65432100 | \$current_struct_version\]\n" +- expect { +- -re "$prompt$" {} +- eof { perror "EOF setting API variables"} +- timeout { perror "timeout setting API variables"} +- } +- send "set bad_api_version_mask \[expr 0x65432100 | \$current_api_version\]\n" +- expect { +- -re "$prompt$" {} +- eof { perror "EOF setting API variables"} +- timeout { perror "timeout setting API variables"} +- } +- send "set no_api_version_mask \$current_api_version\n" +- expect { +- -re "$prompt$" {} +- eof { perror "EOF setting API variables"} +- timeout { perror "timeout setting API variables"} +- } +- send "set no_struct_version_mask \$current_struct_version\n" +- expect { +- -re "$prompt$" {} +- eof { perror "EOF setting API variables"} +- timeout { perror "timeout setting API variables"} +- } +- send "set old_api_version \[expr \$KADM5_API_VERSION_MASK | 0x00\]\n" +- expect { +- -re "$prompt$" {} +- eof { perror "EOF setting API variables"} +- timeout { perror "timeout setting API variables"} +- } +- send "set old_struct_version \[expr \$KADM5_STRUCT_VERSION_MASK | 0x00\]\n" +- expect { +- -re "$prompt$" {} +- eof { perror "EOF setting API variables"} +- timeout { perror "timeout setting API variables"} +- } +- send "set new_api_version \[expr \$KADM5_API_VERSION_MASK | 0xca\]\n" +- expect { +- -re "$prompt$" {} +- eof { perror "EOF setting API variables"} +- timeout { perror "timeout setting API variables"} +- } +- send "set new_struct_version \[expr \$KADM5_STRUCT_VERSION_MASK | 0xca\]\n" +- expect { +- -re "$prompt$" {} +- eof { perror "EOF setting API variables"} +- timeout { perror "timeout setting API variables"} +- } +- +- set api_pid $pid +-# puts stdout "Finishing api_start (spawn_id $spawn_id, pid $api_pid)." +- return $pid +-} +-api_start +- +diff --git a/src/lib/kadm5/unit-test/deps b/src/lib/kadm5/unit-test/deps +deleted file mode 100644 +index cf54f475b..000000000 +--- a/src/lib/kadm5/unit-test/deps ++++ /dev/null +@@ -1,86 +0,0 @@ +-# +-# Generated makefile dependencies follow. +-# +-$(OUTPRE)init-test.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \ +- $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \ +- $(BUILDTOP)/include/kadm5/chpass_util_strings.h $(BUILDTOP)/include/kadm5/kadm_err.h \ +- $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ +- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ +- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ +- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ +- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ +- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \ +- $(top_srcdir)/include/krb5.h init-test.c +-$(OUTPRE)destroy-test.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \ +- $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \ +- $(BUILDTOP)/include/kadm5/admin_internal.h $(BUILDTOP)/include/kadm5/chpass_util_strings.h \ +- $(BUILDTOP)/include/kadm5/client_internal.h $(BUILDTOP)/include/kadm5/kadm_err.h \ +- $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ +- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ +- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ +- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ +- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ +- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \ +- $(top_srcdir)/include/krb5.h destroy-test.c +-$(OUTPRE)handle-test.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ +- $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssrpc/types.h \ +- $(BUILDTOP)/include/kadm5/admin.h $(BUILDTOP)/include/kadm5/admin_internal.h \ +- $(BUILDTOP)/include/kadm5/chpass_util_strings.h $(BUILDTOP)/include/kadm5/kadm_err.h \ +- $(BUILDTOP)/include/kadm5/server_internal.h $(BUILDTOP)/include/krb5/krb5.h \ +- $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ +- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ +- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ +- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ +- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ +- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \ +- $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/plugin.h \ +- handle-test.c +-$(OUTPRE)iter-test.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \ +- $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \ +- $(BUILDTOP)/include/kadm5/chpass_util_strings.h $(BUILDTOP)/include/kadm5/kadm_err.h \ +- $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ +- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ +- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ +- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ +- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ +- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \ +- $(top_srcdir)/include/krb5.h iter-test.c +-$(OUTPRE)setkey-test.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ +- $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssrpc/types.h \ +- $(BUILDTOP)/include/kadm5/admin.h $(BUILDTOP)/include/kadm5/chpass_util_strings.h \ +- $(BUILDTOP)/include/kadm5/kadm_err.h $(BUILDTOP)/include/krb5/krb5.h \ +- $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ +- $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ +- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ +- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ +- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ +- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ +- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/k5-buf.h \ +- $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ +- $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ +- $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ +- $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \ +- $(top_srcdir)/include/kdb.h $(top_srcdir)/include/krb5.h \ +- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \ +- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ +- setkey-test.c +-$(OUTPRE)randkey-test.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \ +- $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \ +- $(BUILDTOP)/include/kadm5/chpass_util_strings.h $(BUILDTOP)/include/kadm5/kadm_err.h \ +- $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ +- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ +- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ +- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ +- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ +- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \ +- $(top_srcdir)/include/krb5.h randkey-test.c +-$(OUTPRE)lock-test.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \ +- $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \ +- $(BUILDTOP)/include/kadm5/chpass_util_strings.h $(BUILDTOP)/include/kadm5/kadm_err.h \ +- $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ +- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ +- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ +- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ +- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ +- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \ +- $(top_srcdir)/include/krb5.h lock-test.c +diff --git a/src/lib/kadm5/unit-test/destroy-test.c b/src/lib/kadm5/unit-test/destroy-test.c +deleted file mode 100644 +index 738cfeb86..000000000 +--- a/src/lib/kadm5/unit-test/destroy-test.c ++++ /dev/null +@@ -1,48 +0,0 @@ +-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +- +-#define TEST_NUM 25 +- +-int main() +-{ +- kadm5_ret_t ret; +- char *cp; +- int x; +- void *server_handle; +- kadm5_server_handle_t handle; +- krb5_context context; +- +- ret = kadm5_init_krb5_context(&context); +- if (ret != 0) { +- com_err("test", ret, "context init"); +- exit(2); +- } +- for(x = 0; x < TEST_NUM; x++) { +- ret = kadm5_init(context, "admin", "admin", KADM5_ADMIN_SERVICE, 0, +- KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL, +- &server_handle); +- if(ret != KADM5_OK) { +- com_err("test", ret, "init"); +- exit(2); +- } +- handle = (kadm5_server_handle_t) server_handle; +- cp = strdup(strchr(handle->cache_name, ':') + 1); +- kadm5_destroy(server_handle); +- if(access(cp, F_OK) == 0) { +- puts("ticket cache not destroyed"); +- exit(2); +- } +- free(cp); +- } +- krb5_free_context(context); +- exit(0); +-} +diff --git a/src/lib/kadm5/unit-test/diff-files/destroy-1 b/src/lib/kadm5/unit-test/diff-files/destroy-1 +deleted file mode 100644 +index 593d67320..000000000 +--- a/src/lib/kadm5/unit-test/diff-files/destroy-1 ++++ /dev/null +@@ -1,2 +0,0 @@ +-##! nochanges +- +diff --git a/src/lib/kadm5/unit-test/diff-files/no-diffs b/src/lib/kadm5/unit-test/diff-files/no-diffs +deleted file mode 100644 +index 593d67320..000000000 +--- a/src/lib/kadm5/unit-test/diff-files/no-diffs ++++ /dev/null +@@ -1,2 +0,0 @@ +-##! nochanges +- +diff --git a/src/lib/kadm5/unit-test/handle-test.c b/src/lib/kadm5/unit-test/handle-test.c +deleted file mode 100644 +index 29bd2c9a1..000000000 +--- a/src/lib/kadm5/unit-test/handle-test.c ++++ /dev/null +@@ -1,140 +0,0 @@ +-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#ifdef CLIENT_TEST +-#include +-#else +-#include +-#include +-#endif +- +-int main(int argc, char *argv[]) +-{ +- kadm5_ret_t ret; +- void *server_handle; +- kadm5_server_handle_t handle; +- kadm5_server_handle_rec orig_handle; +- kadm5_policy_ent_rec pol; +- kadm5_principal_ent_t princ; +- kadm5_principal_ent_rec kprinc; +- krb5_keyblock *key; +- krb5_principal tprinc; +- krb5_context context; +- +- +- kadm5_init_krb5_context(&context); +- +- ret = kadm5_init(context, "admin/none", "admin", KADM5_ADMIN_SERVICE, NULL, +- KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL, +- &server_handle); +- if(ret != KADM5_OK) { +- com_err("test", ret, "init"); +- exit(2); +- } +- handle = (kadm5_server_handle_t) server_handle; +- orig_handle = *handle; +- handle->magic_number = KADM5_STRUCT_VERSION; +- krb5_parse_name(context, "testuser", &tprinc); +- ret = kadm5_get_principal(server_handle, tprinc, &kprinc, +- KADM5_PRINCIPAL_NORMAL_MASK); +- if(ret != KADM5_BAD_SERVER_HANDLE) { +- fprintf(stderr, "%s -- returned -- %s\n", "get-principal", +- error_message(ret)); +- exit(1); +- } +- +- ret = kadm5_get_policy(server_handle, "pol1", &pol); +- if(ret != KADM5_BAD_SERVER_HANDLE) { +- fprintf(stderr, "%s -- returned -- %s\n", "get-policy", +- error_message(ret)); +- exit(1); +- } +- +- princ = &kprinc; +- ret = kadm5_create_principal(server_handle, princ, KADM5_PRINCIPAL, "pass"); +- if(ret != KADM5_BAD_SERVER_HANDLE) { +- fprintf(stderr, "%s -- returned -- %s\n", "create-principal", +- error_message(ret)); +- exit(1); +- } +- +- ret = kadm5_create_policy(server_handle, &pol, KADM5_POLICY); +- if(ret != KADM5_BAD_SERVER_HANDLE) { +- fprintf(stderr, "%s -- returned -- %s\n", "create-policy", +- error_message(ret)); +- exit(1); +- } +- +- ret = kadm5_modify_principal(server_handle, princ, KADM5_PW_EXPIRATION); +- if(ret != KADM5_BAD_SERVER_HANDLE) { +- fprintf(stderr, "%s -- returned -- %s\n", "modify-principal", +- error_message(ret)); +- exit(1); +- } +- +- ret = kadm5_modify_policy(server_handle, &pol, KADM5_PW_MAX_LIFE); +- if(ret != KADM5_BAD_SERVER_HANDLE) { +- fprintf(stderr, "%s -- returned -- %s\n", "modify-policy", +- error_message(ret)); +- exit(1); +- } +- +- ret = kadm5_delete_principal(server_handle, tprinc); +- if(ret != KADM5_BAD_SERVER_HANDLE) { +- fprintf(stderr, "%s -- returned -- %s\n", "delete-principal", +- error_message(ret)); +- exit(1); +- } +- +- ret = kadm5_delete_policy(server_handle, "pol1"); +- if(ret != KADM5_BAD_SERVER_HANDLE) { +- fprintf(stderr, "%s -- returned -- %s\n", "delete-policy", +- error_message(ret)); +- exit(1); +- } +- +- ret = kadm5_chpass_principal(server_handle, tprinc, "FooBar"); +- if(ret != KADM5_BAD_SERVER_HANDLE) { +- fprintf(stderr, "%s -- returned -- %s\n", "chpass", +- error_message(ret)); +- exit(1); +- } +- ret = kadm5_randkey_principal(server_handle, tprinc, &key, NULL); +- if(ret != KADM5_BAD_SERVER_HANDLE) { +- fprintf(stderr, "%s -- returned -- %s\n", "randkey", +- error_message(ret)); +- exit(1); +- } +- +- ret = kadm5_rename_principal(server_handle, tprinc, tprinc); +- if(ret != KADM5_BAD_SERVER_HANDLE) { +- fprintf(stderr, "%s -- returned -- %s\n", "rename", +- error_message(ret)); +- exit(1); +- } +- +- ret = kadm5_destroy(server_handle); +- if(ret != KADM5_BAD_SERVER_HANDLE) { +- fprintf(stderr, "%s -- returned -- %s\n", "destroy", +- error_message(ret)); +- exit(1); +- } +- +- *handle = orig_handle; +- ret = kadm5_destroy(server_handle); +- if (ret != KADM5_OK) { +- fprintf(stderr, "valid %s -- returned -- %s\n", "destroy", +- error_message(ret)); +- exit(1); +- } +- +- krb5_free_principal(context, tprinc); +- krb5_free_context(context); +- exit(0); +-} +diff --git a/src/lib/kadm5/unit-test/init-test.c b/src/lib/kadm5/unit-test/init-test.c +deleted file mode 100644 +index 9f06621e8..000000000 +--- a/src/lib/kadm5/unit-test/init-test.c ++++ /dev/null +@@ -1,39 +0,0 @@ +-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ +-#include +-#include +-#include +-#include +-#include +-#include +- +-int main() +-{ +- kadm5_ret_t ret; +- void *server_handle; +- kadm5_config_params params; +- krb5_context context; +- +- memset(¶ms, 0, sizeof(params)); +- params.mask |= KADM5_CONFIG_NO_AUTH; +- ret = kadm5_init_krb5_context(&context); +- if (ret != 0) { +- com_err("init-test", ret, "while initializing krb5 context"); +- exit(1); +- } +- ret = kadm5_init(context, "admin", "admin", NULL, ¶ms, +- KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL, +- &server_handle); +- if (!ret) +- (void)kadm5_destroy(server_handle); +- krb5_free_context(context); +- if (ret == KADM5_RPC_ERROR) { +- exit(0); +- } +- else if (ret != 0) { +- com_err("init-test", ret, "while initializing without auth"); +- exit(1); +- } else { +- fprintf(stderr, "Unexpected success while initializing without auth!\n"); +- exit(1); +- } +-} +diff --git a/src/lib/kadm5/unit-test/iter-test.c b/src/lib/kadm5/unit-test/iter-test.c +deleted file mode 100644 +index cd85ebe4d..000000000 +--- a/src/lib/kadm5/unit-test/iter-test.c ++++ /dev/null +@@ -1,51 +0,0 @@ +-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ +-#include +-#include +-#include +- +-int main(int argc, char **argv) +-{ +- kadm5_ret_t ret; +- void *server_handle; +- char **names; +- int count, princ, i; +- krb5_context context; +- +- if (argc != 3) { +- fprintf(stderr, "Usage: %s [-princ|-pol] exp\n", argv[0]); +- exit(1); +- } +- princ = (strcmp(argv[1], "-princ") == 0); +- +- ret = kadm5_init_krb5_context(&context); +- if (ret != KADM5_OK) { +- com_err("iter-test", ret, "while initializing context"); +- exit(1); +- } +- ret = kadm5_init("admin", "admin", KADM5_ADMIN_SERVICE, 0, +- KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL, +- &server_handle); +- if (ret != KADM5_OK) { +- com_err("iter-test", ret, "while initializing"); +- exit(1); +- } +- +- if (princ) +- ret = kadm5_get_principals(server_handle, argv[2], &names, &count); +- else +- ret = kadm5_get_policies(server_handle, argv[2], &names, &count); +- +- if (ret != KADM5_OK) { +- com_err("iter-test", ret, "while retrieving list"); +- exit(1); +- } +- +- for (i = 0; i < count; i++) +- printf("%d: %s\n", i, names[i]); +- +- kadm5_free_name_list(server_handle, names, count); +- +- (void) kadm5_destroy(server_handle); +- +- return 0; +-} +diff --git a/src/lib/kadm5/unit-test/lib/lib.t b/src/lib/kadm5/unit-test/lib/lib.t +deleted file mode 100644 +index 3444775cf..000000000 +--- a/src/lib/kadm5/unit-test/lib/lib.t ++++ /dev/null +@@ -1,306 +0,0 @@ +-global timeout +-set timeout 60 +- +-set lib_pid 0 +- +-# +-# The functions in this library used to be responsible for bazillions +-# of wasted api_starts. Now, they all just use their own library +-# handle so they are not interrupted when the main tests call init or +-# destroy. They have to keep track of when the api exists and +-# restarts, though, since the lib_handle needs to be re-opened in that +-# case. +-# +-proc lib_start_api {} { +- global spawn_id lib_pid test +- +- if {! [api_isrunning $lib_pid]} { +- api_exit +- set lib_pid [api_start] +- if {! [cmd { +- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ +- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ +- lib_handle +- }]} { +- perror "$test: unexpected failure in init" +- return +- } +- verbose "+++ restarted api ($lib_pid) for lib" +- } else { +- verbose "+++ api $lib_pid already running for lib" +- } +-} +- +-proc cmd {command} { +- global prompt +- global spawn_id +- global test +- +- send "[string trim $command]\n" +- expect { +- -re "OK .*$prompt$" { return 1 } +- -re "ERROR .*$prompt$" { return 0 } +- "wrong # args" { perror "$test: wrong number args"; return 0 } +- timeout { fail "$test: timeout"; return 0 } +- eof { fail "$test: eof"; api_exit; lib_start_api; return 0 } +- } +-} +- +-proc tcl_cmd {command} { +- global prompt spawn_id test +- +- send "[string trim $command]\n" +- expect { +- -re "$prompt$" { return 1} +- "wrong # args" { perror "$test: wrong number args"; return 0 } +- timeout { error_and_restart "timeout" } +- eof { api_exit; lib_start_api; return 0 } +- } +-} +- +-proc one_line_succeed_test {command} { +- global prompt +- global spawn_id +- global test +- +- send "[string trim $command]\n" +- expect { +- -re "OK .*$prompt$" { pass "$test"; return 1 } +- -re "ERROR .*$prompt$" { +- fail "$test: $expect_out(buffer)"; return 0 +- } +- "wrong # args" { perror "$test: wrong number args"; return 0 } +- timeout { fail "$test: timeout"; return 0 } +- eof { fail "$test: eof"; api_exit; lib_start_api; return 0 } +- } +-} +- +-proc one_line_fail_test {command code} { +- global prompt +- global spawn_id +- global test +- +- send "[string trim $command]\n" +- expect { +- -re "ERROR .*$code.*$prompt$" { pass "$test"; return 1 } +- -re "ERROR .*$prompt$" { fail "$test: bad failure"; return 0 } +- -re "OK .*$prompt$" { fail "$test: bad success"; return 0 } +- "wrong # args" { perror "$test: wrong number args"; return 0 } +- timeout { fail "$test: timeout"; return 0 } +- eof { fail "$test: eof"; api_exit; lib_start_api; return 0 } +- } +-} +- +-proc one_line_fail_test_nochk {command} { +- global prompt +- global spawn_id +- global test +- +- send "[string trim $command]\n" +- expect { +- -re "ERROR .*$prompt$" { pass "$test:"; return 1 } +- -re "OK .*$prompt$" { fail "$test: bad success"; return 0 } +- "wrong # args" { perror "$test: wrong number args"; return 0 } +- timeout { fail "$test: timeout"; return 0 } +- eof { fail "$test: eof"; api_exit; lib_start_api; return 0 } +- } +-} +- +-proc resync {} { +- global prompt spawn_id test +- +- expect { +- -re "$prompt$" {} +- "wrong # args" { perror "$test: wrong number args"; return 0 } +- eof { api_exit; lib_start_api } +- } +-} +- +-proc create_principal {name} { +- lib_start_api +- +- set ret [cmd [format { +- kadm5_create_principal $lib_handle [simple_principal \ +- "%s"] {KADM5_PRINCIPAL} "%s" +- } $name $name]] +- +- return $ret +-} +- +-proc create_policy {name} { +- lib_start_api +- +- set ret [cmd [format { +- kadm5_create_policy $lib_handle [simple_policy "%s"] \ +- {KADM5_POLICY} +- } $name $name]] +- +- return $ret +-} +- +-proc create_principal_pol {name policy} { +- lib_start_api +- +- set ret [cmd [format { +- kadm5_create_principal $lib_handle [princ_w_pol "%s" \ +- "%s"] {KADM5_PRINCIPAL KADM5_POLICY} "%s" +- } $name $policy $name]] +- +- return $ret +-} +- +-proc delete_principal {name} { +- lib_start_api +- +- set ret [cmd [format { +- kadm5_delete_principal $lib_handle "%s" +- } $name]] +- +- return $ret +-} +- +-proc delete_policy {name} { +- lib_start_api +- +- set ret [cmd [format {kadm5_delete_policy $lib_handle "%s"} $name]] +- +- return $ret +-} +- +-proc principal_exists {name} { +-# puts stdout "Starting principal_exists." +- +- lib_start_api +- +- set ret [cmd [format { +- kadm5_get_principal $lib_handle "%s" principal \ +- KADM5_PRINCIPAL_NORMAL_MASK +- } $name]] +- +-# puts stdout "Finishing principal_exists." +- +- return $ret +-} +- +-proc policy_exists {name} { +- lib_start_api +- +-# puts stdout "Starting policy_exists." +- +- set ret [cmd [format { +- kadm5_get_policy $lib_handle "%s" policy +- } $name]] +- +-# puts stdout "Finishing policy_exists." +- +- return $ret +-} +- +-proc error_and_restart {error} { +- api_exit +- api_start +- perror $error +-} +- +-proc test {name} { +- global test verbose +- +- set test $name +- if {$verbose >= 1} { +- puts stdout "At $test" +- } +-} +- +-proc begin_dump {} { +- global TOP +- global RPC +- +- if { ! $RPC } { +-# exec $env(SIMPLE_DUMP) > /tmp/dump.before +- } +-} +- +-proc end_dump_compare {name} { +- global file +- global TOP +- global RPC +- +- if { ! $RPC } { +-# set file $TOP/admin/lib/unit-test/diff-files/$name +-# exec $env(SIMPLE_DUMP) > /tmp/dump.after +-# exec $env(COMPARE_DUMP) /tmp/dump.before /tmp/dump.after $file +- } +-} +- +-proc kinit { princ pass {opts ""} } { +- global env; +- global KINIT +- +- eval spawn $KINIT -5 $opts $princ +- expect { +- -re {Password for .*: $} +- {send "$pass\n"} +- timeout {puts "Timeout waiting for prompt" ; close } +- } +- +- # this necessary so close(1) in the child will not sleep waiting for +- # the parent, which is us, to read pending data. +- +- expect { +- "when initializing cache" { perror "kinit failed: $expect_out(buffer)" } +- eof {} +- } +- wait +-} +- +-proc kdestroy {} { +- global KDESTROY +- global errorCode errorInfo +- global env +- +- if {[info exists errorCode]} { +- set saveErrorCode $errorCode +- } +- if {[info exists errorInfo]} { +- set saveErrorInfo $errorInfo +- } +- catch "exec $KDESTROY -5 2>/dev/null" +- if {[info exists saveErrorCode]} { +- set errorCode $saveErrorCode +- } elseif {[info exists errorCode]} { +- unset errorCode +- } +- if {[info exists saveErrorInfo]} { +- set errorInfo $saveErrorInfo +- } elseif {[info exists errorInfo]} { +- unset errorInfo +- } +-} +- +-proc create_principal_with_keysalts {name keysalts} { +- global kadmin_local +- +- spawn $kadmin_local -e "$keysalts" +- expect { +- "kadmin.local:" {} +- default { perror "waiting for kadmin.local prompt"; return 1} +- } +- send "ank -pw \"$name\" \"$name\"\n" +- expect { +- -re "Principal \"$name.*\" created." {} +- "kadmin.local:" { +- perror "expecting principal created message"; +- return 1 +- } +- default { perror "waiting for principal created message"; return 1 } +- } +- expect { +- "kadmin.local:" {} +- default { perror "waiting for kadmin.local prompt"; return 1 } +- } +- close +- wait +- return 0 +-} +- +- +diff --git a/src/lib/kadm5/unit-test/lock-test.c b/src/lib/kadm5/unit-test/lock-test.c +deleted file mode 100644 +index 59f9d2609..000000000 +--- a/src/lib/kadm5/unit-test/lock-test.c ++++ /dev/null +@@ -1,105 +0,0 @@ +-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ +-#include +-#include +-#include +-#include +-#include +- +-char *whoami; +- +-static void usage() +-{ +- fprintf(stderr, +- "Usage: %s {shared|exclusive|permanent|release|" +- "get name|wait} ...\n", whoami); +- exit(1); +-} +- +-int main(int argc, char **argv) +-{ +- krb5_error_code ret; +- osa_policy_ent_t entry; +- krb5_context context; +- kadm5_config_params params; +- krb5_error_code kret; +- +- whoami = argv[0]; +- +- kret = kadm5_init_krb5_context(&context); +- if (kret) { +- com_err(whoami, kret, "while initializing krb5"); +- exit(1); +- } +- +- params.mask = 0; +- ret = kadm5_get_config_params(context, 1, ¶ms, ¶ms); +- if (ret) { +- com_err(whoami, ret, "while retrieving configuration parameters"); +- exit(1); +- } +- if (! (params.mask & KADM5_CONFIG_ADBNAME)) { +- com_err(whoami, KADM5_BAD_SERVER_PARAMS, +- "while retrieving configuration parameters"); +- exit(1); +- } +- +- ret = krb5_db_open( context, NULL, KRB5_KDB_OPEN_RW); +- if (ret) { +- com_err(whoami, ret, "while opening database"); +- exit(1); +- } +- +- argc--; argv++; +- while (argc) { +- if (strcmp(*argv, "shared") == 0) { +- ret = krb5_db_lock(context, KRB5_DB_LOCKMODE_SHARED); +- if (ret) +- com_err(whoami, ret, "while getting shared lock"); +- else +- printf("shared\n"); +- } else if (strcmp(*argv, "exclusive") == 0) { +- ret = krb5_db_lock(context, KRB5_DB_LOCKMODE_EXCLUSIVE ); +- if (ret) +- com_err(whoami, ret, "while getting exclusive lock"); +- else +- printf("exclusive\n"); +- } else if (strcmp(*argv, "permanent") == 0) { +- ret = krb5_db_lock(context, KRB5_DB_LOCKMODE_EXCLUSIVE ); +- if (ret) +- com_err(whoami, ret, "while getting permanent lock"); +- else +- printf("permanent\n"); +- } else if (strcmp(*argv, "release") == 0) { +- ret = krb5_db_unlock(context); +- if (ret) +- com_err(whoami, ret, "while releasing lock"); +- else +- printf("released\n"); +- } else if (strcmp(*argv, "get") == 0) { +- argc--; argv++; +- if (!argc) usage(); +- if ((ret = krb5_db_get_policy(context, *argv, &entry))) { +- com_err(whoami, ret, "while getting policy"); +- } else { +- printf("retrieved\n"); +- krb5_db_free_policy(context, entry); +- } +- } else if (strcmp(*argv, "wait") == 0) { +- getchar(); +- } else { +- fprintf(stderr, "%s: Invalid argument \"%s\"\n", +- whoami, *argv); +- usage(); +- } +- +- argc--; argv++; +- } +- +- ret = krb5_db_fini(context); +- if (ret) { +- com_err(whoami, ret, "while closing database"); +- exit(1); +- } +- +- return 0; +-} +diff --git a/src/lib/kadm5/unit-test/randkey-test.c b/src/lib/kadm5/unit-test/randkey-test.c +deleted file mode 100644 +index dbef88ac8..000000000 +--- a/src/lib/kadm5/unit-test/randkey-test.c ++++ /dev/null +@@ -1,42 +0,0 @@ +-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ +-#include +-#include +-#include +-#include +-#include +-#include +-#include +- +-#define TEST_NUM 1000 +- +-int main() +-{ +- kadm5_ret_t ret; +- krb5_keyblock *keys[TEST_NUM]; +- krb5_principal tprinc; +- krb5_keyblock *newkey; +- krb5_context context; +- void *server_handle; +- +- int x, i; +- +- kadm5_init_krb5_context(&context); +- +- krb5_parse_name(context, "testuser", &tprinc); +- ret = kadm5_init(context, "admin", "admin", KADM5_ADMIN_SERVICE, NULL, +- KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL, +- &server_handle); +- if(ret != KADM5_OK) { +- com_err("test", ret, "init"); +- exit(2); +- } +- for(x = 0; x < TEST_NUM; x++) { +- kadm5_randkey_principal(server_handle, tprinc, &keys[x], NULL); +- for(i = 0; i < x; i++) { +- if (!memcmp(newkey->contents, keys[i]->contents, newkey->length)) +- puts("match found"); +- } +- } +- kadm5_destroy(server_handle); +- exit(0); +-} +diff --git a/src/lib/kadm5/unit-test/setkey-test.c b/src/lib/kadm5/unit-test/setkey-test.c +deleted file mode 100644 +index 8e7df96e9..000000000 +--- a/src/lib/kadm5/unit-test/setkey-test.c ++++ /dev/null +@@ -1,246 +0,0 @@ +-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ +-#include +-#include +- +-#if HAVE_SRAND48 +-#define RAND() lrand48() +-#define SRAND(a) srand48(a) +-#define RAND_TYPE long +-#elif HAVE_SRAND +-#define RAND() rand() +-#define SRAND(a) srand(a) +-#define RAND_TYPE int +-#elif HAVE_SRANDOM +-#define RAND() random() +-#define SRAND(a) srandom(a) +-#define RAND_TYPE long +-#else /* no random */ +-need a random number generator +-#endif /* no random */ +- +-krb5_keyblock test1[] = { +- {0, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0, 0}, +- {-1}, +-}; +-krb5_keyblock test2[] = { +- {0, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0, 0}, +- {-1}, +-}; +-krb5_keyblock test3[] = { +- {0, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0, 0}, +- {-1}, +-}; +- +-krb5_keyblock *tests[] = { +- test1, test2, test3, NULL +-}; +- +-krb5_data tgtname = { +- 0, +- KRB5_TGS_NAME_SIZE, +- KRB5_TGS_NAME +-}; +- +-krb5_enctype ktypes[] = { 0, 0 }; +- +-extern krb5_kt_ops krb5_ktf_writable_ops; +- +-int +-main(int argc, char **argv) +-{ +- krb5_context context; +- krb5_keytab kt; +- krb5_keytab_entry ktent; +- krb5_encrypt_block eblock; +- krb5_creds my_creds; +- krb5_get_init_creds_opt *opt; +- kadm5_principal_ent_rec princ_ent; +- krb5_principal princ, server; +- char pw[16]; +- char *whoami, *principal, *authprinc, *authpwd; +- krb5_data pwdata; +- void *handle; +- int ret, test, encnum; +- unsigned int i; +- +- whoami = argv[0]; +- +- if (argc < 2 || argc > 4) { +- fprintf(stderr, "Usage: %s principal [authuser] [authpwd]\n", whoami); +- exit(1); +- } +- principal = argv[1]; +- authprinc = (argc > 2) ? argv[2] : argv[0]; +- authpwd = (argc > 3) ? argv[3] : NULL; +- +- /* +- * Setup. Initialize data structures, open keytab, open connection +- * to kadm5 server. +- */ +- +- memset(&context, 0, sizeof(context)); +- kadm5_init_krb5_context(&context); +- +- ret = krb5_parse_name(context, principal, &princ); +- if (ret) { +- com_err(whoami, ret, "while parsing principal name %s", principal); +- exit(1); +- } +- +- if((ret = krb5_build_principal_ext(context, &server, +- krb5_princ_realm(kcontext, princ)->length, +- krb5_princ_realm(kcontext, princ)->data, +- tgtname.length, tgtname.data, +- krb5_princ_realm(kcontext, princ)->length, +- krb5_princ_realm(kcontext, princ)->data, +- 0))) { +- com_err(whoami, ret, "while building server name"); +- exit(1); +- } +- +- ret = krb5_kt_default(context, &kt); +- if (ret) { +- com_err(whoami, ret, "while opening keytab"); +- exit(1); +- } +- +- ret = kadm5_init(context, authprinc, authpwd, KADM5_ADMIN_SERVICE, NULL, +- KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL, +- &handle); +- if (ret) { +- com_err(whoami, ret, "while initializing connection"); +- exit(1); +- } +- +- /* these pw's don't need to be secure, just different every time */ +- SRAND((RAND_TYPE)time((void *) NULL)); +- pwdata.data = pw; +- pwdata.length = sizeof(pw); +- +- /* +- * For each test: +- * +- * For each enctype in the test, construct a random password/key. +- * Assign all keys to principal with kadm5_setkey_principal. Add +- * each key to the keytab, and acquire an initial ticket with the +- * keytab (XXX can I specify the kvno explicitly?). If +- * krb5_get_init_creds_keytab succeeds, then the keys were set +- * successfully. +- */ +- for (test = 0; tests[test] != NULL; test++) { +- krb5_keyblock *testp = tests[test]; +- kadm5_key_data *extracted; +- int n_extracted, match; +- printf("+ Test %d:\n", test); +- +- for (encnum = 0; testp[encnum].magic != -1; encnum++) { +- for (i = 0; i < sizeof(pw); i++) +- pw[i] = (RAND() % 26) + '0'; /* XXX */ +- +- krb5_use_enctype(context, &eblock, testp[encnum].enctype); +- ret = krb5_string_to_key(context, &eblock, &testp[encnum], +- &pwdata, NULL); +- if (ret) { +- com_err(whoami, ret, "while converting string to key"); +- exit(1); +- } +- } +- +- /* now, encnum == # of keyblocks in testp */ +- ret = kadm5_setkey_principal(handle, princ, testp, encnum); +- if (ret) { +- com_err(whoami, ret, "while setting keys"); +- exit(1); +- } +- +- ret = kadm5_get_principal(handle, princ, &princ_ent, KADM5_KVNO); +- if (ret) { +- com_err(whoami, ret, "while retrieving principal"); +- exit(1); +- } +- +- ret = kadm5_get_principal_keys(handle, princ, 0, &extracted, +- &n_extracted); +- if (ret) { +- com_err(whoami, ret, "while extracting keys"); +- exit(1); +- } +- +- for (encnum = 0; testp[encnum].magic != -1; encnum++) { +- printf("+ enctype %d\n", testp[encnum].enctype); +- +- for (match = 0; match < n_extracted; match++) { +- if (extracted[match].key.enctype == testp[encnum].enctype) +- break; +- } +- if (match >= n_extracted) { +- com_err(whoami, KRB5_WRONG_ETYPE, "while matching enctypes"); +- exit(1); +- } +- if (extracted[match].key.length != testp[encnum].length || +- memcmp(extracted[match].key.contents, testp[encnum].contents, +- testp[encnum].length) != 0) { +- com_err(whoami, KRB5_KDB_NO_MATCHING_KEY, "verifying keys"); +- exit(1); +- } +- +- memset(&ktent, 0, sizeof(ktent)); +- ktent.principal = princ; +- ktent.key = testp[encnum]; +- ktent.vno = princ_ent.kvno; +- +- ret = krb5_kt_add_entry(context, kt, &ktent); +- if (ret) { +- com_err(whoami, ret, "while adding keytab entry"); +- exit(1); +- } +- +- memset(&my_creds, 0, sizeof(my_creds)); +- my_creds.client = princ; +- my_creds.server = server; +- +- ktypes[0] = testp[encnum].enctype; +- ret = krb5_get_init_creds_opt_alloc(context, &opt); +- if (ret) { +- com_err(whoami, ret, "while allocating gic opts"); +- exit(1); +- } +- krb5_get_init_creds_opt_set_etype_list(opt, ktypes, 1); +- ret = krb5_get_init_creds_keytab(context, &my_creds, princ, +- kt, 0, NULL /* in_tkt_service */, +- opt); +- krb5_get_init_creds_opt_free(context, opt); +- if (ret) { +- com_err(whoami, ret, "while acquiring initial ticket"); +- exit(1); +- } +- krb5_free_cred_contents(context, &my_creds); +- +- /* since I can't specify enctype explicitly ... */ +- ret = krb5_kt_remove_entry(context, kt, &ktent); +- if (ret) { +- com_err(whoami, ret, "while removing keytab entry"); +- exit(1); +- } +- } +- +- (void)kadm5_free_kadm5_key_data(context, n_extracted, extracted); +- } +- +- ret = krb5_kt_close(context, kt); +- if (ret) { +- com_err(whoami, ret, "while closing keytab"); +- exit(1); +- } +- +- ret = kadm5_destroy(handle); +- if (ret) { +- com_err(whoami, ret, "while closing kadmin connection"); +- exit(1); +- } +- +- krb5_free_principal(context, princ); +- krb5_free_principal(context, server); +- krb5_free_context(context); +- return 0; +-} +diff --git a/src/lib/kadm5/unit-test/site.exp b/src/lib/kadm5/unit-test/site.exp +deleted file mode 100644 +index 7fe397463..000000000 +--- a/src/lib/kadm5/unit-test/site.exp ++++ /dev/null +@@ -1,2 +0,0 @@ +-set tool kadm5_srv_tcl +-set prompt "% " +-- +2.31.1 + diff --git a/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch b/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch index 429cf4d..3c90b97 100644 --- a/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch +++ b/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch @@ -1,4 +1,4 @@ -From 0a2778833d2f04a29fe9d7122913abe42299044a Mon Sep 17 00:00:00 2001 +From c99ecf1bb49e2fbd0bf30a7b357cf06407b9588a Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Sat, 15 May 2021 18:04:58 -0400 Subject: [PATCH] Remove deprecated OpenSSL calls from softpkcs11 @@ -7,16 +7,17 @@ Rewrite add_pubkey_info() in terms of the EVP_PKEY interface. In this process, fix its unchecked allocations and fail fast for non-RSA keys. (cherry picked from commit d6bf42279675100e3e4fe7c6e08eef74d49624cb) +(cherry picked from commit 5072bfdfaddae762680d0f9d97afa6dbf8274760) --- src/configure.ac | 1 + src/tests/softpkcs11/main.c | 106 ++++++++++++++++++++++++------------ 2 files changed, 72 insertions(+), 35 deletions(-) diff --git a/src/configure.ac b/src/configure.ac -index ea708491b..477819091 100644 +index 3e1052db7..eb6307468 100644 --- a/src/configure.ac +++ b/src/configure.ac -@@ -1118,6 +1118,7 @@ int i = 1; +@@ -1114,6 +1114,7 @@ int i = 1; ])], k5_cv_openssl_version_okay=yes, k5_cv_openssl_version_okay=no)]) old_LIBS="$LIBS" AC_CHECK_LIB(crypto, PKCS7_get_signer_info) diff --git a/Use-OpenSSL-s-KBKDF-and-KRB5KDF-for-deriving-long-te.patch b/Use-OpenSSL-s-KBKDF-and-KRB5KDF-for-deriving-long-te.patch new file mode 100644 index 0000000..927b506 --- /dev/null +++ b/Use-OpenSSL-s-KBKDF-and-KRB5KDF-for-deriving-long-te.patch @@ -0,0 +1,482 @@ +From 21e3b9a4463f1d1aeb71de8a27c298f1307d186b Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Fri, 4 Oct 2019 14:49:29 -0400 +Subject: [PATCH] Use OpenSSL's KBKDF and KRB5KDF for deriving long-term keys + +If supported, use OpenSSL-provided KBKDF (aes-sha2 and camellia) and +KRB5KDF (3des and aes-sha1). We already use OpenSSL's PBKDF2 where +appropriate. OpenSSL added support for these KDFs in 3.0. + +(cherry picked from commit ef8d11f6fb1232201c9efd2ae2ed567023fb85d2) +[rharwood@redhat.com: 3des removal] +--- + src/lib/crypto/krb/derive.c | 409 ++++++++++++++++++++++++++++-------- + 1 file changed, 324 insertions(+), 85 deletions(-) + +diff --git a/src/lib/crypto/krb/derive.c b/src/lib/crypto/krb/derive.c +index 6707a7308..8e474b38e 100644 +--- a/src/lib/crypto/krb/derive.c ++++ b/src/lib/crypto/krb/derive.c +@@ -27,6 +27,12 @@ + + #include "crypto_int.h" + ++#ifdef HAVE_EVP_KDF_FETCH ++#include ++#include ++#include ++#endif ++ + static krb5_key + find_cached_dkey(struct derived_key *list, const krb5_data *constant) + { +@@ -77,55 +83,251 @@ cleanup: + return ENOMEM; + } + ++#ifdef HAVE_EVP_KDF_FETCH + static krb5_error_code +-derive_random_rfc3961(const struct krb5_enc_provider *enc, +- krb5_key inkey, krb5_data *outrnd, +- const krb5_data *in_constant) ++openssl_kbdkf_counter_hmac(const struct krb5_hash_provider *hash, ++ krb5_key inkey, krb5_data *outrnd, ++ const krb5_data *label, const krb5_data *context) + { +- size_t blocksize, keybytes, n; + krb5_error_code ret; +- krb5_data block = empty_data(); ++ EVP_KDF *kdf = NULL; ++ EVP_KDF_CTX *kctx = NULL; ++ OSSL_PARAM params[6]; ++ size_t i = 0; ++ char *digest; + +- blocksize = enc->block_size; +- keybytes = enc->keybytes; ++ /* On NULL hash, preserve default behavior for pbkdf2_string_to_key(). */ ++ if (hash == NULL || !strcmp(hash->hash_name, "SHA1")) { ++ digest = "SHA1"; ++ } else if (!strcmp(hash->hash_name, "SHA-256")) { ++ digest = "SHA256"; ++ } else if (!strcmp(hash->hash_name, "SHA-384")) { ++ digest = "SHA384"; ++ } else { ++ ret = KRB5_CRYPTO_INTERNAL; ++ goto done; ++ } + +- if (blocksize == 1) +- return KRB5_BAD_ENCTYPE; +- if (inkey->keyblock.length != enc->keylength || outrnd->length != keybytes) ++ kdf = EVP_KDF_fetch(NULL, "KBKDF", NULL); ++ if (!kdf) { ++ ret = KRB5_CRYPTO_INTERNAL; ++ goto done; ++ } ++ ++ kctx = EVP_KDF_CTX_new(kdf); ++ if (!kctx) { ++ ret = KRB5_CRYPTO_INTERNAL; ++ goto done; ++ } ++ ++ params[i++] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, ++ digest, 0); ++ params[i++] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC, ++ "HMAC", 0); ++ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, ++ inkey->keyblock.contents, ++ inkey->keyblock.length); ++ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, ++ context->data, ++ context->length); ++ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT, ++ label->data, ++ label->length); ++ params[i] = OSSL_PARAM_construct_end(); ++ if (EVP_KDF_derive(kctx, (unsigned char *)outrnd->data, outrnd->length, ++ params) <= 0) { ++ ret = KRB5_CRYPTO_INTERNAL; ++ goto done; ++ } ++ ++ ret = 0; ++done: ++ if (ret) ++ zap(outrnd->data, outrnd->length); ++ EVP_KDF_free(kdf); ++ EVP_KDF_CTX_free(kctx); ++ return ret; ++} ++ ++static krb5_error_code ++openssl_kbkdf_feedback_cmac(const struct krb5_enc_provider *enc, ++ krb5_key inkey, krb5_data *outrnd, ++ const krb5_data *in_constant) ++{ ++ krb5_error_code ret; ++ EVP_KDF *kdf = NULL; ++ EVP_KDF_CTX *kctx = NULL; ++ OSSL_PARAM params[7]; ++ size_t i = 0; ++ char *cipher; ++ static unsigned char zeroes[16]; ++ ++ memset(zeroes, 0, sizeof(zeroes)); ++ ++ if (!memcmp(enc, &krb5int_enc_camellia128, sizeof(*enc))) { ++ cipher = "CAMELLIA-128-CBC"; ++ } else if (!memcmp(enc, &krb5int_enc_camellia256, sizeof(*enc))) { ++ cipher = "CAMELLIA-256-CBC"; ++ } else { ++ ret = KRB5_CRYPTO_INTERNAL; ++ goto done; ++ } ++ ++ kdf = EVP_KDF_fetch(NULL, "KBKDF", NULL); ++ if (!kdf) { ++ ret = KRB5_CRYPTO_INTERNAL; ++ goto done; ++ } ++ ++ kctx = EVP_KDF_CTX_new(kdf); ++ if (!kctx) { ++ ret = KRB5_CRYPTO_INTERNAL; ++ goto done; ++ } ++ ++ params[i++] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE, ++ "FEEDBACK", 0); ++ params[i++] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC, ++ "CMAC", 0); ++ params[i++] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CIPHER, ++ cipher, 0); ++ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, ++ inkey->keyblock.contents, ++ inkey->keyblock.length); ++ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT, ++ in_constant->data, ++ in_constant->length); ++ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, ++ zeroes, sizeof(zeroes)); ++ params[i] = OSSL_PARAM_construct_end(); ++ if (EVP_KDF_derive(kctx, (unsigned char *)outrnd->data, outrnd->length, ++ params) <= 0) { ++ ret = KRB5_CRYPTO_INTERNAL; ++ goto done; ++ } ++ ++ ret = 0; ++done: ++ if (ret) ++ zap(outrnd->data, outrnd->length); ++ EVP_KDF_free(kdf); ++ EVP_KDF_CTX_free(kctx); ++ return ret; ++} ++ ++static krb5_error_code ++openssl_krb5kdf(const struct krb5_enc_provider *enc, krb5_key inkey, ++ krb5_data *outrnd, const krb5_data *in_constant) ++{ ++ krb5_error_code ret; ++ EVP_KDF *kdf = NULL; ++ EVP_KDF_CTX *kctx = NULL; ++ OSSL_PARAM params[4]; ++ size_t i = 0; ++ char *cipher; ++ ++ if (inkey->keyblock.length != enc->keylength || ++ outrnd->length != enc->keybytes) { ++ return KRB5_CRYPTO_INTERNAL; ++ } ++ ++ if (!memcmp(enc, &krb5int_enc_aes128, sizeof(*enc))) { ++ cipher = "AES-128-CBC"; ++ } else if (!memcmp(enc, &krb5int_enc_aes256, sizeof(*enc))) { ++ cipher = "AES-256-CBC"; ++ } else { ++ ret = KRB5_CRYPTO_INTERNAL; ++ goto done; ++ } ++ ++ kdf = EVP_KDF_fetch(NULL, "KRB5KDF", NULL); ++ if (kdf == NULL) { ++ ret = KRB5_CRYPTO_INTERNAL; ++ goto done; ++ } ++ ++ kctx = EVP_KDF_CTX_new(kdf); ++ if (kctx == NULL) { ++ ret = KRB5_CRYPTO_INTERNAL; ++ goto done; ++ } ++ ++ params[i++] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CIPHER, ++ cipher, 0); ++ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, ++ inkey->keyblock.contents, ++ inkey->keyblock.length); ++ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_CONSTANT, ++ in_constant->data, ++ in_constant->length); ++ params[i] = OSSL_PARAM_construct_end(); ++ if (EVP_KDF_derive(kctx, (unsigned char *)outrnd->data, outrnd->length, ++ params) <= 0) { ++ ret = KRB5_CRYPTO_INTERNAL; ++ goto done; ++ } ++ ++ ret = 0; ++done: ++ if (ret) ++ zap(outrnd->data, outrnd->length); ++ EVP_KDF_free(kdf); ++ EVP_KDF_CTX_free(kctx); ++ return ret; ++} ++ ++#else /* HAVE_EVP_KDF_FETCH */ ++ ++/* ++ * NIST SP800-108 KDF in counter mode (section 5.1). ++ * Parameters: ++ * - HMAC (with hash as the hash provider) is the PRF. ++ * - A block counter of four bytes is used. ++ * - Four bytes are used to encode the output length in the PRF input. ++ * ++ * There are no uses requiring more than a single PRF invocation. ++ */ ++static krb5_error_code ++builtin_sp800_108_counter_hmac(const struct krb5_hash_provider *hash, ++ krb5_key inkey, krb5_data *outrnd, ++ const krb5_data *label, ++ const krb5_data *context) ++{ ++ krb5_crypto_iov iov[5]; ++ krb5_error_code ret; ++ krb5_data prf; ++ unsigned char ibuf[4], lbuf[4]; ++ ++ if (hash == NULL || outrnd->length > hash->hashsize) + return KRB5_CRYPTO_INTERNAL; + + /* Allocate encryption data buffer. */ +- ret = alloc_data(&block, blocksize); ++ ret = alloc_data(&prf, hash->hashsize); + if (ret) + return ret; + +- /* Initialize the input block. */ +- if (in_constant->length == blocksize) { +- memcpy(block.data, in_constant->data, blocksize); +- } else { +- krb5int_nfold(in_constant->length * 8, +- (unsigned char *) in_constant->data, +- blocksize * 8, (unsigned char *) block.data); +- } ++ /* [i]2: four-byte big-endian binary string giving the block counter (1) */ ++ iov[0].flags = KRB5_CRYPTO_TYPE_DATA; ++ iov[0].data = make_data(ibuf, sizeof(ibuf)); ++ store_32_be(1, ibuf); ++ /* Label */ ++ iov[1].flags = KRB5_CRYPTO_TYPE_DATA; ++ iov[1].data = *label; ++ /* 0x00: separator byte */ ++ iov[2].flags = KRB5_CRYPTO_TYPE_DATA; ++ iov[2].data = make_data("", 1); ++ /* Context */ ++ iov[3].flags = KRB5_CRYPTO_TYPE_DATA; ++ iov[3].data = *context; ++ /* [L]2: four-byte big-endian binary string giving the output length */ ++ iov[4].flags = KRB5_CRYPTO_TYPE_DATA; ++ iov[4].data = make_data(lbuf, sizeof(lbuf)); ++ store_32_be(outrnd->length * 8, lbuf); + +- /* Loop encrypting the blocks until enough key bytes are generated. */ +- n = 0; +- while (n < keybytes) { +- ret = encrypt_block(enc, inkey, &block); +- if (ret) +- goto cleanup; +- +- if ((keybytes - n) <= blocksize) { +- memcpy(outrnd->data + n, block.data, (keybytes - n)); +- break; +- } +- +- memcpy(outrnd->data + n, block.data, blocksize); +- n += blocksize; +- } +- +-cleanup: +- zapfree(block.data, blocksize); ++ ret = krb5int_hmac(hash, inkey, iov, 5, &prf); ++ if (!ret) ++ memcpy(outrnd->data, prf.data, outrnd->length); ++ zapfree(prf.data, prf.length); + return ret; + } + +@@ -139,9 +341,9 @@ cleanup: + * - Four bytes are used to encode the output length in the PRF input. + */ + static krb5_error_code +-derive_random_sp800_108_feedback_cmac(const struct krb5_enc_provider *enc, +- krb5_key inkey, krb5_data *outrnd, +- const krb5_data *in_constant) ++builtin_sp800_108_feedback_cmac(const struct krb5_enc_provider *enc, ++ krb5_key inkey, krb5_data *outrnd, ++ const krb5_data *in_constant) + { + size_t blocksize, keybytes, n; + krb5_crypto_iov iov[6]; +@@ -204,56 +406,94 @@ cleanup: + return ret; + } + +-/* +- * NIST SP800-108 KDF in counter mode (section 5.1). +- * Parameters: +- * - HMAC (with hash as the hash provider) is the PRF. +- * - A block counter of four bytes is used. +- * - Four bytes are used to encode the output length in the PRF input. +- * +- * There are no uses requiring more than a single PRF invocation. +- */ ++static krb5_error_code ++builtin_derive_random_rfc3961(const struct krb5_enc_provider *enc, ++ krb5_key inkey, krb5_data *outrnd, ++ const krb5_data *in_constant) ++{ ++ size_t blocksize, keybytes, n; ++ krb5_error_code ret; ++ krb5_data block = empty_data(); ++ ++ blocksize = enc->block_size; ++ keybytes = enc->keybytes; ++ ++ if (blocksize == 1) ++ return KRB5_BAD_ENCTYPE; ++ if (inkey->keyblock.length != enc->keylength || outrnd->length != keybytes) ++ return KRB5_CRYPTO_INTERNAL; ++ ++ /* Allocate encryption data buffer. */ ++ ret = alloc_data(&block, blocksize); ++ if (ret) ++ return ret; ++ ++ /* Initialize the input block. */ ++ if (in_constant->length == blocksize) { ++ memcpy(block.data, in_constant->data, blocksize); ++ } else { ++ krb5int_nfold(in_constant->length * 8, ++ (unsigned char *) in_constant->data, ++ blocksize * 8, (unsigned char *) block.data); ++ } ++ ++ /* Loop encrypting the blocks until enough key bytes are generated. */ ++ n = 0; ++ while (n < keybytes) { ++ ret = encrypt_block(enc, inkey, &block); ++ if (ret) ++ goto cleanup; ++ ++ if ((keybytes - n) <= blocksize) { ++ memcpy(outrnd->data + n, block.data, (keybytes - n)); ++ break; ++ } ++ ++ memcpy(outrnd->data + n, block.data, blocksize); ++ n += blocksize; ++ } ++ ++cleanup: ++ zapfree(block.data, blocksize); ++ return ret; ++} ++#endif /* HAVE_EVP_KDF_FETCH */ ++ + krb5_error_code + k5_sp800_108_counter_hmac(const struct krb5_hash_provider *hash, + krb5_key inkey, krb5_data *outrnd, + const krb5_data *label, const krb5_data *context) + { +- krb5_crypto_iov iov[5]; +- krb5_error_code ret; +- krb5_data prf; +- unsigned char ibuf[4], lbuf[4]; ++#ifdef HAVE_EVP_KDF_FETCH ++ return openssl_kbdkf_counter_hmac(hash, inkey, outrnd, label, context); ++#else ++ return builtin_sp800_108_counter_hmac(hash, inkey, outrnd, label, ++ context); ++#endif ++} + +- if (hash == NULL || outrnd->length > hash->hashsize) +- return KRB5_CRYPTO_INTERNAL; ++static krb5_error_code ++sp800_108_feedback_cmac(const struct krb5_enc_provider *enc, ++ krb5_key inkey, krb5_data *outrnd, ++ const krb5_data *in_constant) ++{ ++#ifdef HAVE_EVP_KDF_FETCH ++ return openssl_kbkdf_feedback_cmac(enc, inkey, outrnd, in_constant); ++#else ++ return builtin_sp800_108_feedback_cmac(enc, inkey, outrnd, in_constant); ++#endif ++} + +- /* Allocate encryption data buffer. */ +- ret = alloc_data(&prf, hash->hashsize); +- if (ret) +- return ret; +- +- /* [i]2: four-byte big-endian binary string giving the block counter (1) */ +- iov[0].flags = KRB5_CRYPTO_TYPE_DATA; +- iov[0].data = make_data(ibuf, sizeof(ibuf)); +- store_32_be(1, ibuf); +- /* Label */ +- iov[1].flags = KRB5_CRYPTO_TYPE_DATA; +- iov[1].data = *label; +- /* 0x00: separator byte */ +- iov[2].flags = KRB5_CRYPTO_TYPE_DATA; +- iov[2].data = make_data("", 1); +- /* Context */ +- iov[3].flags = KRB5_CRYPTO_TYPE_DATA; +- iov[3].data = *context; +- /* [L]2: four-byte big-endian binary string giving the output length */ +- iov[4].flags = KRB5_CRYPTO_TYPE_DATA; +- iov[4].data = make_data(lbuf, sizeof(lbuf)); +- store_32_be(outrnd->length * 8, lbuf); +- +- ret = krb5int_hmac(hash, inkey, iov, 5, &prf); +- if (!ret) +- memcpy(outrnd->data, prf.data, outrnd->length); +- zapfree(prf.data, prf.length); +- return ret; ++static krb5_error_code ++derive_random_rfc3961(const struct krb5_enc_provider *enc, ++ krb5_key inkey, krb5_data *outrnd, ++ const krb5_data *in_constant) ++{ ++#ifdef HAVE_EVP_KDF_FETCH ++ return openssl_krb5kdf(enc, inkey, outrnd, in_constant); ++#else ++ return builtin_derive_random_rfc3961(enc, inkey, outrnd, in_constant); ++#endif + } + + krb5_error_code +@@ -268,8 +508,7 @@ krb5int_derive_random(const struct krb5_enc_provider *enc, + case DERIVE_RFC3961: + return derive_random_rfc3961(enc, inkey, outrnd, in_constant); + case DERIVE_SP800_108_CMAC: +- return derive_random_sp800_108_feedback_cmac(enc, inkey, outrnd, +- in_constant); ++ return sp800_108_feedback_cmac(enc, inkey, outrnd, in_constant); + case DERIVE_SP800_108_HMAC: + return k5_sp800_108_counter_hmac(hash, inkey, outrnd, in_constant, + &empty); diff --git a/Use-OpenSSL-s-SSKDF-in-PKINIT-when-available.patch b/Use-OpenSSL-s-SSKDF-in-PKINIT-when-available.patch new file mode 100644 index 0000000..0a9cde1 --- /dev/null +++ b/Use-OpenSSL-s-SSKDF-in-PKINIT-when-available.patch @@ -0,0 +1,408 @@ +From 8bbb492f2be1418e1e4bb2cf197414810dac9589 Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Fri, 20 Sep 2019 17:20:59 -0400 +Subject: [PATCH] Use OpenSSL's SSKDF in PKINIT when available + +Starting in 3.0, OpenSSL implements SSKDF, which is the basis of our +id-pkinit-kdf (RFC 8636). Factor out common setup code around +other_info. Adjust code to comply to existing style. + +(cherry picked from commit 4376a22e41fb639be31daf81275a332d3f930996) +--- + .../preauth/pkinit/pkinit_crypto_openssl.c | 294 +++++++++++------- + 1 file changed, 181 insertions(+), 113 deletions(-) + +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index e1153344e..350c2118a 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -38,6 +38,12 @@ + #include + #include + ++#ifdef HAVE_EVP_KDF_FETCH ++#include ++#include ++#include ++#endif ++ + static krb5_error_code pkinit_init_pkinit_oids(pkinit_plg_crypto_context ); + static void pkinit_fini_pkinit_oids(pkinit_plg_crypto_context ); + +@@ -2294,15 +2300,16 @@ cleanup: + } + + +-/** ++/* + * Given an algorithm_identifier, this function returns the hash length + * and EVP function associated with that algorithm. ++ * ++ * RFC 8636 defines a SHA384 variant, but we don't use it. + */ + static krb5_error_code +-pkinit_alg_values(krb5_context context, +- const krb5_data *alg_id, +- size_t *hash_bytes, +- const EVP_MD *(**func)(void)) ++pkinit_alg_values(krb5_context context, const krb5_data *alg_id, ++ size_t *hash_bytes, const EVP_MD *(**func)(void), ++ char **hash_name) + { + *hash_bytes = 0; + *func = NULL; +@@ -2311,18 +2318,21 @@ pkinit_alg_values(krb5_context context, + krb5_pkinit_sha1_oid_len))) { + *hash_bytes = 20; + *func = &EVP_sha1; ++ *hash_name = strdup("SHA1"); + return 0; + } else if ((alg_id->length == krb5_pkinit_sha256_oid_len) && + (0 == memcmp(alg_id->data, krb5_pkinit_sha256_oid, + krb5_pkinit_sha256_oid_len))) { + *hash_bytes = 32; + *func = &EVP_sha256; ++ *hash_name = strdup("SHA256"); + return 0; + } else if ((alg_id->length == krb5_pkinit_sha512_oid_len) && + (0 == memcmp(alg_id->data, krb5_pkinit_sha512_oid, + krb5_pkinit_sha512_oid_len))) { + *hash_bytes = 64; + *func = &EVP_sha512; ++ *hash_name = strdup("SHA512"); + return 0; + } else { + krb5_set_error_message(context, KRB5_ERR_BAD_S2K_PARAMS, +@@ -2331,11 +2341,60 @@ pkinit_alg_values(krb5_context context, + } + } /* pkinit_alg_values() */ + ++#ifdef HAVE_EVP_KDF_FETCH ++static krb5_error_code ++openssl_sskdf(krb5_context context, size_t hash_bytes, krb5_data *key, ++ krb5_data *info, char *out, size_t out_len, char *digest) ++{ ++ krb5_error_code ret; ++ EVP_KDF *kdf = NULL; ++ EVP_KDF_CTX *kctx = NULL; ++ OSSL_PARAM params[4]; ++ size_t i = 0; + +-/* pkinit_alg_agility_kdf() -- +- * This function generates a key using the KDF described in +- * draft_ietf_krb_wg_pkinit_alg_agility-04.txt. The algorithm is +- * described as follows: ++ if (digest == NULL) { ++ ret = oerr(context, ENOMEM, ++ _("Failed to allocate space for digest algorithm name")); ++ goto done; ++ } ++ ++ kdf = EVP_KDF_fetch(NULL, "SSKDF", NULL); ++ if (kdf == NULL) { ++ ret = oerr(context, KRB5_CRYPTO_INTERNAL, _("Failed to fetch SSKDF")); ++ goto done; ++ } ++ ++ kctx = EVP_KDF_CTX_new(kdf); ++ if (!kctx) { ++ ret = oerr(context, KRB5_CRYPTO_INTERNAL, ++ _("Failed to instantiate SSKDF")); ++ goto done; ++ } ++ ++ params[i++] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, ++ digest, 0); ++ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, ++ key->data, key->length); ++ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, ++ info->data, info->length); ++ params[i] = OSSL_PARAM_construct_end(); ++ if (EVP_KDF_derive(kctx, (unsigned char *)out, out_len, params) <= 0) { ++ ret = oerr(context, KRB5_CRYPTO_INTERNAL, ++ _("Failed to derive key using SSKDF")); ++ goto done; ++ } ++ ++ ret = 0; ++done: ++ EVP_KDF_free(kdf); ++ EVP_KDF_CTX_free(kctx); ++ return ret; ++} ++#else ++/* ++ * Generate a key using the KDF described in RFC 8636, also known as SSKDF ++ * (single-step kdf). Our caller precomputes `reps`, but otherwise the ++ * algorithm is as follows: + * + * 1. reps = keydatalen (K) / hash length (H) + * +@@ -2349,95 +2408,16 @@ pkinit_alg_values(krb5_context context, + * + * 4. Set key = Hash1 || Hash2 || ... so that length of key is K bytes. + */ +-krb5_error_code +-pkinit_alg_agility_kdf(krb5_context context, +- krb5_data *secret, +- krb5_data *alg_oid, +- krb5_const_principal party_u_info, +- krb5_const_principal party_v_info, +- krb5_enctype enctype, +- krb5_data *as_req, +- krb5_data *pk_as_rep, +- krb5_keyblock *key_block) ++static krb5_error_code ++builtin_sskdf(krb5_context context, unsigned int reps, size_t hash_len, ++ const EVP_MD *(*EVP_func)(void), krb5_data *secret, ++ krb5_data *other_info, char *out, size_t out_len) + { +- krb5_error_code retval = 0; ++ krb5_error_code ret = 0; + +- unsigned int reps = 0; +- uint32_t counter = 1; /* Does this type work on Windows? */ ++ uint32_t counter = 1; + size_t offset = 0; +- size_t hash_len = 0; +- size_t rand_len = 0; +- size_t key_len = 0; +- krb5_data random_data; +- krb5_sp80056a_other_info other_info_fields; +- krb5_pkinit_supp_pub_info supp_pub_info_fields; +- krb5_data *other_info = NULL; +- krb5_data *supp_pub_info = NULL; +- krb5_algorithm_identifier alg_id; + EVP_MD_CTX *ctx = NULL; +- const EVP_MD *(*EVP_func)(void); +- +- /* initialize random_data here to make clean-up safe */ +- random_data.length = 0; +- random_data.data = NULL; +- +- /* allocate and initialize the key block */ +- key_block->magic = 0; +- key_block->enctype = enctype; +- if (0 != (retval = krb5_c_keylengths(context, enctype, &rand_len, +- &key_len))) +- goto cleanup; +- +- random_data.length = rand_len; +- key_block->length = key_len; +- +- if (NULL == (key_block->contents = malloc(key_block->length))) { +- retval = ENOMEM; +- goto cleanup; +- } +- +- memset (key_block->contents, 0, key_block->length); +- +- /* If this is anonymous pkinit, use the anonymous principle for party_u_info */ +- if (party_u_info && krb5_principal_compare_any_realm(context, party_u_info, +- krb5_anonymous_principal())) +- party_u_info = (krb5_principal)krb5_anonymous_principal(); +- +- if (0 != (retval = pkinit_alg_values(context, alg_oid, &hash_len, &EVP_func))) +- goto cleanup; +- +- /* 1. reps = keydatalen (K) / hash length (H) */ +- reps = key_block->length/hash_len; +- +- /* ... and round up, if necessary */ +- if (key_block->length > (reps * hash_len)) +- reps++; +- +- /* Allocate enough space in the random data buffer to hash directly into +- * it, even if the last hash will make it bigger than the key length. */ +- if (NULL == (random_data.data = malloc(reps * hash_len))) { +- retval = ENOMEM; +- goto cleanup; +- } +- +- /* Encode the ASN.1 octet string for "SuppPubInfo" */ +- supp_pub_info_fields.enctype = enctype; +- supp_pub_info_fields.as_req = *as_req; +- supp_pub_info_fields.pk_as_rep = *pk_as_rep; +- if (0 != ((retval = encode_krb5_pkinit_supp_pub_info(&supp_pub_info_fields, +- &supp_pub_info)))) +- goto cleanup; +- +- /* Now encode the ASN.1 octet string for "OtherInfo" */ +- memset(&alg_id, 0, sizeof alg_id); +- alg_id.algorithm = *alg_oid; /*alias*/ +- +- other_info_fields.algorithm_identifier = alg_id; +- other_info_fields.party_u_info = (krb5_principal) party_u_info; +- other_info_fields.party_v_info = (krb5_principal) party_v_info; +- other_info_fields.supp_pub_info = *supp_pub_info; +- if (0 != (retval = encode_krb5_sp80056a_other_info(&other_info_fields, &other_info))) +- goto cleanup; + + /* 2. Initialize a 32-bit, big-endian bit string counter as 1. + * 3. For i = 1 to reps by 1, do the following: +@@ -2450,7 +2430,7 @@ pkinit_alg_agility_kdf(krb5_context context, + + ctx = EVP_MD_CTX_new(); + if (ctx == NULL) { +- retval = KRB5_CRYPTO_INTERNAL; ++ ret = KRB5_CRYPTO_INTERNAL; + goto cleanup; + } + +@@ -2458,7 +2438,7 @@ pkinit_alg_agility_kdf(krb5_context context, + if (!EVP_DigestInit(ctx, EVP_func())) { + krb5_set_error_message(context, KRB5_CRYPTO_INTERNAL, + "Call to OpenSSL EVP_DigestInit() returned an error."); +- retval = KRB5_CRYPTO_INTERNAL; ++ ret = KRB5_CRYPTO_INTERNAL; + goto cleanup; + } + +@@ -2467,15 +2447,16 @@ pkinit_alg_agility_kdf(krb5_context context, + !EVP_DigestUpdate(ctx, other_info->data, other_info->length)) { + krb5_set_error_message(context, KRB5_CRYPTO_INTERNAL, + "Call to OpenSSL EVP_DigestUpdate() returned an error."); +- retval = KRB5_CRYPTO_INTERNAL; ++ ret = KRB5_CRYPTO_INTERNAL; + goto cleanup; + } + +- /* 4. Set key = Hash1 || Hash2 || ... so that length of key is K bytes. */ +- if (!EVP_DigestFinal(ctx, (uint8_t *)random_data.data + offset, &s)) { ++ /* 4. Set key = Hash1 || Hash2 || ... so that length of key is K ++ * bytes. */ ++ if (!EVP_DigestFinal(ctx, (unsigned char *)out + offset, &s)) { + krb5_set_error_message(context, KRB5_CRYPTO_INTERNAL, + "Call to OpenSSL EVP_DigestUpdate() returned an error."); +- retval = KRB5_CRYPTO_INTERNAL; ++ ret = KRB5_CRYPTO_INTERNAL; + goto cleanup; + } + offset += s; +@@ -2484,26 +2465,113 @@ pkinit_alg_agility_kdf(krb5_context context, + EVP_MD_CTX_free(ctx); + ctx = NULL; + } +- +- retval = krb5_c_random_to_key(context, enctype, &random_data, +- key_block); +- + cleanup: + EVP_MD_CTX_free(ctx); ++ return ret; ++} /* builtin_sskdf() */ ++#endif /* HAVE_EVP_KDF_FETCH */ + +- /* If this has been an error, free the allocated key_block, if any */ +- if (retval) { +- krb5_free_keyblock_contents(context, key_block); ++/* id-pkinit-kdf family, as specified by RFC 8636. */ ++krb5_error_code ++pkinit_alg_agility_kdf(krb5_context context, krb5_data *secret, ++ krb5_data *alg_oid, krb5_const_principal party_u_info, ++ krb5_const_principal party_v_info, ++ krb5_enctype enctype, krb5_data *as_req, ++ krb5_data *pk_as_rep, krb5_keyblock *key_block) ++{ ++ krb5_error_code ret; ++ size_t hash_len = 0, rand_len = 0, key_len = 0; ++ const EVP_MD *(*EVP_func)(void); ++ krb5_sp80056a_other_info other_info_fields; ++ krb5_pkinit_supp_pub_info supp_pub_info_fields; ++ krb5_data *other_info = NULL, *supp_pub_info = NULL; ++ krb5_data random_data = empty_data(); ++ krb5_algorithm_identifier alg_id; ++ unsigned int reps; ++ char *hash_name = NULL; ++ ++ /* Allocate and initialize the key block. */ ++ key_block->magic = 0; ++ key_block->enctype = enctype; ++ ++ /* Use separate variables to avoid alignment restriction problems. */ ++ ret = krb5_c_keylengths(context, enctype, &rand_len, &key_len); ++ if (ret) ++ goto cleanup; ++ random_data.length = rand_len; ++ key_block->length = key_len; ++ ++ key_block->contents = k5calloc(key_block->length, 1, &ret); ++ if (key_block->contents == NULL) ++ goto cleanup; ++ ++ /* If this is anonymous pkinit, use the anonymous principle for ++ * party_u_info. */ ++ if (party_u_info && ++ krb5_principal_compare_any_realm(context, party_u_info, ++ krb5_anonymous_principal())) { ++ party_u_info = (krb5_principal)krb5_anonymous_principal(); + } + +- /* free other allocated resources, either way */ +- if (random_data.data) +- free(random_data.data); ++ ret = pkinit_alg_values(context, alg_oid, &hash_len, &EVP_func, ++ &hash_name); ++ if (ret) ++ goto cleanup; ++ ++ /* 1. reps = keydatalen (K) / hash length (H) */ ++ reps = key_block->length / hash_len; ++ ++ /* ... and round up, if necessary. */ ++ if (key_block->length > (reps * hash_len)) ++ reps++; ++ ++ /* Allocate enough space in the random data buffer to hash directly into ++ * it, even if the last hash will make it bigger than the key length. */ ++ random_data.data = k5alloc(reps * hash_len, &ret); ++ if (random_data.data == NULL) ++ goto cleanup; ++ ++ /* Encode the ASN.1 octet string for "SuppPubInfo". */ ++ supp_pub_info_fields.enctype = enctype; ++ supp_pub_info_fields.as_req = *as_req; ++ supp_pub_info_fields.pk_as_rep = *pk_as_rep; ++ ret = encode_krb5_pkinit_supp_pub_info(&supp_pub_info_fields, ++ &supp_pub_info); ++ if (ret) ++ goto cleanup; ++ ++ /* Now encode the ASN.1 octet string for "OtherInfo". */ ++ memset(&alg_id, 0, sizeof(alg_id)); ++ alg_id.algorithm = *alg_oid; ++ other_info_fields.algorithm_identifier = alg_id; ++ other_info_fields.party_u_info = (krb5_principal)party_u_info; ++ other_info_fields.party_v_info = (krb5_principal)party_v_info; ++ other_info_fields.supp_pub_info = *supp_pub_info; ++ ret = encode_krb5_sp80056a_other_info(&other_info_fields, &other_info); ++ if (ret) ++ goto cleanup; ++ ++#ifdef HAVE_EVP_KDF_FETCH ++ ret = openssl_sskdf(context, hash_len, secret, other_info, ++ random_data.data, key_block->length, hash_name); ++#else ++ ret = builtin_sskdf(context, reps, hash_len, EVP_func, secret, ++ other_info, random_data.data, key_block->length); ++#endif ++ if (ret) ++ goto cleanup; ++ ++ ret = krb5_c_random_to_key(context, enctype, &random_data, key_block); ++cleanup: ++ if (ret) ++ krb5_free_keyblock_contents(context, key_block); ++ ++ free(hash_name); ++ zapfree(random_data.data, random_data.length); + krb5_free_data(context, other_info); + krb5_free_data(context, supp_pub_info); +- +- return retval; +-} /*pkinit_alg_agility_kdf() */ ++ return ret; ++} + + /* Call DH_compute_key() and ensure that we left-pad short results instead of + * leaving junk bytes at the end of the buffer. */ diff --git a/downstream-Remove-3des-support.patch b/downstream-Remove-3des-support.patch index 9c29cdd..3d351eb 100644 --- a/downstream-Remove-3des-support.patch +++ b/downstream-Remove-3des-support.patch @@ -9,6 +9,12 @@ to user other enctypes. Mark the 3DES enctypes UNSUPPORTED and retain their constants. Last-updated: 1.19-beta1 +[antorres@redhat.com: remove diffs for: + - src/kdamin/testing/proto/kdc.conf.proto + - src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp + - src/lib/kadm5/unit-test/api.current/get-principal-v2.exp + - src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp + since they were removed by Remove-TCL-based-libkadm5-API-tests.patch] --- doc/admin/advanced/retiring-des.rst | 11 + doc/admin/conf_files/kdc_conf.rst | 7 +- @@ -350,19 +356,6 @@ index db80063eb..63e67a2ba 100644 #define CKSUMTYPE_HMAC_SHA1_96_AES128 0x000f /**< RFC 3962. Used with ENCTYPE_AES128_CTS_HMAC_SHA1_96 */ #define CKSUMTYPE_HMAC_SHA1_96_AES256 0x0010 /**< RFC 3962. Used with -diff --git a/src/kadmin/testing/proto/kdc.conf.proto b/src/kadmin/testing/proto/kdc.conf.proto -index 8a4b87de1..d7f1d076b 100644 ---- a/src/kadmin/testing/proto/kdc.conf.proto -+++ b/src/kadmin/testing/proto/kdc.conf.proto -@@ -11,6 +11,6 @@ - dict_file = __K5ROOT__/ovsec_adm.dict - kadmind_port = 1751 - kpasswd_port = 1752 -- master_key_type = des3-hmac-sha1 -- supported_enctypes = des3-hmac-sha1:normal aes256-cts:normal aes128-cts:normal aes256-sha2:normal aes128-sha2:normal -+ master_key_type = aes256-cts -+ supported_enctypes = aes256-cts:normal aes128-cts:normal aes256-sha2:normal aes128-sha2:normal - } diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c index 60f30c4f4..c65375aef 100644 --- a/src/kdc/kdc_util.c @@ -5575,55 +5568,6 @@ index 84f194988..32150f5e3 100644 case ENCTYPE_ARCFOUR_HMAC: case ENCTYPE_ARCFOUR_HMAC_EXP: /* RFC 4121 accidentally omits RC4-HMAC-EXP as a "not-newer" enctype, -diff --git a/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp -index 740425c69..6b45f5f72 100644 ---- a/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp -+++ b/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp -@@ -53,10 +53,10 @@ proc test200 {} { - } - - # XXX Perhaps I should actually check the key type returned. -- if {$num_keys == 5} { -+ if {$num_keys == 4} { - pass "$test" - } else { -- fail "$test: $num_keys keys, should be 5" -+ fail "$test: $num_keys keys, should be 4" - } - if { ! [cmd {kadm5_destroy $server_handle}]} { - perror "$test: unexpected failure in destroy" -diff --git a/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp -index 3ea1ba29b..d2c6d1afa 100644 ---- a/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp -+++ b/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp -@@ -143,8 +143,8 @@ proc test101_102 {rpc} { - } - - set failed 0 -- if {$num_keys != 5} { -- fail "$test: num_keys $num_keys should be 5" -+ if {$num_keys != 4} { -+ fail "$test: num_keys $num_keys should be 4" - set failed 1 - } - for {set i 0} {$i < $num_keys} {incr i} { -diff --git a/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp -index 2925c1c43..2f76c8b43 100644 ---- a/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp -+++ b/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp -@@ -46,10 +46,10 @@ proc test100 {} { - } - - # XXX Perhaps I should actually check the key type returned. -- if {$num_keys == 5} { -+ if {$num_keys == 4} { - pass "$test" - } else { -- fail "$test: $num_keys keys, should be 5" -+ fail "$test: $num_keys keys, should be 4" - } - if { ! [cmd {kadm5_destroy $server_handle}]} { - perror "$test: unexpected failure in destroy" diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c index aa35baa3c..bfa99d9eb 100644 --- a/src/lib/krb5/krb/init_ctx.c diff --git a/krb5.spec b/krb5.spec index 82c7d8a..41b4341 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.2 -Release: %{?zdpd}3%{?dist}.1 +Release: %{?zdpd}4%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -68,7 +68,6 @@ Patch1: downstream-SELinux-integration.patch Patch3: downstream-netlib-and-dns.patch Patch4: downstream-fix-debuginfo-with-y.tab.c.patch Patch5: downstream-Remove-3des-support.patch -Patch6: downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch Patch7: downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch Patch8: Add-APIs-for-marshalling-credentials.patch Patch9: Add-hostname-canonicalization-helper-to-k5test.py.patch @@ -90,6 +89,11 @@ Patch25: Clean-up-context-after-failed-open-in-libkdb5.patch Patch26: Use-asan-in-one-of-the-CI-builds.patch Patch29: Clean-up-gssapi_krb5-ccache-name-functions.patch Patch30: Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch +Patch32: Add-buildsystem-detection-of-the-OpenSSL-3-KDF-inter.patch +Patch33: Use-OpenSSL-s-SSKDF-in-PKINIT-when-available.patch +Patch34: Use-OpenSSL-s-KBKDF-and-KRB5KDF-for-deriving-long-te.patch +Patch35: Handle-OpenSSL-3-s-providers.patch +Patch36: Remove-TCL-based-libkadm5-API-tests.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -118,11 +122,11 @@ BuildRequires: net-tools, rpcbind BuildRequires: hostname BuildRequires: iproute BuildRequires: python3-pyrad +BuildRequires: procps-ng %endif -# Need KDFs. This is the backported version -BuildRequires: openssl-devel >= 1:1.1.1d-4 -BuildRequires: openssl-devel < 1:3.0.0 +# Need KDFs. This is the "real" version +BuildRequires: openssl-devel => 1:3.0.0 %description Kerberos V5 is a trusted-third-party network authentication system, @@ -148,7 +152,7 @@ to install this package. %package libs Summary: The non-admin shared libraries used by Kerberos 5 -Requires: openssl-libs >= 1:1.1.1d-4 +Requires: openssl-libs >= 1:3.0.0 Requires: coreutils, gawk, grep, sed Requires: keyutils-libs >= 1.5.8 Requires: /etc/crypto-policies/back-ends/krb5.config @@ -248,10 +252,7 @@ popd # Mess with some of the default ports that we use for testing, so that multiple # builds going on the same host don't step on each other. -cfg="src/kadmin/testing/proto/kdc.conf.proto \ - src/kadmin/testing/proto/krb5.conf.proto \ - src/lib/kadm5/unit-test/api.current/init-v2.exp \ - src/util/k5test.py" +cfg="src/util/k5test.py" LONG_BIT=`getconf LONG_BIT` PORT=`expr 61000 + $LONG_BIT - 48` sed -i -e s,61000,`expr "$PORT" + 0`,g $cfg @@ -647,6 +648,10 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Fri Dec 3 2021 Antonio Torres - 1.19.2-4 +- Add patches to support OpenSLL 3.0.0 +- Remove TCL-based libkadm5 API tests + * Tue Sep 14 2021 Sahana Prasad - 1.19.2-3.1 - Rebuilt with OpenSSL 3.0.0 From 75355e197a5a2e2981b3e65f3c4dab6e36e626e3 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jan 2022 15:08:32 +0000 Subject: [PATCH 051/103] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- krb5.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/krb5.spec b/krb5.spec index 41b4341..8eb3e03 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.2 -Release: %{?zdpd}4%{?dist} +Release: %{?zdpd}4%{?dist}.1 # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -648,6 +648,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Thu Jan 20 2022 Fedora Release Engineering - 1.19.2-4.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Fri Dec 3 2021 Antonio Torres - 1.19.2-4 - Add patches to support OpenSLL 3.0.0 - Remove TCL-based libkadm5 API tests From b998554176f38ed9aefe1cd8b7fe2f4225b01171 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Thu, 3 Feb 2022 12:27:25 +0200 Subject: [PATCH 052/103] Temporarily remove package note to unblock krb5-dependent packages Resolves: rhbz#2048909 Signed-off-by: Alexander Bokovoy --- krb5.spec | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/krb5.spec b/krb5.spec index 8eb3e03..4d595fb 100644 --- a/krb5.spec +++ b/krb5.spec @@ -1,3 +1,8 @@ +# Force to not include the package note file +# the non-existing package note file is pulled into krb5-config +# and breaks any application that is using krb5 development libs +%undefine _package_note_file + %bcond_without check %if %{without check} %global skipcheck 1 @@ -42,7 +47,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.2 -Release: %{?zdpd}4%{?dist}.1 +Release: %{?zdpd}5%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -648,6 +653,10 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Wed Feb 02 2022 Alexander Bokovoy - 1.19.2-5 +- Temporarily remove package note to unblock krb5-dependent packages +- Resolves: rhbz#2048909 + * Thu Jan 20 2022 Fedora Release Engineering - 1.19.2-4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From f858c7e550077b9183045cbaf36fdef2a3c2fa97 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Thu, 9 Sep 2021 22:10:28 +0200 Subject: [PATCH 053/103] Drop old trigger scriptlet 1.15.1 was ~2017, so there is no need to support upgrades from such old systemd. This allows the dependency on grep to be dropped. grep pulls in pcre, but most other programs in the core group depend on the newer pcre2, so it's nicer to avoid pulling in pcre in minimal installations. --- krb5.spec | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/krb5.spec b/krb5.spec index 4d595fb..8ccc583 100644 --- a/krb5.spec +++ b/krb5.spec @@ -47,7 +47,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.2 -Release: %{?zdpd}5%{?dist} +Release: %{?zdpd}6%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -158,7 +158,7 @@ to install this package. %package libs Summary: The non-admin shared libraries used by Kerberos 5 Requires: openssl-libs >= 1:3.0.0 -Requires: coreutils, gawk, grep, sed +Requires: coreutils, gawk, sed Requires: keyutils-libs >= 1.5.8 Requires: /etc/crypto-policies/back-ends/krb5.config @@ -465,12 +465,6 @@ rm -- "$RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/preauth/test.so" %ldconfig_scriptlets libs -%triggerun libs -- krb5-libs < 1.15.1-5 -if ! grep -q 'includedir /etc/krb5.conf.d' /etc/krb5.conf ; then - sed -i '1i # To opt out of the system crypto-policies configuration of krb5, remove the\n# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.\nincludedir /etc/krb5.conf.d/\n' /etc/krb5.conf -fi -exit 0 - %ldconfig_scriptlets server-ldap %post server @@ -653,6 +647,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Tue Feb 8 2022 Zbigniew JÄ™drzejewski-Szmek - 1.19.2-6 +- Drop old trigger scriplet + * Wed Feb 02 2022 Alexander Bokovoy - 1.19.2-5 - Temporarily remove package note to unblock krb5-dependent packages - Resolves: rhbz#2048909 From 970430cbffb6170964d18fc96dee98d787f6ea49 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 8 Feb 2022 14:15:30 +0100 Subject: [PATCH 054/103] Drop link flags from krb5-config Introspecing krb5-config shows that all of the flags in LDFLAGS= are inappropriate for export, so just drop them all. --- krb5.spec | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/krb5.spec b/krb5.spec index 8ccc583..62d3292 100644 --- a/krb5.spec +++ b/krb5.spec @@ -1,8 +1,3 @@ -# Force to not include the package note file -# the non-existing package note file is pulled into krb5-config -# and breaks any application that is using krb5 development libs -%undefine _package_note_file - %bcond_without check %if %{without check} %global skipcheck 1 @@ -436,7 +431,8 @@ sed -r -i -e 's|^libdir=/usr/lib(64)?$|libdir=/usr/lib|g' $RPM_BUILD_ROOT%{_bind # Workaround krb5-config reading too much from LDFLAGS. # https://bugzilla.redhat.com/show_bug.cgi?id=1997021 -sed -i -e "s/-specs=[^ ]*//g" $RPM_BUILD_ROOT%{_bindir}/krb5-config +# https://bugzilla.redhat.com/show_bug.cgi?id=2048909 +sed -i -r -e 's/^(LDFLAGS=).*/\1/' $RPM_BUILD_ROOT%{_bindir}/krb5-config # Install processed man pages. for section in 1 5 8 ; do @@ -649,6 +645,7 @@ exit 0 %changelog * Tue Feb 8 2022 Zbigniew JÄ™drzejewski-Szmek - 1.19.2-6 - Drop old trigger scriplet +- Reenable package notes and strip LDFLAGS from krb5-config (rhbz#2048909) * Wed Feb 02 2022 Alexander Bokovoy - 1.19.2-5 - Temporarily remove package note to unblock krb5-dependent packages From 2ef37ab30d679328b361422aa40ec32f1fc138d3 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Wed, 23 Mar 2022 11:30:21 +0100 Subject: [PATCH 055/103] Use SHA-256 instead of SHA-1 for PKINIT CMS digest CMS digest and signature algorithm for the anonymous PKINIT is changed from SHA-1 to SHA-256. SHA-1 hasn't been considered secure anymore for this kind of purposes for some years already. Resolves: rhbz#2067121 Signed-off-by: Julien Rische --- ...nstead-of-SHA1-for-PKINIT-CMS-digest.patch | 113 ++++++++++++++++++ krb5.spec | 6 +- 2 files changed, 118 insertions(+), 1 deletion(-) create mode 100644 Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch diff --git a/Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch b/Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch new file mode 100644 index 0000000..ace4da9 --- /dev/null +++ b/Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch @@ -0,0 +1,113 @@ +From 538be893707e2306e89f5e5ca92c0db0ee305e3e Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Fri, 11 Mar 2022 11:33:56 +0100 +Subject: [PATCH] Use SHA-256 instead of SHA-1 for PKINIT CMS digest + +Various organizations including NIST have been strongly recommending to +stop using SHA-1 for digital signatures for some years already. CMS +digest is used to generate such signatures, hence it should be upgraded +to use SHA-256. +--- + .../preauth/pkinit/pkinit_crypto_openssl.c | 27 ++++++++++--------- + 1 file changed, 14 insertions(+), 13 deletions(-) + +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index 42e5c581d..2a6ef4aaa 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -1240,7 +1240,7 @@ cms_signeddata_create(krb5_context context, + /* will not fill-out EVP_PKEY because it's on the smartcard */ + + /* Set digest algs */ +- p7si->digest_alg->algorithm = OBJ_nid2obj(NID_sha1); ++ p7si->digest_alg->algorithm = OBJ_nid2obj(NID_sha256); + + if (p7si->digest_alg->parameter != NULL) + ASN1_TYPE_free(p7si->digest_alg->parameter); +@@ -1251,17 +1251,17 @@ cms_signeddata_create(krb5_context context, + /* Set sig algs */ + if (p7si->digest_enc_alg->parameter != NULL) + ASN1_TYPE_free(p7si->digest_enc_alg->parameter); +- p7si->digest_enc_alg->algorithm = OBJ_nid2obj(NID_sha1WithRSAEncryption); ++ p7si->digest_enc_alg->algorithm = OBJ_nid2obj(NID_sha256WithRSAEncryption); + if (!(p7si->digest_enc_alg->parameter = ASN1_TYPE_new())) + goto cleanup; + p7si->digest_enc_alg->parameter->type = V_ASN1_NULL; + + /* add signed attributes */ +- /* compute sha1 digest over the EncapsulatedContentInfo */ ++ /* compute sha256 digest over the EncapsulatedContentInfo */ + ctx = EVP_MD_CTX_new(); + if (ctx == NULL) + goto cleanup; +- EVP_DigestInit_ex(ctx, EVP_sha1(), NULL); ++ EVP_DigestInit_ex(ctx, EVP_sha256(), NULL); + EVP_DigestUpdate(ctx, data, data_len); + md_tmp = EVP_MD_CTX_md(ctx); + EVP_DigestFinal_ex(ctx, md_data, &md_len); +@@ -1289,9 +1289,10 @@ cms_signeddata_create(krb5_context context, + goto cleanup2; + + #ifndef WITHOUT_PKCS11 +- /* Some tokens can only do RSAEncryption without sha1 hash */ +- /* to compute sha1WithRSAEncryption, encode the algorithm ID for the hash +- * function and the hash value into an ASN.1 value of type DigestInfo ++ /* Some tokens can only do RSAEncryption without sha256 hash */ ++ /* to compute sha256WithRSAEncryption, encode the algorithm ID for the ++ * hash function and the hash value into an ASN.1 value of type ++ * DigestInfo + * DigestInfo::=SEQUENCE { + * digestAlgorithm AlgorithmIdentifier, + * digest OCTET STRING } +@@ -1310,7 +1311,7 @@ cms_signeddata_create(krb5_context context, + alg = X509_ALGOR_new(); + if (alg == NULL) + goto cleanup2; +- X509_ALGOR_set0(alg, OBJ_nid2obj(NID_sha1), V_ASN1_NULL, NULL); ++ X509_ALGOR_set0(alg, OBJ_nid2obj(NID_sha256), V_ASN1_NULL, NULL); + alg_len = i2d_X509_ALGOR(alg, NULL); + + digest = ASN1_OCTET_STRING_new(); +@@ -1339,7 +1340,7 @@ cms_signeddata_create(krb5_context context, + #endif + { + pkiDebug("mech = %s\n", +- id_cryptoctx->pkcs11_method == 1 ? "CKM_SHA1_RSA_PKCS" : "FS"); ++ id_cryptoctx->pkcs11_method == 1 ? "CKM_SHA256_RSA_PKCS" : "FS"); + retval = pkinit_sign_data(context, id_cryptoctx, abuf, alen, + &sig, &sig_len); + } +@@ -4189,7 +4190,7 @@ create_signature(unsigned char **sig, unsigned int *sig_len, + ctx = EVP_MD_CTX_new(); + if (ctx == NULL) + return ENOMEM; +- EVP_SignInit(ctx, EVP_sha1()); ++ EVP_SignInit(ctx, EVP_sha256()); + EVP_SignUpdate(ctx, data, data_len); + *sig_len = EVP_PKEY_size(pkey); + if ((*sig = malloc(*sig_len)) == NULL) +@@ -4663,10 +4664,10 @@ pkinit_get_certs_pkcs11(krb5_context context, + + #ifndef PKINIT_USE_MECH_LIST + /* +- * We'd like to use CKM_SHA1_RSA_PKCS for signing if it's available, but ++ * We'd like to use CKM_SHA256_RSA_PKCS for signing if it's available, but + * many cards seems to be confused about whether they are capable of + * this or not. The safe thing seems to be to ignore the mechanism list, +- * always use CKM_RSA_PKCS and calculate the sha1 digest ourselves. ++ * always use CKM_RSA_PKCS and calculate the sha256 digest ourselves. + */ + + id_cryptoctx->mech = CKM_RSA_PKCS; +@@ -4694,7 +4695,7 @@ pkinit_get_certs_pkcs11(krb5_context context, + if (mechp[i] == CKM_RSA_PKCS) { + /* This seems backwards... */ + id_cryptoctx->mech = +- (info.flags & CKF_SIGN) ? CKM_SHA1_RSA_PKCS : CKM_RSA_PKCS; ++ (info.flags & CKF_SIGN) ? CKM_SHA256_RSA_PKCS : CKM_RSA_PKCS; + } + } + free(mechp); +-- +2.35.1 + diff --git a/krb5.spec b/krb5.spec index 62d3292..4fd6248 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.2 -Release: %{?zdpd}6%{?dist} +Release: %{?zdpd}7%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -94,6 +94,7 @@ Patch33: Use-OpenSSL-s-SSKDF-in-PKINIT-when-available.patch Patch34: Use-OpenSSL-s-KBKDF-and-KRB5KDF-for-deriving-long-te.patch Patch35: Handle-OpenSSL-3-s-providers.patch Patch36: Remove-TCL-based-libkadm5-API-tests.patch +Patch37: Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -643,6 +644,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Wed Mar 23 2022 Julien Rische - 1.19.2-7 +- Use SHA-256 instead of SHA-1 for PKINIT CMS digest + * Tue Feb 8 2022 Zbigniew JÄ™drzejewski-Szmek - 1.19.2-6 - Drop old trigger scriplet - Reenable package notes and strip LDFLAGS from krb5-config (rhbz#2048909) From 0ceb166d962e91314715d1167af9584f90020504 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 5 Apr 2022 16:50:01 +0300 Subject: [PATCH 056/103] Allow use of larger RADIUS attributes in krad library In kr_attrset_decode(), explicitly treat the length byte as unsigned. Otherwise attributes longer than 125 characters will be rejected with EBADMSG. Add a 253-character-long NAS-Identifier attribute to the tests to make sure that attributes with the maximal number of characters are working as expected. [ghudson@mit.edu: used uint8_t cast per current practices; edited commit message] ticket: 9036 (new) From upstream, needed in preparation for OAuth2 support for FreeIPA and SSSD. Signed-off-by: Alexander Bokovoy --- krb5-krad-larger-attrs.patch | 69 ++++++++++++++++++++++++++++++++++++ krb5.spec | 6 +++- 2 files changed, 74 insertions(+), 1 deletion(-) create mode 100644 krb5-krad-larger-attrs.patch diff --git a/krb5-krad-larger-attrs.patch b/krb5-krad-larger-attrs.patch new file mode 100644 index 0000000..32111ec --- /dev/null +++ b/krb5-krad-larger-attrs.patch @@ -0,0 +1,69 @@ +From f35077bfc570205092eca2a9d44e50ce265622f4 Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Mon, 8 Nov 2021 17:48:50 +0100 +Subject: [PATCH] Support larger RADIUS attributes in libkrad + +In kr_attrset_decode(), explicitly treat the length byte as unsigned. +Otherwise attributes longer than 125 characters will be rejected with +EBADMSG. + +Add a 253-character-long NAS-Identifier attribute to the tests to make +sure that attributes with the maximal number of characters are working +as expected. + +[ghudson@mit.edu: used uint8_t cast per current practices; edited +commit message] + +ticket: 9036 (new) +--- + src/lib/krad/attrset.c | 2 +- + src/lib/krad/t_packet.c | 13 +++++++++++++ + 2 files changed, 14 insertions(+), 1 deletion(-) + +diff --git a/src/lib/krad/attrset.c b/src/lib/krad/attrset.c +index 03c613716..f309f1581 100644 +--- a/src/lib/krad/attrset.c ++++ b/src/lib/krad/attrset.c +@@ -217,7 +217,7 @@ kr_attrset_decode(krb5_context ctx, const krb5_data *in, const char *secret, + + for (i = 0; i + 2 < in->length; ) { + type = in->data[i++]; +- tmp = make_data(&in->data[i + 1], in->data[i] - 2); ++ tmp = make_data(&in->data[i + 1], (uint8_t)in->data[i] - 2); + i += tmp.length + 1; + + retval = (in->length < i) ? EBADMSG : 0; +diff --git a/src/lib/krad/t_packet.c b/src/lib/krad/t_packet.c +index 0a92e9cc2..c22489144 100644 +--- a/src/lib/krad/t_packet.c ++++ b/src/lib/krad/t_packet.c +@@ -57,6 +57,14 @@ make_packet(krb5_context ctx, const krb5_data *username, + krb5_error_code retval; + const krb5_data *data; + int i = 0; ++ krb5_data nas_id; ++ ++ nas_id = string2data("12345678901234567890123456789012345678901234567890" ++ "12345678901234567890123456789012345678901234567890" ++ "12345678901234567890123456789012345678901234567890" ++ "12345678901234567890123456789012345678901234567890" ++ "12345678901234567890123456789012345678901234567890" ++ "123"); + + retval = krad_attrset_new(ctx, &set); + if (retval != 0) +@@ -71,6 +79,11 @@ make_packet(krb5_context ctx, const krb5_data *username, + if (retval != 0) + goto out; + ++ retval = krad_attrset_add(set, krad_attr_name2num("NAS-Identifier"), ++ &nas_id); ++ if (retval != 0) ++ goto out; ++ + retval = krad_packet_new_request(ctx, "foo", + krad_code_name2num("Access-Request"), + set, iterator, &i, &tmp); +-- +2.35.1 + diff --git a/krb5.spec b/krb5.spec index 4fd6248..cdd5f26 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.2 -Release: %{?zdpd}7%{?dist} +Release: %{?zdpd}8{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -95,6 +95,7 @@ Patch34: Use-OpenSSL-s-KBKDF-and-KRB5KDF-for-deriving-long-te.patch Patch35: Handle-OpenSSL-3-s-providers.patch Patch36: Remove-TCL-based-libkadm5-API-tests.patch Patch37: Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch +Patch38: krb5-krad-larger-attrs.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -644,6 +645,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Tue Apr 05 2022 Alexander Bokovoy - 1.19.2-8 +- Allow use of larger RADIUS attributes in krad library + * Wed Mar 23 2022 Julien Rische - 1.19.2-7 - Use SHA-256 instead of SHA-1 for PKINIT CMS digest From 29a69aee06f339b74f9e1ffcb424b8766f54e8d0 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 5 Apr 2022 16:52:33 +0300 Subject: [PATCH 057/103] fix dist macro --- krb5.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/krb5.spec b/krb5.spec index cdd5f26..b54534c 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.2 -Release: %{?zdpd}8{?dist} +Release: %{?zdpd}8%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz From fc958d47737fba99e4187562ac0ce2d445845798 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 5 Apr 2022 22:14:44 +0300 Subject: [PATCH 058/103] Fix libkrad client cleanup code Resolves: rhbz#2072059 Signed-off-by: Alexander Bokovoy --- krb5-krad-remote.patch | 209 +++++++++++++++++++++++++++++++++++++++++ krb5.spec | 9 +- 2 files changed, 216 insertions(+), 2 deletions(-) create mode 100644 krb5-krad-remote.patch diff --git a/krb5-krad-remote.patch b/krb5-krad-remote.patch new file mode 100644 index 0000000..42452ff --- /dev/null +++ b/krb5-krad-remote.patch @@ -0,0 +1,209 @@ +From ce160f8826bae223876a6527a731c36b6912db15 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Tue, 9 Nov 2021 13:00:43 -0500 +Subject: [PATCH 1/2] Avoid use after free during libkrad cleanup + +libkrad client requests contain a list of references to remotes, with +no back-references or reference counts. To prevent accesses to +dangling references during cleanup, cancel all requests on all remotes +before freeing any remotes. + +Remove the code for aging out unused servers. This code was fairly +safe as all requests referencing a remote should have completed or +timed out during an hour of disuse, but in the current design we have +no way to guarantee or check that. The set of addresses we send +RADIUS requests to will generally be small, so aging out servers is +unnecessary. + +ticket: 9035 (new) +--- + src/lib/krad/client.c | 42 ++++++++++++++--------------------------- + src/lib/krad/internal.h | 4 ++++ + src/lib/krad/remote.c | 11 ++++++++--- + 3 files changed, 26 insertions(+), 31 deletions(-) + +diff --git a/src/lib/krad/client.c b/src/lib/krad/client.c +index 6365dd1c6..810940afc 100644 +--- a/src/lib/krad/client.c ++++ b/src/lib/krad/client.c +@@ -64,7 +64,6 @@ struct request_st { + + struct server_st { + krad_remote *serv; +- time_t last; + K5_LIST_ENTRY(server_st) list; + }; + +@@ -81,15 +80,10 @@ get_server(krad_client *rc, const struct addrinfo *ai, const char *secret, + krad_remote **out) + { + krb5_error_code retval; +- time_t currtime; + server *srv; + +- if (time(&currtime) == (time_t)-1) +- return errno; +- + K5_LIST_FOREACH(srv, &rc->servers, list) { + if (kr_remote_equals(srv->serv, ai, secret)) { +- srv->last = currtime; + *out = srv->serv; + return 0; + } +@@ -98,7 +92,6 @@ get_server(krad_client *rc, const struct addrinfo *ai, const char *secret, + srv = calloc(1, sizeof(server)); + if (srv == NULL) + return ENOMEM; +- srv->last = currtime; + + retval = kr_remote_new(rc->kctx, rc->vctx, ai, secret, &srv->serv); + if (retval != 0) { +@@ -173,28 +166,12 @@ request_new(krad_client *rc, krad_code code, const krad_attrset *attrs, + return 0; + } + +-/* Close remotes that haven't been used in a while. */ +-static void +-age(struct server_head *head, time_t currtime) +-{ +- server *srv, *tmp; +- +- K5_LIST_FOREACH_SAFE(srv, head, list, tmp) { +- if (currtime == (time_t)-1 || currtime - srv->last > 60 * 60) { +- K5_LIST_REMOVE(srv, list); +- kr_remote_free(srv->serv); +- free(srv); +- } +- } +-} +- + /* Handle a response from a server (or related errors). */ + static void + on_response(krb5_error_code retval, const krad_packet *reqp, + const krad_packet *rspp, void *data) + { + request *req = data; +- time_t currtime; + size_t i; + + /* Do nothing if we are already completed. */ +@@ -221,10 +198,6 @@ on_response(krb5_error_code retval, const krad_packet *reqp, + for (i = 0; req->remotes[i].remote != NULL; i++) + kr_remote_cancel(req->remotes[i].remote, req->remotes[i].packet); + +- /* Age out servers that haven't been used in a while. */ +- if (time(&currtime) != (time_t)-1) +- age(&req->rc->servers, currtime); +- + request_free(req); + } + +@@ -247,10 +220,23 @@ krad_client_new(krb5_context kctx, verto_ctx *vctx, krad_client **out) + void + krad_client_free(krad_client *rc) + { ++ server *srv; ++ + if (rc == NULL) + return; + +- age(&rc->servers, -1); ++ /* Cancel all requests before freeing any remotes, since each request's ++ * callback data may contain references to multiple remotes. */ ++ K5_LIST_FOREACH(srv, &rc->servers, list) ++ kr_remote_cancel_all(srv->serv); ++ ++ while (!K5_LIST_EMPTY(&rc->servers)) { ++ srv = K5_LIST_FIRST(&rc->servers); ++ K5_LIST_REMOVE(srv, list); ++ kr_remote_free(srv->serv); ++ free(srv); ++ } ++ + free(rc); + } + +diff --git a/src/lib/krad/internal.h b/src/lib/krad/internal.h +index 0143d155a..7619563fc 100644 +--- a/src/lib/krad/internal.h ++++ b/src/lib/krad/internal.h +@@ -109,6 +109,10 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs, + void + kr_remote_cancel(krad_remote *rr, const krad_packet *pkt); + ++/* Cancel all requests awaiting responses. */ ++void ++kr_remote_cancel_all(krad_remote *rr); ++ + /* Determine if this remote object refers to the remote resource identified + * by the addrinfo struct and the secret. */ + krb5_boolean +diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c +index 7e491e994..06ae751bc 100644 +--- a/src/lib/krad/remote.c ++++ b/src/lib/krad/remote.c +@@ -421,15 +421,20 @@ error: + return retval; + } + ++void ++kr_remote_cancel_all(krad_remote *rr) ++{ ++ while (!K5_TAILQ_EMPTY(&rr->list)) ++ request_finish(K5_TAILQ_FIRST(&rr->list), ECANCELED, NULL); ++} ++ + void + kr_remote_free(krad_remote *rr) + { + if (rr == NULL) + return; + +- while (!K5_TAILQ_EMPTY(&rr->list)) +- request_finish(K5_TAILQ_FIRST(&rr->list), ECANCELED, NULL); +- ++ kr_remote_cancel_all(rr); + free(rr->secret); + if (rr->info != NULL) + free(rr->info->ai_addr); +-- +2.35.1 + + +From e0084425df784952e76b3bcc8ae9d08300234733 Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Mon, 8 Nov 2021 17:47:17 +0100 +Subject: [PATCH 2/2] More python3 fixes for t_daemon.py + +[ghudson@mit.edu: use a list comprehension instead of map()] +--- + src/lib/krad/t_daemon.py | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/src/lib/krad/t_daemon.py b/src/lib/krad/t_daemon.py +index 7668cd7f8..4a3de079c 100755 +--- a/src/lib/krad/t_daemon.py ++++ b/src/lib/krad/t_daemon.py +@@ -50,7 +50,7 @@ class TestServer(server.Server): + + for key in pkt.keys(): + if key == "User-Password": +- passwd = map(pkt.PwDecrypt, pkt[key]) ++ passwd = [pkt.PwDecrypt(x) for x in pkt[key]] + + reply = self.CreateReplyPacket(pkt) + if passwd == ['accept']: +@@ -61,8 +61,8 @@ class TestServer(server.Server): + + srv = TestServer(addresses=["localhost"], + hosts={"127.0.0.1": +- server.RemoteHost("127.0.0.1", "foo", "localhost")}, +- dict=dictionary.Dictionary(StringIO.StringIO(DICTIONARY))) ++ server.RemoteHost("127.0.0.1", b"foo", "localhost")}, ++ dict=dictionary.Dictionary(StringIO(DICTIONARY))) + + # Write a sentinel character to let the parent process know we're listening. + sys.stdout.write("~") +-- +2.35.1 + diff --git a/krb5.spec b/krb5.spec index b54534c..cab77bb 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.2 -Release: %{?zdpd}8%{?dist} +Release: %{?zdpd}9%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -95,7 +95,8 @@ Patch34: Use-OpenSSL-s-KBKDF-and-KRB5KDF-for-deriving-long-te.patch Patch35: Handle-OpenSSL-3-s-providers.patch Patch36: Remove-TCL-based-libkadm5-API-tests.patch Patch37: Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch -Patch38: krb5-krad-larger-attrs.patch +Patch38: krb5-krad-remote.patch +Patch39: krb5-krad-larger-attrs.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -645,6 +646,10 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Tue Apr 05 2022 Alexander Bokovoy - 1.19.2-9 +- Fix libkrad client cleanup +- Fixes rhbz#2072059 + * Tue Apr 05 2022 Alexander Bokovoy - 1.19.2-8 - Allow use of larger RADIUS attributes in krad library From 04513849e37aaad2eb9cacc9fad4e3abcdb724fc Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Wed, 20 Apr 2022 11:37:16 +0200 Subject: [PATCH 059/103] Try harder to avoid password change replay errors change_set_password() was changed to prefer TCP. However, because UDP_LAST falls back to UDP after one second, we can still get a replay error due to a dropped packet, before the TCP layer has a chance to retry. Instead, try k5_sendto() with NO_UDP, and only fall back to UDP after TCP fails completely without reaching a server. In sendto_kdc.c, implement an ONLY_UDP transport strategy to allow the UDP fallback. Resolves: rhbz#2076965 Signed-off-by: Julien Rische --- ...-avoid-password-change-replay-errors.patch | 91 +++++++++++++++++++ krb5.spec | 7 +- 2 files changed, 97 insertions(+), 1 deletion(-) create mode 100644 Try-harder-to-avoid-password-change-replay-errors.patch diff --git a/Try-harder-to-avoid-password-change-replay-errors.patch b/Try-harder-to-avoid-password-change-replay-errors.patch new file mode 100644 index 0000000..875ed9c --- /dev/null +++ b/Try-harder-to-avoid-password-change-replay-errors.patch @@ -0,0 +1,91 @@ +From 1f706852ee759160e763c355a3053ad5e045fa06 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Fri, 4 Mar 2022 00:45:00 -0500 +Subject: [PATCH] Try harder to avoid password change replay errors + +Commit d7b3018d338fc9c989c3fa17505870f23c3759a8 (ticket 7905) changed +change_set_password() to prefer TCP. However, because UDP_LAST falls +back to UDP after one second, we can still get a replay error due to a +dropped packet, before the TCP layer has a chance to retry. + +Instead, try k5_sendto() with NO_UDP, and only fall back to UDP after +TCP fails completely without reaching a server. In sendto_kdc.c, +implement an ONLY_UDP transport strategy to allow the UDP fallback. + +ticket: 9037 +--- + src/lib/krb5/os/changepw.c | 9 ++++++++- + src/lib/krb5/os/os-proto.h | 1 + + src/lib/krb5/os/sendto_kdc.c | 12 ++++++++---- + 3 files changed, 17 insertions(+), 5 deletions(-) + +diff --git a/src/lib/krb5/os/changepw.c b/src/lib/krb5/os/changepw.c +index 9f968da7f..c59232586 100644 +--- a/src/lib/krb5/os/changepw.c ++++ b/src/lib/krb5/os/changepw.c +@@ -255,9 +255,16 @@ change_set_password(krb5_context context, + callback_info.pfn_cleanup = kpasswd_sendto_msg_cleanup; + krb5_free_data_contents(callback_ctx.context, &chpw_rep); + ++ /* UDP retransmits may be seen as replays. Only try UDP after other ++ * transports fail completely. */ + code = k5_sendto(callback_ctx.context, NULL, &creds->server->realm, +- &sl, UDP_LAST, &callback_info, &chpw_rep, ++ &sl, NO_UDP, &callback_info, &chpw_rep, + ss2sa(&remote_addr), &addrlen, NULL, NULL, NULL); ++ if (code == KRB5_KDC_UNREACH) { ++ code = k5_sendto(callback_ctx.context, NULL, &creds->server->realm, ++ &sl, ONLY_UDP, &callback_info, &chpw_rep, ++ ss2sa(&remote_addr), &addrlen, NULL, NULL, NULL); ++ } + if (code) + goto cleanup; + +diff --git a/src/lib/krb5/os/os-proto.h b/src/lib/krb5/os/os-proto.h +index a985f2aec..91d2791ce 100644 +--- a/src/lib/krb5/os/os-proto.h ++++ b/src/lib/krb5/os/os-proto.h +@@ -49,6 +49,7 @@ typedef enum { + UDP_FIRST = 0, + UDP_LAST, + NO_UDP, ++ ONLY_UDP + } k5_transport_strategy; + + /* A single server hostname or address. */ +diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c +index 0eedec175..c7f5d861a 100644 +--- a/src/lib/krb5/os/sendto_kdc.c ++++ b/src/lib/krb5/os/sendto_kdc.c +@@ -802,11 +802,14 @@ resolve_server(krb5_context context, const krb5_data *realm, + int err, result; + char portbuf[PORT_LENGTH]; + +- /* Skip UDP entries if we don't want UDP. */ ++ /* Skip entries excluded by the strategy. */ + if (strategy == NO_UDP && entry->transport == UDP) + return 0; ++ if (strategy == ONLY_UDP && entry->transport != UDP && ++ entry->transport != TCP_OR_UDP) ++ return 0; + +- transport = (strategy == UDP_FIRST) ? UDP : TCP; ++ transport = (strategy == UDP_FIRST || strategy == ONLY_UDP) ? UDP : TCP; + if (entry->hostname == NULL) { + /* Added by a module, so transport is either TCP or UDP. */ + ai.ai_socktype = socktype_for_transport(entry->transport); +@@ -850,8 +853,9 @@ resolve_server(krb5_context context, const krb5_data *realm, + } + + /* For TCP_OR_UDP entries, add each address again with the non-preferred +- * transport, unless we are avoiding UDP. Flag these as deferred. */ +- if (retval == 0 && entry->transport == TCP_OR_UDP && strategy != NO_UDP) { ++ * transport, if there is one. Flag these as deferred. */ ++ if (retval == 0 && entry->transport == TCP_OR_UDP && ++ (strategy == UDP_FIRST || strategy == UDP_LAST)) { + transport = (strategy == UDP_FIRST) ? TCP : UDP; + for (a = addrs; a != 0 && retval == 0; a = a->ai_next) { + a->ai_socktype = socktype_for_transport(transport); +-- +2.35.1 + diff --git a/krb5.spec b/krb5.spec index cab77bb..35787ff 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.2 -Release: %{?zdpd}9%{?dist} +Release: %{?zdpd}10%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -97,6 +97,7 @@ Patch36: Remove-TCL-based-libkadm5-API-tests.patch Patch37: Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch Patch38: krb5-krad-remote.patch Patch39: krb5-krad-larger-attrs.patch +Patch40: Try-harder-to-avoid-password-change-replay-errors.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -646,6 +647,10 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Wed Apr 20 2022 Julien Rische - 1.19.2-10 +- Try harder to avoid password change replay errors +- Resolves: rhbz#2072059 + * Tue Apr 05 2022 Alexander Bokovoy - 1.19.2-9 - Fix libkrad client cleanup - Fixes rhbz#2072059 From c25a51c9699ee8398345a3431f62c97c63390cb0 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Mon, 2 May 2022 11:04:06 +0200 Subject: [PATCH 060/103] Use p11-kit as default PKCS11 module Resolves: rhbz#2073274 Signed-off-by: Julien Rische --- ...-variable-for-default-PKCS-11-module.patch | 201 ++++++++++++++++++ krb5.spec | 6 +- 2 files changed, 206 insertions(+), 1 deletion(-) create mode 100644 Add-configure-variable-for-default-PKCS-11-module.patch diff --git a/Add-configure-variable-for-default-PKCS-11-module.patch b/Add-configure-variable-for-default-PKCS-11-module.patch new file mode 100644 index 0000000..724b707 --- /dev/null +++ b/Add-configure-variable-for-default-PKCS-11-module.patch @@ -0,0 +1,201 @@ +From 2a91dabd9752825b96faf3b25ea643d5282c5957 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Fri, 22 Apr 2022 14:12:37 +0200 +Subject: [PATCH] Add configure variable for default PKCS#11 module + +[ghudson@mit.edu: added documentation of configure variable and doc +substitution; shortened commit message] + +ticket: 9058 (new) +--- + doc/admin/conf_files/krb5_conf.rst | 2 +- + doc/build/options2configure.rst | 3 +++ + doc/conf.py | 3 +++ + doc/mitK5defaults.rst | 25 +++++++++++++------------ + src/configure.ac | 8 ++++++++ + src/doc/Makefile.in | 2 ++ + src/man/Makefile.in | 4 +++- + src/man/krb5.conf.man | 2 +- + src/plugins/preauth/pkinit/pkinit.h | 1 - + 9 files changed, 34 insertions(+), 16 deletions(-) + +diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst +index adba8238d..3d25c9a12 100644 +--- a/doc/admin/conf_files/krb5_conf.rst ++++ b/doc/admin/conf_files/krb5_conf.rst +@@ -1020,7 +1020,7 @@ information for PKINIT is as follows: + All keyword/values are optional. *modname* specifies the location + of a library implementing PKCS #11. If a value is encountered + with no keyword, it is assumed to be the *modname*. If no +- module-name is specified, the default is ``opensc-pkcs11.so``. ++ module-name is specified, the default is |pkcs11_modname|. + ``slotid=`` and/or ``token=`` may be specified to force the use of + a particular smard card reader or token if there is more than one + available. ``certid=`` and/or ``certlabel=`` may be specified to +diff --git a/doc/build/options2configure.rst b/doc/build/options2configure.rst +index a8959626d..8f8ac911c 100644 +--- a/doc/build/options2configure.rst ++++ b/doc/build/options2configure.rst +@@ -143,6 +143,9 @@ Environment variables + This option allows one to specify libraries to be passed to the + linker (e.g., ``-l``) + ++**PKCS11_MODNAME=**\ *library* ++ Override the built-in default PKCS11 library name. ++ + **SS_LIB=**\ *libs*... + If ``-lss`` is not the correct way to link in your installed ss + library, for example if additional support libraries are needed, +diff --git a/doc/conf.py b/doc/conf.py +index a876fd633..252ab891a 100644 +--- a/doc/conf.py ++++ b/doc/conf.py +@@ -242,6 +242,7 @@ if 'mansubs' in tags: + ccache = '``@CCNAME@``' + keytab = '``@KTNAME@``' + ckeytab = '``@CKTNAME@``' ++ pkcs11_modname = '``@PKCS11MOD@``' + elif 'pathsubs' in tags: + # Read configured paths from a file produced by the build system. + exec(open("paths.py").read()) +@@ -255,6 +256,7 @@ else: + ccache = ':ref:`DEFCCNAME `' + keytab = ':ref:`DEFKTNAME `' + ckeytab = ':ref:`DEFCKTNAME `' ++ pkcs11_modname = ':ref:`PKCS11_MODNAME `' + + rst_epilog = '\n' + +@@ -275,6 +277,7 @@ else: + rst_epilog += '.. |ccache| replace:: %s\n' % ccache + rst_epilog += '.. |keytab| replace:: %s\n' % keytab + rst_epilog += '.. |ckeytab| replace:: %s\n' % ckeytab ++ rst_epilog += '.. |pkcs11_modname| replace:: %s\n' % pkcs11_modname + rst_epilog += ''' + .. |krb5conf| replace:: ``/etc/krb5.conf`` + .. |defkeysalts| replace:: ``aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal`` +diff --git a/doc/mitK5defaults.rst b/doc/mitK5defaults.rst +index 74e69f4ad..aea7af3db 100644 +--- a/doc/mitK5defaults.rst ++++ b/doc/mitK5defaults.rst +@@ -59,18 +59,19 @@ subdirectories of ``/usr/local``. When MIT krb5 is integrated into an + operating system, the paths are generally chosen to match the + operating system's filesystem layout. + +-========================== ============= =========================== =========================== +-Description Symbolic name Custom build path Typical OS path +-========================== ============= =========================== =========================== +-User programs BINDIR ``/usr/local/bin`` ``/usr/bin`` +-Libraries and plugins LIBDIR ``/usr/local/lib`` ``/usr/lib`` +-Parent of KDC state dir LOCALSTATEDIR ``/usr/local/var`` ``/var`` +-Parent of KDC runtime dir RUNSTATEDIR ``/usr/local/var/run`` ``/run`` +-Administrative programs SBINDIR ``/usr/local/sbin`` ``/usr/sbin`` +-Alternate krb5.conf dir SYSCONFDIR ``/usr/local/etc`` ``/etc`` +-Default ccache name DEFCCNAME ``FILE:/tmp/krb5cc_%{uid}`` ``FILE:/tmp/krb5cc_%{uid}`` +-Default keytab name DEFKTNAME ``FILE:/etc/krb5.keytab`` ``FILE:/etc/krb5.keytab`` +-========================== ============= =========================== =========================== ++========================== ============== =========================== =========================== ++Description Symbolic name Custom build path Typical OS path ++========================== ============== =========================== =========================== ++User programs BINDIR ``/usr/local/bin`` ``/usr/bin`` ++Libraries and plugins LIBDIR ``/usr/local/lib`` ``/usr/lib`` ++Parent of KDC state dir LOCALSTATEDIR ``/usr/local/var`` ``/var`` ++Parent of KDC runtime dir RUNSTATEDIR ``/usr/local/var/run`` ``/run`` ++Administrative programs SBINDIR ``/usr/local/sbin`` ``/usr/sbin`` ++Alternate krb5.conf dir SYSCONFDIR ``/usr/local/etc`` ``/etc`` ++Default ccache name DEFCCNAME ``FILE:/tmp/krb5cc_%{uid}`` ``FILE:/tmp/krb5cc_%{uid}`` ++Default keytab name DEFKTNAME ``FILE:/etc/krb5.keytab`` ``FILE:/etc/krb5.keytab`` ++Default PKCS11 module PKCS11_MODNAME ``opensc-pkcs11.so`` ``opensc-pkcs11.so`` ++========================== ============== =========================== =========================== + + The default client keytab name (DEFCKTNAME) typically defaults to + ``FILE:/usr/local/var/krb5/user/%{euid}/client.keytab`` for a custom +diff --git a/src/configure.ac b/src/configure.ac +index 82b049af9..52e6563da 100644 +--- a/src/configure.ac ++++ b/src/configure.ac +@@ -1442,6 +1442,14 @@ AC_DEFINE_UNQUOTED(DEFKTNAME, ["$DEFKTNAME"], [Define to default keytab name]) + AC_DEFINE_UNQUOTED(DEFCKTNAME, ["$DEFCKTNAME"], + [Define to default client keytab name]) + ++AC_ARG_VAR(PKCS11_MODNAME, [Default PKCS11 module name]) ++if test "${PKCS11_MODNAME+set}" != set; then ++ PKCS11_MODNAME=opensc-pkcs11.so ++fi ++AC_MSG_NOTICE([Default PKCS11 module name: $PKCS11_MODNAME]) ++AC_DEFINE_UNQUOTED(PKCS11_MODNAME, ["$PKCS11_MODNAME"], ++ [Default PKCS11 module name]) ++ + AC_CONFIG_FILES([build-tools/krb5-config], [chmod +x build-tools/krb5-config]) + AC_CONFIG_FILES([build-tools/kadm-server.pc + build-tools/kadm-client.pc +diff --git a/src/doc/Makefile.in b/src/doc/Makefile.in +index 379bc3651..a1b0cff0a 100644 +--- a/src/doc/Makefile.in ++++ b/src/doc/Makefile.in +@@ -10,6 +10,7 @@ sysconfdir=@sysconfdir@ + DEFCCNAME=@DEFCCNAME@ + DEFKTNAME=@DEFKTNAME@ + DEFCKTNAME=@DEFCKTNAME@ ++PKCS11_MODNAME=@PKCS11_MODNAME@ + + RST_SOURCES= _static \ + _templates \ +@@ -118,6 +119,7 @@ paths.py: + echo 'ccache = "``$(DEFCCNAME)``"' >> $@ + echo 'keytab = "``$(DEFKTNAME)``"' >> $@ + echo 'ckeytab = "``$(DEFCKTNAME)``"' >> $@ ++ echo 'pkcs11_modname = "``$(PKCS11_MODNAME)``"' >> $@ + + # Dummy rule that man/Makefile can invoke + version.py: $(docsrc)/version.py +diff --git a/src/man/Makefile.in b/src/man/Makefile.in +index 00b1b2de0..85cae0914 100644 +--- a/src/man/Makefile.in ++++ b/src/man/Makefile.in +@@ -8,6 +8,7 @@ sysconfdir=@sysconfdir@ + DEFCCNAME=@DEFCCNAME@ + DEFKTNAME=@DEFKTNAME@ + DEFCKTNAME=@DEFCKTNAME@ ++PKCS11_MODNAME=@PKCS11_MODNAME@ + + MANSUBS=k5identity.sub k5login.sub k5srvutil.sub kadm5.acl.sub kadmin.sub \ + kadmind.sub kdb5_ldap_util.sub kdb5_util.sub kdc.conf.sub \ +@@ -47,7 +48,8 @@ $(docsrc)/version.py: $(top_srcdir)/patchlevel.h + -e 's|@SYSCONFDIR@|$(sysconfdir)|g' \ + -e 's|@CCNAME@|$(DEFCCNAME)|g' \ + -e 's|@KTNAME@|$(DEFKTNAME)|g' \ +- -e 's|@CKTNAME@|$(DEFCKTNAME)|g' $? > $@ ++ -e 's|@CKTNAME@|$(DEFCKTNAME)|g' \ ++ -e 's|@PKCS11MOD@|$(PKCS11_MODNAME)|g' $? > $@ + + all: $(MANSUBS) + +diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man +index e993d5c09..42f5ea4f9 100644 +--- a/src/man/krb5.conf.man ++++ b/src/man/krb5.conf.man +@@ -1151,7 +1151,7 @@ user\(aqs certificate and private key. + All keyword/values are optional. \fImodname\fP specifies the location + of a library implementing PKCS #11. If a value is encountered + with no keyword, it is assumed to be the \fImodname\fP\&. If no +-module\-name is specified, the default is \fBopensc\-pkcs11.so\fP\&. ++module\-name is specified, the default is \fB@PKCS11MOD@\fP\&. + \fBslotid=\fP and/or \fBtoken=\fP may be specified to force the use of + a particular smard card reader or token if there is more than one + available. \fBcertid=\fP and/or \fBcertlabel=\fP may be specified to +diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h +index b437fd53f..a2018cb10 100644 +--- a/src/plugins/preauth/pkinit/pkinit.h ++++ b/src/plugins/preauth/pkinit/pkinit.h +@@ -42,7 +42,6 @@ + #ifndef WITHOUT_PKCS11 + #include "pkcs11.h" + +-#define PKCS11_MODNAME "opensc-pkcs11.so" + #define PK_SIGLEN_GUESS 1000 + #define PK_NOSLOT 999999 + #endif +-- +2.35.1 + diff --git a/krb5.spec b/krb5.spec index 35787ff..c59f2d0 100644 --- a/krb5.spec +++ b/krb5.spec @@ -98,6 +98,7 @@ Patch37: Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch Patch38: krb5-krad-remote.patch Patch39: krb5-krad-larger-attrs.patch Patch40: Try-harder-to-avoid-password-change-replay-errors.patch +Patch41: Add-configure-variable-for-default-PKCS-11-module.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -289,6 +290,7 @@ CPPFLAGS="`echo $DEFINES $INCLUDES`" CFLAGS="$CFLAGS" \ CPPFLAGS="$CPPFLAGS" \ SS_LIB="-lss" \ + PKCS11_MODNAME="p11-kit-proxy.so" \ --enable-shared \ --runstatedir=/run \ --localstatedir=%{_var}/kerberos \ @@ -647,7 +649,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog -* Wed Apr 20 2022 Julien Rische - 1.19.2-10 +* Mon May 2 2022 Julien Rische - 1.19.2-10 +- Use p11-kit as default PKCS11 module +- Resolves: rhbz#2073274 - Try harder to avoid password change replay errors - Resolves: rhbz#2072059 From e9188f0caa13fb780f4b32fa6ac3f0eb625d4acb Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Tue, 10 May 2022 16:43:18 +0200 Subject: [PATCH 061/103] Allow krad UDP/TCP localhost connection with FIPS libkrad allows to establish connections only to UNIX socket in FIPS mode, because MD5 digest is not considered safe enough to be used for network communication. However, FreeRadius requires connection on TCP or UDP ports. This commit allows TCP or UDP connections in FIPS mode if destination is localhost. Resolves: rhbz#2082189 Signed-off-by: Julien Rische --- ...P-TCP-localhost-connection-with-FIPS.patch | 81 +++++++++++++++++++ krb5.spec | 7 +- 2 files changed, 87 insertions(+), 1 deletion(-) create mode 100644 downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch diff --git a/downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch b/downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch new file mode 100644 index 0000000..7455cb9 --- /dev/null +++ b/downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch @@ -0,0 +1,81 @@ +From a43d621ae83c89abb74764f0fd9d90a8e9992333 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Thu, 5 May 2022 17:15:12 +0200 +Subject: [PATCH] Allow krad UDP/TCP localhost connection with FIPS + +libkrad allows to establish connections only to UNIX socket in FIPS +mode, because MD5 digest is not considered safe enough to be used for +network communication. However, FreeRadius requires connection on TCP or +UDP ports. + +This commit allows TCP or UDP connections in FIPS mode if destination is +localhost. + +Resolves: rhbz#2082189 +--- + src/lib/krad/remote.c | 35 +++++++++++++++++++++++++++++++++-- + 1 file changed, 33 insertions(+), 2 deletions(-) + +diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c +index 7b5804b1d..e671bc5c2 100644 +--- a/src/lib/krad/remote.c ++++ b/src/lib/krad/remote.c +@@ -33,6 +33,7 @@ + + #include + #include ++#include + + #include + +@@ -74,6 +75,35 @@ on_io(verto_ctx *ctx, verto_ev *ev); + static void + on_timeout(verto_ctx *ctx, verto_ev *ev); + ++static in_addr_t get_in_addr(struct addrinfo *info) ++{ return ((struct sockaddr_in *)(info->ai_addr))->sin_addr.s_addr; } ++ ++static struct in6_addr *get_in6_addr(struct addrinfo *info) ++{ return &(((struct sockaddr_in6 *)(info->ai_addr))->sin6_addr); } ++ ++static bool is_inet_localhost(struct addrinfo *info) ++{ ++ struct addrinfo *p; ++ ++ for (p = info; p; p = p->ai_next) { ++ switch (p->ai_family) { ++ case AF_INET: ++ if (IN_LOOPBACKNET != (get_in_addr(p) & IN_CLASSA_NET ++ >> IN_CLASSA_NSHIFT)) ++ return false; ++ break; ++ case AF_INET6: ++ if (!IN6_IS_ADDR_LOOPBACK(get_in6_addr(p))) ++ return false; ++ break; ++ default: ++ return false; ++ } ++ } ++ ++ return true; ++} ++ + /* Iterate over the set of outstanding packets. */ + static const krad_packet * + iterator(request **out) +@@ -455,8 +485,9 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs, + (krad_packet_iter_cb)iterator, &r, &tmp); + if (retval != 0) + goto error; +- else if (tmp->is_fips && rr->info->ai_family != AF_LOCAL && +- rr->info->ai_family != AF_UNIX) { ++ else if (tmp->is_fips && rr->info->ai_family != AF_LOCAL ++ && rr->info->ai_family != AF_UNIX ++ && !is_inet_localhost(rr->info)) { + /* This would expose cleartext passwords, so abort. */ + retval = ESOCKTNOSUPPORT; + goto error; +-- +2.35.1 + diff --git a/krb5.spec b/krb5.spec index c59f2d0..89ed921 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.2 -Release: %{?zdpd}10%{?dist} +Release: %{?zdpd}11%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -99,6 +99,7 @@ Patch38: krb5-krad-remote.patch Patch39: krb5-krad-larger-attrs.patch Patch40: Try-harder-to-avoid-password-change-replay-errors.patch Patch41: Add-configure-variable-for-default-PKCS-11-module.patch +Patch42: downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -649,6 +650,10 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Thu May 12 2022 Julien Rische - 1.19.2-11 +- Allow libkrad UDP/TCP connection to localhost in FIPS mode +- Resolves: rhbz#2082189 + * Mon May 2 2022 Julien Rische - 1.19.2-10 - Use p11-kit as default PKCS11 module - Resolves: rhbz#2073274 From 601b89387bd1c41859001b731c2fcbb9b530d291 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Wed, 15 Jun 2022 15:37:30 +0200 Subject: [PATCH 062/103] Read GSS configuration files with mtime 0 There is at least one case (with flatpaks) where configuration files in the special read-only /etc all have an mtime of 0. Using an initial last modified time of 0 in g_initialize.c causes these files to never be read. Change the initial high value to the be the "invalid" value (time_t)-1. Since the C and POSIX standards do not require time_t to be signed, special-case the checks in load_if_changed() and updateMechList() to treat all mod times as newer than -1. Signed-off-by: Julien Rische --- ...GSS-configuration-files-with-mtime-0.patch | 71 +++++++++++++++++++ krb5.spec | 4 +- 2 files changed, 74 insertions(+), 1 deletion(-) create mode 100644 Read-GSS-configuration-files-with-mtime-0.patch diff --git a/Read-GSS-configuration-files-with-mtime-0.patch b/Read-GSS-configuration-files-with-mtime-0.patch new file mode 100644 index 0000000..5bcae39 --- /dev/null +++ b/Read-GSS-configuration-files-with-mtime-0.patch @@ -0,0 +1,71 @@ +From f8747c22fd159ad3556fdf6ec4f269c754c1eadb Mon Sep 17 00:00:00 2001 +From: Simo Sorce +Date: Thu, 19 May 2022 12:27:40 -0400 +Subject: [PATCH] Read GSS configuration files with mtime 0 + +There is at least one case (with flatpaks) where configuration files +in the special read-only /etc all have an mtime of 0. Using an +initial last modified time of 0 in g_initialize.c causes these files +to never be read. + +Change the initial high value to the be the "invalid" value +(time_t)-1. Since the C and POSIX standards do not require time_t to +be signed, special-case the checks in load_if_changed() and +updateMechList() to treat all mod times as newer than -1. + +[ghudson@mit.edu: edited commit message; slightly modified approach] + +ticket: 9060 (new) +target_version: 1.20 +tags: pullup +--- + src/lib/gssapi/mechglue/g_initialize.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/src/lib/gssapi/mechglue/g_initialize.c b/src/lib/gssapi/mechglue/g_initialize.c +index 6d49700a5..857d4a4f2 100644 +--- a/src/lib/gssapi/mechglue/g_initialize.c ++++ b/src/lib/gssapi/mechglue/g_initialize.c +@@ -93,7 +93,7 @@ static void free_mechSet(void); + static gss_mech_info g_mechList = NULL; + static gss_mech_info g_mechListTail = NULL; + static k5_mutex_t g_mechListLock = K5_MUTEX_PARTIAL_INITIALIZER; +-static time_t g_confFileModTime = (time_t)0; ++static time_t g_confFileModTime = (time_t)-1; + static time_t g_confLastCall = (time_t)0; + + static gss_OID_set_desc g_mechSet = { 0, NULL }; +@@ -469,9 +469,9 @@ load_if_changed(const char *pathname, time_t last, time_t *highest) + mtime = check_link_mtime(pathname, &mtime); + if (mtime == (time_t)-1) + return; +- if (mtime > *highest) ++ if (mtime > *highest || *highest == (time_t)-1) + *highest = mtime; +- if (mtime > last) ++ if (mtime > last || last == (time_t)-1) + loadConfigFile(pathname); + } + +@@ -482,7 +482,7 @@ static void + loadConfigFiles() + { + glob_t globbuf; +- time_t highest = 0, now; ++ time_t highest = (time_t)-1, now; + char **path; + const char *val; + +@@ -522,7 +522,8 @@ updateMechList(void) + + #if defined(_WIN32) + time_t lastConfModTime = getRegConfigModTime(MECH_KEY); +- if (g_confFileModTime >= lastConfModTime) ++ if (g_confFileModTime >= lastConfModTime && ++ g_confFileModTime != (time_t)-1) + return; + g_confFileModTime = lastConfModTime; + loadConfigFromRegistry(HKEY_CURRENT_USER, MECH_KEY); +-- +2.35.3 + diff --git a/krb5.spec b/krb5.spec index 89ed921..a1a851e 100644 --- a/krb5.spec +++ b/krb5.spec @@ -100,6 +100,7 @@ Patch39: krb5-krad-larger-attrs.patch Patch40: Try-harder-to-avoid-password-change-replay-errors.patch Patch41: Add-configure-variable-for-default-PKCS-11-module.patch Patch42: downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch +Patch43: Read-GSS-configuration-files-with-mtime-0.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -650,9 +651,10 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog -* Thu May 12 2022 Julien Rische - 1.19.2-11 +* Wed Jun 15 2022 Julien Rische - 1.19.2-11 - Allow libkrad UDP/TCP connection to localhost in FIPS mode - Resolves: rhbz#2082189 +- Read GSS configuration files with mtime 0 * Mon May 2 2022 Julien Rische - 1.19.2-10 - Use p11-kit as default PKCS11 module From e138eb81254c03b9f61b74ecace323828d16a53f Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 21 Jul 2022 16:36:11 +0000 Subject: [PATCH 063/103] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- krb5.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/krb5.spec b/krb5.spec index a1a851e..4ac72a8 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.2 -Release: %{?zdpd}11%{?dist} +Release: %{?zdpd}11%{?dist}.1 # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -651,6 +651,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Thu Jul 21 2022 Fedora Release Engineering - 1.19.2-11.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Wed Jun 15 2022 Julien Rische - 1.19.2-11 - Allow libkrad UDP/TCP connection to localhost in FIPS mode - Resolves: rhbz#2082189 From 3907ec760c6da3179e0d4c20c758af692316383d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 2 Aug 2022 11:17:13 +0200 Subject: [PATCH 064/103] Use baserelease to set the release number --- krb5.spec | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/krb5.spec b/krb5.spec index 4ac72a8..80865ec 100644 --- a/krb5.spec +++ b/krb5.spec @@ -30,10 +30,18 @@ %global configure_default_ccache_name 1 %global configured_default_ccache_name KEYRING:persistent:%%{uid} -# for prereleases, % global prerelease beta1 -%if %{defined prerelease} -%global dashpre -%{prerelease} -%global zdpd 0.%{prerelease}. +# Use baserelease to set the release number! +# +# baserelease is what we have standardized across Fedora and what +# rpmdev-bumpspec knows how to handle. +%global baserelease 12 + +# This should be e.g. beta1 or %%nil +%global pre_release %nil + +%global krb5_release %{baserelease} +%if "x%{?pre_release}" != "x" +%global krb5_release 0.%{baserelease}.%{pre_release} %endif # Should be in form 5.0, 6.1, etc. @@ -42,7 +50,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.2 -Release: %{?zdpd}11%{?dist}.1 +Release: %{krb5_release}%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -651,6 +659,9 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Tue Aug 02 2022 Andreas Schneider - 1.19.2-12 +- Use baserelease to set the release number + * Thu Jul 21 2022 Fedora Release Engineering - 1.19.2-11.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From 440331a1e41116fa88674a211fa7fd81efb01f18 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Aug 2022 13:12:52 +0200 Subject: [PATCH 065/103] Fix the Source0 and Source1 variables --- krb5.spec | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/krb5.spec b/krb5.spec index 80865ec..ae1a948 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,6 +42,18 @@ %global krb5_release %{baserelease} %if "x%{?pre_release}" != "x" %global krb5_release 0.%{baserelease}.%{pre_release} +%global krb5_pre_release -%{pre_release} +%endif + +%global krb5_version_major 1 +%global krb5_version_minor 19 +# For a release without a patch number set to %%nil +%global krb5_version_patch 2 + +%global krb5_version_major_minor %{krb5_version_major}.%{krb5_version_minor} +%global krb5_version %{krb5_version_major_minor} +%if "x%{?krb5_version_patch}" != "x" +%global krb5_version %{krb5_version_major_minor}.%{krb5_version_patch} %endif # Should be in form 5.0, 6.1, etc. @@ -49,12 +61,12 @@ Summary: The Kerberos network authentication system Name: krb5 -Version: 1.19.2 +Version: %{krb5_version} Release: %{krb5_release}%{?dist} # rharwood has trust path to signing key and verifies on check-in -Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz -Source1: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz.asc +Source0: https://web.mit.edu/kerberos/dist/krb5/%{krb5_version_major_minor}/krb5-%{krb5_version}%{?krb5_pre_release}.tar.gz +Source1: https://web.mit.edu/kerberos/dist/krb5/%{krb5_version_major_minor}/krb5-%{krb5_version}%{?krb5_pre_release}.tar.gz.asc # Numbering is a relic of old init systems etc. It's easiest to just leave. Source2: kprop.service From f5aa40a4a20812fca640998fb740506383f16127 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 2 Aug 2022 11:19:48 +0200 Subject: [PATCH 066/103] Do not define netlib, but use autoconf detection for res_* functions This looks like an ancient patch and is not needed anymore. --- downstream-netlib-and-dns.patch | 24 ------------------------ krb5.spec | 8 ++++++-- 2 files changed, 6 insertions(+), 26 deletions(-) delete mode 100644 downstream-netlib-and-dns.patch diff --git a/downstream-netlib-and-dns.patch b/downstream-netlib-and-dns.patch deleted file mode 100644 index d3ae129..0000000 --- a/downstream-netlib-and-dns.patch +++ /dev/null @@ -1,24 +0,0 @@ -From 2d7e197fa88dccd3ca051f9f7cb97937c35c55a8 Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Tue, 23 Aug 2016 16:46:21 -0400 -Subject: [PATCH] [downstream] netlib and dns - -We want to be able to use --with-netlib and --enable-dns at the same time. - -Last-updated: krb5-1.3.1 ---- - src/aclocal.m4 | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/src/aclocal.m4 b/src/aclocal.m4 -index 5afb96e58..4a4d460e3 100644 ---- a/src/aclocal.m4 -+++ b/src/aclocal.m4 -@@ -718,6 +718,7 @@ AC_HELP_STRING([--with-netlib=LIBS], use user defined resolver library), - LIBS="$LIBS $withval" - AC_MSG_RESULT("netlib will use \'$withval\'") - fi -+ KRB5_AC_ENABLE_DNS - ],dnl - [AC_LIBRARY_NET] - )])dnl diff --git a/krb5.spec b/krb5.spec index ae1a948..41e81e8 100644 --- a/krb5.spec +++ b/krb5.spec @@ -85,7 +85,6 @@ Source39: krb5-krb5kdc.conf Patch0: downstream-ksu-pam-integration.patch Patch1: downstream-SELinux-integration.patch -Patch3: downstream-netlib-and-dns.patch Patch4: downstream-fix-debuginfo-with-y.tab.c.patch Patch5: downstream-Remove-3des-support.patch Patch7: downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch @@ -320,7 +319,6 @@ CPPFLAGS="`echo $DEFINES $INCLUDES`" --without-krb5-config \ --with-system-et \ --with-system-ss \ - --with-netlib=-lresolv \ --with-tcl \ --enable-dns-for-realm \ --with-ldap \ @@ -335,6 +333,11 @@ CPPFLAGS="`echo $DEFINES $INCLUDES`" --with-lmdb \ || (cat config.log; exit 1) +# Check we have required features enabled +for x in DNS_LOOKUP DNS_LOOKUP_REALM; do + grep -q "#define KRB5_${x} 1" include/autoconf.h +done + # Sanity check the KDC_RUN_DIR. pushd include make osconf.h @@ -673,6 +676,7 @@ exit 0 %changelog * Tue Aug 02 2022 Andreas Schneider - 1.19.2-12 - Use baserelease to set the release number +- Do not define netlib, but use autoconf detection for res_* functions * Thu Jul 21 2022 Fedora Release Engineering - 1.19.2-11.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From 0c2f5dcbe51e58baf592f8c479dd6080055516da Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 2 Aug 2022 11:21:47 +0200 Subject: [PATCH 067/103] Add missing BR for resolv_wrapper to run t_discover_uri.py --- krb5.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/krb5.spec b/krb5.spec index 41e81e8..4d0dffb 100644 --- a/krb5.spec +++ b/krb5.spec @@ -149,6 +149,7 @@ BuildRequires: hostname BuildRequires: iproute BuildRequires: python3-pyrad BuildRequires: procps-ng +BuildRequires: resolv_wrapper %endif # Need KDFs. This is the "real" version @@ -677,6 +678,7 @@ exit 0 * Tue Aug 02 2022 Andreas Schneider - 1.19.2-12 - Use baserelease to set the release number - Do not define netlib, but use autoconf detection for res_* functions +- Add missing BR for resolv_wrapper to run t_discover_uri.py * Thu Jul 21 2022 Fedora Release Engineering - 1.19.2-11.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From c13bf943d82a1284cc233f81531e613d21b4592b Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Wed, 9 Nov 2022 11:38:44 +0100 Subject: [PATCH 068/103] Fix integer overflows in PAC parsing (CVE-2022-42898) Resolves: rhbz#2143011 Signed-off-by: Julien Rische --- Fix-integer-overflows-in-PAC-parsing.patch | 106 +++++++++++++++++++++ krb5.spec | 7 +- 2 files changed, 112 insertions(+), 1 deletion(-) create mode 100644 Fix-integer-overflows-in-PAC-parsing.patch diff --git a/Fix-integer-overflows-in-PAC-parsing.patch b/Fix-integer-overflows-in-PAC-parsing.patch new file mode 100644 index 0000000..272e34e --- /dev/null +++ b/Fix-integer-overflows-in-PAC-parsing.patch @@ -0,0 +1,106 @@ +From 06d30f43a41029d83248bbac1a9b65fc09987597 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Mon, 17 Oct 2022 20:25:11 -0400 +Subject: [PATCH] Fix integer overflows in PAC parsing + +In krb5_parse_pac(), check for buffer counts large enough to threaten +integer overflow in the header length and memory length calculations. +Avoid potential integer overflows when checking the length of each +buffer. + +CVE-2022-42898: + +In MIT krb5 releases 1.8 and later, an authenticated attacker may be +able to cause a KDC or kadmind process to crash by reading beyond the +bounds of allocated memory, creating a denial of service. A +privileged attacker may similarly be able to cause a Kerberos or GSS +application service to crash. On 32-bit platforms, an attacker can +also cause insufficient memory to be allocated for the result, +potentially leading to remote code execution in a KDC, kadmind, or GSS +or Kerberos application server process. An attacker with the +privileges of a cross-realm KDC may be able to extract secrets from +the KDC process's memory by having them copied into the PAC of a new +ticket. + +ticket: 9074 (new) +tags: pullup +target_version: 1.20-next +target_version: 1.19-next +--- + src/lib/krb5/krb/pac.c | 9 +++++++-- + src/lib/krb5/krb/t_pac.c | 18 ++++++++++++++++++ + 2 files changed, 25 insertions(+), 2 deletions(-) + +diff --git a/src/lib/krb5/krb/pac.c b/src/lib/krb5/krb/pac.c +index 950beda657..1b9ef12276 100644 +--- a/src/lib/krb5/krb/pac.c ++++ b/src/lib/krb5/krb/pac.c +@@ -27,6 +27,8 @@ + #include "k5-int.h" + #include "authdata.h" + ++#define MAX_BUFFERS 4096 ++ + /* draft-brezak-win2k-krb-authz-00 */ + + /* +@@ -316,6 +318,9 @@ krb5_pac_parse(krb5_context context, + if (version != 0) + return EINVAL; + ++ if (cbuffers < 1 || cbuffers > MAX_BUFFERS) ++ return ERANGE; ++ + header_len = PACTYPE_LENGTH + (cbuffers * PAC_INFO_BUFFER_LENGTH); + if (len < header_len) + return ERANGE; +@@ -348,8 +353,8 @@ krb5_pac_parse(krb5_context context, + krb5_pac_free(context, pac); + return EINVAL; + } +- if (buffer->Offset < header_len || +- buffer->Offset + buffer->cbBufferSize > len) { ++ if (buffer->Offset < header_len || buffer->Offset > len || ++ buffer->cbBufferSize > len - buffer->Offset) { + krb5_pac_free(context, pac); + return ERANGE; + } +diff --git a/src/lib/krb5/krb/t_pac.c b/src/lib/krb5/krb/t_pac.c +index ee47152ee4..ccd165380d 100644 +--- a/src/lib/krb5/krb/t_pac.c ++++ b/src/lib/krb5/krb/t_pac.c +@@ -431,6 +431,16 @@ static const unsigned char s4u_pac_ent_xrealm[] = { + 0x8a, 0x81, 0x9c, 0x9c, 0x00, 0x00, 0x00, 0x00 + }; + ++static const unsigned char fuzz1[] = { ++ 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, ++ 0x06, 0xff, 0xff, 0xff, 0x00, 0x00, 0xf5 ++}; ++ ++static const unsigned char fuzz2[] = { ++ 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, ++ 0x20, 0x20 ++}; ++ + static const char *s4u_principal = "w2k8u@ACME.COM"; + static const char *s4u_enterprise = "w2k8u@abc@ACME.COM"; + +@@ -646,6 +656,14 @@ main(int argc, char **argv) + krb5_free_principal(context, sep); + } + ++ /* Check problematic PACs found by fuzzing. */ ++ ret = krb5_pac_parse(context, fuzz1, sizeof(fuzz1), &pac); ++ if (!ret) ++ err(context, ret, "krb5_pac_parse should have failed"); ++ ret = krb5_pac_parse(context, fuzz2, sizeof(fuzz2), &pac); ++ if (!ret) ++ err(context, ret, "krb5_pac_parse should have failed"); ++ + /* + * Test empty free + */ +-- +2.37.3 + diff --git a/krb5.spec b/krb5.spec index 4d0dffb..c6039dc 100644 --- a/krb5.spec +++ b/krb5.spec @@ -34,7 +34,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 12 +%global baserelease 13 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -120,6 +120,7 @@ Patch40: Try-harder-to-avoid-password-change-replay-errors.patch Patch41: Add-configure-variable-for-default-PKCS-11-module.patch Patch42: downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch Patch43: Read-GSS-configuration-files-with-mtime-0.patch +Patch44: Fix-integer-overflows-in-PAC-parsing.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -675,6 +676,10 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Wed Nov 09 2022 Julien Rische - 1.19.2-13 +- Fix integer overflows in PAC parsing (CVE-2022-42898) +- Resolves: rhbz#2143011 + * Tue Aug 02 2022 Andreas Schneider - 1.19.2-12 - Use baserelease to set the release number - Do not define netlib, but use autoconf detection for res_* functions From 56cee506e7918e93bfe86bf2b7f960ab05cff0df Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Wed, 23 Nov 2022 18:27:49 +0100 Subject: [PATCH 069/103] New upstream version (1.20.1) Also set "supportedCMSTypes" to SHA-512/256 with RSA encryption Resolves: rhbz#2124463 Resolves: rhbz#2114766 Signed-off-by: Julien Rische --- .gitignore | 95 +- ... 0001-downstream-ksu-pam-integration.patch | 21 +- ... 0002-downstream-SELinux-integration.patch | 100 +- ...ownstream-fix-debuginfo-with-y.tab.c.patch | 9 +- ... 0004-downstream-Remove-3des-support.patch | 1015 +- ...am-FIPS-with-PRNG-and-RADIUS-and-MD4.patch | 84 +- ...-krad-UDP-TCP-localhost-connection-w.patch | 11 +- ...-variable-for-default-PKCS-11-module.patch | 30 +- ...asonable-supportedCMSTypes-in-PKINIT.patch | 159 + 0009-Simplify-plugin-loading-code.patch | 622 + Add-APIs-for-marshalling-credentials.patch | 220 - ...P_GET_CRED_LIST-for-faster-iteration.patch | 358 - ...detection-of-the-OpenSSL-3-KDF-inter.patch | 25 - ...canonicalization-helper-to-k5test.py.patch | 84 - ...ith-keytab-to-defer-canonicalization.patch | 60 - ...context-after-failed-open-in-libkdb5.patch | 35 - ...up-gssapi_krb5-ccache-name-functions.patch | 193 - ...CM-flag-transmission-for-remove_cred.patch | 103 - Fix-KCM-retrieval-support-for-sssd.patch | 62 - ...-deref-on-TGS-inner-body-null-server.patch | 45 - Fix-integer-overflows-in-PAC-parsing.patch | 106 - Fix-k5tls-module-for-OpenSSL-3.patch | 58 - ...in-k-with-fallback-or-referral-realm.patch | 64 - ...aks-on-error-in-kadm5-init-functions.patch | 664 - ...pkcs11-build-issues-with-openssl-3.0.patch | 552 - ...incipal-realm-canonicalization-cases.patch | 96 - Handle-OpenSSL-3-s-providers.patch | 301 - ...teration-fallback-work-with-sssd-kcm.patch | 26 - ...dejagnu-kadmin-tests-to-Python-tests.patch | 1750 -- ...GSS-configuration-files-with-mtime-0.patch | 71 - Remove-TCL-based-libkadm5-API-tests.patch | 18229 ---------------- ...ecated-OpenSSL-calls-from-softpkcs11.patch | 150 - Support-host-based-GSS-initiator-names.patch | 578 - ...-avoid-password-change-replay-errors.patch | 91 - Use-KCM_OP_RETRIEVE-in-KCM-client.patch | 235 - ...KDF-and-KRB5KDF-for-deriving-long-te.patch | 482 - ...SSL-s-SSKDF-in-PKINIT-when-available.patch | 408 - ...nstead-of-SHA1-for-PKINIT-CMS-digest.patch | 113 - Use-asan-in-one-of-the-CI-builds.patch | 22 - ...ackported-version-of-OpenSSL-3-KDF-i.patch | 752 - krb5-krad-larger-attrs.patch | 69 - krb5-krad-remote.patch | 209 - krb5.spec | 127 +- sources | 4 +- 44 files changed, 1453 insertions(+), 27035 deletions(-) rename downstream-ksu-pam-integration.patch => 0001-downstream-ksu-pam-integration.patch (98%) rename downstream-SELinux-integration.patch => 0002-downstream-SELinux-integration.patch (94%) rename downstream-fix-debuginfo-with-y.tab.c.patch => 0003-downstream-fix-debuginfo-with-y.tab.c.patch (90%) rename downstream-Remove-3des-support.patch => 0004-downstream-Remove-3des-support.patch (92%) rename downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch => 0005-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch (91%) rename downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch => 0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch (90%) rename Add-configure-variable-for-default-PKCS-11-module.patch => 0007-Add-configure-variable-for-default-PKCS-11-module.patch (93%) create mode 100644 0008-Set-reasonable-supportedCMSTypes-in-PKINIT.patch create mode 100644 0009-Simplify-plugin-loading-code.patch delete mode 100644 Add-APIs-for-marshalling-credentials.patch delete mode 100644 Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch delete mode 100644 Add-buildsystem-detection-of-the-OpenSSL-3-KDF-inter.patch delete mode 100644 Add-hostname-canonicalization-helper-to-k5test.py.patch delete mode 100644 Allow-kinit-with-keytab-to-defer-canonicalization.patch delete mode 100644 Clean-up-context-after-failed-open-in-libkdb5.patch delete mode 100644 Clean-up-gssapi_krb5-ccache-name-functions.patch delete mode 100644 Fix-KCM-flag-transmission-for-remove_cred.patch delete mode 100644 Fix-KCM-retrieval-support-for-sssd.patch delete mode 100644 Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch delete mode 100644 Fix-integer-overflows-in-PAC-parsing.patch delete mode 100644 Fix-k5tls-module-for-OpenSSL-3.patch delete mode 100644 Fix-kadmin-k-with-fallback-or-referral-realm.patch delete mode 100644 Fix-leaks-on-error-in-kadm5-init-functions.patch delete mode 100644 Fix-softpkcs11-build-issues-with-openssl-3.0.patch delete mode 100644 Fix-some-principal-realm-canonicalization-cases.patch delete mode 100644 Handle-OpenSSL-3-s-providers.patch delete mode 100644 Make-KCM-iteration-fallback-work-with-sssd-kcm.patch delete mode 100644 Move-some-dejagnu-kadmin-tests-to-Python-tests.patch delete mode 100644 Read-GSS-configuration-files-with-mtime-0.patch delete mode 100644 Remove-TCL-based-libkadm5-API-tests.patch delete mode 100644 Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch delete mode 100644 Support-host-based-GSS-initiator-names.patch delete mode 100644 Try-harder-to-avoid-password-change-replay-errors.patch delete mode 100644 Use-KCM_OP_RETRIEVE-in-KCM-client.patch delete mode 100644 Use-OpenSSL-s-KBKDF-and-KRB5KDF-for-deriving-long-te.patch delete mode 100644 Use-OpenSSL-s-SSKDF-in-PKINIT-when-available.patch delete mode 100644 Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch delete mode 100644 Use-asan-in-one-of-the-CI-builds.patch delete mode 100644 downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch delete mode 100644 krb5-krad-larger-attrs.patch delete mode 100644 krb5-krad-remote.patch diff --git a/.gitignore b/.gitignore index c3c3cb9..7fa0027 100644 --- a/.gitignore +++ b/.gitignore @@ -1,49 +1,50 @@ -krb5-1.3.4.tar.gz -krb5-1.3.5.tar.gz -krb5-1.3.5.tar.gz.asc -krb5-1.3.6.tar.gz -krb5-1.3.6.tar.gz.asc -krb5-1.4.tar.gz -krb5-1.4.tar.gz.asc -krb5-1.4.1.tar.gz -krb5-1.4.1.tar.gz.asc -krb5-1.4.2.tar.gz -krb5-1.4.2.tar.gz.asc -krb5-1.4.3.tar.gz -krb5-1.4.3.tar.gz.asc -krb5-1.5.tar.gz -krb5-1.5.tar.gz.asc -krb5-1.6.tar.gz -krb5-1.6.tar.gz.asc -krb5-1.6-pdf.tar.gz -krb5-1.6.1.tar.gz -krb5-1.6.1.tar.gz.asc -krb5-1.6.1-pdf.tar.gz -krb5-1.6.2.tar.gz -krb5-1.6.2.tar.gz.asc -krb5-1.6.2-pdf.tar.gz -krb5-1.6.3.tar.gz -krb5-1.6.3.tar.gz.asc -krb5-1.6.3-pdf.tar.gz -krb5-1.7.tar.gz -krb5-1.7.tar.gz.asc -krb5-1.7-pdf.tar.gz -krb5-1.7.1.tar.gz -krb5-1.7.1.tar.gz.asc -krb5-1.7.1-pdf.tar.gz -krb5-1.8.tar.gz -krb5-1.8.tar.gz.asc -krb5-appl-1.0.tar.gz -krb5-appl-1.0.tar.gz.asc -krb5-1.8-pdf.tar.gz -krb5-1.8.1.tar.gz -krb5-1.8.1.tar.gz.asc -krb5-1.8.1-pdf.tar.gz -krb5-1.8.2.tar.gz.asc -krb5-1.8.2-pdf.tar.gz -krb5-1.8.3.tar.gz -krb5-1.8.3.tar.gz.asc -krb5-1.8.3-pdf.tar.gz +/results_krb5 +/krb5-1.3.4.tar.gz +/krb5-1.3.5.tar.gz +/krb5-1.3.5.tar.gz.asc +/krb5-1.3.6.tar.gz +/krb5-1.3.6.tar.gz.asc +/krb5-1.4.tar.gz +/krb5-1.4.tar.gz.asc +/krb5-1.4.1.tar.gz +/krb5-1.4.1.tar.gz.asc +/krb5-1.4.2.tar.gz +/krb5-1.4.2.tar.gz.asc +/krb5-1.4.3.tar.gz +/krb5-1.4.3.tar.gz.asc +/krb5-1.5.tar.gz +/krb5-1.5.tar.gz.asc +/krb5-1.6.tar.gz +/krb5-1.6.tar.gz.asc +/krb5-1.6-pdf.tar.gz +/krb5-1.6.1.tar.gz +/krb5-1.6.1.tar.gz.asc +/krb5-1.6.1-pdf.tar.gz +/krb5-1.6.2.tar.gz +/krb5-1.6.2.tar.gz.asc +/krb5-1.6.2-pdf.tar.gz +/krb5-1.6.3.tar.gz +/krb5-1.6.3.tar.gz.asc +/krb5-1.6.3-pdf.tar.gz +/krb5-1.7.tar.gz +/krb5-1.7.tar.gz.asc +/krb5-1.7-pdf.tar.gz +/krb5-1.7.1.tar.gz +/krb5-1.7.1.tar.gz.asc +/krb5-1.7.1-pdf.tar.gz +/krb5-1.8.tar.gz +/krb5-1.8.tar.gz.asc +/krb5-appl-1.0.tar.gz +/krb5-appl-1.0.tar.gz.asc +/krb5-1.8-pdf.tar.gz +/krb5-1.8.1.tar.gz +/krb5-1.8.1.tar.gz.asc +/krb5-1.8.1-pdf.tar.gz +/krb5-1.8.2.tar.gz.asc +/krb5-1.8.2-pdf.tar.gz +/krb5-1.8.3.tar.gz +/krb5-1.8.3.tar.gz.asc +/krb5-1.8.3-pdf.tar.gz /krb5-1.9-beta2.tar.gz /krb5-1.9-beta2.tar.gz.asc /krb5-1.9-beta2-pdf.tar.bz2 @@ -199,3 +200,5 @@ krb5-1.8.3-pdf.tar.gz /krb5-1.19.1.tar.gz.asc /krb5-1.19.2.tar.gz /krb5-1.19.2.tar.gz.asc +/krb5-1.20.1.tar.gz +/krb5-1.20.1.tar.gz.asc diff --git a/downstream-ksu-pam-integration.patch b/0001-downstream-ksu-pam-integration.patch similarity index 98% rename from downstream-ksu-pam-integration.patch rename to 0001-downstream-ksu-pam-integration.patch index bebe946..2b737c0 100644 --- a/downstream-ksu-pam-integration.patch +++ b/0001-downstream-ksu-pam-integration.patch @@ -1,4 +1,4 @@ -From 659b3b4a654b879ce84ad8fb4621dde5ae693385 Mon Sep 17 00:00:00 2001 +From 37d69135d0be7f46732c401cdbb3abc075bf4117 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:29:58 -0400 Subject: [PATCH] [downstream] ksu pam integration @@ -30,10 +30,10 @@ Last-updated: krb5-1.18-beta1 create mode 100644 src/clients/ksu/pam.h diff --git a/src/aclocal.m4 b/src/aclocal.m4 -index 024d6370c..ca9fcf664 100644 +index 9920476f91..bf9da35bbc 100644 --- a/src/aclocal.m4 +++ b/src/aclocal.m4 -@@ -1677,3 +1677,72 @@ if test "$with_ldap" = yes; then +@@ -1458,3 +1458,72 @@ if test "$with_ldap" = yes; then OPENLDAP_PLUGIN=yes fi ])dnl @@ -107,7 +107,7 @@ index 024d6370c..ca9fcf664 100644 +])dnl + diff --git a/src/clients/ksu/Makefile.in b/src/clients/ksu/Makefile.in -index 8b4edce4d..9d58f29b5 100644 +index 8b4edce4d8..9d58f29b5d 100644 --- a/src/clients/ksu/Makefile.in +++ b/src/clients/ksu/Makefile.in @@ -3,12 +3,14 @@ BUILDTOP=$(REL)..$(S).. @@ -145,7 +145,7 @@ index 8b4edce4d..9d58f29b5 100644 clean: $(RM) ksu diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c -index af1286172..931f05404 100644 +index af12861729..931f054041 100644 --- a/src/clients/ksu/main.c +++ b/src/clients/ksu/main.c @@ -26,6 +26,7 @@ @@ -303,7 +303,7 @@ index af1286172..931f05404 100644 } diff --git a/src/clients/ksu/pam.c b/src/clients/ksu/pam.c new file mode 100644 -index 000000000..cbfe48704 +index 0000000000..cbfe487047 --- /dev/null +++ b/src/clients/ksu/pam.c @@ -0,0 +1,389 @@ @@ -698,7 +698,7 @@ index 000000000..cbfe48704 +#endif diff --git a/src/clients/ksu/pam.h b/src/clients/ksu/pam.h new file mode 100644 -index 000000000..0ab76569c +index 0000000000..0ab76569cb --- /dev/null +++ b/src/clients/ksu/pam.h @@ -0,0 +1,57 @@ @@ -760,10 +760,10 @@ index 000000000..0ab76569c +void appl_pam_cleanup(void); +#endif diff --git a/src/configure.ac b/src/configure.ac -index 4eb080784..693f76a81 100644 +index f03028b5fd..aa970b0447 100644 --- a/src/configure.ac +++ b/src/configure.ac -@@ -1389,6 +1389,8 @@ AC_SUBST([VERTO_VERSION]) +@@ -1400,6 +1400,8 @@ AC_SUBST([VERTO_VERSION]) AC_PATH_PROG(GROFF, groff) @@ -772,3 +772,6 @@ index 4eb080784..693f76a81 100644 # Make localedir work in autoconf 2.5x. if test "${localedir+set}" != set; then localedir='$(datadir)/locale' +-- +2.38.1 + diff --git a/downstream-SELinux-integration.patch b/0002-downstream-SELinux-integration.patch similarity index 94% rename from downstream-SELinux-integration.patch rename to 0002-downstream-SELinux-integration.patch index 48b058b..4271d66 100644 --- a/downstream-SELinux-integration.patch +++ b/0002-downstream-SELinux-integration.patch @@ -1,4 +1,4 @@ -From 97966ffaac6bf9f2e09ac33a16b15794b31d51de Mon Sep 17 00:00:00 2001 +From c6b58ed180ed91b579d322ff5004f68750f1eb4f Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:30:53 -0400 Subject: [PATCH] [downstream] SELinux integration @@ -36,7 +36,9 @@ The selabel APIs for looking up the context should be thread-safe (per Red Hat #273081), so switching to using them instead of matchpathcon(), which we used earlier, is some improvement. -Last-updated: krb5-1.18-beta1 +Last-updated: krb5-1.20.1 +[jrische@redhat.com: Replace deprecated security_context_t by char *: + - src/util/support/selinux.c] --- src/aclocal.m4 | 48 +++ src/build-tools/krb5-config.in | 3 +- @@ -61,13 +63,13 @@ Last-updated: krb5-1.18-beta1 .../kdb/ldap/ldap_util/kdb5_ldap_services.c | 11 +- src/util/profile/prof_file.c | 3 +- src/util/support/Makefile.in | 3 +- - src/util/support/selinux.c | 406 ++++++++++++++++++ - 24 files changed, 573 insertions(+), 21 deletions(-) + src/util/support/selinux.c | 405 ++++++++++++++++++ + 24 files changed, 572 insertions(+), 21 deletions(-) create mode 100644 src/include/k5-label.h create mode 100644 src/util/support/selinux.c diff --git a/src/aclocal.m4 b/src/aclocal.m4 -index ca9fcf664..5afb96e58 100644 +index bf9da35bbc..01283f482e 100644 --- a/src/aclocal.m4 +++ b/src/aclocal.m4 @@ -85,6 +85,7 @@ AC_SUBST_FILE(libnodeps_frag) @@ -78,7 +80,7 @@ index ca9fcf664..5afb96e58 100644 KRB5_LIB_PARAMS KRB5_AC_INITFINI KRB5_AC_ENABLE_THREADS -@@ -1745,4 +1746,51 @@ AC_SUBST(PAM_LIBS) +@@ -1526,4 +1527,51 @@ AC_SUBST(PAM_LIBS) AC_SUBST(PAM_MAN) AC_SUBST(NON_PAM_MAN) ])dnl @@ -131,7 +133,7 @@ index ca9fcf664..5afb96e58 100644 +AC_SUBST(SELINUX_LIBS) +])dnl diff --git a/src/build-tools/krb5-config.in b/src/build-tools/krb5-config.in -index dead0dddc..fef3e054f 100755 +index dead0dddce..fef3e054fc 100755 --- a/src/build-tools/krb5-config.in +++ b/src/build-tools/krb5-config.in @@ -41,6 +41,7 @@ DL_LIB='@DL_LIB@' @@ -152,7 +154,7 @@ index dead0dddc..fef3e054f 100755 echo $lib_flags diff --git a/src/config/pre.in b/src/config/pre.in -index 3752174c7..0d2068575 100644 +index a0c60c70b3..7eaa2f351c 100644 --- a/src/config/pre.in +++ b/src/config/pre.in @@ -177,6 +177,7 @@ LD = $(PURE) @LD@ @@ -163,7 +165,7 @@ index 3752174c7..0d2068575 100644 INSTALL=@INSTALL@ INSTALL_STRIP= -@@ -403,7 +404,7 @@ SUPPORT_LIB = -l$(SUPPORT_LIBNAME) +@@ -379,7 +380,7 @@ SUPPORT_LIB = -l$(SUPPORT_LIBNAME) # HESIOD_LIBS is -lhesiod... HESIOD_LIBS = @HESIOD_LIBS@ @@ -173,10 +175,10 @@ index 3752174c7..0d2068575 100644 GSS_LIBS = $(GSS_KRB5_LIB) # needs fixing if ever used on macOS! diff --git a/src/configure.ac b/src/configure.ac -index 693f76a81..dd2cad3ee 100644 +index aa970b0447..40545f2bfc 100644 --- a/src/configure.ac +++ b/src/configure.ac -@@ -1391,6 +1391,8 @@ AC_PATH_PROG(GROFF, groff) +@@ -1402,6 +1402,8 @@ AC_PATH_PROG(GROFF, groff) KRB5_WITH_PAM @@ -186,7 +188,7 @@ index 693f76a81..dd2cad3ee 100644 if test "${localedir+set}" != set; then localedir='$(datadir)/locale' diff --git a/src/include/k5-int.h b/src/include/k5-int.h -index cf524252f..efb523689 100644 +index 44dc1eeb3f..c3aecba7d4 100644 --- a/src/include/k5-int.h +++ b/src/include/k5-int.h @@ -128,6 +128,7 @@ typedef unsigned char u_char; @@ -199,7 +201,7 @@ index cf524252f..efb523689 100644 #define KRB5_KDB_MAX_RLIFE (60*60*24*7) /* one week */ diff --git a/src/include/k5-label.h b/src/include/k5-label.h new file mode 100644 -index 000000000..dfaaa847c +index 0000000000..dfaaa847cb --- /dev/null +++ b/src/include/k5-label.h @@ -0,0 +1,32 @@ @@ -236,7 +238,7 @@ index 000000000..dfaaa847c +#endif +#endif diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin -index 045334a08..db80063eb 100644 +index c0194c3c94..7e1dea2cbf 100644 --- a/src/include/krb5/krb5.hin +++ b/src/include/krb5/krb5.hin @@ -87,6 +87,12 @@ @@ -253,7 +255,7 @@ index 045334a08..db80063eb 100644 #include diff --git a/src/kadmin/dbutil/dump.c b/src/kadmin/dbutil/dump.c -index 634ba4a8b..cea7939f4 100644 +index a89b5144f6..4d6cc0bdf9 100644 --- a/src/kadmin/dbutil/dump.c +++ b/src/kadmin/dbutil/dump.c @@ -148,12 +148,21 @@ create_ofile(char *ofile, char **tmpname) @@ -288,10 +290,10 @@ index 634ba4a8b..cea7939f4 100644 com_err(progname, errno, _("while creating 'ok' file, '%s'"), file_ok); goto cleanup; diff --git a/src/kdc/main.c b/src/kdc/main.c -index 3be6dcb07..24d441e16 100644 +index 38b9299066..085afc9220 100644 --- a/src/kdc/main.c +++ b/src/kdc/main.c -@@ -872,7 +872,7 @@ write_pid_file(const char *path) +@@ -848,7 +848,7 @@ write_pid_file(const char *path) FILE *file; unsigned long pid; @@ -301,10 +303,10 @@ index 3be6dcb07..24d441e16 100644 return errno; pid = (unsigned long) getpid(); diff --git a/src/kprop/kpropd.c b/src/kprop/kpropd.c -index 498ca599a..c6b8efc28 100644 +index f2341d720f..ffdac9f397 100644 --- a/src/kprop/kpropd.c +++ b/src/kprop/kpropd.c -@@ -487,6 +487,9 @@ doit(int fd) +@@ -488,6 +488,9 @@ doit(int fd) krb5_enctype etype; int database_fd; char host[INET6_ADDRSTRLEN + 1]; @@ -314,7 +316,7 @@ index 498ca599a..c6b8efc28 100644 signal_wrapper(SIGALRM, alarm_handler); alarm(params.iprop_resync_timeout); -@@ -542,9 +545,15 @@ doit(int fd) +@@ -543,9 +546,15 @@ doit(int fd) free(name); exit(1); } @@ -331,7 +333,7 @@ index 498ca599a..c6b8efc28 100644 KRB5_LOCKMODE_EXCLUSIVE | KRB5_LOCKMODE_DONTBLOCK); if (retval) { diff --git a/src/lib/kadm5/logger.c b/src/lib/kadm5/logger.c -index c6885edf2..9aec3c05e 100644 +index c6885edf2a..9aec3c05e8 100644 --- a/src/lib/kadm5/logger.c +++ b/src/lib/kadm5/logger.c @@ -309,7 +309,7 @@ krb5_klog_init(krb5_context kcontext, char *ename, char *whoami, krb5_boolean do @@ -353,7 +355,7 @@ index c6885edf2..9aec3c05e 100644 set_cloexec_file(f); log_control.log_entries[lindex].lfu_filep = f; diff --git a/src/lib/kdb/kdb_log.c b/src/lib/kdb/kdb_log.c -index 2659a2501..e9b95fce5 100644 +index 2659a25018..e9b95fce59 100644 --- a/src/lib/kdb/kdb_log.c +++ b/src/lib/kdb/kdb_log.c @@ -480,7 +480,7 @@ ulog_map(krb5_context context, const char *logname, uint32_t ulogentries) @@ -366,7 +368,7 @@ index 2659a2501..e9b95fce5 100644 retval = errno; goto cleanup; diff --git a/src/lib/krb5/ccache/cc_dir.c b/src/lib/krb5/ccache/cc_dir.c -index 7b100a0ec..5683a0433 100644 +index 1da40b51d0..f3ab7340a6 100644 --- a/src/lib/krb5/ccache/cc_dir.c +++ b/src/lib/krb5/ccache/cc_dir.c @@ -183,10 +183,19 @@ write_primary_file(const char *primary_path, const char *contents) @@ -416,7 +418,7 @@ index 7b100a0ec..5683a0433 100644 _("Credential cache directory %s does not exist"), dirname); diff --git a/src/lib/krb5/keytab/kt_file.c b/src/lib/krb5/keytab/kt_file.c -index e510211fc..f3ea28c8e 100644 +index e510211fc5..f3ea28c8ec 100644 --- a/src/lib/krb5/keytab/kt_file.c +++ b/src/lib/krb5/keytab/kt_file.c @@ -735,14 +735,14 @@ krb5_ktfileint_open(krb5_context context, krb5_keytab id, int mode) @@ -437,10 +439,10 @@ index e510211fc..f3ea28c8e 100644 goto report_errno; writevno = 1; diff --git a/src/lib/krb5/os/trace.c b/src/lib/krb5/os/trace.c -index 7073459f0..e9b99f4ca 100644 +index 3369fc4ba6..95f82cda03 100644 --- a/src/lib/krb5/os/trace.c +++ b/src/lib/krb5/os/trace.c -@@ -458,7 +458,7 @@ krb5_set_trace_filename(krb5_context context, const char *filename) +@@ -459,7 +459,7 @@ krb5_set_trace_filename(krb5_context context, const char *filename) fd = malloc(sizeof(*fd)); if (fd == NULL) return ENOMEM; @@ -450,7 +452,7 @@ index 7073459f0..e9b99f4ca 100644 free(fd); return errno; diff --git a/src/plugins/kdb/db2/adb_openclose.c b/src/plugins/kdb/db2/adb_openclose.c -index 7db30a33b..2b9d01921 100644 +index 7db30a33b0..2b9d01921d 100644 --- a/src/plugins/kdb/db2/adb_openclose.c +++ b/src/plugins/kdb/db2/adb_openclose.c @@ -152,7 +152,7 @@ osa_adb_init_db(osa_adb_db_t *dbp, char *filename, char *lockfilename, @@ -463,7 +465,7 @@ index 7db30a33b..2b9d01921 100644 * maybe someone took away write permission so we could only * get shared locks? diff --git a/src/plugins/kdb/db2/kdb_db2.c b/src/plugins/kdb/db2/kdb_db2.c -index 1a476b586..b40bb2240 100644 +index 2c163d91cc..9a344a603e 100644 --- a/src/plugins/kdb/db2/kdb_db2.c +++ b/src/plugins/kdb/db2/kdb_db2.c @@ -694,8 +694,8 @@ ctx_create_db(krb5_context context, krb5_db2_context *dbc) @@ -478,7 +480,7 @@ index 1a476b586..b40bb2240 100644 retval = errno; goto cleanup; diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_open.c b/src/plugins/kdb/db2/libdb2/btree/bt_open.c -index 2977b17f3..d5809a5a9 100644 +index 2977b17f3a..d5809a5a93 100644 --- a/src/plugins/kdb/db2/libdb2/btree/bt_open.c +++ b/src/plugins/kdb/db2/libdb2/btree/bt_open.c @@ -60,6 +60,7 @@ static char sccsid[] = "@(#)bt_open.c 8.11 (Berkeley) 11/2/95"; @@ -499,7 +501,7 @@ index 2977b17f3..d5809a5a9 100644 } else { diff --git a/src/plugins/kdb/db2/libdb2/hash/hash.c b/src/plugins/kdb/db2/libdb2/hash/hash.c -index 862dbb164..686a960c9 100644 +index 862dbb1640..686a960c96 100644 --- a/src/plugins/kdb/db2/libdb2/hash/hash.c +++ b/src/plugins/kdb/db2/libdb2/hash/hash.c @@ -51,6 +51,7 @@ static char sccsid[] = "@(#)hash.c 8.12 (Berkeley) 11/7/95"; @@ -520,7 +522,7 @@ index 862dbb164..686a960c9 100644 (void)fcntl(hashp->fp, F_SETFD, 1); } diff --git a/src/plugins/kdb/db2/libdb2/recno/rec_open.c b/src/plugins/kdb/db2/libdb2/recno/rec_open.c -index d8b26e701..b0daa7c02 100644 +index d8b26e7011..b0daa7c021 100644 --- a/src/plugins/kdb/db2/libdb2/recno/rec_open.c +++ b/src/plugins/kdb/db2/libdb2/recno/rec_open.c @@ -51,6 +51,7 @@ static char sccsid[] = "@(#)rec_open.c 8.12 (Berkeley) 11/18/94"; @@ -542,7 +544,7 @@ index d8b26e701..b0daa7c02 100644 if (fname != NULL && fcntl(rfd, F_SETFD, 1) == -1) { diff --git a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c -index e87688d66..30f7c00ab 100644 +index e87688d666..30f7c00ab5 100644 --- a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c +++ b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c @@ -190,7 +190,7 @@ kdb5_ldap_stash_service_password(int argc, char **argv) @@ -579,7 +581,7 @@ index e87688d66..30f7c00ab 100644 if (newfile == NULL) { com_err(me, errno, _("Error creating file %s"), tmp_file); diff --git a/src/util/profile/prof_file.c b/src/util/profile/prof_file.c -index aa951df05..79f9500f6 100644 +index aa951df05f..79f9500f69 100644 --- a/src/util/profile/prof_file.c +++ b/src/util/profile/prof_file.c @@ -33,6 +33,7 @@ @@ -600,7 +602,7 @@ index aa951df05..79f9500f6 100644 retval = errno; if (retval == 0) diff --git a/src/util/support/Makefile.in b/src/util/support/Makefile.in -index 86d5a950a..1052d53a1 100644 +index 86d5a950a6..1052d53a1e 100644 --- a/src/util/support/Makefile.in +++ b/src/util/support/Makefile.in @@ -74,6 +74,7 @@ IPC_SYMS= \ @@ -622,10 +624,10 @@ index 86d5a950a..1052d53a1 100644 diff --git a/src/util/support/selinux.c b/src/util/support/selinux.c new file mode 100644 -index 000000000..6d41f3244 +index 0000000000..807d039da3 --- /dev/null +++ b/src/util/support/selinux.c -@@ -0,0 +1,406 @@ +@@ -0,0 +1,405 @@ +/* + * Copyright 2007,2008,2009,2011,2012,2013,2016 Red Hat, Inc. All Rights Reserved. + * @@ -724,17 +726,16 @@ index 000000000..6d41f3244 + } +} + -+static security_context_t ++static char * +push_fscreatecon(const char *pathname, mode_t mode) +{ -+ security_context_t previous, configuredsc, currentsc, derivedsc; ++ char *previous, *configuredsc, *currentsc, *genpath; ++ const char *derivedsc, *fullpath, *currentuser; + context_t current, derived; -+ const char *fullpath, *currentuser; -+ char *genpath; + -+ previous = configuredsc = currentsc = derivedsc = NULL; ++ previous = configuredsc = currentsc = genpath = NULL; ++ derivedsc = NULL; + current = derived = NULL; -+ genpath = NULL; + + fullpath = pathname; + @@ -862,7 +863,7 @@ index 000000000..6d41f3244 +} + +static void -+pop_fscreatecon(security_context_t previous) ++pop_fscreatecon(char *previous) +{ + if (!is_selinux_enabled()) { + return; @@ -916,7 +917,7 @@ index 000000000..6d41f3244 +{ + FILE *fp; + int errno_save; -+ security_context_t ctx; ++ char *ctx; + + if ((strcmp(mode, "r") == 0) || + (strcmp(mode, "rb") == 0)) { @@ -942,7 +943,7 @@ index 000000000..6d41f3244 +{ + int fd; + int errno_save; -+ security_context_t ctx; ++ char *ctx; + + k5_once(&labeled_once, label_mutex_init); + k5_mutex_lock(&labeled_mutex); @@ -963,7 +964,7 @@ index 000000000..6d41f3244 +{ + int ret; + int errno_save; -+ security_context_t ctx; ++ char *ctx; + + k5_once(&labeled_once, label_mutex_init); + k5_mutex_lock(&labeled_mutex); @@ -984,7 +985,7 @@ index 000000000..6d41f3244 +{ + int ret; + int errno_save; -+ security_context_t ctx; ++ char *ctx; + + k5_once(&labeled_once, label_mutex_init); + k5_mutex_lock(&labeled_mutex); @@ -1005,7 +1006,7 @@ index 000000000..6d41f3244 +{ + int fd; + int errno_save; -+ security_context_t ctx; ++ char *ctx; + mode_t mode; + va_list ap; + @@ -1032,3 +1033,6 @@ index 000000000..6d41f3244 +} + +#endif /* USE_SELINUX */ +-- +2.38.1 + diff --git a/downstream-fix-debuginfo-with-y.tab.c.patch b/0003-downstream-fix-debuginfo-with-y.tab.c.patch similarity index 90% rename from downstream-fix-debuginfo-with-y.tab.c.patch rename to 0003-downstream-fix-debuginfo-with-y.tab.c.patch index 494152c..3c58cc1 100644 --- a/downstream-fix-debuginfo-with-y.tab.c.patch +++ b/0003-downstream-fix-debuginfo-with-y.tab.c.patch @@ -1,4 +1,4 @@ -From 98b50683165089bf7bd9d91f953abbd79a8b1b08 Mon Sep 17 00:00:00 2001 +From c7fe7cbd61f7debf052ddcc6cc5f01bb7e4f5385 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:49:25 -0400 Subject: [PATCH] [downstream] fix debuginfo with y.tab.c @@ -14,7 +14,7 @@ Last-updated: krb5-1.9 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/src/kadmin/cli/Makefile.in b/src/kadmin/cli/Makefile.in -index adfea6e2b..d1327e400 100644 +index adfea6e2b5..d1327e400b 100644 --- a/src/kadmin/cli/Makefile.in +++ b/src/kadmin/cli/Makefile.in @@ -37,3 +37,8 @@ clean-unix:: @@ -27,7 +27,7 @@ index adfea6e2b..d1327e400 100644 + $(YACC.y) $< + $(CP) y.tab.c $@ diff --git a/src/plugins/kdb/ldap/ldap_util/Makefile.in b/src/plugins/kdb/ldap/ldap_util/Makefile.in -index 8669c2436..a22f23c02 100644 +index 8669c2436c..a22f23c02c 100644 --- a/src/plugins/kdb/ldap/ldap_util/Makefile.in +++ b/src/plugins/kdb/ldap/ldap_util/Makefile.in @@ -20,7 +20,7 @@ $(PROG): $(OBJS) $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIB) $(GETDATE) @@ -39,3 +39,6 @@ index 8669c2436..a22f23c02 100644 install: $(INSTALL_PROGRAM) $(PROG) ${DESTDIR}$(ADMIN_BINDIR)/$(PROG) +-- +2.38.1 + diff --git a/downstream-Remove-3des-support.patch b/0004-downstream-Remove-3des-support.patch similarity index 92% rename from downstream-Remove-3des-support.patch rename to 0004-downstream-Remove-3des-support.patch index 3d351eb..4ec3a0f 100644 --- a/downstream-Remove-3des-support.patch +++ b/0004-downstream-Remove-3des-support.patch @@ -1,4 +1,4 @@ -From defa8816e26ab9f5a8f0b61e7bebad67175c433e Mon Sep 17 00:00:00 2001 +From 7b40250066bbcc529b5348b68199c58fbad82376 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 26 Mar 2019 18:51:10 -0400 Subject: [PATCH] [downstream] Remove 3des support @@ -8,13 +8,17 @@ des3-hmac-sha1, des3-cbc-sha1-kd). Update all tests and documentation to user other enctypes. Mark the 3DES enctypes UNSUPPORTED and retain their constants. -Last-updated: 1.19-beta1 +Last-updated: 1.20-final [antorres@redhat.com: remove diffs for: - src/kdamin/testing/proto/kdc.conf.proto - src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp - src/lib/kadm5/unit-test/api.current/get-principal-v2.exp - src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp since they were removed by Remove-TCL-based-libkadm5-API-tests.patch] +[jrische@redhat.com: restore supportedCMSTypes (not using 3DES any more): + - src/plugins/preauth/pkinit/pkinit_crypto.h + - src/plugins/preauth/pkinit/pkinit_crypto_openssl.c + - src/plugins/preauth/pkinit/pkinit_clnt.c] --- doc/admin/advanced/retiring-des.rst | 11 + doc/admin/conf_files/kdc_conf.rst | 7 +- @@ -24,35 +28,34 @@ Last-updated: 1.19-beta1 doc/conf.py | 2 +- doc/mitK5features.rst | 2 +- src/Makefile.in | 4 +- - src/configure.ac | 1 - + src/configure.ac | 4 +- src/include/krb5/krb5.hin | 10 +- - src/kadmin/testing/proto/kdc.conf.proto | 4 +- src/kdc/kdc_util.c | 4 - src/lib/crypto/Makefile.in | 8 +- src/lib/crypto/builtin/Makefile.in | 6 +- src/lib/crypto/builtin/des/ISSUES | 13 - - src/lib/crypto/builtin/des/Makefile.in | 80 ---- - src/lib/crypto/builtin/des/d3_aead.c | 133 ------ - src/lib/crypto/builtin/des/d3_kysched.c | 51 --- - src/lib/crypto/builtin/des/deps | 150 ------- + src/lib/crypto/builtin/des/Makefile.in | 82 ---- + src/lib/crypto/builtin/des/d3_aead.c | 137 ------ + src/lib/crypto/builtin/des/d3_kysched.c | 55 --- + src/lib/crypto/builtin/des/deps | 146 ------- src/lib/crypto/builtin/des/des_int.h | 285 ------------- - src/lib/crypto/builtin/des/des_keys.c | 40 -- + src/lib/crypto/builtin/des/des_keys.c | 38 -- src/lib/crypto/builtin/des/destest.c | 240 ----------- src/lib/crypto/builtin/des/doc/libdes.doc | 208 --------- - src/lib/crypto/builtin/des/f_aead.c | 173 -------- + src/lib/crypto/builtin/des/f_aead.c | 177 -------- src/lib/crypto/builtin/des/f_cbc.c | 256 ------------ - src/lib/crypto/builtin/des/f_cksum.c | 136 ------ - src/lib/crypto/builtin/des/f_parity.c | 56 --- - src/lib/crypto/builtin/des/f_sched.c | 359 ---------------- - src/lib/crypto/builtin/des/f_tables.c | 370 ---------------- + src/lib/crypto/builtin/des/f_cksum.c | 141 ------- + src/lib/crypto/builtin/des/f_parity.c | 64 --- + src/lib/crypto/builtin/des/f_sched.c | 363 ---------------- + src/lib/crypto/builtin/des/f_tables.c | 375 ----------------- src/lib/crypto/builtin/des/f_tables.h | 285 ------------- - src/lib/crypto/builtin/des/key_sched.c | 62 --- + src/lib/crypto/builtin/des/key_sched.c | 66 --- src/lib/crypto/builtin/des/keytest.data | 171 -------- src/lib/crypto/builtin/des/t_verify.c | 395 ------------------ - src/lib/crypto/builtin/des/weak_key.c | 86 ---- - .../crypto/builtin/enc_provider/Makefile.in | 6 +- - src/lib/crypto/builtin/enc_provider/deps | 13 - - src/lib/crypto/builtin/enc_provider/des3.c | 105 ----- + src/lib/crypto/builtin/des/weak_key.c | 90 ---- + .../crypto/builtin/enc_provider/Makefile.in | 5 +- + src/lib/crypto/builtin/enc_provider/deps | 11 - + src/lib/crypto/builtin/enc_provider/des3.c | 109 ----- src/lib/crypto/crypto_tests/t_cf2.expected | 1 - src/lib/crypto/crypto_tests/t_cf2.in | 5 - src/lib/crypto/crypto_tests/t_cksums.c | 10 - @@ -61,45 +64,40 @@ Last-updated: 1.19-beta1 src/lib/crypto/crypto_tests/t_encrypt.c | 1 - src/lib/crypto/crypto_tests/t_short.c | 1 - src/lib/crypto/crypto_tests/t_str2key.c | 52 --- + src/lib/crypto/crypto_tests/vectors.c | 4 - src/lib/crypto/krb/Makefile.in | 3 - src/lib/crypto/krb/cksumtypes.c | 6 - - src/lib/crypto/krb/crypto_int.h | 16 - + src/lib/crypto/krb/crypto_int.h | 11 - src/lib/crypto/krb/default_state.c | 10 - src/lib/crypto/krb/enctype_util.c | 3 + src/lib/crypto/krb/etypes.c | 21 - src/lib/crypto/krb/prf_des.c | 47 --- - src/lib/crypto/krb/random_to_key.c | 45 -- + src/lib/crypto/krb/random_to_key.c | 28 -- src/lib/crypto/libk5crypto.exports | 1 - src/lib/crypto/openssl/Makefile.in | 8 +- src/lib/crypto/openssl/des/Makefile.in | 20 - - src/lib/crypto/openssl/des/deps | 15 - - src/lib/crypto/openssl/des/des_keys.c | 40 -- + src/lib/crypto/openssl/des/deps | 14 - + src/lib/crypto/openssl/des/des_keys.c | 39 -- .../crypto/openssl/enc_provider/Makefile.in | 3 - src/lib/crypto/openssl/enc_provider/deps | 11 - - src/lib/crypto/openssl/enc_provider/des3.c | 184 -------- + src/lib/crypto/openssl/enc_provider/des3.c | 188 --------- + src/lib/crypto/openssl/kdf.c | 2 - src/lib/gssapi/krb5/accept_sec_context.c | 1 - src/lib/gssapi/krb5/gssapiP_krb5.h | 6 +- src/lib/gssapi/krb5/k5seal.c | 35 +- src/lib/gssapi/krb5/k5sealiov.c | 27 +- - src/lib/gssapi/krb5/k5unseal.c | 102 ++--- + src/lib/gssapi/krb5/k5unseal.c | 88 ++-- src/lib/gssapi/krb5/k5unsealiov.c | 38 +- src/lib/gssapi/krb5/util_crypt.c | 11 - - .../api.current/chpass-principal-v2.exp | 4 +- - .../api.current/get-principal-v2.exp | 4 +- - .../api.current/randkey-principal-v2.exp | 4 +- src/lib/krb5/krb/init_ctx.c | 3 - src/lib/krb5/krb/s4u_creds.c | 2 - src/lib/krb5/krb/t_etypes.c | 48 +-- src/lib/krb5/os/t_trace.c | 4 +- src/lib/krb5/os/t_trace.ref | 2 +- src/plugins/preauth/pkinit/pkcs11.h | 6 +- - src/plugins/preauth/pkinit/pkinit_clnt.c | 8 - - src/plugins/preauth/pkinit/pkinit_crypto.h | 12 - - .../preauth/pkinit/pkinit_crypto_openssl.c | 38 -- - src/plugins/preauth/pkinit/pkinit_kdf_test.c | 31 -- + src/plugins/preauth/pkinit/pkinit_crypto.h | 10 +- + src/plugins/preauth/pkinit/pkinit_kdf_test.c | 30 -- src/plugins/preauth/spake/t_vectors.c | 25 -- - src/tests/dejagnu/config/default.exp | 78 ---- - src/tests/dejagnu/krb-standalone/kprop.exp | 2 +- src/tests/gssapi/t_enctypes.py | 33 +- src/tests/gssapi/t_invalid.c | 12 - src/tests/gssapi/t_pcontok.c | 16 +- @@ -111,7 +109,7 @@ Last-updated: 1.19-beta1 src/tests/t_salt.py | 5 +- src/util/k5test.py | 7 - .../leash/htmlhelp/html/Encryption_Types.htm | 13 - - 95 files changed, 160 insertions(+), 4835 deletions(-) + 89 files changed, 151 insertions(+), 4713 deletions(-) delete mode 100644 src/lib/crypto/builtin/des/ISSUES delete mode 100644 src/lib/crypto/builtin/des/Makefile.in delete mode 100644 src/lib/crypto/builtin/des/d3_aead.c @@ -140,7 +138,7 @@ Last-updated: 1.19-beta1 delete mode 100644 src/lib/crypto/openssl/enc_provider/des3.c diff --git a/doc/admin/advanced/retiring-des.rst b/doc/admin/advanced/retiring-des.rst -index 38f76d3f4..d5e3c30c0 100644 +index 38f76d3f45..d5e3c30c04 100644 --- a/doc/admin/advanced/retiring-des.rst +++ b/doc/admin/advanced/retiring-des.rst @@ -10,6 +10,13 @@ ability have rendered DES vulnerable to brute force attacks on its 56-bit @@ -169,10 +167,10 @@ index 38f76d3f4..d5e3c30c0 100644 ------------- diff --git a/doc/admin/conf_files/kdc_conf.rst b/doc/admin/conf_files/kdc_conf.rst -index 1dc958d62..3a72aabef 100644 +index 74a0a2acef..846c58ed82 100644 --- a/doc/admin/conf_files/kdc_conf.rst +++ b/doc/admin/conf_files/kdc_conf.rst -@@ -848,8 +848,6 @@ Encryption types marked as "weak" and "deprecated" are available for +@@ -854,8 +854,6 @@ Encryption types marked as "weak" and "deprecated" are available for compatibility but not recommended for use. ==================================================== ========================================================= @@ -181,7 +179,7 @@ index 1dc958d62..3a72aabef 100644 aes256-cts-hmac-sha1-96 aes256-cts aes256-sha1 AES-256 CTS mode with 96-bit SHA-1 HMAC aes128-cts-hmac-sha1-96 aes128-cts aes128-sha1 AES-128 CTS mode with 96-bit SHA-1 HMAC aes256-cts-hmac-sha384-192 aes256-sha2 AES-256 CTS mode with 192-bit SHA-384 HMAC -@@ -858,7 +856,6 @@ arcfour-hmac rc4-hmac arcfour-hmac-md5 RC4 with HMAC/MD5 (deprecat +@@ -864,7 +862,6 @@ arcfour-hmac rc4-hmac arcfour-hmac-md5 RC4 with HMAC/MD5 (deprecat arcfour-hmac-exp rc4-hmac-exp arcfour-hmac-md5-exp Exportable RC4 with HMAC/MD5 (weak) camellia256-cts-cmac camellia256-cts Camellia-256 CTS mode with CMAC camellia128-cts-cmac camellia128-cts Camellia-128 CTS mode with CMAC @@ -189,7 +187,7 @@ index 1dc958d62..3a72aabef 100644 aes The AES family: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, aes256-cts-hmac-sha384-192, and aes128-cts-hmac-sha256-128 rc4 The RC4 family: arcfour-hmac camellia The Camellia family: camellia256-cts-cmac and camellia128-cts-cmac -@@ -870,8 +867,8 @@ from the current list by prefixing them with a minus sign ("-"). +@@ -876,8 +873,8 @@ from the current list by prefixing them with a minus sign ("-"). Types or families can be prefixed with a plus sign ("+") for symmetry; it has the same meaning as just listing the type or family. For example, "``DEFAULT -rc4``" would be the default set of encryption @@ -201,7 +199,7 @@ index 1dc958d62..3a72aabef 100644 While **aes128-cts** and **aes256-cts** are supported for all Kerberos diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst -index 694922c0d..c4d5499d3 100644 +index 694922c0d9..c4d5499d3b 100644 --- a/doc/admin/enctypes.rst +++ b/doc/admin/enctypes.rst @@ -129,7 +129,7 @@ enctype weak? krb5 Windows @@ -229,7 +227,7 @@ index 694922c0d..c4d5499d3 100644 Migrating away from older encryption types diff --git a/doc/admin/troubleshoot.rst b/doc/admin/troubleshoot.rst -index ade5e1f87..e4dc54f7e 100644 +index ade5e1f87a..e4dc54f7e5 100644 --- a/doc/admin/troubleshoot.rst +++ b/doc/admin/troubleshoot.rst @@ -73,11 +73,10 @@ credential verification failed: KDC has no support for encryption type @@ -249,7 +247,7 @@ index ade5e1f87..e4dc54f7e 100644 .. _err_cert_chain_cert_expired: diff --git a/doc/appdev/refs/macros/index.rst b/doc/appdev/refs/macros/index.rst -index 5542d9850..0cb2e81bd 100644 +index a0d4f26701..5f34dea5e8 100644 --- a/doc/appdev/refs/macros/index.rst +++ b/doc/appdev/refs/macros/index.rst @@ -36,7 +36,6 @@ Public @@ -261,7 +259,7 @@ index 5542d9850..0cb2e81bd 100644 CKSUMTYPE_NIST_SHA.rst CKSUMTYPE_RSA_MD4.rst diff --git a/doc/conf.py b/doc/conf.py -index 14158ae81..a876fd633 100644 +index fa0eb80f1f..12168fa695 100644 --- a/doc/conf.py +++ b/doc/conf.py @@ -278,7 +278,7 @@ else: @@ -274,7 +272,7 @@ index 14158ae81..a876fd633 100644 .. |copy| unicode:: U+000A9 ''' diff --git a/doc/mitK5features.rst b/doc/mitK5features.rst -index 4954bb3aa..92ce2a772 100644 +index ca2d6ef117..100c64a1c1 100644 --- a/doc/mitK5features.rst +++ b/doc/mitK5features.rst @@ -37,7 +37,7 @@ Database backends: LDAP, DB2, LMDB @@ -287,7 +285,7 @@ index 4954bb3aa..92ce2a772 100644 Interoperability ---------------- diff --git a/src/Makefile.in b/src/Makefile.in -index 7d2507ef8..c16715ac7 100644 +index 8f14e9bf2c..ba3bb18eec 100644 --- a/src/Makefile.in +++ b/src/Makefile.in @@ -130,7 +130,7 @@ WINMAKEFILES=Makefile \ @@ -309,19 +307,26 @@ index 7d2507ef8..c16715ac7 100644 ##DOS## $(WCONFIG) config < $@.in > $@ ##DOS##lib\crypto\builtin\camellia\Makefile: lib\crypto\builtin\camellia\Makefile.in $(MKFDEP) diff --git a/src/configure.ac b/src/configure.ac -index dd2cad3ee..3e1052db7 100644 +index 40545f2bfc..8dc864718d 100644 --- a/src/configure.ac +++ b/src/configure.ac -@@ -1480,7 +1480,6 @@ V5_AC_OUTPUT_MAKEFILE(. - lib/crypto lib/crypto/krb lib/crypto/$CRYPTO_IMPL - lib/crypto/$CRYPTO_IMPL/enc_provider - lib/crypto/$CRYPTO_IMPL/hash_provider -- lib/crypto/$CRYPTO_IMPL/des - lib/crypto/$CRYPTO_IMPL/md4 lib/crypto/$CRYPTO_IMPL/md5 - lib/crypto/$CRYPTO_IMPL/sha1 lib/crypto/$CRYPTO_IMPL/sha2 - lib/crypto/$CRYPTO_IMPL/aes lib/crypto/$CRYPTO_IMPL/camellia +@@ -1489,12 +1489,12 @@ V5_AC_OUTPUT_MAKEFILE(. + lib lib/kdb + + lib/crypto lib/crypto/krb lib/crypto/crypto_tests +- lib/crypto/builtin lib/crypto/builtin/des ++ lib/crypto/builtin + lib/crypto/builtin/aes lib/crypto/builtin/camellia + lib/crypto/builtin/md4 lib/crypto/builtin/md5 + lib/crypto/builtin/sha1 lib/crypto/builtin/sha2 + lib/crypto/builtin/enc_provider lib/crypto/builtin/hash_provider +- lib/crypto/openssl lib/crypto/openssl/des ++ lib/crypto/openssl + lib/crypto/openssl/enc_provider lib/crypto/openssl/hash_provider + + lib/krb5 lib/krb5/error_tables lib/krb5/asn.1 lib/krb5/ccache diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin -index db80063eb..63e67a2ba 100644 +index 7e1dea2cbf..fb9f2a366c 100644 --- a/src/include/krb5/krb5.hin +++ b/src/include/krb5/krb5.hin @@ -426,8 +426,8 @@ typedef struct _krb5_crypto_iov { @@ -347,20 +352,20 @@ index db80063eb..63e67a2ba 100644 #define ENCTYPE_AES128_CTS_HMAC_SHA1_96 0x0011 /**< RFC 3962 */ #define ENCTYPE_AES256_CTS_HMAC_SHA1_96 0x0012 /**< RFC 3962 */ #define ENCTYPE_AES128_CTS_HMAC_SHA256_128 0x0013 /**< RFC 8009 */ -@@ -458,7 +458,7 @@ typedef struct _krb5_crypto_iov { +@@ -463,7 +463,7 @@ typedef struct _krb5_crypto_iov { #define CKSUMTYPE_RSA_MD5 0x0007 #define CKSUMTYPE_RSA_MD5_DES 0x0008 #define CKSUMTYPE_NIST_SHA 0x0009 -#define CKSUMTYPE_HMAC_SHA1_DES3 0x000c +#define CKSUMTYPE_HMAC_SHA1_DES3 0x000c /* @deprecated removed */ + #define CKSUMTYPE_SHA1 0x000e /**< RFC 3961 */ #define CKSUMTYPE_HMAC_SHA1_96_AES128 0x000f /**< RFC 3962. Used with ENCTYPE_AES128_CTS_HMAC_SHA1_96 */ - #define CKSUMTYPE_HMAC_SHA1_96_AES256 0x0010 /**< RFC 3962. Used with diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c -index 60f30c4f4..c65375aef 100644 +index 9f2a67d189..b7a9aa4992 100644 --- a/src/kdc/kdc_util.c +++ b/src/kdc/kdc_util.c -@@ -1017,8 +1017,6 @@ enctype_name(krb5_enctype ktype, char *buf, size_t buflen) +@@ -1111,8 +1111,6 @@ enctype_name(krb5_enctype ktype, char *buf, size_t buflen) name = "rsaEncryption-EnvOID"; else if (ktype == ENCTYPE_RSA_ES_OAEP_ENV) name = "id-RSAES-OAEP-EnvOID"; @@ -369,7 +374,7 @@ index 60f30c4f4..c65375aef 100644 else return krb5_enctype_to_name(ktype, FALSE, buf, buflen); -@@ -1605,8 +1603,6 @@ krb5_boolean +@@ -1704,8 +1702,6 @@ krb5_boolean enctype_requires_etype_info_2(krb5_enctype enctype) { switch(enctype) { @@ -379,28 +384,25 @@ index 60f30c4f4..c65375aef 100644 case ENCTYPE_ARCFOUR_HMAC_EXP : return 0; diff --git a/src/lib/crypto/Makefile.in b/src/lib/crypto/Makefile.in -index c3fcfd7e8..890d54adf 100644 +index 10e8c74cf8..25c4f40cc3 100644 --- a/src/lib/crypto/Makefile.in +++ b/src/lib/crypto/Makefile.in -@@ -13,7 +13,7 @@ STOBJLISTS=$(CRYPTO_IMPL)/enc_provider/OBJS.ST \ - $(CRYPTO_IMPL)/hash_provider/OBJS.ST \ - $(CRYPTO_IMPL)/md4/OBJS.ST $(CRYPTO_IMPL)/md5/OBJS.ST \ - $(CRYPTO_IMPL)/sha1/OBJS.ST $(CRYPTO_IMPL)/sha2/OBJS.ST \ -- $(CRYPTO_IMPL)/aes/OBJS.ST $(CRYPTO_IMPL)/des/OBJS.ST \ -+ $(CRYPTO_IMPL)/aes/OBJS.ST \ - $(CRYPTO_IMPL)/camellia/OBJS.ST krb/OBJS.ST \ - $(CRYPTO_IMPL)/OBJS.ST +@@ -10,12 +10,12 @@ LIBMINOR=1 + RELDIR=crypto -@@ -21,7 +21,7 @@ SUBDIROBJLISTS=$(CRYPTO_IMPL)/enc_provider/OBJS.ST \ - $(CRYPTO_IMPL)/hash_provider/OBJS.ST \ - $(CRYPTO_IMPL)/md4/OBJS.ST $(CRYPTO_IMPL)/md5/OBJS.ST \ - $(CRYPTO_IMPL)/sha1/OBJS.ST $(CRYPTO_IMPL)/sha2/OBJS.ST \ -- $(CRYPTO_IMPL)/aes/OBJS.ST $(CRYPTO_IMPL)/des/OBJS.ST \ -+ $(CRYPTO_IMPL)/aes/OBJS.ST \ - $(CRYPTO_IMPL)/camellia/OBJS.ST krb/OBJS.ST \ - $(CRYPTO_IMPL)/OBJS.ST + STOBJLISTS=krb/OBJS.ST \ +- builtin/OBJS.ST builtin/des/OBJS.ST \ ++ builtin/OBJS.ST \ + builtin/aes/OBJS.ST builtin/camellia/OBJS.ST \ + builtin/md4/OBJS.ST builtin/md5/OBJS.ST \ + builtin/sha1/OBJS.ST builtin/sha2/OBJS.ST \ + builtin/enc_provider/OBJS.ST builtin/hash_provider/OBJS.ST \ +- openssl/OBJS.ST openssl/des/OBJS.ST \ ++ openssl/OBJS.ST \ + openssl/enc_provider/OBJS.ST openssl/hash_provider/OBJS.ST -@@ -34,8 +34,8 @@ SHLIB_EXPDEPLIBS= $(SUPPORT_DEPLIB) + SUBDIROBJLISTS=$(STOBJLISTS) +@@ -28,8 +28,8 @@ SHLIB_EXPDEPLIBS= $(SUPPORT_DEPLIB) SHLIB_LDFLAGS= $(LDFLAGS) @SHLIB_RPATH_DIRS@ ##DOS##LIBNAME=$(OUTPRE)crypto.lib @@ -412,7 +414,7 @@ index c3fcfd7e8..890d54adf 100644 all-unix: all-liblinks install-unix: install-libs diff --git a/src/lib/crypto/builtin/Makefile.in b/src/lib/crypto/builtin/Makefile.in -index baf5d974f..82adf1dec 100644 +index daf19da195..c9e967c807 100644 --- a/src/lib/crypto/builtin/Makefile.in +++ b/src/lib/crypto/builtin/Makefile.in @@ -1,6 +1,6 @@ @@ -420,11 +422,11 @@ index baf5d974f..82adf1dec 100644 BUILDTOP=$(REL)..$(S)..$(S).. -SUBDIRS=camellia des aes md4 md5 sha1 sha2 enc_provider hash_provider +SUBDIRS=camellia aes md4 md5 sha1 sha2 enc_provider hash_provider - LOCALINCLUDES = -I$(srcdir)/../krb -I$(srcdir) + LOCALINCLUDES=-I$(srcdir)/../krb $(CRYPTO_IMPL_CFLAGS) ##DOS##BUILDTOP = ..\..\.. -@@ -22,7 +22,7 @@ SRCS=\ - $(srcdir)/init.c \ +@@ -25,7 +25,7 @@ SRCS=\ + $(srcdir)/kdf.c \ $(srcdir)/pbkdf2.c -STOBJLISTS= des/OBJS.ST md4/OBJS.ST \ @@ -432,7 +434,7 @@ index baf5d974f..82adf1dec 100644 md5/OBJS.ST sha1/OBJS.ST sha2/OBJS.ST \ enc_provider/OBJS.ST \ hash_provider/OBJS.ST \ -@@ -30,7 +30,7 @@ STOBJLISTS= des/OBJS.ST md4/OBJS.ST \ +@@ -33,7 +33,7 @@ STOBJLISTS= des/OBJS.ST md4/OBJS.ST \ camellia/OBJS.ST \ OBJS.ST @@ -443,7 +445,7 @@ index baf5d974f..82adf1dec 100644 hash_provider/OBJS.ST \ diff --git a/src/lib/crypto/builtin/des/ISSUES b/src/lib/crypto/builtin/des/ISSUES deleted file mode 100644 -index 157891103..000000000 +index 1578911033..0000000000 --- a/src/lib/crypto/builtin/des/ISSUES +++ /dev/null @@ -1,13 +0,0 @@ @@ -462,13 +464,13 @@ index 157891103..000000000 -const? diff --git a/src/lib/crypto/builtin/des/Makefile.in b/src/lib/crypto/builtin/des/Makefile.in deleted file mode 100644 -index 54b329d0f..000000000 +index 397ac87ed4..0000000000 --- a/src/lib/crypto/builtin/des/Makefile.in +++ /dev/null -@@ -1,80 +0,0 @@ +@@ -1,82 +0,0 @@ -mydir=lib$(S)crypto$(S)builtin$(S)des -BUILDTOP=$(REL)..$(S)..$(S)..$(S).. --LOCALINCLUDES = -I$(srcdir)/.. -I$(srcdir)/../../krb +-LOCALINCLUDES=-I$(srcdir)/../../krb $(CRYPTO_IMPL_CFLAGS) - -##DOS##BUILDTOP = ..\..\..\.. -##DOS##PREFIXDIR = builtin\des @@ -526,7 +528,9 @@ index 54b329d0f..000000000 - -all-unix: all-libobjs - --check-unix: verify destest +-check-unix: check-unix-@CRYPTO_BUILTIN_TESTS@ +-check-unix-no: +-check-unix-yes: verify destest - $(RUN_TEST) ./verify -z - $(RUN_TEST) ./verify -m - $(RUN_TEST) ./verify @@ -548,10 +552,10 @@ index 54b329d0f..000000000 - diff --git a/src/lib/crypto/builtin/des/d3_aead.c b/src/lib/crypto/builtin/des/d3_aead.c deleted file mode 100644 -index bddf75a47..000000000 +index fb83f73b43..0000000000 --- a/src/lib/crypto/builtin/des/d3_aead.c +++ /dev/null -@@ -1,133 +0,0 @@ +@@ -1,137 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* - * Copyright (C) 2008 by the Massachusetts Institute of Technology. @@ -580,6 +584,8 @@ index bddf75a47..000000000 -#include "des_int.h" -#include "f_tables.h" - +-#ifdef K5_BUILTIN_DES +- -void -krb5int_des3_cbc_encrypt(krb5_crypto_iov *data, unsigned long num_data, - const mit_des_key_schedule ks1, @@ -685,12 +691,14 @@ index bddf75a47..000000000 - store_32_be(ocipherr, ivec + 4); - } -} +- +-#endif /* K5_BUILTIN_DES */ diff --git a/src/lib/crypto/builtin/des/d3_kysched.c b/src/lib/crypto/builtin/des/d3_kysched.c deleted file mode 100644 -index ebd1050b1..000000000 +index 55fb9449b5..0000000000 --- a/src/lib/crypto/builtin/des/d3_kysched.c +++ /dev/null -@@ -1,51 +0,0 @@ +@@ -1,55 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* - * Copyright 1995 by Richard P. Basch. All Rights Reserved. @@ -714,9 +722,11 @@ index ebd1050b1..000000000 - * express or implied warranty. - */ - --#include "k5-int.h" +-#include "crypto_int.h" -#include "des_int.h" - +-#ifdef K5_BUILTIN_DES +- -int -mit_des3_key_sched(mit_des3_cblock k, mit_des3_key_schedule schedule) -{ @@ -742,20 +752,20 @@ index ebd1050b1..000000000 - /* if key was good, return 0 */ - return 0; -} +- +-#endif /* K5_BUILTIN_DES */ diff --git a/src/lib/crypto/builtin/des/deps b/src/lib/crypto/builtin/des/deps deleted file mode 100644 -index a1db1f36e..000000000 +index 1c1239d696..0000000000 --- a/src/lib/crypto/builtin/des/deps +++ /dev/null -@@ -1,150 +0,0 @@ +@@ -1,146 +0,0 @@ -# -# Generated makefile dependencies follow. -# -d3_aead.so d3_aead.po $(OUTPRE)d3_aead.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ - $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ - $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \ -- $(srcdir)/../aes/aes.h $(srcdir)/../aes/brg_types.h \ -- $(srcdir)/../crypto_mod.h $(srcdir)/../sha2/sha2.h \ - $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ @@ -767,20 +777,18 @@ index a1db1f36e..000000000 -d3_kysched.so d3_kysched.po $(OUTPRE)d3_kysched.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ -- $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ -- $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ -- $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ -- $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ -- $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \ -- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \ -- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ -- d3_kysched.c des_int.h +- $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \ +- $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ +- $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ +- $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ +- $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \ +- $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ +- $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \ +- $(top_srcdir)/include/socket-utils.h d3_kysched.c des_int.h -des_keys.so des_keys.po $(OUTPRE)des_keys.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ -- $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../aes/aes.h \ -- $(srcdir)/../aes/brg_types.h $(srcdir)/../crypto_mod.h \ -- $(srcdir)/../sha2/sha2.h $(top_srcdir)/include/k5-buf.h \ +- $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \ - $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ - $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ - $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ @@ -791,8 +799,6 @@ index a1db1f36e..000000000 -f_aead.so f_aead.po $(OUTPRE)f_aead.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ - $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ - $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \ -- $(srcdir)/../aes/aes.h $(srcdir)/../aes/brg_types.h \ -- $(srcdir)/../crypto_mod.h $(srcdir)/../sha2/sha2.h \ - $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ @@ -803,69 +809,71 @@ index a1db1f36e..000000000 - des_int.h f_aead.c f_tables.h -f_cksum.so f_cksum.po $(OUTPRE)f_cksum.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ - $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ -- $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \ -- $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ -- $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ -- $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ -- $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \ -- $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ -- $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \ -- $(top_srcdir)/include/socket-utils.h des_int.h f_cksum.c \ -- f_tables.h +- $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \ +- $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ +- $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ +- $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ +- $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ +- $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \ +- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \ +- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ +- des_int.h f_cksum.c f_tables.h -f_parity.so f_parity.po $(OUTPRE)f_parity.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ -- $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ -- $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ -- $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ -- $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ -- $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \ -- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \ -- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ -- des_int.h f_parity.c --f_sched.so f_sched.po $(OUTPRE)f_sched.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ -- $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ -- $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \ +- $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \ - $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ - $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ - $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ - $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \ -- $(top_srcdir)/include/socket-utils.h des_int.h f_sched.c +- $(top_srcdir)/include/socket-utils.h des_int.h f_parity.c +-f_sched.so f_sched.po $(OUTPRE)f_sched.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ +- $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ +- $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \ +- $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ +- $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ +- $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ +- $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ +- $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \ +- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \ +- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ +- des_int.h f_sched.c -f_tables.so f_tables.po $(OUTPRE)f_tables.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ -- $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ -- $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ -- $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ -- $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ -- $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \ -- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \ -- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ -- des_int.h f_tables.c f_tables.h +- $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \ +- $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ +- $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ +- $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ +- $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \ +- $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ +- $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \ +- $(top_srcdir)/include/socket-utils.h des_int.h f_tables.c \ +- f_tables.h -key_sched.so key_sched.po $(OUTPRE)key_sched.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ -- $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ -- $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ -- $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ -- $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ -- $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \ -- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \ -- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ -- des_int.h key_sched.c +- $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \ +- $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ +- $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ +- $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ +- $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \ +- $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ +- $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \ +- $(top_srcdir)/include/socket-utils.h des_int.h key_sched.c -weak_key.so weak_key.po $(OUTPRE)weak_key.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ -- $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ -- $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ -- $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ -- $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ -- $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \ -- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \ -- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ -- des_int.h weak_key.c +- $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \ +- $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ +- $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ +- $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ +- $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \ +- $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ +- $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \ +- $(top_srcdir)/include/socket-utils.h des_int.h weak_key.c -destest.so destest.po $(OUTPRE)destest.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ - $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ - $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \ @@ -900,7 +908,7 @@ index a1db1f36e..000000000 - des_int.h t_verify.c diff --git a/src/lib/crypto/builtin/des/des_int.h b/src/lib/crypto/builtin/des/des_int.h deleted file mode 100644 -index f8dc6b296..000000000 +index f8dc6b296a..0000000000 --- a/src/lib/crypto/builtin/des/des_int.h +++ /dev/null @@ -1,285 +0,0 @@ @@ -1191,10 +1199,10 @@ index f8dc6b296..000000000 -#endif /*DES_INTERNAL_DEFS*/ diff --git a/src/lib/crypto/builtin/des/des_keys.c b/src/lib/crypto/builtin/des/des_keys.c deleted file mode 100644 -index 32b119aad..000000000 +index 027b09d728..0000000000 --- a/src/lib/crypto/builtin/des/des_keys.c +++ /dev/null -@@ -1,40 +0,0 @@ +@@ -1,38 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* lib/crypto/builtin/des/des_keys.c - Key functions used by Kerberos code */ -/* @@ -1224,20 +1232,18 @@ index 32b119aad..000000000 -#include "crypto_int.h" -#include "des_int.h" - +-#ifdef K5_BUILTIN_DES_KEY_PARITY +- -void -k5_des_fixup_key_parity(unsigned char *keybits) -{ - mit_des_fixup_key_parity(keybits); -} - --krb5_boolean --k5_des_is_weak_key(unsigned char *keybits) --{ -- return mit_des_is_weak_key(keybits); --} +-#endif /* K5_BUILTIN_DES_KEY_PARITY */ diff --git a/src/lib/crypto/builtin/des/destest.c b/src/lib/crypto/builtin/des/destest.c deleted file mode 100644 -index 52114304e..000000000 +index 52114304e3..0000000000 --- a/src/lib/crypto/builtin/des/destest.c +++ /dev/null @@ -1,240 +0,0 @@ @@ -1483,7 +1489,7 @@ index 52114304e..000000000 -} diff --git a/src/lib/crypto/builtin/des/doc/libdes.doc b/src/lib/crypto/builtin/des/doc/libdes.doc deleted file mode 100644 -index 6e9431ed2..000000000 +index 6e9431ed2e..0000000000 --- a/src/lib/crypto/builtin/des/doc/libdes.doc +++ /dev/null @@ -1,208 +0,0 @@ @@ -1697,10 +1703,10 @@ index 6e9431ed2..000000000 -string length desired. diff --git a/src/lib/crypto/builtin/des/f_aead.c b/src/lib/crypto/builtin/des/f_aead.c deleted file mode 100644 -index 71b8dff4d..000000000 +index f887735820..0000000000 --- a/src/lib/crypto/builtin/des/f_aead.c +++ /dev/null -@@ -1,173 +0,0 @@ +@@ -1,177 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* - * Copyright (C) 2008 by the Massachusetts Institute of Technology. @@ -1729,6 +1735,8 @@ index 71b8dff4d..000000000 -#include "des_int.h" -#include "f_tables.h" - +-#ifdef K5_BUILTIN_DES +- -const mit_des_cblock mit_des_zeroblock /* = all zero */; - -void @@ -1874,9 +1882,11 @@ index 71b8dff4d..000000000 - DES_DO_DECRYPT_1 (*left, *right, kp); -} -#endif +- +-#endif /* K5_BUILTIN_DES */ diff --git a/src/lib/crypto/builtin/des/f_cbc.c b/src/lib/crypto/builtin/des/f_cbc.c deleted file mode 100644 -index 84d5382f2..000000000 +index 84d5382f22..0000000000 --- a/src/lib/crypto/builtin/des/f_cbc.c +++ /dev/null @@ -1,256 +0,0 @@ @@ -2138,10 +2148,10 @@ index 84d5382f2..000000000 -} diff --git a/src/lib/crypto/builtin/des/f_cksum.c b/src/lib/crypto/builtin/des/f_cksum.c deleted file mode 100644 -index cb482b009..000000000 +index 615a947f4a..0000000000 --- a/src/lib/crypto/builtin/des/f_cksum.c +++ /dev/null -@@ -1,136 +0,0 @@ +@@ -1,141 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* lib/crypto/builtin/des/f_cksum.c */ -/* @@ -2173,9 +2183,12 @@ index cb482b009..000000000 -/* - * des_cbc_cksum.c - compute an 8 byte checksum using DES in CBC mode - */ +-#include "crypto_int.h" -#include "des_int.h" -#include "f_tables.h" - +-#ifdef K5_BUILTIN_DES +- -/* - * This routine performs DES cipher-block-chaining checksum operation, - * a.k.a. Message Authentication Code. It ALWAYS encrypts from input @@ -2278,12 +2291,14 @@ index cb482b009..000000000 - */ - return right & 0xFFFFFFFFUL; -} +- +-#endif /* K5_BUILTIN_DES */ diff --git a/src/lib/crypto/builtin/des/f_parity.c b/src/lib/crypto/builtin/des/f_parity.c deleted file mode 100644 -index 460b5061b..000000000 +index a658878f6f..0000000000 --- a/src/lib/crypto/builtin/des/f_parity.c +++ /dev/null -@@ -1,56 +0,0 @@ +@@ -1,64 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* - * These routines check and fix parity of encryption keys for the DES @@ -2295,9 +2310,11 @@ index 460b5061b..000000000 - * Mark Eichin -- Cygnus Support - */ - -- +-#include "crypto_int.h" -#include "des_int.h" - +-#ifdef K5_BUILTIN_DES_KEY_PARITY +- -/* - * des_fixup_key_parity: Forces odd parity per byte; parity is bits - * 8,16,...64 in des order, implies 0, 8, 16, ... @@ -2320,6 +2337,10 @@ index 460b5061b..000000000 - return; -} - +-#endif /* K5_BUILTIN_DES_KEY_PARITY */ +- +-#ifdef K5_BUILTIN_DES +- -/* - * des_check_key_parity: returns true iff key has the correct des parity. - * See des_fix_key_parity for the definition of @@ -2340,12 +2361,14 @@ index 460b5061b..000000000 - - return(1); -} +- +-#endif /* K5_BUILTIN_DES */ diff --git a/src/lib/crypto/builtin/des/f_sched.c b/src/lib/crypto/builtin/des/f_sched.c deleted file mode 100644 -index 666a510fb..000000000 +index bbc88a1c8d..0000000000 --- a/src/lib/crypto/builtin/des/f_sched.c +++ /dev/null -@@ -1,359 +0,0 @@ +@@ -1,363 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* lib/crypto/builtin/des/f_sched.c */ -/* @@ -2377,9 +2400,11 @@ index 666a510fb..000000000 -/* - * des_make_sched.c - permute a DES key, returning the resulting key schedule - */ --#include "k5-int.h" +-#include "crypto_int.h" -#include "des_int.h" - +-#ifdef K5_BUILTIN_DES +- -/* - * Permuted choice 1 tables. These are used to extract bits - * from the left and right parts of the key to form Ci and Di. @@ -2705,12 +2730,14 @@ index 666a510fb..000000000 - } - return (0); -} +- +-#endif /* K5_BUILTIN_DES */ diff --git a/src/lib/crypto/builtin/des/f_tables.c b/src/lib/crypto/builtin/des/f_tables.c deleted file mode 100644 -index 6308cb0d5..000000000 +index e50ab1fc60..0000000000 --- a/src/lib/crypto/builtin/des/f_tables.c +++ /dev/null -@@ -1,370 +0,0 @@ +@@ -1,375 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* lib/crypto/builtin/des/f_tables.c */ -/* @@ -2747,9 +2774,12 @@ index 6308cb0d5..000000000 - * Include the header file so something will complain if the - * declarations get out of sync - */ +-#include "crypto_int.h" -#include "des_int.h" -#include "f_tables.h" - +-#ifdef K5_BUILTIN_DES +- -/* - * These tables may be declared const if you want. Many compilers - * don't support this, though. @@ -3081,9 +3111,11 @@ index 6308cb0d5..000000000 - 0x40000000, 0x40080010, 0x40084010, 0x00084000 - }, -}; +- +-#endif /* K5_BUILTIN_DES */ diff --git a/src/lib/crypto/builtin/des/f_tables.h b/src/lib/crypto/builtin/des/f_tables.h deleted file mode 100644 -index fc91b566c..000000000 +index fc91b566cf..0000000000 --- a/src/lib/crypto/builtin/des/f_tables.h +++ /dev/null @@ -1,285 +0,0 @@ @@ -3374,10 +3406,10 @@ index fc91b566c..000000000 -#endif /* __DES_TABLES_H__ */ diff --git a/src/lib/crypto/builtin/des/key_sched.c b/src/lib/crypto/builtin/des/key_sched.c deleted file mode 100644 -index 87f02b6a9..000000000 +index d6dedd93c6..0000000000 --- a/src/lib/crypto/builtin/des/key_sched.c +++ /dev/null -@@ -1,62 +0,0 @@ +@@ -1,66 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* lib/crypto/builtin/des/key_sched.c */ -/* @@ -3423,9 +3455,11 @@ index 87f02b6a9..000000000 - * Originally written 6/85 by Steve Miller, MIT Project Athena. - */ - --#include "k5-int.h" +-#include "crypto_int.h" -#include "des_int.h" - +-#ifdef K5_BUILTIN_DES +- -int -mit_des_key_sched(mit_des_cblock k, mit_des_key_schedule schedule) -{ @@ -3440,9 +3474,11 @@ index 87f02b6a9..000000000 - /* if key was good, return 0 */ - return 0; -} +- +-#endif /* K5_BUILTIN_DES */ diff --git a/src/lib/crypto/builtin/des/keytest.data b/src/lib/crypto/builtin/des/keytest.data deleted file mode 100644 -index 7ff34eedc..000000000 +index 7ff34eedcf..0000000000 --- a/src/lib/crypto/builtin/des/keytest.data +++ /dev/null @@ -1,171 +0,0 @@ @@ -3619,7 +3655,7 @@ index 7ff34eedc..000000000 -1C587F1C13924FEF 305532286D6F295A 63FAC0D034D9F793 diff --git a/src/lib/crypto/builtin/des/t_verify.c b/src/lib/crypto/builtin/des/t_verify.c deleted file mode 100644 -index 4a19933ca..000000000 +index 4a19933cad..0000000000 --- a/src/lib/crypto/builtin/des/t_verify.c +++ /dev/null @@ -1,395 +0,0 @@ @@ -4020,10 +4056,10 @@ index 4a19933ca..000000000 -} diff --git a/src/lib/crypto/builtin/des/weak_key.c b/src/lib/crypto/builtin/des/weak_key.c deleted file mode 100644 -index eb41b267d..000000000 +index f8304a3638..0000000000 --- a/src/lib/crypto/builtin/des/weak_key.c +++ /dev/null -@@ -1,86 +0,0 @@ +@@ -1,90 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* lib/crypto/builtin/des/weak_key.c */ -/* @@ -4059,9 +4095,11 @@ index eb41b267d..000000000 - * Originally written 8/85 by Steve Miller, MIT Project Athena. - */ - --#include "k5-int.h" +-#include "crypto_int.h" -#include "des_int.h" - +-#ifdef K5_BUILTIN_DES +- -/* - * The following are the weak DES keys: - */ @@ -4110,20 +4148,21 @@ index eb41b267d..000000000 - - return 0; -} +- +-#endif /* K5_BUILTIN_DES */ diff --git a/src/lib/crypto/builtin/enc_provider/Makefile.in b/src/lib/crypto/builtin/enc_provider/Makefile.in -index 3459e1d0e..af6276b96 100644 +index 6ad7cbd4e0..655966b255 100644 --- a/src/lib/crypto/builtin/enc_provider/Makefile.in +++ b/src/lib/crypto/builtin/enc_provider/Makefile.in -@@ -1,7 +1,6 @@ +@@ -1,6 +1,6 @@ mydir=lib$(S)crypto$(S)builtin$(S)enc_provider BUILDTOP=$(REL)..$(S)..$(S)..$(S).. --LOCALINCLUDES = -I$(srcdir)/../des \ -- -I$(srcdir)/../aes \ -+LOCALINCLUDES = -I$(srcdir)/../aes \ - -I$(srcdir)/../camellia \ - -I$(srcdir)/../../krb \ - -I$(srcdir)/.. -@@ -11,19 +10,16 @@ LOCALINCLUDES = -I$(srcdir)/../des \ +-LOCALINCLUDES = -I$(srcdir)/../des -I$(srcdir)/../aes -I$(srcdir)/../camellia \ ++LOCALINCLUDES = -I$(srcdir)/../aes -I$(srcdir)/../camellia \ + -I$(srcdir)/../../krb $(CRYPTO_IMPL_CFLAGS) + + ##DOS##BUILDTOP = ..\..\..\.. +@@ -8,19 +8,16 @@ LOCALINCLUDES = -I$(srcdir)/../des -I$(srcdir)/../aes -I$(srcdir)/../camellia \ ##DOS##OBJFILE = ..\..\$(OUTPRE)enc_provider.lst STLIBOBJS= \ @@ -4144,19 +4183,17 @@ index 3459e1d0e..af6276b96 100644 $(srcdir)/camellia.c \ $(srcdir)/rc4.c diff --git a/src/lib/crypto/builtin/enc_provider/deps b/src/lib/crypto/builtin/enc_provider/deps -index ea4ffecd8..061289a91 100644 +index a3414a38ec..dc29d9fce8 100644 --- a/src/lib/crypto/builtin/enc_provider/deps +++ b/src/lib/crypto/builtin/enc_provider/deps -@@ -1,19 +1,6 @@ +@@ -1,17 +1,6 @@ # # Generated makefile dependencies follow. # -des3.so des3.po $(OUTPRE)des3.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ - $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ - $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \ -- $(srcdir)/../aes/aes.h $(srcdir)/../aes/brg_types.h \ -- $(srcdir)/../crypto_mod.h $(srcdir)/../des/des_int.h \ -- $(srcdir)/../sha2/sha2.h $(top_srcdir)/include/k5-buf.h \ +- $(srcdir)/../des/des_int.h $(top_srcdir)/include/k5-buf.h \ - $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ - $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ - $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ @@ -4169,10 +4206,10 @@ index ea4ffecd8..061289a91 100644 $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \ diff --git a/src/lib/crypto/builtin/enc_provider/des3.c b/src/lib/crypto/builtin/enc_provider/des3.c deleted file mode 100644 -index 9b8244223..000000000 +index c2634d5e10..0000000000 --- a/src/lib/crypto/builtin/enc_provider/des3.c +++ /dev/null -@@ -1,105 +0,0 @@ +@@ -1,109 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* - * Copyright (C) 1998 by the FundsXpress, INC. @@ -4203,6 +4240,8 @@ index 9b8244223..000000000 -#include "crypto_int.h" -#include "des_int.h" - +-#ifdef K5_BUILTIN_DES +- -static krb5_error_code -validate_and_schedule(krb5_key key, const krb5_data *ivec, - const krb5_crypto_iov *data, size_t num_data, @@ -4278,8 +4317,10 @@ index 9b8244223..000000000 - krb5int_des_init_state, - krb5int_default_free_state -}; +- +-#endif /* K5_BUILTIN_DES */ diff --git a/src/lib/crypto/crypto_tests/t_cf2.expected b/src/lib/crypto/crypto_tests/t_cf2.expected -index f8251a16c..bc6aa50c8 100644 +index f8251a16cb..bc6aa50c84 100644 --- a/src/lib/crypto/crypto_tests/t_cf2.expected +++ b/src/lib/crypto/crypto_tests/t_cf2.expected @@ -1,6 +1,5 @@ @@ -4290,7 +4331,7 @@ index f8251a16c..bc6aa50c8 100644 edd02a39d2dbde31611c16e610be062c 67f6ea530aea85a37dcbb23349ea52dcc61ca8493ff557252327fd8304341584 diff --git a/src/lib/crypto/crypto_tests/t_cf2.in b/src/lib/crypto/crypto_tests/t_cf2.in -index 73e2f8fbc..c4d23b506 100644 +index 73e2f8fbc9..c4d23b506b 100644 --- a/src/lib/crypto/crypto_tests/t_cf2.in +++ b/src/lib/crypto/crypto_tests/t_cf2.in @@ -8,11 +8,6 @@ key1 @@ -4306,7 +4347,7 @@ index 73e2f8fbc..c4d23b506 100644 key1 key2 diff --git a/src/lib/crypto/crypto_tests/t_cksums.c b/src/lib/crypto/crypto_tests/t_cksums.c -index 8297fcbf5..3063d12ec 100644 +index 557340ec5e..9f9a177ef0 100644 --- a/src/lib/crypto/crypto_tests/t_cksums.c +++ b/src/lib/crypto/crypto_tests/t_cksums.c @@ -59,16 +59,6 @@ struct test { @@ -4327,7 +4368,7 @@ index 8297fcbf5..3063d12ec 100644 { KV5M_DATA, 37, "eight nine ten eleven twelve thirteen" }, CKSUMTYPE_HMAC_SHA1_96_AES128, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 3, diff --git a/src/lib/crypto/crypto_tests/t_decrypt.c b/src/lib/crypto/crypto_tests/t_decrypt.c -index a40a85500..716f2c337 100644 +index a40a855007..716f2c337a 100644 --- a/src/lib/crypto/crypto_tests/t_decrypt.c +++ b/src/lib/crypto/crypto_tests/t_decrypt.c @@ -39,62 +39,6 @@ struct test { @@ -4402,7 +4443,7 @@ index a40a85500..716f2c337 100644 ENCTYPE_ARCFOUR_HMAC_EXP, ENCTYPE_AES128_CTS_HMAC_SHA1_96, diff --git a/src/lib/crypto/crypto_tests/t_derive.c b/src/lib/crypto/crypto_tests/t_derive.c -index afbf7477f..93ce30da2 100644 +index afbf7477f6..93ce30da20 100644 --- a/src/lib/crypto/crypto_tests/t_derive.c +++ b/src/lib/crypto/crypto_tests/t_derive.c @@ -38,41 +38,6 @@ struct test { @@ -4456,7 +4497,7 @@ index afbf7477f..93ce30da2 100644 case ENCTYPE_AES256_CTS_HMAC_SHA1_96: return &krb5int_enc_aes256; case ENCTYPE_CAMELLIA128_CTS_CMAC: return &krb5int_enc_camellia128; diff --git a/src/lib/crypto/crypto_tests/t_encrypt.c b/src/lib/crypto/crypto_tests/t_encrypt.c -index bd9b94691..290a72e1e 100644 +index bd9b94691c..290a72e1e0 100644 --- a/src/lib/crypto/crypto_tests/t_encrypt.c +++ b/src/lib/crypto/crypto_tests/t_encrypt.c @@ -37,7 +37,6 @@ @@ -4468,7 +4509,7 @@ index bd9b94691..290a72e1e 100644 ENCTYPE_ARCFOUR_HMAC_EXP, ENCTYPE_AES256_CTS_HMAC_SHA1_96, diff --git a/src/lib/crypto/crypto_tests/t_short.c b/src/lib/crypto/crypto_tests/t_short.c -index d4c2b97df..4466b7115 100644 +index d4c2b97dfd..4466b71158 100644 --- a/src/lib/crypto/crypto_tests/t_short.c +++ b/src/lib/crypto/crypto_tests/t_short.c @@ -34,7 +34,6 @@ @@ -4480,7 +4521,7 @@ index d4c2b97df..4466b7115 100644 ENCTYPE_ARCFOUR_HMAC_EXP, ENCTYPE_AES256_CTS_HMAC_SHA1_96, diff --git a/src/lib/crypto/crypto_tests/t_str2key.c b/src/lib/crypto/crypto_tests/t_str2key.c -index cdb1acc6d..ef4c4a7d3 100644 +index cdb1acc6d0..ef4c4a7d3b 100644 --- a/src/lib/crypto/crypto_tests/t_str2key.c +++ b/src/lib/crypto/crypto_tests/t_str2key.c @@ -35,58 +35,6 @@ struct test { @@ -4542,11 +4583,33 @@ index cdb1acc6d..ef4c4a7d3 100644 /* Test vectors from RFC 3962 appendix B. */ { ENCTYPE_AES128_CTS_HMAC_SHA1_96, +diff --git a/src/lib/crypto/crypto_tests/vectors.c b/src/lib/crypto/crypto_tests/vectors.c +index bcf5c9106f..eb107dbcd2 100644 +--- a/src/lib/crypto/crypto_tests/vectors.c ++++ b/src/lib/crypto/crypto_tests/vectors.c +@@ -190,8 +190,6 @@ test_s2k (krb5_enctype enctype) + } + } + +-static void test_des3_s2k () { test_s2k (ENCTYPE_DES3_CBC_SHA1); } +- + static void + keyToData (krb5_keyblock *k, krb5_data *d) + { +@@ -208,8 +206,6 @@ void check_error (int r, int line) { + } + #define CHECK check_error(r, __LINE__) + +-extern struct krb5_enc_provider krb5int_enc_des3; +-struct krb5_enc_provider *enc = &krb5int_enc_des3; + extern struct krb5_enc_provider krb5int_enc_aes128, krb5int_enc_aes256; + + void DK (krb5_keyblock *out, krb5_keyblock *in, const krb5_data *usage) { diff --git a/src/lib/crypto/krb/Makefile.in b/src/lib/crypto/krb/Makefile.in -index b74e6f7cc..2b0c4163d 100644 +index cb2e40a3a5..f66698bd53 100644 --- a/src/lib/crypto/krb/Makefile.in +++ b/src/lib/crypto/krb/Makefile.in -@@ -50,7 +50,6 @@ STLIBOBJS=\ +@@ -47,7 +47,6 @@ STLIBOBJS=\ prf.o \ prf_aes2.o \ prf_cmac.o \ @@ -4554,7 +4617,7 @@ index b74e6f7cc..2b0c4163d 100644 prf_dk.o \ prf_rc4.o \ prng.o \ -@@ -109,7 +108,6 @@ OBJS=\ +@@ -103,7 +102,6 @@ OBJS=\ $(OUTPRE)prf.$(OBJEXT) \ $(OUTPRE)prf_aes2.$(OBJEXT) \ $(OUTPRE)prf_cmac.$(OBJEXT) \ @@ -4562,7 +4625,7 @@ index b74e6f7cc..2b0c4163d 100644 $(OUTPRE)prf_dk.$(OBJEXT) \ $(OUTPRE)prf_rc4.$(OBJEXT) \ $(OUTPRE)prng.$(OBJEXT) \ -@@ -168,7 +166,6 @@ SRCS=\ +@@ -159,7 +157,6 @@ SRCS=\ $(srcdir)/prf.c \ $(srcdir)/prf_aes2.c \ $(srcdir)/prf_cmac.c \ @@ -4571,10 +4634,10 @@ index b74e6f7cc..2b0c4163d 100644 $(srcdir)/prf_rc4.c \ $(srcdir)/prng.c \ diff --git a/src/lib/crypto/krb/cksumtypes.c b/src/lib/crypto/krb/cksumtypes.c -index ecc2e08c9..f5fbe8a2a 100644 +index f7ba322f24..25a3ffd2d2 100644 --- a/src/lib/crypto/krb/cksumtypes.c +++ b/src/lib/crypto/krb/cksumtypes.c -@@ -46,12 +46,6 @@ const struct krb5_cksumtypes krb5int_cksumtypes_list[] = { +@@ -52,12 +52,6 @@ const struct krb5_cksumtypes krb5int_cksumtypes_list[] = { krb5int_unkeyed_checksum, NULL, 20, 20, CKSUM_UNKEYED }, @@ -4588,21 +4651,19 @@ index ecc2e08c9..f5fbe8a2a 100644 "hmac-md5-rc4", { "hmac-md5-enc", "hmac-md5-earcfour" }, "Microsoft HMAC MD5", diff --git a/src/lib/crypto/krb/crypto_int.h b/src/lib/crypto/krb/crypto_int.h -index 19f808749..4bc430c7a 100644 +index 3629616d96..1ee4b30e02 100644 --- a/src/lib/crypto/krb/crypto_int.h +++ b/src/lib/crypto/krb/crypto_int.h -@@ -276,10 +276,6 @@ krb5_error_code krb5int_aes2_string_to_key(const struct krb5_keytypes *enc, +@@ -332,8 +332,6 @@ krb5_error_code krb5int_aes2_string_to_key(const struct krb5_keytypes *enc, /* Random to key */ krb5_error_code k5_rand2key_direct(const krb5_data *randombits, krb5_keyblock *keyblock); --krb5_error_code k5_rand2key_des(const krb5_data *randombits, -- krb5_keyblock *keyblock); -krb5_error_code k5_rand2key_des3(const krb5_data *randombits, - krb5_keyblock *keyblock); /* Pseudo-random function */ krb5_error_code krb5int_des_prf(const struct krb5_keytypes *ktp, -@@ -368,11 +364,6 @@ krb5_keyusage krb5int_arcfour_translate_usage(krb5_keyusage usage); +@@ -411,11 +409,6 @@ krb5_keyusage krb5int_arcfour_translate_usage(krb5_keyusage usage); /* Ensure library initialization has occurred. */ int krb5int_crypto_init(void); @@ -4614,7 +4675,7 @@ index 19f808749..4bc430c7a 100644 /* Default state cleanup handler (used by module enc providers). */ void krb5int_default_free_state(krb5_data *state); -@@ -425,7 +416,6 @@ void k5_iov_cursor_put(struct iov_cursor *cursor, unsigned char *block); +@@ -468,7 +461,6 @@ void k5_iov_cursor_put(struct iov_cursor *cursor, unsigned char *block); /* Modules must implement the k5_sha256() function prototyped in k5-int.h. */ /* Modules must implement the following enc_providers and hash_providers: */ @@ -4622,21 +4683,18 @@ index 19f808749..4bc430c7a 100644 extern const struct krb5_enc_provider krb5int_enc_arcfour; extern const struct krb5_enc_provider krb5int_enc_aes128; extern const struct krb5_enc_provider krb5int_enc_aes256; -@@ -442,12 +432,6 @@ extern const struct krb5_hash_provider krb5int_hash_sha384; +@@ -485,9 +477,6 @@ extern const struct krb5_hash_provider krb5int_hash_sha384; /* Modules must implement the following functions. */ -/* Set the parity bits to the correct values in keybits. */ -void k5_des_fixup_key_parity(unsigned char *keybits); -- --/* Return true if keybits is a weak or semi-weak DES key. */ --krb5_boolean k5_des_is_weak_key(unsigned char *keybits); - /* Compute an HMAC using the provided hash function, key, and data, storing the * result into output (caller-allocated). */ krb5_error_code krb5int_hmac(const struct krb5_hash_provider *hash, diff --git a/src/lib/crypto/krb/default_state.c b/src/lib/crypto/krb/default_state.c -index 0757c8b02..f89dc7902 100644 +index 0757c8b02c..f89dc79023 100644 --- a/src/lib/crypto/krb/default_state.c +++ b/src/lib/crypto/krb/default_state.c @@ -32,16 +32,6 @@ @@ -4657,7 +4715,7 @@ index 0757c8b02..f89dc7902 100644 krb5int_default_free_state(krb5_data *state) { diff --git a/src/lib/crypto/krb/enctype_util.c b/src/lib/crypto/krb/enctype_util.c -index 1542d4062..a0037912a 100644 +index 1542d40629..a0037912a7 100644 --- a/src/lib/crypto/krb/enctype_util.c +++ b/src/lib/crypto/krb/enctype_util.c @@ -45,6 +45,9 @@ struct { @@ -4671,7 +4729,7 @@ index 1542d4062..a0037912a 100644 }; diff --git a/src/lib/crypto/krb/etypes.c b/src/lib/crypto/krb/etypes.c -index fc278783b..7635393a4 100644 +index fc278783b9..7635393a41 100644 --- a/src/lib/crypto/krb/etypes.c +++ b/src/lib/crypto/krb/etypes.c @@ -35,27 +35,6 @@ @@ -4704,7 +4762,7 @@ index fc278783b..7635393a4 100644 { ENCTYPE_ARCFOUR_HMAC, diff --git a/src/lib/crypto/krb/prf_des.c b/src/lib/crypto/krb/prf_des.c deleted file mode 100644 -index 7a2d719c5..000000000 +index 7a2d719c5f..0000000000 --- a/src/lib/crypto/krb/prf_des.c +++ /dev/null @@ -1,47 +0,0 @@ @@ -4756,10 +4814,10 @@ index 7a2d719c5..000000000 - return ktp->enc->encrypt(key, NULL, &iov, 1); -} diff --git a/src/lib/crypto/krb/random_to_key.c b/src/lib/crypto/krb/random_to_key.c -index 157462526..863090beb 100644 +index 9394385aa0..863090beb2 100644 --- a/src/lib/crypto/krb/random_to_key.c +++ b/src/lib/crypto/krb/random_to_key.c -@@ -71,48 +71,3 @@ k5_rand2key_direct(const krb5_data *randombits, krb5_keyblock *keyblock) +@@ -71,31 +71,3 @@ k5_rand2key_direct(const krb5_data *randombits, krb5_keyblock *keyblock) memcpy(keyblock->contents, randombits->data, randombits->length); return 0; } @@ -4773,23 +4831,6 @@ index 157462526..863090beb 100644 -} - -krb5_error_code --k5_rand2key_des(const krb5_data *randombits, krb5_keyblock *keyblock) --{ -- if (randombits->length != 7) -- return(KRB5_CRYPTO_INTERNAL); -- -- keyblock->magic = KV5M_KEYBLOCK; -- -- /* Take the seven bytes, move them around into the top 7 bits of the -- * 8 key bytes, then compute the parity bits. */ -- memcpy(keyblock->contents, randombits->data, randombits->length); -- eighth_byte(keyblock->contents); -- k5_des_fixup_key_parity(keyblock->contents); -- -- return 0; --} -- --krb5_error_code -k5_rand2key_des3(const krb5_data *randombits, krb5_keyblock *keyblock) -{ - int i; @@ -4809,7 +4850,7 @@ index 157462526..863090beb 100644 - return 0; -} diff --git a/src/lib/crypto/libk5crypto.exports b/src/lib/crypto/libk5crypto.exports -index d6cc1b423..f44cb9170 100644 +index 052f4d4b51..d8ffa63304 100644 --- a/src/lib/crypto/libk5crypto.exports +++ b/src/lib/crypto/libk5crypto.exports @@ -86,7 +86,6 @@ krb5_k_verify_checksum @@ -4818,23 +4859,23 @@ index d6cc1b423..f44cb9170 100644 krb5int_aes_decrypt -krb5int_enc_des3 krb5int_arcfour_gsscrypt - krb5int_camellia_cbc_mac + krb5int_camellia_encrypt krb5int_cmac_checksum diff --git a/src/lib/crypto/openssl/Makefile.in b/src/lib/crypto/openssl/Makefile.in -index aa434b168..234fc0e76 100644 +index 08de047d0a..88f7fd0a09 100644 --- a/src/lib/crypto/openssl/Makefile.in +++ b/src/lib/crypto/openssl/Makefile.in @@ -1,6 +1,6 @@ mydir=lib$(S)crypto$(S)openssl BUILDTOP=$(REL)..$(S)..$(S).. --SUBDIRS=camellia des aes md4 md5 sha1 sha2 enc_provider hash_provider -+SUBDIRS=camellia aes md4 md5 sha1 sha2 enc_provider hash_provider - LOCALINCLUDES = -I$(srcdir)/../krb -I$(srcdir) +-SUBDIRS=des enc_provider hash_provider ++SUBDIRS=enc_provider hash_provider + LOCALINCLUDES=-I$(srcdir)/../krb $(CRYPTO_IMPL_CFLAGS) STLIBOBJS=\ @@ -24,14 +24,14 @@ SRCS=\ - $(srcdir)/sha256.c \ - $(srcdir)/stubs.c + $(srcdir)/pbkdf2.c \ + $(srcdir)/sha256.c -STOBJLISTS= des/OBJS.ST md4/OBJS.ST \ +STOBJLISTS= md4/OBJS.ST \ @@ -4860,13 +4901,13 @@ index aa434b168..234fc0e76 100644 @libobj_frag@ diff --git a/src/lib/crypto/openssl/des/Makefile.in b/src/lib/crypto/openssl/des/Makefile.in deleted file mode 100644 -index 4392fb8ea..000000000 +index a6cece1dd1..0000000000 --- a/src/lib/crypto/openssl/des/Makefile.in +++ /dev/null @@ -1,20 +0,0 @@ -mydir=lib$(S)crypto$(S)openssl$(S)des -BUILDTOP=$(REL)..$(S)..$(S)..$(S).. --LOCALINCLUDES = -I$(srcdir)/../../krb -I$(srcdir)/.. +-LOCALINCLUDES = -I$(srcdir)/../../krb $(CRYPTO_IMPL_CFLAGS) - -STLIBOBJS= des_keys.o - @@ -4886,31 +4927,30 @@ index 4392fb8ea..000000000 - diff --git a/src/lib/crypto/openssl/des/deps b/src/lib/crypto/openssl/des/deps deleted file mode 100644 -index 21b904f89..000000000 +index 723c268082..0000000000 --- a/src/lib/crypto/openssl/des/deps +++ /dev/null -@@ -1,15 +0,0 @@ +@@ -1,14 +0,0 @@ -# -# Generated makefile dependencies follow. -# -des_keys.so des_keys.po $(OUTPRE)des_keys.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ -- $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../crypto_mod.h \ -- $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ -- $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ -- $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ -- $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ -- $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \ -- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \ -- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ -- des_keys.c +- $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \ +- $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ +- $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ +- $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ +- $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \ +- $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ +- $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \ +- $(top_srcdir)/include/socket-utils.h des_keys.c diff --git a/src/lib/crypto/openssl/des/des_keys.c b/src/lib/crypto/openssl/des/des_keys.c deleted file mode 100644 -index 51d9db216..000000000 +index 83f1cbf22a..0000000000 --- a/src/lib/crypto/openssl/des/des_keys.c +++ /dev/null -@@ -1,40 +0,0 @@ +@@ -1,39 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* lib/crypto/openssl/des/des_keys.c - Key functions used by Kerberos code */ -/* @@ -4938,6 +4978,9 @@ index 51d9db216..000000000 - */ - -#include "crypto_int.h" +- +-#ifdef K5_OPENSSL_DES_KEY_PARITY +- -#include - -void @@ -4946,17 +4989,13 @@ index 51d9db216..000000000 - DES_set_odd_parity((DES_cblock *)keybits); -} - --krb5_boolean --k5_des_is_weak_key(unsigned char *keybits) --{ -- return DES_is_weak_key((DES_cblock *)keybits); --} +-#endif diff --git a/src/lib/crypto/openssl/enc_provider/Makefile.in b/src/lib/crypto/openssl/enc_provider/Makefile.in -index a9069d22d..2b32c3ac4 100644 +index 26827cfed5..f0d37c1213 100644 --- a/src/lib/crypto/openssl/enc_provider/Makefile.in +++ b/src/lib/crypto/openssl/enc_provider/Makefile.in @@ -3,19 +3,16 @@ BUILDTOP=$(REL)..$(S)..$(S)..$(S).. - LOCALINCLUDES = -I$(srcdir)/../../krb -I$(srcdir)/.. + LOCALINCLUDES = -I$(srcdir)/../../krb $(CRYPTO_IMPL_CFLAGS) STLIBOBJS= \ - des3.o \ @@ -4976,7 +5015,7 @@ index a9069d22d..2b32c3ac4 100644 $(srcdir)/camellia.c \ $(srcdir)/rc4.c diff --git a/src/lib/crypto/openssl/enc_provider/deps b/src/lib/crypto/openssl/enc_provider/deps -index 1c28cc842..91ba48234 100644 +index 1c87a526d0..a502990a0c 100644 --- a/src/lib/crypto/openssl/enc_provider/deps +++ b/src/lib/crypto/openssl/enc_provider/deps @@ -1,17 +1,6 @@ @@ -4986,23 +5025,23 @@ index 1c28cc842..91ba48234 100644 -des3.so des3.po $(OUTPRE)des3.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ - $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ - $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \ -- $(srcdir)/../crypto_mod.h $(top_srcdir)/include/k5-buf.h \ -- $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ -- $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ -- $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ -- $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \ -- $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ -- $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \ -- $(top_srcdir)/include/socket-utils.h des3.c +- $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ +- $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ +- $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ +- $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ +- $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \ +- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \ +- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ +- des3.c aes.so aes.po $(OUTPRE)aes.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \ diff --git a/src/lib/crypto/openssl/enc_provider/des3.c b/src/lib/crypto/openssl/enc_provider/des3.c deleted file mode 100644 -index 1c439c2cd..000000000 +index 90fcf9acb5..0000000000 --- a/src/lib/crypto/openssl/enc_provider/des3.c +++ /dev/null -@@ -1,184 +0,0 @@ +@@ -1,188 +0,0 @@ -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -/* lib/crypto/openssl/enc_provider/des3.c */ -/* @@ -5055,8 +5094,10 @@ index 1c439c2cd..000000000 - */ - -#include "crypto_int.h" --#include - +-#ifdef K5_OPENSSL_DES +- +-#include - -#define DES3_BLOCK_SIZE 8 -#define DES3_KEY_SIZE 24 @@ -5187,11 +5228,26 @@ index 1c439c2cd..000000000 - krb5int_des_init_state, - krb5int_default_free_state -}; +- +-#endif /* K5_OPENSSL_DES */ +diff --git a/src/lib/crypto/openssl/kdf.c b/src/lib/crypto/openssl/kdf.c +index 41e845eae0..5a43c3d9eb 100644 +--- a/src/lib/crypto/openssl/kdf.c ++++ b/src/lib/crypto/openssl/kdf.c +@@ -60,8 +60,6 @@ enc_name(const struct krb5_enc_provider *enc) + return "AES-128-CBC"; + if (enc == &krb5int_enc_aes256) + return "AES-256-CBC"; +- if (enc == &krb5int_enc_des3) +- return "DES-EDE3-CBC"; + return NULL; + } + diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c -index 75f071c3e..fcf2c2152 100644 +index d4e90793f9..1bc807172b 100644 --- a/src/lib/gssapi/krb5/accept_sec_context.c +++ b/src/lib/gssapi/krb5/accept_sec_context.c -@@ -1039,7 +1039,6 @@ kg_accept_krb5(minor_status, context_handle, +@@ -1030,7 +1030,6 @@ kg_accept_krb5(minor_status, context_handle, } switch (negotiated_etype) { @@ -5200,7 +5256,7 @@ index 75f071c3e..fcf2c2152 100644 case ENCTYPE_ARCFOUR_HMAC_EXP: /* RFC 4121 accidentally omits RC4-HMAC-EXP as a "not-newer" diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h -index a7e0e63ec..3bacdcd35 100644 +index a4446530fc..88d41130a7 100644 --- a/src/lib/gssapi/krb5/gssapiP_krb5.h +++ b/src/lib/gssapi/krb5/gssapiP_krb5.h @@ -125,14 +125,14 @@ enum sgn_alg { @@ -5230,7 +5286,7 @@ index a7e0e63ec..3bacdcd35 100644 }; diff --git a/src/lib/gssapi/krb5/k5seal.c b/src/lib/gssapi/krb5/k5seal.c -index d1cdce486..7f7146a0a 100644 +index d1cdce486f..7f7146a0a2 100644 --- a/src/lib/gssapi/krb5/k5seal.c +++ b/src/lib/gssapi/krb5/k5seal.c @@ -136,19 +136,12 @@ make_seal_token_v1 (krb5_context context, @@ -5283,7 +5339,7 @@ index d1cdce486..7f7146a0a 100644 krb5_free_checksum_contents(context, &md5cksum); diff --git a/src/lib/gssapi/krb5/k5sealiov.c b/src/lib/gssapi/krb5/k5sealiov.c -index 9bb2ee109..9147bb2c7 100644 +index 9bb2ee1099..9147bb2c78 100644 --- a/src/lib/gssapi/krb5/k5sealiov.c +++ b/src/lib/gssapi/krb5/k5sealiov.c @@ -144,18 +144,11 @@ make_seal_token_v1_iov(krb5_context context, @@ -5328,7 +5384,7 @@ index 9bb2ee109..9147bb2c7 100644 /* create the seq_num */ code = kg_make_seq_num(context, ctx->seq, ctx->initiate ? 0 : 0xFF, diff --git a/src/lib/gssapi/krb5/k5unseal.c b/src/lib/gssapi/krb5/k5unseal.c -index 9b183bc33..f0cc4a680 100644 +index 9b183bc337..f0cc4a6809 100644 --- a/src/lib/gssapi/krb5/k5unseal.c +++ b/src/lib/gssapi/krb5/k5unseal.c @@ -131,28 +131,21 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer, @@ -5393,13 +5449,15 @@ index 9b183bc33..f0cc4a680 100644 + if (signalg != SGN_ALG_HMAC_MD5) { *minor_status = 0; return(GSS_S_DEFECTIVE_TOKEN); -- ++ } + - case SGN_ALG_HMAC_SHA1_DES3_KD: - case SGN_ALG_HMAC_MD5: - /* compute the checksum of the message */ - - /* 8 = bytes of token body to be checksummed according to spec */ -- ++ /* compute the checksum of the message */ + - if (! (data_ptr = xmalloc(8 + plainlen))) { - if (sealalg != 0xffff) - xfree(plain); @@ -5408,33 +5466,9 @@ index 9b183bc33..f0cc4a680 100644 - *minor_status = ENOMEM; - return(GSS_S_FAILURE); - } -- -- (void) memcpy(data_ptr, ptr-2, 8); -- -- (void) memcpy(data_ptr+8, plain, plainlen); -- -- plaind.length = 8 + plainlen; -- plaind.data = data_ptr; -- code = krb5_k_make_checksum(context, md5cksum.checksum_type, -- ctx->seq, sign_usage, -- &plaind, &md5cksum); -- xfree(data_ptr); -- -- if (code) { -- if (toktype == KG_TOK_SEAL_MSG) -- gssalloc_free(token.value); -- *minor_status = code; -- return(GSS_S_FAILURE); -- } -- -- code = k5_bcmp(md5cksum.contents, ptr + 14, cksum_len); -- break; - } - -+ /* compute the checksum of the message */ -+ + /* 8 = bytes of token body to be checksummed according to spec */ -+ + +- (void) memcpy(data_ptr, ptr-2, 8); + if (! (data_ptr = xmalloc(8 + plainlen))) { + if (sealalg != 0xffff) + xfree(plain); @@ -5443,32 +5477,47 @@ index 9b183bc33..f0cc4a680 100644 + *minor_status = ENOMEM; + return(GSS_S_FAILURE); + } -+ + +- (void) memcpy(data_ptr+8, plain, plainlen); + (void) memcpy(data_ptr, ptr-2, 8); -+ + +- plaind.length = 8 + plainlen; +- plaind.data = data_ptr; +- code = krb5_k_make_checksum(context, md5cksum.checksum_type, +- ctx->seq, sign_usage, +- &plaind, &md5cksum); +- xfree(data_ptr); + (void) memcpy(data_ptr+8, plain, plainlen); -+ + +- if (code) { +- if (toktype == KG_TOK_SEAL_MSG) +- gssalloc_free(token.value); +- *minor_status = code; +- return(GSS_S_FAILURE); +- } + plaind.length = 8 + plainlen; + plaind.data = data_ptr; + code = krb5_k_make_checksum(context, md5cksum.checksum_type, + ctx->seq, sign_usage, + &plaind, &md5cksum); + xfree(data_ptr); -+ + +- code = k5_bcmp(md5cksum.contents, ptr + 14, cksum_len); +- break; + if (code) { + if (toktype == KG_TOK_SEAL_MSG) + gssalloc_free(token.value); + *minor_status = code; + return(GSS_S_FAILURE); -+ } -+ + } + + code = k5_bcmp(md5cksum.contents, ptr + 14, cksum_len); + krb5_free_checksum_contents(context, &md5cksum); if (sealalg != 0xffff) xfree(plain); diff --git a/src/lib/gssapi/krb5/k5unsealiov.c b/src/lib/gssapi/krb5/k5unsealiov.c -index 85a9574f3..3ce2a90ce 100644 +index 85a9574f36..3ce2a90ce9 100644 --- a/src/lib/gssapi/krb5/k5unsealiov.c +++ b/src/lib/gssapi/krb5/k5unsealiov.c @@ -102,28 +102,21 @@ kg_unseal_v1_iov(krb5_context context, @@ -5547,7 +5596,7 @@ index 85a9574f3..3ce2a90ce 100644 code = 0; retval = GSS_S_BAD_SIG; diff --git a/src/lib/gssapi/krb5/util_crypt.c b/src/lib/gssapi/krb5/util_crypt.c -index 84f194988..32150f5e3 100644 +index 84f1949887..32150f5e34 100644 --- a/src/lib/gssapi/krb5/util_crypt.c +++ b/src/lib/gssapi/krb5/util_crypt.c @@ -97,17 +97,6 @@ kg_setup_keys(krb5_context context, krb5_gss_ctx_id_rec *ctx, krb5_key subkey, @@ -5569,7 +5618,7 @@ index 84f194988..32150f5e3 100644 case ENCTYPE_ARCFOUR_HMAC_EXP: /* RFC 4121 accidentally omits RC4-HMAC-EXP as a "not-newer" enctype, diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c -index aa35baa3c..bfa99d9eb 100644 +index 87b486c53f..2b5abcd817 100644 --- a/src/lib/krb5/krb/init_ctx.c +++ b/src/lib/krb5/krb/init_ctx.c @@ -59,7 +59,6 @@ @@ -5580,7 +5629,7 @@ index aa35baa3c..bfa99d9eb 100644 ENCTYPE_ARCFOUR_HMAC, ENCTYPE_CAMELLIA128_CTS_CMAC, ENCTYPE_CAMELLIA256_CTS_CMAC, 0 -@@ -467,8 +466,6 @@ krb5int_parse_enctype_list(krb5_context context, const char *profkey, +@@ -450,8 +449,6 @@ krb5int_parse_enctype_list(krb5_context context, const char *profkey, /* Set all enctypes in the default list. */ for (i = 0; default_list[i]; i++) mod_list(default_list[i], sel, weak, &list); @@ -5590,7 +5639,7 @@ index aa35baa3c..bfa99d9eb 100644 mod_list(ENCTYPE_AES256_CTS_HMAC_SHA1_96, sel, weak, &list); mod_list(ENCTYPE_AES128_CTS_HMAC_SHA1_96, sel, weak, &list); diff --git a/src/lib/krb5/krb/s4u_creds.c b/src/lib/krb5/krb/s4u_creds.c -index 44d113e7c..966278578 100644 +index 44d113e7c5..9662785783 100644 --- a/src/lib/krb5/krb/s4u_creds.c +++ b/src/lib/krb5/krb/s4u_creds.c @@ -288,8 +288,6 @@ verify_s4u2self_reply(krb5_context context, @@ -5603,7 +5652,7 @@ index 44d113e7c..966278578 100644 case ENCTYPE_ARCFOUR_HMAC_EXP : not_newer = TRUE; diff --git a/src/lib/krb5/krb/t_etypes.c b/src/lib/krb5/krb/t_etypes.c -index 90c9f626c..935aca12f 100644 +index 90c9f626c6..935aca12f5 100644 --- a/src/lib/krb5/krb/t_etypes.c +++ b/src/lib/krb5/krb/t_etypes.c @@ -50,17 +50,6 @@ static struct { @@ -5675,7 +5724,7 @@ index 90c9f626c..935aca12f 100644 { NULL, { ENCTYPE_AES256_CTS_HMAC_SHA1_96, 0 }, diff --git a/src/lib/krb5/os/t_trace.c b/src/lib/krb5/os/t_trace.c -index 10ba8d0ac..24064ffcf 100644 +index 10ba8d0ac7..24064ffcfd 100644 --- a/src/lib/krb5/os/t_trace.c +++ b/src/lib/krb5/os/t_trace.c @@ -65,8 +65,8 @@ main (int argc, char *argv[]) @@ -5690,7 +5739,7 @@ index 10ba8d0ac..24064ffcf 100644 krb5_keytab keytab; krb5_creds creds; diff --git a/src/lib/krb5/os/t_trace.ref b/src/lib/krb5/os/t_trace.ref -index 044a66999..98fb14f3f 100644 +index 044a66999e..98fb14f3f7 100644 --- a/src/lib/krb5/os/t_trace.ref +++ b/src/lib/krb5/os/t_trace.ref @@ -41,7 +41,7 @@ int, krb5_principal type: ? @@ -5703,7 +5752,7 @@ index 044a66999..98fb14f3f 100644 krb5_ccache, display type:name: FILE:/path/to/ccache krb5_keytab, display name: FILE:/etc/krb5.keytab diff --git a/src/plugins/preauth/pkinit/pkcs11.h b/src/plugins/preauth/pkinit/pkcs11.h -index e3d284631..586661bb7 100644 +index e3d2846315..586661bb7e 100644 --- a/src/plugins/preauth/pkinit/pkcs11.h +++ b/src/plugins/preauth/pkinit/pkcs11.h @@ -339,9 +339,9 @@ typedef unsigned long ck_key_type_t; @@ -5719,99 +5768,29 @@ index e3d284631..586661bb7 100644 #define CKK_CAST (0x16) #define CKK_CAST3 (0x17) #define CKK_CAST128 (0x18) -diff --git a/src/plugins/preauth/pkinit/pkinit_clnt.c b/src/plugins/preauth/pkinit/pkinit_clnt.c -index 2817cc213..a385da7c3 100644 ---- a/src/plugins/preauth/pkinit/pkinit_clnt.c -+++ b/src/plugins/preauth/pkinit/pkinit_clnt.c -@@ -212,14 +212,6 @@ pkinit_as_req_create(krb5_context context, - auth_pack.clientPublicValue = &info; - auth_pack.supportedKDFs = (krb5_data **)supported_kdf_alg_ids; - -- /* add List of CMS algorithms */ -- retval = create_krb5_supportedCMSTypes(context, plgctx->cryptoctx, -- reqctx->cryptoctx, -- reqctx->idctx, &cmstypes); -- auth_pack.supportedCMSTypes = cmstypes; -- if (retval) -- goto cleanup; -- - switch(protocol) { - case DH_PROTOCOL: - TRACE_PKINIT_CLIENT_REQ_DH(context); diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h -index 77d5c61fe..1f9868351 100644 +index 94a1b22fb1..65f6210727 100644 --- a/src/plugins/preauth/pkinit/pkinit_crypto.h +++ b/src/plugins/preauth/pkinit/pkinit_crypto.h -@@ -380,18 +380,6 @@ krb5_error_code server_process_dh - unsigned int *server_key_len_out); /* OUT - receives length of DH secret key */ - --/* -- * this functions takes in crypto specific representation of -- * supportedCMSTypes and creates a list of -- * krb5_algorithm_identifier -- */ --krb5_error_code create_krb5_supportedCMSTypes +@@ -376,11 +376,11 @@ krb5_error_code server_process_dh + * krb5_algorithm_identifier + */ + krb5_error_code create_krb5_supportedCMSTypes - (krb5_context context, /* IN */ - pkinit_plg_crypto_context plg_cryptoctx, /* IN */ - pkinit_req_crypto_context req_cryptoctx, /* IN */ - pkinit_identity_crypto_context id_cryptoctx, /* IN */ - krb5_algorithm_identifier ***supportedCMSTypes); /* OUT */ -- ++ (krb5_context context, /* IN */ ++ pkinit_plg_crypto_context plg_cryptoctx, /* IN */ ++ pkinit_req_crypto_context req_cryptoctx, /* IN */ ++ pkinit_identity_crypto_context id_cryptoctx, /* IN */ ++ krb5_algorithm_identifier ***supportedCMSTypes); /* OUT */ + /* * this functions takes in crypto specific representation of - * trustedCertifiers and creates a list of -diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -index e5940a513..e1153344e 100644 ---- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -@@ -5486,44 +5486,6 @@ cleanup: - return retval; - } - --krb5_error_code --create_krb5_supportedCMSTypes(krb5_context context, -- pkinit_plg_crypto_context plg_cryptoctx, -- pkinit_req_crypto_context req_cryptoctx, -- pkinit_identity_crypto_context id_cryptoctx, -- krb5_algorithm_identifier ***oids) --{ -- -- krb5_error_code retval = ENOMEM; -- krb5_algorithm_identifier **loids = NULL; -- krb5_data des3oid = {0, 8, "\x2A\x86\x48\x86\xF7\x0D\x03\x07" }; -- -- *oids = NULL; -- loids = malloc(2 * sizeof(krb5_algorithm_identifier *)); -- if (loids == NULL) -- goto cleanup; -- loids[1] = NULL; -- loids[0] = malloc(sizeof(krb5_algorithm_identifier)); -- if (loids[0] == NULL) { -- free(loids); -- goto cleanup; -- } -- retval = pkinit_copy_krb5_data(&loids[0]->algorithm, &des3oid); -- if (retval) { -- free(loids[0]); -- free(loids); -- goto cleanup; -- } -- loids[0]->parameters.length = 0; -- loids[0]->parameters.data = NULL; -- -- *oids = loids; -- retval = 0; --cleanup: -- -- return retval; --} -- - krb5_error_code - create_krb5_trustedCertifiers(krb5_context context, - pkinit_plg_crypto_context plg_cryptoctx, diff --git a/src/plugins/preauth/pkinit/pkinit_kdf_test.c b/src/plugins/preauth/pkinit/pkinit_kdf_test.c -index 7acbd0d28..cd998a29a 100644 +index 7f38e84910..99c93ac128 100644 --- a/src/plugins/preauth/pkinit/pkinit_kdf_test.c +++ b/src/plugins/preauth/pkinit/pkinit_kdf_test.c @@ -49,7 +49,6 @@ char eighteen_bs[9]; @@ -5822,14 +5801,13 @@ index 7acbd0d28..cd998a29a 100644 const krb5_data lha_data = DATA_FROM_STRING("lha"); krb5_octet key1_hex[] = -@@ -185,36 +184,6 @@ main(int argc, char **argv) +@@ -187,35 +186,6 @@ main(int argc, char **argv) goto cleanup; } - /* TEST 3: SHA-512/DES3 */ - /* set up algorithm id */ -- alg_id.algorithm.data = (char *)krb5_pkinit_sha512_oid; -- alg_id.algorithm.length = krb5_pkinit_sha512_oid_len; +- alg_id.algorithm = sha512_id; - - enctype = enctype_des3; - @@ -5839,7 +5817,7 @@ index 7acbd0d28..cd998a29a 100644 - u_principal, v_principal, - enctype, &as_req, &pk_as_rep, - &key_block))) { -- printf("ERROR in pkinit_kdf_test: kdf call failed, retval = %d", +- printf("ERROR in pkinit_kdf_test: kdf call failed, retval = %d\n", - retval); - goto cleanup; - } @@ -5860,7 +5838,7 @@ index 7acbd0d28..cd998a29a 100644 /* release all allocated resources, whether good or bad return */ free(secret.data); diff --git a/src/plugins/preauth/spake/t_vectors.c b/src/plugins/preauth/spake/t_vectors.c -index 2279202d3..96b0307d7 100644 +index 2279202d3a..96b0307d78 100644 --- a/src/plugins/preauth/spake/t_vectors.c +++ b/src/plugins/preauth/spake/t_vectors.c @@ -56,31 +56,6 @@ struct test { @@ -5895,158 +5873,8 @@ index 2279202d3..96b0307d7 100644 { ENCTYPE_ARCFOUR_HMAC, SPAKE_GROUP_EDWARDS25519, /* initial key, w, x, y, T, S, K */ "8846F7EAEE8FB117AD06BDD830B7586C", -diff --git a/src/tests/dejagnu/config/default.exp b/src/tests/dejagnu/config/default.exp -index 85bbf478a..302dee74c 100644 ---- a/src/tests/dejagnu/config/default.exp -+++ b/src/tests/dejagnu/config/default.exp -@@ -15,8 +15,6 @@ set timeout 100 - set stty_init {erase \^h kill \^u} - set env(TERM) dumb - --set des3_krbtgt 0 -- - if { [string length $VALGRIND] } { - rename spawn valgrind_aux_spawn - proc spawn { args } { -@@ -105,17 +103,9 @@ if { $PRIOCNTL_HACK } { - # particularly with regards to encryption types. - - set passes { -- { -- des3 -- mode=udp -- des3_krbtgt=1 -- {supported_enctypes=des3-cbc-sha1:normal} -- {dummy=[verbose -log "DES3 TGT, DES3 enctype"]} -- } - { - aes-only - mode=udp -- des3_krbtgt=0 - {supported_enctypes=aes256-cts-hmac-sha1-96:normal} - {permitted_enctypes(kdc)=aes256-cts-hmac-sha1-96} - {permitted_enctypes(client)=aes256-cts-hmac-sha1-96} -@@ -130,7 +120,6 @@ set passes { - { - aes-sha2-only - mode=udp -- des3_krbtgt=0 - {supported_enctypes=aes256-sha2:normal} - {permitted_enctypes(kdc)=aes256-sha2} - {permitted_enctypes(replica)=aes256-sha2} -@@ -146,7 +135,6 @@ set passes { - { - camellia-only - mode=udp -- des3_krbtgt=0 - {supported_enctypes=camellia256-cts:normal} - {permitted_enctypes(kdc)=camellia256-cts} - {permitted_enctypes(replica)=camellia256-cts} -@@ -159,32 +147,9 @@ set passes { - {master_key_type=camellia256-cts} - {dummy=[verbose -log "Camellia-256 enctype"]} - } -- { -- aes-des3 -- mode=udp -- des3_krbtgt=0 -- {supported_enctypes=aes256-cts-hmac-sha1-96:normal des3-cbc-sha1:normal} -- {permitted_enctypes(kdc)=aes256-cts-hmac-sha1-96 des3-cbc-sha1} -- {permitted_enctypes(client)=aes256-cts-hmac-sha1-96 des3-cbc-sha1} -- {permitted_enctypes(server)=aes256-cts-hmac-sha1-96 des3-cbc-sha1} -- {master_key_type=aes256-cts-hmac-sha1-96} -- {dummy=[verbose -log "AES + DES3 + DES enctypes"]} -- } -- { -- aes-des3tgt -- mode=udp -- des3_krbtgt=1 -- {supported_enctypes=aes256-cts-hmac-sha1-96:normal des3-cbc-sha1:normal} -- {permitted_enctypes(kdc)=aes256-cts-hmac-sha1-96 des3-cbc-sha1} -- {permitted_enctypes(client)=aes256-cts-hmac-sha1-96 des3-cbc-sha1} -- {permitted_enctypes(server)=aes256-cts-hmac-sha1-96 des3-cbc-sha1} -- {master_key_type=aes256-cts-hmac-sha1-96} -- {dummy=[verbose -log "AES enctypes, DES3 TGT"]} -- } - { - all-enctypes - mode=udp -- des3_krbtgt=0 - {allow_weak_crypto(kdc)=false} - {allow_weak_crypto(replica)=false} - {allow_weak_crypto(client)=false} -@@ -946,7 +911,6 @@ proc setup_kerberos_db { standalone } { - global REALMNAME KDB5_UTIL KADMIN_LOCAL KEY - global tmppwd hostname - global spawn_id -- global des3_krbtgt - global multipass_name last_passname_db - - set failall 0 -@@ -1143,48 +1107,6 @@ proc setup_kerberos_db { standalone } { - } - } - -- if $des3_krbtgt { -- # Set the TGT key to DES3. -- set test "kadmin.local TGT to DES3" -- set body { -- if $failall { -- break -- } -- spawn $KADMIN_LOCAL -r $REALMNAME -e des3-cbc-sha1:normal -- verbose "starting $test" -- expect_after $def_exp_after -- -- expect "kadmin.local: " -- send "cpw -randkey krbtgt/$REALMNAME@$REALMNAME\r" -- # It echos... -- expect "cpw -randkey krbtgt/$REALMNAME@$REALMNAME\r" -- expect { -- "Key for \"krbtgt/$REALMNAME@$REALMNAME\" randomized." { } -- } -- expect "kadmin.local: " -- send "quit\r" -- expect eof -- catch expect_after -- if ![check_exit_status kadmin_local] { -- break -- } -- } -- set ret [catch $body] -- catch "expect eof" -- catch expect_after -- if $ret { -- set failall 1 -- if $standalone { -- fail $test -- } else { -- delete_db -- } -- } else { -- if $standalone { -- pass $test -- } -- } -- } - envstack_pop - - # create the admin database lock file -diff --git a/src/tests/dejagnu/krb-standalone/kprop.exp b/src/tests/dejagnu/krb-standalone/kprop.exp -index 661e3fd9a..2b8f60045 100644 ---- a/src/tests/dejagnu/krb-standalone/kprop.exp -+++ b/src/tests/dejagnu/krb-standalone/kprop.exp -@@ -54,7 +54,7 @@ proc doit { } { - global REALMNAME KEY - global KADMIN_LOCAL KTUTIL KDB5_UTIL KPROPLOG KPROP kpropd_spawn_id - global hostname tmppwd spawn_id timeout -- global KRBIV supported_enctypes portbase mode ulog des3_krbtgt -+ global KRBIV supported_enctypes portbase mode ulog - - # Delete any db, ulog files - delete_db diff --git a/src/tests/gssapi/t_enctypes.py b/src/tests/gssapi/t_enctypes.py -index 7494d7fcd..2f95d8996 100755 +index 7494d7fcdb..2f95d89967 100755 --- a/src/tests/gssapi/t_enctypes.py +++ b/src/tests/gssapi/t_enctypes.py @@ -1,24 +1,17 @@ @@ -6115,7 +5943,7 @@ index 7494d7fcd..2f95d8996 100755 # because the ticket session key and initiator subkey are # non-permitted. (This is unfortunate if the acceptor's restriction diff --git a/src/tests/gssapi/t_invalid.c b/src/tests/gssapi/t_invalid.c -index 9876a11e6..fb8fe5511 100644 +index 9876a11e67..fb8fe55111 100644 --- a/src/tests/gssapi/t_invalid.c +++ b/src/tests/gssapi/t_invalid.c @@ -84,18 +84,6 @@ struct test { @@ -6138,7 +5966,7 @@ index 9876a11e6..fb8fe5511 100644 ENCTYPE_ARCFOUR_HMAC, ENCTYPE_ARCFOUR_HMAC, SEAL_ALG_MICROSOFT_RC4, SGN_ALG_HMAC_MD5, 8, diff --git a/src/tests/gssapi/t_pcontok.c b/src/tests/gssapi/t_pcontok.c -index 7368f752f..bf22bd3da 100644 +index 7368f752f0..bf22bd3da1 100644 --- a/src/tests/gssapi/t_pcontok.c +++ b/src/tests/gssapi/t_pcontok.c @@ -43,7 +43,6 @@ @@ -6173,7 +6001,7 @@ index 7368f752f..bf22bd3da 100644 tlen = 20 + mech_krb5.length + cksize; token = malloc(tlen); diff --git a/src/tests/gssapi/t_prf.c b/src/tests/gssapi/t_prf.c -index f71774cdc..d1857c433 100644 +index f71774cdc9..d1857c433f 100644 --- a/src/tests/gssapi/t_prf.c +++ b/src/tests/gssapi/t_prf.c @@ -41,13 +41,6 @@ static struct { @@ -6191,10 +6019,10 @@ index f71774cdc..d1857c433 100644 "3BB3AE288C12B3B9D06B208A4151B3B6", "9AEA11A3BCF3C53F1F91F5A0BA2132E2501ADF5F3C28" diff --git a/src/tests/t_authdata.py b/src/tests/t_authdata.py -index 3fa957ad2..2e01f46bc 100644 +index 97e2474bf8..47ea9e4b47 100644 --- a/src/tests/t_authdata.py +++ b/src/tests/t_authdata.py -@@ -174,7 +174,7 @@ realm.run([kvno, 'restricted']) +@@ -164,7 +164,7 @@ realm.run([kvno, 'restricted']) # preferred krbtgt enctype changes. mark('#8139 regression test') realm.kinit(realm.user_princ, password('user'), ['-f']) @@ -6204,7 +6032,7 @@ index 3fa957ad2..2e01f46bc 100644 realm.run(['./forward']) realm.run([kvno, realm.host_princ]) diff --git a/src/tests/t_etype_info.py b/src/tests/t_etype_info.py -index c982508d8..96e90a69d 100644 +index c982508d8b..96e90a69d2 100644 --- a/src/tests/t_etype_info.py +++ b/src/tests/t_etype_info.py @@ -1,6 +1,6 @@ @@ -6253,7 +6081,7 @@ index c982508d8..96e90a69d 100644 # Verify that etype-info2 is included in a MORE_PREAUTH_DATA_REQUIRED # error if the client does optimistic preauth. diff --git a/src/tests/t_keyrollover.py b/src/tests/t_keyrollover.py -index 2c825a692..f29e0d550 100755 +index 2c825a6922..f29e0d5500 100755 --- a/src/tests/t_keyrollover.py +++ b/src/tests/t_keyrollover.py @@ -37,9 +37,9 @@ realm.run([klist, '-e'], expected_msg=msg) @@ -6281,7 +6109,7 @@ index 2c825a692..f29e0d550 100755 realm.stop() diff --git a/src/tests/t_mkey.py b/src/tests/t_mkey.py -index 32f4070bc..da0ed1831 100755 +index 32f4070bcb..da0ed1831e 100755 --- a/src/tests/t_mkey.py +++ b/src/tests/t_mkey.py @@ -7,7 +7,6 @@ import struct @@ -6334,7 +6162,7 @@ index 32f4070bc..da0ed1831 100755 # master key fetch does not segfault. mark('#8395 regression test') diff --git a/src/tests/t_salt.py b/src/tests/t_salt.py -index 65084bbf3..55ca89745 100755 +index 65084bbf35..55ca897459 100755 --- a/src/tests/t_salt.py +++ b/src/tests/t_salt.py @@ -16,13 +16,12 @@ def test_salt(realm, e1, salt, e2): @@ -6354,10 +6182,10 @@ index 65084bbf3..55ca89745 100755 # Test using different salt types in a principal's key list. # Parameters from one key in the list must not leak over to later ones. diff --git a/src/util/k5test.py b/src/util/k5test.py -index 6afe4b92c..789b0f4b9 100644 +index 619f1995f8..771f82e3cc 100644 --- a/src/util/k5test.py +++ b/src/util/k5test.py -@@ -1278,13 +1278,6 @@ _passes = [ +@@ -1344,13 +1344,6 @@ _passes = [ # No special settings; exercises AES256. ('default', None, None, None), @@ -6372,7 +6200,7 @@ index 6afe4b92c..789b0f4b9 100644 ('arcfour', None, {'libdefaults': {'permitted_enctypes': 'rc4'}}, diff --git a/src/windows/leash/htmlhelp/html/Encryption_Types.htm b/src/windows/leash/htmlhelp/html/Encryption_Types.htm -index 1aebdd0b4..c38eefd2b 100644 +index 1aebdd0b4a..c38eefd2bd 100644 --- a/src/windows/leash/htmlhelp/html/Encryption_Types.htm +++ b/src/windows/leash/htmlhelp/html/Encryption_Types.htm @@ -79,19 +79,6 @@ will have an entry in the Encryption type column.
@@ -6395,3 +6223,6 @@ index 1aebdd0b4..c38eefd2b 100644 aes The AES Advanced Encryption Standard family, like 3DES, is a symmetric block cipher and was designed +-- +2.38.1 + diff --git a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch b/0005-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch similarity index 91% rename from downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch rename to 0005-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch index 553dec9..ecf661d 100644 --- a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch +++ b/0005-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch @@ -1,4 +1,4 @@ -From 91e1d43858d90f59f5d9f45987cfca02c3175feb Mon Sep 17 00:00:00 2001 +From 239cd24624b801d4fc4bb4686bef8526e7675d77 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 9 Nov 2018 15:12:21 -0500 Subject: [PATCH] [downstream] FIPS with PRNG and RADIUS and MD4 @@ -21,10 +21,10 @@ post7 restores MD5 and adds radius_md5_fips_override. post8 silences a static analyzer warning. -Last-updated: krb5-1.17 +Last-updated: krb5-1.20 --- doc/admin/conf_files/krb5_conf.rst | 6 +++ - src/lib/crypto/krb/prng.c | 11 ++++- + src/lib/crypto/krb/prng.c | 15 +++++- .../crypto/openssl/enc_provider/camellia.c | 6 +++ src/lib/crypto/openssl/enc_provider/rc4.c | 13 +++++- .../crypto/openssl/hash_provider/hash_evp.c | 12 +++++ @@ -38,10 +38,10 @@ Last-updated: krb5-1.17 src/lib/krad/t_attrset.c | 4 +- src/plugins/preauth/spake/spake_client.c | 6 +++ src/plugins/preauth/spake/spake_kdc.c | 6 +++ - 15 files changed, 151 insertions(+), 33 deletions(-) + 15 files changed, 155 insertions(+), 33 deletions(-) diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst -index 675175955..adba8238d 100644 +index d5d6e06ebb..2a4962069f 100644 --- a/doc/admin/conf_files/krb5_conf.rst +++ b/doc/admin/conf_files/krb5_conf.rst @@ -330,6 +330,12 @@ The libdefaults section may contain any of the following relations: @@ -58,22 +58,26 @@ index 675175955..adba8238d 100644 If this flag is true, reverse name lookup will be used in addition to forward name lookup to canonicalizing hostnames for use in diff --git a/src/lib/crypto/krb/prng.c b/src/lib/crypto/krb/prng.c -index cb9ca9b98..f0e9984ca 100644 +index d6b79e2dea..9e80a03d21 100644 --- a/src/lib/crypto/krb/prng.c +++ b/src/lib/crypto/krb/prng.c -@@ -26,6 +26,8 @@ +@@ -26,6 +26,12 @@ #include "crypto_int.h" +#include ++ ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++#include ++#endif + krb5_error_code KRB5_CALLCONV krb5_c_random_seed(krb5_context context, krb5_data *data) { -@@ -99,9 +101,16 @@ krb5_boolean - k5_get_os_entropy(unsigned char *buf, size_t len, int strong) +@@ -96,9 +102,16 @@ cleanup: + static krb5_boolean + get_os_entropy(unsigned char *buf, size_t len) { - const char *device; -#if defined(__linux__) && defined(SYS_getrandom) int r; @@ -89,10 +93,10 @@ index cb9ca9b98..f0e9984ca 100644 /* * Pull from the /dev/urandom pool, but require it to have been seeded. diff --git a/src/lib/crypto/openssl/enc_provider/camellia.c b/src/lib/crypto/openssl/enc_provider/camellia.c -index 2da691329..f79679a0b 100644 +index 01920e6ce1..d9f327add6 100644 --- a/src/lib/crypto/openssl/enc_provider/camellia.c +++ b/src/lib/crypto/openssl/enc_provider/camellia.c -@@ -304,6 +304,9 @@ krb5int_camellia_cbc_mac(krb5_key key, const krb5_crypto_iov *data, +@@ -387,6 +387,9 @@ krb5int_camellia_cbc_mac(krb5_key key, const krb5_crypto_iov *data, unsigned char blockY[CAMELLIA_BLOCK_SIZE], blockB[CAMELLIA_BLOCK_SIZE]; struct iov_cursor cursor; @@ -102,7 +106,7 @@ index 2da691329..f79679a0b 100644 if (output->length < CAMELLIA_BLOCK_SIZE) return KRB5_BAD_MSIZE; -@@ -331,6 +334,9 @@ static krb5_error_code +@@ -418,6 +421,9 @@ static krb5_error_code krb5int_camellia_init_state (const krb5_keyblock *key, krb5_keyusage usage, krb5_data *state) { @@ -113,10 +117,10 @@ index 2da691329..f79679a0b 100644 state->data = (void *) malloc(16); if (state->data == NULL) diff --git a/src/lib/crypto/openssl/enc_provider/rc4.c b/src/lib/crypto/openssl/enc_provider/rc4.c -index bc87c6f42..9bf407899 100644 +index 448d563348..ce63cb5f1b 100644 --- a/src/lib/crypto/openssl/enc_provider/rc4.c +++ b/src/lib/crypto/openssl/enc_provider/rc4.c -@@ -66,6 +66,9 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data, +@@ -69,6 +69,9 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data, EVP_CIPHER_CTX *ctx = NULL; struct arcfour_state *arcstate; @@ -126,7 +130,7 @@ index bc87c6f42..9bf407899 100644 arcstate = (state != NULL) ? (void *)state->data : NULL; if (arcstate != NULL) { ctx = arcstate->ctx; -@@ -113,7 +116,12 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data, +@@ -116,7 +119,12 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data, static void k5_arcfour_free_state(krb5_data *state) { @@ -140,7 +144,7 @@ index bc87c6f42..9bf407899 100644 EVP_CIPHER_CTX_free(arcstate->ctx); free(arcstate); -@@ -125,6 +133,9 @@ k5_arcfour_init_state(const krb5_keyblock *key, +@@ -128,6 +136,9 @@ k5_arcfour_init_state(const krb5_keyblock *key, { struct arcfour_state *arcstate; @@ -151,10 +155,10 @@ index bc87c6f42..9bf407899 100644 * The cipher state here is a saved pointer to a struct arcfour_state * object, rather than a flat byte array as in most enc providers. The diff --git a/src/lib/crypto/openssl/hash_provider/hash_evp.c b/src/lib/crypto/openssl/hash_provider/hash_evp.c -index 1e0fb8fc3..2eb5139c0 100644 +index f2fbffdb29..11659908bb 100644 --- a/src/lib/crypto/openssl/hash_provider/hash_evp.c +++ b/src/lib/crypto/openssl/hash_provider/hash_evp.c -@@ -49,6 +49,11 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data, +@@ -60,6 +60,11 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data, if (ctx == NULL) return ENOMEM; @@ -166,7 +170,7 @@ index 1e0fb8fc3..2eb5139c0 100644 ok = EVP_DigestInit_ex(ctx, type, NULL); for (i = 0; i < num_data; i++) { if (!SIGN_IOV(&data[i])) -@@ -64,12 +69,19 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data, +@@ -78,6 +83,11 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data, static krb5_error_code hash_md4(const krb5_crypto_iov *data, size_t num_data, krb5_data *output) { @@ -178,6 +182,7 @@ index 1e0fb8fc3..2eb5139c0 100644 return hash_evp(EVP_md4(), data, num_data, output); } +@@ -90,6 +100,8 @@ const struct krb5_hash_provider krb5int_hash_md4 = { static krb5_error_code hash_md5(const krb5_crypto_iov *data, size_t num_data, krb5_data *output) { @@ -187,24 +192,24 @@ index 1e0fb8fc3..2eb5139c0 100644 } diff --git a/src/lib/crypto/openssl/hmac.c b/src/lib/crypto/openssl/hmac.c -index 7dc59dcc0..769a50c00 100644 +index bf12b8d6a0..f21e268f7f 100644 --- a/src/lib/crypto/openssl/hmac.c +++ b/src/lib/crypto/openssl/hmac.c -@@ -103,7 +103,11 @@ map_digest(const struct krb5_hash_provider *hash) +@@ -111,7 +111,11 @@ map_digest(const struct krb5_hash_provider *hash) return EVP_sha256(); - else if (!strncmp(hash->hash_name, "SHA-384",7)) + else if (hash == &krb5int_hash_sha384) return EVP_sha384(); -- else if (!strncmp(hash->hash_name, "MD5", 3)) +- else if (hash == &krb5int_hash_md5) + + if (FIPS_mode()) + return NULL; + -+ if (!strncmp(hash->hash_name, "MD5", 3)) ++ if (hash == &krb5int_hash_md5) return EVP_md5(); - else if (!strncmp(hash->hash_name, "MD4", 3)) + else if (hash == &krb5int_hash_md4) return EVP_md4(); diff --git a/src/lib/krad/attr.c b/src/lib/krad/attr.c -index 9c13d9d75..42d354a3b 100644 +index 9c13d9d755..42d354a3b5 100644 --- a/src/lib/krad/attr.c +++ b/src/lib/krad/attr.c @@ -38,7 +38,8 @@ @@ -328,7 +333,7 @@ index 9c13d9d75..42d354a3b 100644 krad_attr diff --git a/src/lib/krad/attrset.c b/src/lib/krad/attrset.c -index 03c613716..d89982a13 100644 +index f309f1581c..6ec031e320 100644 --- a/src/lib/krad/attrset.c +++ b/src/lib/krad/attrset.c @@ -167,7 +167,8 @@ krad_attrset_copy(const krad_attrset *set, krad_attrset **copy) @@ -351,7 +356,7 @@ index 03c613716..d89982a13 100644 return retval; diff --git a/src/lib/krad/internal.h b/src/lib/krad/internal.h -index 0143d155a..57672982f 100644 +index 7619563fc5..e123763954 100644 --- a/src/lib/krad/internal.h +++ b/src/lib/krad/internal.h @@ -39,6 +39,8 @@ @@ -397,7 +402,7 @@ index 0143d155a..57672982f 100644 /* Decode attributes from a buffer. */ krb5_error_code -@@ -152,4 +163,17 @@ gai_error_code(int err) +@@ -156,4 +167,17 @@ gai_error_code(int err) } } @@ -416,7 +421,7 @@ index 0143d155a..57672982f 100644 + #endif /* INTERNAL_H_ */ diff --git a/src/lib/krad/packet.c b/src/lib/krad/packet.c -index c597174b6..fc2d24800 100644 +index c597174b65..fc2d248001 100644 --- a/src/lib/krad/packet.c +++ b/src/lib/krad/packet.c @@ -53,12 +53,6 @@ typedef unsigned char uchar; @@ -477,7 +482,7 @@ index c597174b6..fc2d24800 100644 } diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c -index a938665f6..7b5804b1d 100644 +index 06ae751bc8..929f1cef67 100644 --- a/src/lib/krad/remote.c +++ b/src/lib/krad/remote.c @@ -263,7 +263,7 @@ on_io_write(krad_remote *rr) @@ -498,7 +503,7 @@ index a938665f6..7b5804b1d 100644 request_finish(r, 0, rsp); break; } -@@ -455,6 +455,12 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs, +@@ -460,6 +460,12 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs, (krad_packet_iter_cb)iterator, &r, &tmp); if (retval != 0) goto error; @@ -512,7 +517,7 @@ index a938665f6..7b5804b1d 100644 K5_TAILQ_FOREACH(r, &rr->list, list) { if (r->request == tmp) { diff --git a/src/lib/krad/t_attr.c b/src/lib/krad/t_attr.c -index eb2a780c8..4d285ad9d 100644 +index eb2a780c89..4d285ad9de 100644 --- a/src/lib/krad/t_attr.c +++ b/src/lib/krad/t_attr.c @@ -50,6 +50,7 @@ main() @@ -533,7 +538,7 @@ index eb2a780c8..4d285ad9d 100644 insist(len == sizeof(encoded)); insist(memcmp(outbuf, encoded, len) == 0); diff --git a/src/lib/krad/t_attrset.c b/src/lib/krad/t_attrset.c -index 7928335ca..0f9576253 100644 +index 7928335ca4..0f95762534 100644 --- a/src/lib/krad/t_attrset.c +++ b/src/lib/krad/t_attrset.c @@ -49,6 +49,7 @@ main() @@ -555,7 +560,7 @@ index 7928335ca..0f9576253 100644 /* Manually encode User-Name. */ diff --git a/src/plugins/preauth/spake/spake_client.c b/src/plugins/preauth/spake/spake_client.c -index 00734a13b..a3ce22b70 100644 +index 00734a13b5..a3ce22b70f 100644 --- a/src/plugins/preauth/spake/spake_client.c +++ b/src/plugins/preauth/spake/spake_client.c @@ -38,6 +38,8 @@ @@ -579,7 +584,7 @@ index 00734a13b..a3ce22b70 100644 vt->name = "spake"; vt->pa_type_list = pa_types; diff --git a/src/plugins/preauth/spake/spake_kdc.c b/src/plugins/preauth/spake/spake_kdc.c -index 88c964ce1..c7df0392f 100644 +index 1a772d450f..232e78bc05 100644 --- a/src/plugins/preauth/spake/spake_kdc.c +++ b/src/plugins/preauth/spake/spake_kdc.c @@ -41,6 +41,8 @@ @@ -591,7 +596,7 @@ index 88c964ce1..c7df0392f 100644 /* * The SPAKE kdcpreauth module uses a secure cookie containing the following * concatenated fields (all integer fields are big-endian): -@@ -571,6 +573,10 @@ kdcpreauth_spake_initvt(krb5_context context, int maj_ver, int min_ver, +@@ -551,6 +553,10 @@ kdcpreauth_spake_initvt(krb5_context context, int maj_ver, int min_ver, if (maj_ver != 1) return KRB5_PLUGIN_VER_NOTSUPP; @@ -602,3 +607,6 @@ index 88c964ce1..c7df0392f 100644 vt = (krb5_kdcpreauth_vtable)vtable; vt->name = "spake"; vt->pa_type_list = pa_types; +-- +2.38.1 + diff --git a/downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch b/0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch similarity index 90% rename from downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch rename to 0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch index 7455cb9..b8e5429 100644 --- a/downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch +++ b/0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch @@ -1,7 +1,8 @@ -From a43d621ae83c89abb74764f0fd9d90a8e9992333 Mon Sep 17 00:00:00 2001 +From 5587c755b6ca82bde093523e2d17b255158cd90e Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Thu, 5 May 2022 17:15:12 +0200 -Subject: [PATCH] Allow krad UDP/TCP localhost connection with FIPS +Subject: [PATCH] [downstream] Allow krad UDP/TCP localhost connection + with FIPS libkrad allows to establish connections only to UNIX socket in FIPS mode, because MD5 digest is not considered safe enough to be used for @@ -17,7 +18,7 @@ Resolves: rhbz#2082189 1 file changed, 33 insertions(+), 2 deletions(-) diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c -index 7b5804b1d..e671bc5c2 100644 +index 929f1cef67..063f17a613 100644 --- a/src/lib/krad/remote.c +++ b/src/lib/krad/remote.c @@ -33,6 +33,7 @@ @@ -64,7 +65,7 @@ index 7b5804b1d..e671bc5c2 100644 /* Iterate over the set of outstanding packets. */ static const krad_packet * iterator(request **out) -@@ -455,8 +485,9 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs, +@@ -460,8 +490,9 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs, (krad_packet_iter_cb)iterator, &r, &tmp); if (retval != 0) goto error; @@ -77,5 +78,5 @@ index 7b5804b1d..e671bc5c2 100644 retval = ESOCKTNOSUPPORT; goto error; -- -2.35.1 +2.38.1 diff --git a/Add-configure-variable-for-default-PKCS-11-module.patch b/0007-Add-configure-variable-for-default-PKCS-11-module.patch similarity index 93% rename from Add-configure-variable-for-default-PKCS-11-module.patch rename to 0007-Add-configure-variable-for-default-PKCS-11-module.patch index 724b707..1445133 100644 --- a/Add-configure-variable-for-default-PKCS-11-module.patch +++ b/0007-Add-configure-variable-for-default-PKCS-11-module.patch @@ -1,4 +1,4 @@ -From 2a91dabd9752825b96faf3b25ea643d5282c5957 Mon Sep 17 00:00:00 2001 +From 842b4c3b5695e2518e6f1a1545db78865c04b59c Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Fri, 22 Apr 2022 14:12:37 +0200 Subject: [PATCH] Add configure variable for default PKCS#11 module @@ -20,10 +20,10 @@ ticket: 9058 (new) 9 files changed, 34 insertions(+), 16 deletions(-) diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst -index adba8238d..3d25c9a12 100644 +index 2a4962069f..a33711d918 100644 --- a/doc/admin/conf_files/krb5_conf.rst +++ b/doc/admin/conf_files/krb5_conf.rst -@@ -1020,7 +1020,7 @@ information for PKINIT is as follows: +@@ -1017,7 +1017,7 @@ information for PKINIT is as follows: All keyword/values are optional. *modname* specifies the location of a library implementing PKCS #11. If a value is encountered with no keyword, it is assumed to be the *modname*. If no @@ -33,10 +33,10 @@ index adba8238d..3d25c9a12 100644 a particular smard card reader or token if there is more than one available. ``certid=`` and/or ``certlabel=`` may be specified to diff --git a/doc/build/options2configure.rst b/doc/build/options2configure.rst -index a8959626d..8f8ac911c 100644 +index 9e355dc2c5..e879b18bd2 100644 --- a/doc/build/options2configure.rst +++ b/doc/build/options2configure.rst -@@ -143,6 +143,9 @@ Environment variables +@@ -137,6 +137,9 @@ Environment variables This option allows one to specify libraries to be passed to the linker (e.g., ``-l``) @@ -47,7 +47,7 @@ index a8959626d..8f8ac911c 100644 If ``-lss`` is not the correct way to link in your installed ss library, for example if additional support libraries are needed, diff --git a/doc/conf.py b/doc/conf.py -index a876fd633..252ab891a 100644 +index 12168fa695..0ab5ff9606 100644 --- a/doc/conf.py +++ b/doc/conf.py @@ -242,6 +242,7 @@ if 'mansubs' in tags: @@ -75,7 +75,7 @@ index a876fd633..252ab891a 100644 .. |krb5conf| replace:: ``/etc/krb5.conf`` .. |defkeysalts| replace:: ``aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal`` diff --git a/doc/mitK5defaults.rst b/doc/mitK5defaults.rst -index 74e69f4ad..aea7af3db 100644 +index 74e69f4ad0..aea7af3dbb 100644 --- a/doc/mitK5defaults.rst +++ b/doc/mitK5defaults.rst @@ -59,18 +59,19 @@ subdirectories of ``/usr/local``. When MIT krb5 is integrated into an @@ -111,10 +111,10 @@ index 74e69f4ad..aea7af3db 100644 The default client keytab name (DEFCKTNAME) typically defaults to ``FILE:/usr/local/var/krb5/user/%{euid}/client.keytab`` for a custom diff --git a/src/configure.ac b/src/configure.ac -index 82b049af9..52e6563da 100644 +index 8dc864718d..9774cb71ae 100644 --- a/src/configure.ac +++ b/src/configure.ac -@@ -1442,6 +1442,14 @@ AC_DEFINE_UNQUOTED(DEFKTNAME, ["$DEFKTNAME"], [Define to default keytab name]) +@@ -1471,6 +1471,14 @@ AC_DEFINE_UNQUOTED(DEFKTNAME, ["$DEFKTNAME"], [Define to default keytab name]) AC_DEFINE_UNQUOTED(DEFCKTNAME, ["$DEFCKTNAME"], [Define to default client keytab name]) @@ -130,7 +130,7 @@ index 82b049af9..52e6563da 100644 AC_CONFIG_FILES([build-tools/kadm-server.pc build-tools/kadm-client.pc diff --git a/src/doc/Makefile.in b/src/doc/Makefile.in -index 379bc3651..a1b0cff0a 100644 +index 379bc36511..a1b0cff0a4 100644 --- a/src/doc/Makefile.in +++ b/src/doc/Makefile.in @@ -10,6 +10,7 @@ sysconfdir=@sysconfdir@ @@ -150,7 +150,7 @@ index 379bc3651..a1b0cff0a 100644 # Dummy rule that man/Makefile can invoke version.py: $(docsrc)/version.py diff --git a/src/man/Makefile.in b/src/man/Makefile.in -index 00b1b2de0..85cae0914 100644 +index 00b1b2de06..85cae0914e 100644 --- a/src/man/Makefile.in +++ b/src/man/Makefile.in @@ -8,6 +8,7 @@ sysconfdir=@sysconfdir@ @@ -172,10 +172,10 @@ index 00b1b2de0..85cae0914 100644 all: $(MANSUBS) diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man -index e993d5c09..42f5ea4f9 100644 +index 51acb38815..fd2c6f2bc4 100644 --- a/src/man/krb5.conf.man +++ b/src/man/krb5.conf.man -@@ -1151,7 +1151,7 @@ user\(aqs certificate and private key. +@@ -1148,7 +1148,7 @@ user\(aqs certificate and private key. All keyword/values are optional. \fImodname\fP specifies the location of a library implementing PKCS #11. If a value is encountered with no keyword, it is assumed to be the \fImodname\fP\&. If no @@ -185,7 +185,7 @@ index e993d5c09..42f5ea4f9 100644 a particular smard card reader or token if there is more than one available. \fBcertid=\fP and/or \fBcertlabel=\fP may be specified to diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h -index b437fd53f..a2018cb10 100644 +index 8135535e2c..66f92d8f03 100644 --- a/src/plugins/preauth/pkinit/pkinit.h +++ b/src/plugins/preauth/pkinit/pkinit.h @@ -42,7 +42,6 @@ @@ -197,5 +197,5 @@ index b437fd53f..a2018cb10 100644 #define PK_NOSLOT 999999 #endif -- -2.35.1 +2.38.1 diff --git a/0008-Set-reasonable-supportedCMSTypes-in-PKINIT.patch b/0008-Set-reasonable-supportedCMSTypes-in-PKINIT.patch new file mode 100644 index 0000000..3755c15 --- /dev/null +++ b/0008-Set-reasonable-supportedCMSTypes-in-PKINIT.patch @@ -0,0 +1,159 @@ +From 3fb8c4c68274d2ff4addb44b7b95b4698c2c4f34 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Wed, 1 Jun 2022 18:02:04 +0200 +Subject: [PATCH] Set reasonable supportedCMSTypes in PKINIT + +The PKINIT client uses AuthPack.supportedCMSTypes to let the KDC know +the algorithms it supports for verification of the CMS data signature. +(The MIT krb5 KDC currently ignores this list, but other +implementations use it.) + +Replace 3DES with sha512WithRSAEncryption and sha256WithRSAEncryption. + +[ghudson@mit.edu: simplified code and used appropriate helpers; edited +commit message] + +ticket: 9066 (new) +--- + src/plugins/preauth/pkinit/pkinit_constants.c | 33 ++++++++++++- + src/plugins/preauth/pkinit/pkinit_crypto.h | 4 ++ + .../preauth/pkinit/pkinit_crypto_openssl.c | 49 ++++++++++--------- + 3 files changed, 60 insertions(+), 26 deletions(-) + +diff --git a/src/plugins/preauth/pkinit/pkinit_constants.c b/src/plugins/preauth/pkinit/pkinit_constants.c +index 652897fa14..1da482e0b4 100644 +--- a/src/plugins/preauth/pkinit/pkinit_constants.c ++++ b/src/plugins/preauth/pkinit/pkinit_constants.c +@@ -32,9 +32,14 @@ + + #include "pkinit.h" + +-/* statically declare OID constants for all three algorithms */ +-static char sha1_oid[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x01}; ++/* RFC 8636 id-pkinit-kdf-ah-sha1: iso(1) identified-organization(3) dod(6) ++ * internet(1) security(5) kerberosv5(2) pkinit(3) kdf(6) sha1(1) */ ++static char sha1_oid[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x01 }; ++/* RFC 8636 id-pkinit-kdf-ah-sha256: iso(1) identified-organization(3) dod(6) ++ * internet(1) security(5) kerberosv5(2) pkinit(3) kdf(6) sha256(2) */ + static char sha256_oid[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x02 }; ++/* RFC 8636 id-pkinit-kdf-ah-sha512: iso(1) identified-organization(3) dod(6) ++ * internet(1) security(5) kerberosv5(2) pkinit(3) kdf(6) sha512(3) */ + static char sha512_oid[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x03 }; + + const krb5_data sha1_id = { KV5M_DATA, sizeof(sha1_oid), sha1_oid }; +@@ -48,6 +53,30 @@ krb5_data const * const supported_kdf_alg_ids[] = { + NULL + }; + ++/* RFC 4055 sha256WithRSAEncryption: iso(1) member-body(2) us(840) ++ * rsadsi(113549) pkcs(1) 1 11 */ ++static char sha256WithRSAEncr_oid[9] = { ++ 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b ++}; ++/* RFC 4055 sha256WithRSAEncryption: iso(1) member-body(2) us(840) ++ * rsadsi(113549) pkcs(1) 1 13 */ ++static char sha512WithRSAEncr_oid[9] = { ++ 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0d ++}; ++ ++const krb5_data sha256WithRSAEncr_id = { ++ KV5M_DATA, sizeof(sha256WithRSAEncr_oid), sha256WithRSAEncr_oid ++}; ++const krb5_data sha512WithRSAEncr_id = { ++ KV5M_DATA, sizeof(sha512WithRSAEncr_oid), sha512WithRSAEncr_oid ++}; ++ ++krb5_data const * const supported_cms_algs[] = { ++ &sha512WithRSAEncr_id, ++ &sha256WithRSAEncr_id, ++ NULL ++}; ++ + /* RFC 2412 section E.2 (well-known group 2) parameters, DER-encoded as + * DomainParameters (RFC 3279 section 2.3.3). */ + static const uint8_t o1024[] = { +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h +index 65f6210727..64300da856 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto.h ++++ b/src/plugins/preauth/pkinit/pkinit_crypto.h +@@ -620,6 +620,10 @@ extern const krb5_data oakley_4096; + */ + extern krb5_data const * const supported_kdf_alg_ids[]; + ++/* CMS signature algorithms supported by this implementation, in order of ++ * decreasing preference. */ ++extern krb5_data const * const supported_cms_algs[]; ++ + krb5_error_code + crypto_encode_der_cert(krb5_context context, pkinit_req_crypto_context reqctx, + uint8_t **der_out, size_t *der_len); +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index d500455dec..1c2aa02827 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -5475,37 +5475,38 @@ create_krb5_supportedCMSTypes(krb5_context context, + pkinit_plg_crypto_context plg_cryptoctx, + pkinit_req_crypto_context req_cryptoctx, + pkinit_identity_crypto_context id_cryptoctx, +- krb5_algorithm_identifier ***oids) ++ krb5_algorithm_identifier ***algs_out) + { ++ krb5_error_code ret; ++ krb5_algorithm_identifier **algs = NULL; ++ size_t i, count; + +- krb5_error_code retval = ENOMEM; +- krb5_algorithm_identifier **loids = NULL; +- krb5_data des3oid = {0, 8, "\x2A\x86\x48\x86\xF7\x0D\x03\x07" }; ++ *algs_out = NULL; + +- *oids = NULL; +- loids = malloc(2 * sizeof(krb5_algorithm_identifier *)); +- if (loids == NULL) +- goto cleanup; +- loids[1] = NULL; +- loids[0] = malloc(sizeof(krb5_algorithm_identifier)); +- if (loids[0] == NULL) { +- free(loids); +- goto cleanup; +- } +- retval = pkinit_copy_krb5_data(&loids[0]->algorithm, &des3oid); +- if (retval) { +- free(loids[0]); +- free(loids); ++ /* Count supported OIDs and allocate list (including null terminator). */ ++ for (count = 0; supported_cms_algs[count] != NULL; count++); ++ algs = k5calloc(count + 1, sizeof(*algs), &ret); ++ if (algs == NULL) + goto cleanup; ++ ++ /* Add an algorithm identifier for each OID, with no parameters. */ ++ for (i = 0; i < count; i++) { ++ algs[i] = k5alloc(sizeof(*algs[i]), &ret); ++ if (algs[i] == NULL) ++ goto cleanup; ++ ret = krb5int_copy_data_contents(context, supported_cms_algs[i], ++ &algs[i]->algorithm); ++ if (ret) ++ goto cleanup; ++ algs[i]->parameters = empty_data(); + } +- loids[0]->parameters.length = 0; +- loids[0]->parameters.data = NULL; + +- *oids = loids; +- retval = 0; +-cleanup: ++ *algs_out = algs; ++ algs = NULL; + +- return retval; ++cleanup: ++ free_krb5_algorithm_identifiers(&algs); ++ return ret; + } + + krb5_error_code +-- +2.38.1 + diff --git a/0009-Simplify-plugin-loading-code.patch b/0009-Simplify-plugin-loading-code.patch new file mode 100644 index 0000000..42802e5 --- /dev/null +++ b/0009-Simplify-plugin-loading-code.patch @@ -0,0 +1,622 @@ +From ffb47e4120d68aef015453350a3a50a9bab1ec58 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Thu, 23 Jun 2022 16:41:40 -0400 +Subject: [PATCH] Simplify plugin loading code + +Remove the USE_CFBUNDLE code, which was only used by KfM. Handle +platform conditionals according to current practice. Use +k5_dir_filenames() instead of opendir() and remove the Windows +implementation of opendir(). +--- + src/util/support/plugins.c | 507 +++++++++++-------------------------- + 1 file changed, 150 insertions(+), 357 deletions(-) + +diff --git a/src/util/support/plugins.c b/src/util/support/plugins.c +index c6a9a21d57..0850565687 100644 +--- a/src/util/support/plugins.c ++++ b/src/util/support/plugins.c +@@ -29,16 +29,6 @@ + #if USE_DLOPEN + #include + #endif +-#include +-#ifdef HAVE_SYS_STAT_H +-#include +-#endif +-#ifdef HAVE_SYS_PARAM_H +-#include +-#endif +-#ifdef HAVE_UNISTD_H +-#include +-#endif + + #if USE_DLOPEN + #ifdef RTLD_GROUP +@@ -68,16 +58,6 @@ + #endif + #endif + +-#if USE_DLOPEN && USE_CFBUNDLE +-#include +- +-/* Currently CoreFoundation only exists on the Mac so we just use +- * pthreads directly to avoid creating empty function calls on other +- * platforms. If a thread initializer ever gets created in the common +- * plugin code, move this there */ +-static pthread_mutex_t krb5int_bundle_mutex = PTHREAD_MUTEX_INITIALIZER; +-#endif +- + #include + static void Tprintf (const char *fmt, ...) + { +@@ -90,374 +70,193 @@ static void Tprintf (const char *fmt, ...) + } + + struct plugin_file_handle { +-#if USE_DLOPEN ++#if defined(USE_DLOPEN) + void *dlhandle; +-#endif +-#ifdef _WIN32 +- HMODULE hinstPlugin; +-#endif +-#if !defined (USE_DLOPEN) && !defined (_WIN32) ++#elif defined(_WIN32) ++ HMODULE module; ++#else + char dummy; + #endif + }; + +-#ifdef _WIN32 +-struct dirent { +- long d_ino; /* inode (always 1 in WIN32) */ +- off_t d_off; /* offset to this dirent */ +- unsigned short d_reclen; /* length of d_name */ +- char d_name[_MAX_FNAME+1]; /* filename (null terminated) */ +-}; +- +-typedef struct { +- intptr_t handle; /* _findfirst/_findnext handle */ +- short offset; /* offset into directory */ +- short finished; /* 1 if there are not more files */ +- struct _finddata_t fileinfo;/* from _findfirst/_findnext */ +- char *dir; /* the dir we are reading */ +- struct dirent dent; /* the dirent to return */ +-} DIR; ++#if defined(USE_DLOPEN) + +-DIR * opendir(const char *dir) ++static long ++open_plugin_dlfcn(struct plugin_file_handle *h, const char *filename, ++ struct errinfo *ep) + { +- DIR *dp; +- char *filespec; +- intptr_t handle; +- int index; +- +- filespec = malloc(strlen(dir) + 2 + 1); +- strcpy(filespec, dir); +- index = strlen(filespec) - 1; +- if (index >= 0 && (filespec[index] == '/' || filespec[index] == '\\')) +- filespec[index] = '\0'; +- strcat(filespec, "/*"); +- +- dp = (DIR *)malloc(sizeof(DIR)); +- dp->offset = 0; +- dp->finished = 0; +- dp->dir = strdup(dir); +- +- if ((handle = _findfirst(filespec, &(dp->fileinfo))) < 0) { +- if (errno == ENOENT) +- dp->finished = 1; +- else { +- free(filespec); +- free(dp->dir); +- free(dp); +- return NULL; +- } ++ const char *e; ++ ++ h->dlhandle = dlopen(filename, PLUGIN_DLOPEN_FLAGS); ++ if (h->dlhandle == NULL) { ++ e = dlerror(); ++ if (e == NULL) ++ e = _("unknown failure"); ++ Tprintf("dlopen(%s): %s\n", filename, e); ++ k5_set_error(ep, ENOENT, _("unable to load plugin [%s]: %s"), ++ filename, e); ++ return ENOENT; + } +- +- dp->handle = handle; +- free(filespec); +- +- return dp; ++ return 0; + } ++#define open_plugin open_plugin_dlfcn + +-struct dirent * readdir(DIR *dp) ++static long ++get_sym_dlfcn(struct plugin_file_handle *h, const char *csymname, ++ void **sym_out, struct errinfo *ep) + { +- if (!dp || dp->finished) return NULL; +- +- if (dp->offset != 0) { +- if (_findnext(dp->handle, &(dp->fileinfo)) < 0) { +- dp->finished = 1; +- return NULL; +- } ++ const char *e; ++ ++ if (h->dlhandle == NULL) ++ return ENOENT; ++ *sym_out = dlsym(h->dlhandle, csymname); ++ if (*sym_out == NULL) { ++ e = dlerror(); ++ if (e == NULL) ++ e = _("unknown failure"); ++ Tprintf("dlsym(%s): %s\n", csymname, e); ++ k5_set_error(ep, ENOENT, "%s", e); ++ return ENOENT; + } +- dp->offset++; +- +- strncpy(dp->dent.d_name, dp->fileinfo.name, _MAX_FNAME); +- dp->dent.d_ino = 1; +- dp->dent.d_reclen = (unsigned short)strlen(dp->dent.d_name); +- dp->dent.d_off = dp->offset; +- +- return &(dp->dent); +-} +- +-int closedir(DIR *dp) +-{ +- if (!dp) return 0; +- _findclose(dp->handle); +- free(dp->dir); +- free(dp); +- + return 0; + } +-#endif ++#define get_sym get_sym_dlfcn + +-long KRB5_CALLCONV +-krb5int_open_plugin (const char *filepath, struct plugin_file_handle **h, struct errinfo *ep) ++static void ++close_plugin_dlfcn(struct plugin_file_handle *h) + { +- long err = 0; +- struct plugin_file_handle *htmp = NULL; +- int got_plugin = 0; +-#if defined(USE_CFBUNDLE) || defined(_WIN32) +- struct stat statbuf; +- +- if (!err) { +- if (stat (filepath, &statbuf) < 0) { +- err = errno; +- Tprintf ("stat(%s): %s\n", filepath, strerror (err)); +- k5_set_error(ep, err, _("unable to find plugin [%s]: %s"), +- filepath, strerror(err)); +- } +- } +-#endif +- +- if (!err) { +- htmp = calloc (1, sizeof (*htmp)); /* calloc initializes ptrs to NULL */ +- if (htmp == NULL) { err = ENOMEM; } +- } +- +-#if USE_DLOPEN +- if (!err +-#if USE_CFBUNDLE +- && ((statbuf.st_mode & S_IFMT) == S_IFREG +- || (statbuf.st_mode & S_IFMT) == S_IFDIR) +-#endif /* USE_CFBUNDLE */ +- ) { +- void *handle = NULL; +- +-#if USE_CFBUNDLE +- char executablepath[MAXPATHLEN]; +- +- if ((statbuf.st_mode & S_IFMT) == S_IFDIR) { +- int lock_err = 0; +- CFStringRef pluginString = NULL; +- CFURLRef pluginURL = NULL; +- CFBundleRef pluginBundle = NULL; +- CFURLRef executableURL = NULL; +- +- /* Lock around CoreFoundation calls since objects are refcounted +- * and the refcounts are not thread-safe. Using pthreads directly +- * because this code is Mac-specific */ +- lock_err = pthread_mutex_lock(&krb5int_bundle_mutex); +- if (lock_err) { err = lock_err; } +- +- if (!err) { +- pluginString = CFStringCreateWithCString (kCFAllocatorDefault, +- filepath, +- kCFStringEncodingASCII); +- if (pluginString == NULL) { err = ENOMEM; } +- } +- +- if (!err) { +- pluginURL = CFURLCreateWithFileSystemPath (kCFAllocatorDefault, +- pluginString, +- kCFURLPOSIXPathStyle, +- true); +- if (pluginURL == NULL) { err = ENOMEM; } +- } +- +- if (!err) { +- pluginBundle = CFBundleCreate (kCFAllocatorDefault, pluginURL); +- if (pluginBundle == NULL) { err = ENOENT; } /* XXX need better error */ +- } +- +- if (!err) { +- executableURL = CFBundleCopyExecutableURL (pluginBundle); +- if (executableURL == NULL) { err = ENOMEM; } +- } +- +- if (!err) { +- if (!CFURLGetFileSystemRepresentation (executableURL, +- true, /* absolute */ +- (UInt8 *)executablepath, +- sizeof (executablepath))) { +- err = ENOMEM; +- } +- } +- +- if (!err) { +- /* override the path the caller passed in */ +- filepath = executablepath; +- } +- +- if (executableURL != NULL) { CFRelease (executableURL); } +- if (pluginBundle != NULL) { CFRelease (pluginBundle); } +- if (pluginURL != NULL) { CFRelease (pluginURL); } +- if (pluginString != NULL) { CFRelease (pluginString); } +- +- /* unlock after CFRelease calls since they modify refcounts */ +- if (!lock_err) { pthread_mutex_unlock (&krb5int_bundle_mutex); } +- } +-#endif /* USE_CFBUNDLE */ +- +- if (!err) { +- handle = dlopen(filepath, PLUGIN_DLOPEN_FLAGS); +- if (handle == NULL) { +- const char *e = dlerror(); +- if (e == NULL) +- e = _("unknown failure"); +- Tprintf ("dlopen(%s): %s\n", filepath, e); +- err = ENOENT; /* XXX */ +- k5_set_error(ep, err, _("unable to load plugin [%s]: %s"), +- filepath, e); +- } +- } ++ if (h->dlhandle != NULL) ++ dlclose(h->dlhandle); ++} ++#define close_plugin close_plugin_dlfcn + +- if (!err) { +- got_plugin = 1; +- htmp->dlhandle = handle; +- handle = NULL; +- } ++#elif defined(_WIN32) + +- if (handle != NULL) { dlclose (handle); } ++static long ++open_plugin_win32(struct plugin_file_handle *h, const char *filename, ++ struct errinfo *ep) ++{ ++ h->module = LoadLibrary(filename); ++ if (h == NULL) { ++ Tprintf("Unable to load dll: %s\n", filename); ++ k5_set_error(ep, ENOENT, _("unable to load DLL [%s]"), filename); ++ return ENOENT; + } +-#endif /* USE_DLOPEN */ +- +-#ifdef _WIN32 +- if (!err && (statbuf.st_mode & S_IFMT) == S_IFREG) { +- HMODULE handle = NULL; ++ return 0; ++} ++#define open_plugin open_plugin_win32 + +- handle = LoadLibrary(filepath); +- if (handle == NULL) { +- Tprintf ("Unable to load dll: %s\n", filepath); +- err = ENOENT; /* XXX */ +- k5_set_error(ep, err, _("unable to load DLL [%s]"), filepath); +- } ++static long ++get_sym_win32(struct plugin_file_handle *h, const char *csymname, ++ void **sym_out, struct errinfo *ep) ++{ ++ LPVOID lpMsgBuf; ++ DWORD dw; + +- if (!err) { +- got_plugin = 1; +- htmp->hinstPlugin = handle; +- handle = NULL; ++ if (h->module == NULL) ++ return ENOENT; ++ *sym_out = GetProcAddress(h->module, csymname); ++ if (*sym_out == NULL) { ++ Tprintf("GetProcAddress(%s): %i\n", csymname, GetLastError()); ++ dw = GetLastError(); ++ if (FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | ++ FORMAT_MESSAGE_FROM_SYSTEM, ++ NULL, dw, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), ++ (LPTSTR)&lpMsgBuf, 0, NULL)) { ++ k5_set_error(ep, ENOENT, _("unable to get DLL Symbol: %s"), ++ (char *)lpMsgBuf); ++ LocalFree(lpMsgBuf); + } +- +- if (handle != NULL) +- FreeLibrary(handle); +- } +-#endif +- +- if (!err && !got_plugin) { +- err = ENOENT; /* no plugin or no way to load plugins */ +- k5_set_error(ep, err, _("plugin unavailable: %s"), strerror(err)); ++ return ENOENT; + } ++ return 0; ++} ++#define get_sym get_sym_win32 + +- if (!err) { +- *h = htmp; +- htmp = NULL; /* h takes ownership */ +- } ++static void ++close_plugin_win32(struct plugin_file_handle *h) ++{ ++ if (h->module != NULL) ++ FreeLibrary(h->module); ++} ++#define close_plugin close_plugin_win32 + +- free(htmp); ++#else + +- return err; ++static long ++open_plugin_dummy(struct plugin_file_handle *h, const char *filename, ++ struct errinfo *ep) ++{ ++ k5_set_error(ep, ENOENT, _("plugin loading unavailable")); ++ return ENOENT; + } ++#define open_plugin open_plugin_dummy + + static long +-krb5int_get_plugin_sym (struct plugin_file_handle *h, +- const char *csymname, int isfunc, void **ptr, +- struct errinfo *ep) ++get_sym_dummy(struct plugin_file_handle *h, const char *csymname, ++ void **sym_out, struct errinfo *ep) + { +- long err = 0; +- void *sym = NULL; ++ return ENOENT; ++} ++#define get_sym get_sym_dummy ++ ++static void ++close_plugin_dummy(struct plugin_file_handle *h) ++{ ++} ++#define close_plugin close_plugin_dummy + +-#if USE_DLOPEN +- if (!err && !sym && (h->dlhandle != NULL)) { +- /* XXX Do we need to add a leading "_" to the symbol name on any +- modern platforms? */ +- sym = dlsym (h->dlhandle, csymname); +- if (sym == NULL) { +- const char *e = dlerror (); /* XXX copy and save away */ +- if (e == NULL) +- e = "unknown failure"; +- Tprintf ("dlsym(%s): %s\n", csymname, e); +- err = ENOENT; /* XXX */ +- k5_set_error(ep, err, "%s", e); +- } +- } + #endif + +-#ifdef _WIN32 +- LPVOID lpMsgBuf; +- DWORD dw; ++long KRB5_CALLCONV ++krb5int_open_plugin(const char *filename, ++ struct plugin_file_handle **handle_out, struct errinfo *ep) ++{ ++ long ret; ++ struct plugin_file_handle *h; + +- if (!err && !sym && (h->hinstPlugin != NULL)) { +- sym = GetProcAddress(h->hinstPlugin, csymname); +- if (sym == NULL) { +- const char *e = "unable to get dll symbol"; /* XXX copy and save away */ +- Tprintf ("GetProcAddress(%s): %i\n", csymname, GetLastError()); +- err = ENOENT; /* XXX */ +- k5_set_error(ep, err, "%s", e); +- +- dw = GetLastError(); +- if (FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | +- FORMAT_MESSAGE_FROM_SYSTEM, +- NULL, +- dw, +- MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), +- (LPTSTR) &lpMsgBuf, +- 0, NULL )) { +- +- fprintf (stderr, "unable to get dll symbol, %s\n", (LPCTSTR)lpMsgBuf); +- LocalFree(lpMsgBuf); +- } +- } +- } +-#endif ++ *handle_out = NULL; + +- if (!err && (sym == NULL)) { +- err = ENOENT; /* unimplemented */ +- } ++ h = calloc(1, sizeof(*h)); ++ if (h == NULL) ++ return ENOMEM; + +- if (!err) { +- *ptr = sym; ++ ret = open_plugin(h, filename, ep); ++ if (ret) { ++ free(h); ++ return ret; + } + +- return err; ++ *handle_out = h; ++ return 0; + } + + long KRB5_CALLCONV +-krb5int_get_plugin_data (struct plugin_file_handle *h, const char *csymname, +- void **ptr, struct errinfo *ep) ++krb5int_get_plugin_data(struct plugin_file_handle *h, const char *csymname, ++ void **sym_out, struct errinfo *ep) + { +- return krb5int_get_plugin_sym (h, csymname, 0, ptr, ep); ++ return get_sym(h, csymname, sym_out, ep); + } + + long KRB5_CALLCONV +-krb5int_get_plugin_func (struct plugin_file_handle *h, const char *csymname, +- void (**ptr)(), struct errinfo *ep) ++krb5int_get_plugin_func(struct plugin_file_handle *h, const char *csymname, ++ void (**sym_out)(), struct errinfo *ep) + { + void *dptr = NULL; +- long err = krb5int_get_plugin_sym (h, csymname, 1, &dptr, ep); +- if (!err) { +- /* Cast function pointers to avoid code duplication */ +- *ptr = (void (*)()) dptr; +- } +- return err; ++ long ret = get_sym(h, csymname, &dptr, ep); ++ ++ if (!ret) ++ *sym_out = (void (*)())dptr; ++ return ret; + } + + void KRB5_CALLCONV + krb5int_close_plugin (struct plugin_file_handle *h) + { +-#if USE_DLOPEN +- if (h->dlhandle != NULL) { dlclose(h->dlhandle); } +-#endif +-#ifdef _WIN32 +- if (h->hinstPlugin != NULL) { FreeLibrary(h->hinstPlugin); } +-#endif +- free (h); ++ close_plugin(h); ++ free(h); + } + +-/* autoconf docs suggest using this preference order */ +-#if HAVE_DIRENT_H || USE_DIRENT_H +-#include +-#define NAMELEN(D) strlen((D)->d_name) +-#else +-#ifndef _WIN32 +-#define dirent direct +-#define NAMELEN(D) ((D)->d->namlen) +-#else +-#define NAMELEN(D) strlen((D)->d_name) +-#endif +-#if HAVE_SYS_NDIR_H +-# include +-#elif HAVE_SYS_DIR_H +-# include +-#elif HAVE_NDIR_H +-# include +-#endif +-#endif +- + static long + krb5int_plugin_file_handle_array_init (struct plugin_file_handle ***harray) + { +@@ -619,42 +418,36 @@ krb5int_open_plugin_dirs (const char * const *dirnames, + if (handle != NULL) { krb5int_close_plugin (handle); } + } + } else { +- /* load all plugins in each directory */ +- DIR *dir = opendir (dirnames[i]); ++ char **fnames = NULL; ++ int j; + +- while (dir != NULL && !err) { +- struct dirent *d = NULL; ++ err = k5_dir_filenames(dirnames[i], &fnames); ++ for (j = 0; !err && fnames[j] != NULL; j++) { + char *filepath = NULL; + struct plugin_file_handle *handle = NULL; + +- d = readdir (dir); +- if (d == NULL) { break; } +- +- if ((strcmp (d->d_name, ".") == 0) || +- (strcmp (d->d_name, "..") == 0)) { ++ if (strcmp(fnames[j], ".") == 0 || ++ strcmp(fnames[j], "..") == 0) + continue; +- } + +- if (!err) { +- int len = NAMELEN (d); +- if (asprintf(&filepath, "%s/%*s", dirnames[i], len, d->d_name) < 0) { +- filepath = NULL; +- err = ENOMEM; +- } ++ if (asprintf(&filepath, "%s/%s", dirnames[i], fnames[j]) < 0) { ++ filepath = NULL; ++ err = ENOMEM; + } + +- if (!err) { +- if (krb5int_open_plugin (filepath, &handle, ep) == 0) { +- err = krb5int_plugin_file_handle_array_add (&h, &count, handle); +- if (!err) { handle = NULL; } /* h takes ownership */ +- } ++ if (!err && krb5int_open_plugin(filepath, &handle, ep) == 0) { ++ err = krb5int_plugin_file_handle_array_add(&h, &count, ++ handle); ++ if (!err) ++ handle = NULL; /* h takes ownership */ + } + + free(filepath); +- if (handle != NULL) { krb5int_close_plugin (handle); } ++ if (handle != NULL) ++ krb5int_close_plugin(handle); + } + +- if (dir != NULL) { closedir (dir); } ++ k5_free_filenames(fnames); + } + } + +-- +2.38.1 + diff --git a/Add-APIs-for-marshalling-credentials.patch b/Add-APIs-for-marshalling-credentials.patch deleted file mode 100644 index 8578721..0000000 --- a/Add-APIs-for-marshalling-credentials.patch +++ /dev/null @@ -1,220 +0,0 @@ -From 3a99832252755cf7e5fef2bd824459cea3eb823e Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Thu, 14 Jan 2021 18:13:09 -0500 -Subject: [PATCH] Add APIs for marshalling credentials - -Faciliate KCM daemon implementations by providing functions to -deserialize and reserialize credentials in the FILE v4 format. - -[ghudson@mit.edu: minor editorial changes] - -ticket: 8980 (new) -(cherry picked from commit 18ea3bd2fca55b789b7de9c663624bc11d348fa6) ---- - doc/appdev/refs/api/index.rst | 2 ++ - src/include/krb5/krb5.hin | 36 ++++++++++++++++++++++ - src/lib/krb5/ccache/ccmarshal.c | 53 +++++++++++++++++++++++++++++++++ - src/lib/krb5/ccache/t_marshal.c | 15 +++++++++- - src/lib/krb5/libkrb5.exports | 2 ++ - src/lib/krb5_32.def | 4 +++ - 6 files changed, 111 insertions(+), 1 deletion(-) - -diff --git a/doc/appdev/refs/api/index.rst b/doc/appdev/refs/api/index.rst -index 727d9b492..9e03fd386 100644 ---- a/doc/appdev/refs/api/index.rst -+++ b/doc/appdev/refs/api/index.rst -@@ -232,6 +232,7 @@ Rarely used public interfaces - krb5_kt_remove_entry.rst - krb5_kt_start_seq_get.rst - krb5_make_authdata_kdc_issued.rst -+ krb5_marshal_credentials.rst - krb5_merge_authdata.rst - krb5_mk_1cred.rst - krb5_mk_error.rst -@@ -285,6 +286,7 @@ Rarely used public interfaces - krb5_tkt_creds_get_times.rst - krb5_tkt_creds_init.rst - krb5_tkt_creds_step.rst -+ krb5_unmarshal_credentials.rst - krb5_verify_init_creds.rst - krb5_verify_init_creds_opt_init.rst - krb5_verify_init_creds_opt_set_ap_req_nofail.rst -diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin -index 63e67a2ba..c26dde535 100644 ---- a/src/include/krb5/krb5.hin -+++ b/src/include/krb5/krb5.hin -@@ -3125,6 +3125,42 @@ krb5_get_credentials(krb5_context context, krb5_flags options, - krb5_ccache ccache, krb5_creds *in_creds, - krb5_creds **out_creds); - -+/** -+ * Serialize a @c krb5_creds object. -+ * -+ * @param [in] context Library context -+ * @param [in] creds The credentials object to serialize -+ * @param [out] data_out The serialized credentials -+ * -+ * Serialize @a creds in the format used by the FILE ccache format (vesion 4) -+ * and KCM ccache protocol. -+ * -+ * Use krb5_free_data() to free @a data_out when it is no longer needed. -+ * -+ * @retval 0 Success; otherwise - Kerberos error codes -+ */ -+krb5_error_code KRB5_CALLCONV -+krb5_marshal_credentials(krb5_context context, krb5_creds *in_creds, -+ krb5_data **data_out); -+ -+/** -+ * Deserialize a @c krb5_creds object. -+ * -+ * @param [in] context Library context -+ * @param [in] data The serialized credentials -+ * @param [out] creds_out The resulting creds object -+ * -+ * Deserialize @a data to credentials in the format used by the FILE ccache -+ * format (vesion 4) and KCM ccache protocol. -+ * -+ * Use krb5_free_creds() to free @a creds_out when it is no longer needed. -+ * -+ * @retval 0 Success; otherwise - Kerberos error codes -+ */ -+krb5_error_code KRB5_CALLCONV -+krb5_unmarshal_credentials(krb5_context context, const krb5_data *data, -+ krb5_creds **creds_out); -+ - /** @deprecated Replaced by krb5_get_validated_creds. */ - krb5_error_code KRB5_CALLCONV - krb5_get_credentials_validate(krb5_context context, krb5_flags options, -diff --git a/src/lib/krb5/ccache/ccmarshal.c b/src/lib/krb5/ccache/ccmarshal.c -index ae634ccab..ab284e721 100644 ---- a/src/lib/krb5/ccache/ccmarshal.c -+++ b/src/lib/krb5/ccache/ccmarshal.c -@@ -515,3 +515,56 @@ k5_marshal_mcred(struct k5buf *buf, krb5_creds *mcred) - if (mcred->second_ticket.length > 0) - put_data(buf, version, &mcred->second_ticket); - } -+ -+krb5_error_code KRB5_CALLCONV -+krb5_marshal_credentials(krb5_context context, krb5_creds *in_creds, -+ krb5_data **data_out) -+{ -+ krb5_error_code ret; -+ krb5_data *data; -+ struct k5buf buf; -+ -+ *data_out = NULL; -+ -+ data = k5alloc(sizeof(krb5_data), &ret); -+ if (ret) -+ return ret; -+ -+ k5_buf_init_dynamic(&buf); -+ k5_marshal_cred(&buf, 4, in_creds); -+ -+ ret = k5_buf_status(&buf); -+ if (ret) { -+ free(data); -+ return ret; -+ } -+ -+ /* Steal payload from buf. */ -+ *data = make_data(buf.data, buf.len); -+ *data_out = data; -+ return 0; -+} -+ -+krb5_error_code KRB5_CALLCONV -+krb5_unmarshal_credentials(krb5_context context, const krb5_data *data, -+ krb5_creds **creds_out) -+{ -+ krb5_error_code ret; -+ krb5_creds *creds; -+ -+ *creds_out = NULL; -+ -+ creds = k5alloc(sizeof(krb5_creds), &ret); -+ if (ret) -+ return ret; -+ -+ ret = k5_unmarshal_cred((unsigned char *)data->data, data->length, 4, -+ creds); -+ if (ret) { -+ free(creds); -+ return ret; -+ } -+ -+ *creds_out = creds; -+ return 0; -+} -diff --git a/src/lib/krb5/ccache/t_marshal.c b/src/lib/krb5/ccache/t_marshal.c -index bd0284afa..96e0931a2 100644 ---- a/src/lib/krb5/ccache/t_marshal.c -+++ b/src/lib/krb5/ccache/t_marshal.c -@@ -268,13 +268,14 @@ main(int argc, char **argv) - krb5_context context; - krb5_ccache cache; - krb5_principal princ; -- krb5_creds cred1, cred2; -+ krb5_creds cred1, cred2, *alloc_cred; - krb5_cc_cursor cursor; - const char *filename; - char *ccname, filebuf[256]; - int version, fd; - const struct test *t; - struct k5buf buf; -+ krb5_data ser_data, *alloc_data; - - if (argc != 2) - abort(); -@@ -285,6 +286,18 @@ main(int argc, char **argv) - if (krb5_init_context(&context) != 0) - abort(); - -+ /* Test public functions for unmarshalling and marshalling. */ -+ ser_data = make_data((char *)tests[3].cred1, tests[3].cred1len); -+ if (krb5_unmarshal_credentials(context, &ser_data, &alloc_cred) != 0) -+ abort(); -+ verify_cred1(alloc_cred); -+ if (krb5_marshal_credentials(context, alloc_cred, &alloc_data) != 0) -+ abort(); -+ assert(alloc_data->length == tests[3].cred1len); -+ assert(memcmp(tests[3].cred1, alloc_data->data, alloc_data->length) == 0); -+ krb5_free_data(context, alloc_data); -+ krb5_free_creds(context, alloc_cred); -+ - for (version = FIRST_VERSION; version <= 4; version++) { - t = &tests[version - 1]; - -diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports -index 2d9d56530..adbfa332b 100644 ---- a/src/lib/krb5/libkrb5.exports -+++ b/src/lib/krb5/libkrb5.exports -@@ -489,6 +489,7 @@ krb5_lock_file - krb5_make_authdata_kdc_issued - krb5_make_full_ipaddr - krb5_make_fulladdr -+krb5_marshal_credentials - krb5_mcc_ops - krb5_merge_authdata - krb5_mk_1cred -@@ -592,6 +593,7 @@ krb5_timeofday - krb5_timestamp_to_sfstring - krb5_timestamp_to_string - krb5_unlock_file -+krb5_unmarshal_credentials - krb5_unpack_full_ipaddr - krb5_unparse_name - krb5_unparse_name_ext -diff --git a/src/lib/krb5_32.def b/src/lib/krb5_32.def -index 4953907aa..60b8dd311 100644 ---- a/src/lib/krb5_32.def -+++ b/src/lib/krb5_32.def -@@ -503,3 +503,7 @@ EXPORTS - ; new in 1.19 - k5_cc_store_primary_cred @470 ; PRIVATE - k5_kt_have_match @471 ; PRIVATE GSSAPI -+ -+; new in 1.20 -+ krb5_marshal_credentials @472 -+ krb5_unmarshal_credentials @473 diff --git a/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch b/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch deleted file mode 100644 index 455e3e0..0000000 --- a/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch +++ /dev/null @@ -1,358 +0,0 @@ -From 8772d8f47b7460a0eef48366881483fd9b3acfd3 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Pavel=20B=C5=99ezina?= -Date: Thu, 11 Feb 2021 15:33:10 +0100 -Subject: [PATCH] Add KCM_OP_GET_CRED_LIST for faster iteration - -For large caches, one IPC operation per credential dominates the cost -of iteration. Instead transfer the whole list of credentials to the -client in one IPC operation. - -Add optional support for the new opcode to the test KCM server to -allow testing of the main and fallback code paths. - -[ghudson@mit.edu: fixed memory leaks and potential memory errors; -adjusted code style and comments; rewrote commit message; added -kcmserver.py support and tests] - -ticket: 8990 (new) -(cherry picked from commit 81bdb47d8ded390263d8ee48f71d5c312b4f1736) ---- - src/include/kcm.h | 12 ++- - src/lib/krb5/ccache/cc_kcm.c | 144 ++++++++++++++++++++++++++++++++--- - src/tests/kcmserver.py | 28 ++++++- - src/tests/t_ccache.py | 10 ++- - 4 files changed, 175 insertions(+), 19 deletions(-) - -diff --git a/src/include/kcm.h b/src/include/kcm.h -index 5ea1447cd..e4140c3a0 100644 ---- a/src/include/kcm.h -+++ b/src/include/kcm.h -@@ -51,9 +51,9 @@ - * - * All replies begin with a 32-bit big-endian reply code. - * -- * Parameters are appended to the request or reply with no delimiters. Flags -- * and time offsets are stored as 32-bit big-endian integers. Names are -- * marshalled as zero-terminated strings. Principals and credentials are -+ * Parameters are appended to the request or reply with no delimiters. Flags, -+ * time offsets, and lengths are stored as 32-bit big-endian integers. Names -+ * are marshalled as zero-terminated strings. Principals and credentials are - * marshalled in the v4 FILE ccache format. UUIDs are 16 bytes. UUID lists - * are not delimited, so nothing can come after them. - */ -@@ -89,7 +89,11 @@ typedef enum kcm_opcode { - KCM_OP_HAVE_NTLM_CRED, - KCM_OP_DEL_NTLM_CRED, - KCM_OP_DO_NTLM_AUTH, -- KCM_OP_GET_NTLM_USER_LIST -+ KCM_OP_GET_NTLM_USER_LIST, -+ -+ /* MIT extensions */ -+ KCM_OP_MIT_EXTENSION_BASE = 13000, -+ KCM_OP_GET_CRED_LIST, /* (name) -> (count, count*{len, cred}) */ - } kcm_opcode; - - #endif /* KCM_H */ -diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c -index 9093f894d..772928e4d 100644 ---- a/src/lib/krb5/ccache/cc_kcm.c -+++ b/src/lib/krb5/ccache/cc_kcm.c -@@ -61,6 +61,17 @@ struct uuid_list { - size_t pos; - }; - -+struct cred_list { -+ krb5_creds *creds; -+ size_t count; -+ size_t pos; -+}; -+ -+struct kcm_cursor { -+ struct uuid_list *uuids; -+ struct cred_list *creds; -+}; -+ - struct kcmio { - SOCKET fd; - #ifdef __APPLE__ -@@ -489,6 +500,69 @@ free_uuid_list(struct uuid_list *uuids) - free(uuids); - } - -+static void -+free_cred_list(struct cred_list *list) -+{ -+ size_t i; -+ -+ if (list == NULL) -+ return; -+ -+ /* Creds are transferred to the caller as list->pos is incremented, so we -+ * can start freeing there. */ -+ for (i = list->pos; i < list->count; i++) -+ krb5_free_cred_contents(NULL, &list->creds[i]); -+ free(list->creds); -+ free(list); -+} -+ -+/* Fetch a cred list from req->reply. */ -+static krb5_error_code -+kcmreq_get_cred_list(struct kcmreq *req, struct cred_list **creds_out) -+{ -+ struct cred_list *list; -+ const unsigned char *data; -+ krb5_error_code ret = 0; -+ size_t count, len, i; -+ -+ *creds_out = NULL; -+ -+ /* Check a rough bound on the count to prevent very large allocations. */ -+ count = k5_input_get_uint32_be(&req->reply); -+ if (count > req->reply.len / 4) -+ return KRB5_KCM_MALFORMED_REPLY; -+ -+ list = malloc(sizeof(*list)); -+ if (list == NULL) -+ return ENOMEM; -+ -+ list->creds = NULL; -+ list->count = count; -+ list->pos = 0; -+ list->creds = k5calloc(count, sizeof(*list->creds), &ret); -+ if (list->creds == NULL) { -+ free(list); -+ return ret; -+ } -+ -+ for (i = 0; i < count; i++) { -+ len = k5_input_get_uint32_be(&req->reply); -+ data = k5_input_get_bytes(&req->reply, len); -+ if (data == NULL) -+ break; -+ ret = k5_unmarshal_cred(data, len, 4, &list->creds[i]); -+ if (ret) -+ break; -+ } -+ if (i < count) { -+ free_cred_list(list); -+ return (ret == ENOMEM) ? ENOMEM : KRB5_KCM_MALFORMED_REPLY; -+ } -+ -+ *creds_out = list; -+ return 0; -+} -+ - static void - kcmreq_free(struct kcmreq *req) - { -@@ -753,33 +827,53 @@ kcm_start_seq_get(krb5_context context, krb5_ccache cache, - { - krb5_error_code ret; - struct kcmreq req = EMPTY_KCMREQ; -- struct uuid_list *uuids; -+ struct uuid_list *uuids = NULL; -+ struct cred_list *creds = NULL; -+ struct kcm_cursor *cursor; - - *cursor_out = NULL; - - get_kdc_offset(context, cache); - -- kcmreq_init(&req, KCM_OP_GET_CRED_UUID_LIST, cache); -+ kcmreq_init(&req, KCM_OP_GET_CRED_LIST, cache); - ret = cache_call(context, cache, &req); -- if (ret) -+ if (ret == 0) { -+ /* GET_CRED_LIST is available. */ -+ ret = kcmreq_get_cred_list(&req, &creds); -+ if (ret) -+ goto cleanup; -+ } else if (ret == KRB5_FCC_INTERNAL) { -+ /* Fall back to GET_CRED_UUID_LIST. */ -+ kcmreq_free(&req); -+ kcmreq_init(&req, KCM_OP_GET_CRED_UUID_LIST, cache); -+ ret = cache_call(context, cache, &req); -+ if (ret) -+ goto cleanup; -+ ret = kcmreq_get_uuid_list(&req, &uuids); -+ if (ret) -+ goto cleanup; -+ } else { - goto cleanup; -- ret = kcmreq_get_uuid_list(&req, &uuids); -- if (ret) -+ } -+ -+ cursor = k5alloc(sizeof(*cursor), &ret); -+ if (cursor == NULL) - goto cleanup; -- *cursor_out = (krb5_cc_cursor)uuids; -+ cursor->uuids = uuids; -+ cursor->creds = creds; -+ *cursor_out = (krb5_cc_cursor)cursor; - - cleanup: - kcmreq_free(&req); - return ret; - } - --static krb5_error_code KRB5_CALLCONV --kcm_next_cred(krb5_context context, krb5_ccache cache, krb5_cc_cursor *cursor, -- krb5_creds *cred_out) -+static krb5_error_code -+next_cred_by_uuid(krb5_context context, krb5_ccache cache, -+ struct uuid_list *uuids, krb5_creds *cred_out) - { - krb5_error_code ret; - struct kcmreq req; -- struct uuid_list *uuids = (struct uuid_list *)*cursor; - - memset(cred_out, 0, sizeof(*cred_out)); - -@@ -797,11 +891,39 @@ kcm_next_cred(krb5_context context, krb5_ccache cache, krb5_cc_cursor *cursor, - return map_invalid(ret); - } - -+static krb5_error_code KRB5_CALLCONV -+kcm_next_cred(krb5_context context, krb5_ccache cache, krb5_cc_cursor *cursor, -+ krb5_creds *cred_out) -+{ -+ struct kcm_cursor *c = (struct kcm_cursor *)*cursor; -+ struct cred_list *list; -+ -+ if (c->uuids != NULL) -+ return next_cred_by_uuid(context, cache, c->uuids, cred_out); -+ -+ list = c->creds; -+ if (list->pos >= list->count) -+ return KRB5_CC_END; -+ -+ /* Transfer memory ownership of one cred to the caller. */ -+ *cred_out = list->creds[list->pos]; -+ memset(&list->creds[list->pos], 0, sizeof(*list->creds)); -+ list->pos++; -+ -+ return 0; -+} -+ - static krb5_error_code KRB5_CALLCONV - kcm_end_seq_get(krb5_context context, krb5_ccache cache, - krb5_cc_cursor *cursor) - { -- free_uuid_list((struct uuid_list *)*cursor); -+ struct kcm_cursor *c = *cursor; -+ -+ if (c == NULL) -+ return 0; -+ free_uuid_list(c->uuids); -+ free_cred_list(c->creds); -+ free(c); - *cursor = NULL; - return 0; - } -diff --git a/src/tests/kcmserver.py b/src/tests/kcmserver.py -index 57432e5a7..8c5e66ff1 100644 ---- a/src/tests/kcmserver.py -+++ b/src/tests/kcmserver.py -@@ -23,6 +23,7 @@ - # traceback.print_exception(etype, value, tb, file=f) - # sys.excepthook = ehook - -+import optparse - import select - import socket - import struct -@@ -49,12 +50,14 @@ class KCMOpcodes(object): - SET_DEFAULT_CACHE = 21 - GET_KDC_OFFSET = 22 - SET_KDC_OFFSET = 23 -+ GET_CRED_LIST = 13001 - - - class KRB5Errors(object): - KRB5_CC_END = -1765328242 - KRB5_CC_NOSUPP = -1765328137 - KRB5_FCC_NOFILE = -1765328189 -+ KRB5_FCC_INTERNAL = -1765328188 - - - def make_uuid(): -@@ -183,6 +186,14 @@ def op_set_kdc_offset(argbytes): - return 0, b'' - - -+def op_get_cred_list(argbytes): -+ name, rest = unmarshal_name(argbytes) -+ cache = get_cache(name) -+ creds = [cache.creds[u] for u in cache.cred_uuids] -+ return 0, (struct.pack('>L', len(creds)) + -+ b''.join(struct.pack('>L', len(c)) + c for c in creds)) -+ -+ - ophandlers = { - KCMOpcodes.GEN_NEW : op_gen_new, - KCMOpcodes.INITIALIZE : op_initialize, -@@ -197,7 +208,8 @@ ophandlers = { - KCMOpcodes.GET_DEFAULT_CACHE : op_get_default_cache, - KCMOpcodes.SET_DEFAULT_CACHE : op_set_default_cache, - KCMOpcodes.GET_KDC_OFFSET : op_get_kdc_offset, -- KCMOpcodes.SET_KDC_OFFSET : op_set_kdc_offset -+ KCMOpcodes.SET_KDC_OFFSET : op_set_kdc_offset, -+ KCMOpcodes.GET_CRED_LIST : op_get_cred_list - } - - # Read and respond to a request from the socket s. -@@ -215,7 +227,11 @@ def service_request(s): - - majver, minver, op = struct.unpack('>BBH', req[:4]) - argbytes = req[4:] -- code, payload = ophandlers[op](argbytes) -+ -+ if op in ophandlers: -+ code, payload = ophandlers[op](argbytes) -+ else: -+ code, payload = KRB5Errors.KRB5_FCC_INTERNAL, b'' - - # The KCM response is the code (4 bytes) and the response payload. - # The Heimdal IPC response is the length of the KCM response (4 -@@ -226,9 +242,15 @@ def service_request(s): - s.sendall(hipc_response) - return True - -+parser = optparse.OptionParser() -+parser.add_option('-c', '--credlist', action='store_true', dest='credlist', -+ default=False, help='Support KCM_OP_GET_CRED_LIST') -+(options, args) = parser.parse_args() -+if not options.credlist: -+ del ophandlers[KCMOpcodes.GET_CRED_LIST] - - server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) --server.bind(sys.argv[1]) -+server.bind(args[0]) - server.listen(5) - select_input = [server,] - sys.stderr.write('starting...\n') -diff --git a/src/tests/t_ccache.py b/src/tests/t_ccache.py -index 66804afa5..90040fb7b 100755 ---- a/src/tests/t_ccache.py -+++ b/src/tests/t_ccache.py -@@ -125,10 +125,18 @@ def collection_test(realm, ccname): - - - collection_test(realm, 'DIR:' + os.path.join(realm.testdir, 'cc')) -+ -+# Test KCM without and with GET_CRED_LIST support. - kcmserver_path = os.path.join(srctop, 'tests', 'kcmserver.py') --realm.start_server([sys.executable, kcmserver_path, kcm_socket_path], -+kcmd = realm.start_server([sys.executable, kcmserver_path, kcm_socket_path], -+ 'starting...') -+collection_test(realm, 'KCM:') -+stop_daemon(kcmd) -+os.remove(kcm_socket_path) -+realm.start_server([sys.executable, kcmserver_path, '-c', kcm_socket_path], - 'starting...') - collection_test(realm, 'KCM:') -+ - if test_keyring: - def cleanup_keyring(anchor, name): - out = realm.run(['keyctl', 'list', anchor]) diff --git a/Add-buildsystem-detection-of-the-OpenSSL-3-KDF-inter.patch b/Add-buildsystem-detection-of-the-OpenSSL-3-KDF-inter.patch deleted file mode 100644 index 269a457..0000000 --- a/Add-buildsystem-detection-of-the-OpenSSL-3-KDF-inter.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 2f039fc910022c9569fe6941a194f0b26bd6c894 Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Fri, 20 Sep 2019 16:11:29 -0400 -Subject: [PATCH] Add buildsystem detection of the OpenSSL-3 KDF interface - -(cherry picked from commit a3e03dfd40928c4615bd9b8546eac0c104377850) ---- - src/configure.ac | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/src/configure.ac b/src/configure.ac -index eb6307468..9c2e816fe 100644 ---- a/src/configure.ac -+++ b/src/configure.ac -@@ -282,6 +282,10 @@ AC_SUBST(CRYPTO_IMPL) - AC_SUBST(CRYPTO_IMPL_CFLAGS) - AC_SUBST(CRYPTO_IMPL_LIBS) - -+if test "$CRYPTO_IMPL" = openssl; then -+ AC_CHECK_FUNCS(EVP_KDF_fetch) -+fi -+ - AC_ARG_WITH([prng-alg], - AC_HELP_STRING([--with-prng-alg=ALG], [use specified PRNG algorithm. @<:@fortuna@:>@]), - [PRNG_ALG=$withval diff --git a/Add-hostname-canonicalization-helper-to-k5test.py.patch b/Add-hostname-canonicalization-helper-to-k5test.py.patch deleted file mode 100644 index 58179a2..0000000 --- a/Add-hostname-canonicalization-helper-to-k5test.py.patch +++ /dev/null @@ -1,84 +0,0 @@ -From e88f0319427cee7245fb05c97a25473297c9d2d6 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Fri, 15 Jan 2021 14:43:34 -0500 -Subject: [PATCH] Add hostname canonicalization helper to k5test.py - -To facilitate fallback tests, add a canonicalize_hostname() function -to k5test.py which works similarly to krb5_expand_hostname(). Use it -in t_gssapi.py for the recently-added acceptor name fallback test. - -(cherry picked from commit 225fffe4e912772acea3a01d45bafb60bfb80948) ---- - src/tests/gssapi/t_gssapi.py | 11 +++-------- - src/util/k5test.py | 22 ++++++++++++++++++++++ - 2 files changed, 25 insertions(+), 8 deletions(-) - -diff --git a/src/tests/gssapi/t_gssapi.py b/src/tests/gssapi/t_gssapi.py -index 1af6f31c2..e22cec427 100755 ---- a/src/tests/gssapi/t_gssapi.py -+++ b/src/tests/gssapi/t_gssapi.py -@@ -8,7 +8,7 @@ for realm in multipass_realms(): - realm.run(['./t_iov', '-s', 'p:' + realm.host_princ]) - realm.run(['./t_pcontok', 'p:' + realm.host_princ]) - --realm = K5Realm(krb5_conf={'libdefaults': {'rdns': 'false'}}) -+realm = K5Realm() - - # Test gss_add_cred(). - realm.run(['./t_add_cred']) -@@ -62,13 +62,8 @@ realm.run(['./t_accname', 'p:host/-nomatch-', - expected_msg=' not found in keytab') - - # If possible, test with an acceptor name requiring fallback to match --# against a keytab entry. Forward-canonicalize the hostname, relying --# on the rdns=false realm setting. --try: -- ai = socket.getaddrinfo(hostname, None, 0, 0, 0, socket.AI_CANONNAME) -- (family, socktype, proto, canonname, sockaddr) = ai[0] --except socket.gaierror: -- canonname = hostname -+# against a keytab entry. -+canonname = canonicalize_hostname(hostname) - if canonname != hostname: - os.rename(realm.keytab, realm.keytab + '.save') - canonprinc = 'host/' + canonname -diff --git a/src/util/k5test.py b/src/util/k5test.py -index 789b0f4b9..251d11a9d 100644 ---- a/src/util/k5test.py -+++ b/src/util/k5test.py -@@ -155,6 +155,10 @@ Scripts may use the following functions and variables: - * password(name): Return a weakly random password based on name. The - password will be consistent across calls with the same name. - -+* canonicalize_hostname(name, rdns=True): Return the DNS -+ canonicalization of name, optionally using reverse DNS. On error, -+ return name converted to lowercase. -+ - * stop_daemon(proc): Stop a daemon process started with - realm.start_server() or realm.start_in_inetd(). Only necessary if - the port needs to be reused; daemon processes will be stopped -@@ -458,6 +462,24 @@ def password(name): - return name + str(os.getpid()) - - -+def canonicalize_hostname(name, rdns=True): -+ """Canonicalize name using DNS, optionally with reverse DNS.""" -+ try: -+ ai = socket.getaddrinfo(name, None, 0, 0, 0, socket.AI_CANONNAME) -+ except socket.gaierror as e: -+ return name.lower() -+ (family, socktype, proto, canonname, sockaddr) = ai[0] -+ -+ if not rdns: -+ return canonname.lower() -+ -+ try: -+ rname = socket.getnameinfo(sockaddr, socket.NI_NAMEREQD) -+ except socket.gaierror: -+ return canonname.lower() -+ return rname[0].lower() -+ -+ - # Exit handler which ensures processes are cleaned up and, on failure, - # prints messages to help developers debug the problem. - def _onexit(): diff --git a/Allow-kinit-with-keytab-to-defer-canonicalization.patch b/Allow-kinit-with-keytab-to-defer-canonicalization.patch deleted file mode 100644 index eee7d1d..0000000 --- a/Allow-kinit-with-keytab-to-defer-canonicalization.patch +++ /dev/null @@ -1,60 +0,0 @@ -From fb4d9fa851b1d0d3375556d1cdc1fce72176df1e Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Thu, 3 Jun 2021 16:03:07 -0400 -Subject: [PATCH] Allow kinit with keytab to defer canonicalization - -[ghudson@mit.edu: added tests] - -ticket: 9012 (new) -(cherry picked from commit 5e6a6efc5df689d9fb8730d0227167ffbb6ece0e) ---- - src/clients/kinit/kinit.c | 11 ----------- - src/tests/t_keytab.py | 13 +++++++++++++ - 2 files changed, 13 insertions(+), 11 deletions(-) - -diff --git a/src/clients/kinit/kinit.c b/src/clients/kinit/kinit.c -index d1f5d74c3..5a6d7237c 100644 ---- a/src/clients/kinit/kinit.c -+++ b/src/clients/kinit/kinit.c -@@ -510,17 +510,6 @@ k5_begin(struct k_opts *opts, struct k5_data *k5) - _("when creating default server principal name")); - goto cleanup; - } -- if (k5->me->realm.data[0] == 0) { -- ret = krb5_unparse_name(k5->ctx, k5->me, &k5->name); -- if (ret == 0) { -- com_err(progname, KRB5_ERR_HOST_REALM_UNKNOWN, -- _("(principal %s)"), k5->name); -- } else { -- com_err(progname, KRB5_ERR_HOST_REALM_UNKNOWN, -- _("for local services")); -- } -- goto cleanup; -- } - } else if (k5->out_cc != NULL) { - /* If the output ccache is initialized, use its principal. */ - if (krb5_cc_get_principal(k5->ctx, k5->out_cc, &princ) == 0) -diff --git a/src/tests/t_keytab.py b/src/tests/t_keytab.py -index 850375c92..a9adebb26 100755 ---- a/src/tests/t_keytab.py -+++ b/src/tests/t_keytab.py -@@ -41,6 +41,19 @@ realm.kinit(realm.user_princ, flags=['-i'], - expected_msg='keytab specified, forcing -k') - realm.klist(realm.user_princ) - -+# Test default principal for -k. This operation requires -+# canonicalization against the keytab in krb5_get_init_creds_keytab() -+# as the krb5_sname_to_principal() result won't have a realm. Try -+# with and without without fallback processing since the code paths -+# are different. -+mark('default principal for -k') -+realm.run([kinit, '-k']) -+realm.klist(realm.host_princ) -+no_canon_conf = {'libdefaults': {'dns_canonicalize_hostname': 'false'}} -+no_canon = realm.special_env('no_canon', False, krb5_conf=no_canon_conf) -+realm.run([kinit, '-k'], env=no_canon) -+realm.klist(realm.host_princ) -+ - # Test extracting keys with multiple key versions present. - mark('multi-kvno extract') - os.remove(realm.keytab) diff --git a/Clean-up-context-after-failed-open-in-libkdb5.patch b/Clean-up-context-after-failed-open-in-libkdb5.patch deleted file mode 100644 index fca6a71..0000000 --- a/Clean-up-context-after-failed-open-in-libkdb5.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 95547c12b39e62df55cef05cae890302834b7f98 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Wed, 23 Jun 2021 16:57:39 -0400 -Subject: [PATCH] Clean up context after failed open in libkdb5 - -If krb5_db_open() or krb5_db_create() fails, release the dal_handle, -as the caller is unlikely to call krb5_db_close() after a failure. - -(cherry picked from commit 849b7056e703bd3724d909263769ce190db59acc) ---- - src/lib/kdb/kdb5.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/src/lib/kdb/kdb5.c b/src/lib/kdb/kdb5.c -index 47e9b31a7..11e2430c4 100644 ---- a/src/lib/kdb/kdb5.c -+++ b/src/lib/kdb/kdb5.c -@@ -675,6 +675,8 @@ krb5_db_open(krb5_context kcontext, char **db_args, int mode) - return status; - status = v->init_module(kcontext, section, db_args, mode); - free(section); -+ if (status) -+ (void)krb5_db_fini(kcontext); - return status; - } - -@@ -702,6 +704,8 @@ krb5_db_create(krb5_context kcontext, char **db_args) - return status; - status = v->create(kcontext, section, db_args); - free(section); -+ if (status) -+ (void)krb5_db_fini(kcontext); - return status; - } - diff --git a/Clean-up-gssapi_krb5-ccache-name-functions.patch b/Clean-up-gssapi_krb5-ccache-name-functions.patch deleted file mode 100644 index 207f186..0000000 --- a/Clean-up-gssapi_krb5-ccache-name-functions.patch +++ /dev/null @@ -1,193 +0,0 @@ -From 5e5ea8e8345c8b2f3254b0d346b8e0de0df3a696 Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Wed, 26 May 2021 18:22:10 -0400 -Subject: [PATCH] Clean up gssapi_krb5 ccache name functions - -Modernize kg_get_ccache_name() and kg_get_ccache_name(). Drop -unnecessary use of const in kg_get_ccache_name() so that its return -value can be properly freed. Fixes some static analyzer false -positives. - -(cherry picked from commit f573f7f8ee5269103a0492d6521a3242c5ffb63b) ---- - src/lib/gssapi/krb5/gssapiP_krb5.h | 3 +- - src/lib/gssapi/krb5/gssapi_krb5.c | 47 ++++++++-------------- - src/lib/gssapi/krb5/set_ccache.c | 64 ++++++++++++------------------ - 3 files changed, 42 insertions(+), 72 deletions(-) - -diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h -index fd7abbd77..88d41130a 100644 ---- a/src/lib/gssapi/krb5/gssapiP_krb5.h -+++ b/src/lib/gssapi/krb5/gssapiP_krb5.h -@@ -380,8 +380,7 @@ OM_uint32 kg_sync_ccache_name (krb5_context context, OM_uint32 *minor_status); - OM_uint32 kg_caller_provided_ccache_name (OM_uint32 *minor_status, - int *out_caller_provided_name); - --OM_uint32 kg_get_ccache_name (OM_uint32 *minor_status, -- const char **out_name); -+OM_uint32 kg_get_ccache_name (OM_uint32 *minor_status, char **out_name); - - OM_uint32 kg_set_ccache_name (OM_uint32 *minor_status, - const char *name); -diff --git a/src/lib/gssapi/krb5/gssapi_krb5.c b/src/lib/gssapi/krb5/gssapi_krb5.c -index 46aa9b7a5..9915a8bb5 100644 ---- a/src/lib/gssapi/krb5/gssapi_krb5.c -+++ b/src/lib/gssapi/krb5/gssapi_krb5.c -@@ -253,46 +253,31 @@ kg_caller_provided_ccache_name (OM_uint32 *minor_status, - } - - OM_uint32 --kg_get_ccache_name (OM_uint32 *minor_status, const char **out_name) -+kg_get_ccache_name(OM_uint32 *minor_status, char **out_name) - { -- const char *name = NULL; -- OM_uint32 err = 0; - char *kg_ccache_name; -+ const char *def_name; -+ OM_uint32 err; -+ krb5_context context; -+ -+ *out_name = NULL; - - kg_ccache_name = k5_getspecific(K5_KEY_GSS_KRB5_CCACHE_NAME); -- - if (kg_ccache_name != NULL) { -- name = strdup(kg_ccache_name); -- if (name == NULL) -- err = ENOMEM; -+ *out_name = strdup(kg_ccache_name); -+ err = (*out_name == NULL) ? ENOMEM : 0; - } else { -- krb5_context context = NULL; -- -- /* Reset the context default ccache (see text above), and then -- retrieve it. */ -+ /* Use the default ccache name. */ - err = krb5_gss_init_context(&context); -- if (!err) -- err = krb5_cc_set_default_name (context, NULL); -- if (!err) { -- name = krb5_cc_default_name(context); -- if (name) { -- name = strdup(name); -- if (name == NULL) -- err = ENOMEM; -- } -- } -- if (err && context) -- save_error_info(err, context); -- if (context) -- krb5_free_context(context); -- } -- -- if (!err) { -- if (out_name) { -- *out_name = name; -- } -+ if (err) -+ goto cleanup; -+ def_name = krb5_cc_default_name(context); -+ *out_name = (def_name != NULL) ? strdup(def_name) : NULL; -+ err = (*out_name == NULL) ? ENOMEM : 0; -+ krb5_free_context(context); - } - -+cleanup: - *minor_status = err; - return (*minor_status == 0) ? GSS_S_COMPLETE : GSS_S_FAILURE; - } -diff --git a/src/lib/gssapi/krb5/set_ccache.c b/src/lib/gssapi/krb5/set_ccache.c -index 8acf3ec90..91c3462be 100644 ---- a/src/lib/gssapi/krb5/set_ccache.c -+++ b/src/lib/gssapi/krb5/set_ccache.c -@@ -26,7 +26,7 @@ - - /* - * Set ccache name used by gssapi, and optionally obtain old ccache -- * name. Caller should not free returned name. -+ * name. Caller must not free returned name. - */ - - #include -@@ -38,11 +38,9 @@ gss_krb5int_ccache_name(OM_uint32 *minor_status, - const gss_OID desired_object, - const gss_buffer_t value) - { -- char *old_name = NULL; - OM_uint32 err = 0; -- OM_uint32 minor = 0; -- char *gss_out_name; - struct krb5_gss_ccache_name_req *req; -+ char *old_name, *cur_name = NULL; - - err = gss_krb5int_initialize_library(); - if (err) { -@@ -57,45 +55,33 @@ gss_krb5int_ccache_name(OM_uint32 *minor_status, - - req = (struct krb5_gss_ccache_name_req *)value->value; - -- gss_out_name = k5_getspecific(K5_KEY_GSS_KRB5_SET_CCACHE_OLD_NAME); -+ /* Our job is simple if the caller doesn't want the current name. */ -+ if (req->out_name == NULL) -+ return kg_set_ccache_name(minor_status, req->name); - -- if (req->out_name) { -- const char *tmp_name = NULL; -+ /* Fetch the current name and change it. */ -+ kg_get_ccache_name(&err, &cur_name); -+ if (err) -+ goto cleanup; -+ kg_set_ccache_name(&err, req->name); -+ if (err) -+ goto cleanup; - -- if (!err) { -- kg_get_ccache_name (&err, &tmp_name); -- } -- if (!err) { -- old_name = gss_out_name; -- gss_out_name = (char *)tmp_name; -- } -- } -- /* If out_name was NULL, we keep the same gss_out_name value, and -- don't free up any storage (leave old_name NULL). */ -+ /* Store the current name in a thread-specific variable. Free that -+ * variable's previous contents. */ -+ old_name = k5_getspecific(K5_KEY_GSS_KRB5_SET_CCACHE_OLD_NAME); -+ err = k5_setspecific(K5_KEY_GSS_KRB5_SET_CCACHE_OLD_NAME, cur_name); -+ if (err) -+ goto cleanup; -+ free(old_name); - -- if (!err) -- kg_set_ccache_name (&err, req->name); -- -- minor = k5_setspecific(K5_KEY_GSS_KRB5_SET_CCACHE_OLD_NAME, gss_out_name); -- if (minor) { -- /* Um. Now what? */ -- if (err == 0) { -- err = minor; -- } -- free(gss_out_name); -- gss_out_name = NULL; -- } -- -- if (!err) { -- if (req->out_name) { -- *(req->out_name) = gss_out_name; -- } -- } -- -- if (old_name != NULL) { -- free (old_name); -- } -+ /* Give the caller an alias to the stored value. */ -+ *req->out_name = cur_name; -+ cur_name = NULL; -+ err = 0; - -+cleanup: -+ free(cur_name); - *minor_status = err; - return (*minor_status == 0) ? GSS_S_COMPLETE : GSS_S_FAILURE; - } diff --git a/Fix-KCM-flag-transmission-for-remove_cred.patch b/Fix-KCM-flag-transmission-for-remove_cred.patch deleted file mode 100644 index 77c383e..0000000 --- a/Fix-KCM-flag-transmission-for-remove_cred.patch +++ /dev/null @@ -1,103 +0,0 @@ -From 1528c264d0e1eebff34132c01f4f770f01f1d1c2 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Mon, 29 Mar 2021 14:32:56 -0400 -Subject: [PATCH] Fix KCM flag transmission for remove_cred - -MIT krb5 uses low bits for KRB5_TC flags, while Heimdal uses high bits -so that the same flag word can also hold KRB5_GC flags. Add a mapping -function and send the Heimdal flag values when performing a -remove_cred operation. - -ticket: 8995 -(cherry picked from commit 11a82cf424f9c905bb73680c64524f087090d4ef) ---- - src/include/kcm.h | 19 +++++++++++++++++++ - src/lib/krb5/ccache/cc_kcm.c | 36 +++++++++++++++++++++++++++++++++++- - 2 files changed, 54 insertions(+), 1 deletion(-) - -diff --git a/src/include/kcm.h b/src/include/kcm.h -index e4140c3a0..9b66f1cbd 100644 ---- a/src/include/kcm.h -+++ b/src/include/kcm.h -@@ -56,8 +56,27 @@ - * are marshalled as zero-terminated strings. Principals and credentials are - * marshalled in the v4 FILE ccache format. UUIDs are 16 bytes. UUID lists - * are not delimited, so nothing can come after them. -+ * -+ * Flag words must use Heimdal flag values, which are not the same as MIT krb5 -+ * values for KRB5_GC and KRB5_TC constants. The same flag word may contain -+ * both kinds of flags in Heimdal, but not in MIT krb5. Defines for the -+ * applicable Heimdal flag values are given below using KCM_GC and KCM_TC -+ * prefixes. - */ - -+#define KCM_GC_CACHED (1U << 0) -+ -+#define KCM_TC_DONT_MATCH_REALM (1U << 31) -+#define KCM_TC_MATCH_KEYTYPE (1U << 30) -+#define KCM_TC_MATCH_SRV_NAMEONLY (1U << 29) -+#define KCM_TC_MATCH_FLAGS_EXACT (1U << 28) -+#define KCM_TC_MATCH_FLAGS (1U << 27) -+#define KCM_TC_MATCH_TIMES_EXACT (1U << 26) -+#define KCM_TC_MATCH_TIMES (1U << 25) -+#define KCM_TC_MATCH_AUTHDATA (1U << 24) -+#define KCM_TC_MATCH_2ND_TKT (1U << 23) -+#define KCM_TC_MATCH_IS_SKEY (1U << 22) -+ - /* Opcodes without comments are currently unused in the MIT client - * implementation. */ - typedef enum kcm_opcode { -diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c -index 772928e4d..1f81a2190 100644 ---- a/src/lib/krb5/ccache/cc_kcm.c -+++ b/src/lib/krb5/ccache/cc_kcm.c -@@ -110,6 +110,40 @@ map_invalid(krb5_error_code code) - KRB5_KCM_MALFORMED_REPLY : code; - } - -+/* -+ * Map an MIT krb5 KRB5_TC flag word to the equivalent Heimdal flag word. Note -+ * that there is no MIT krb5 equivalent for Heimdal's KRB5_TC_DONT_MATCH_REALM -+ * (which is like KRB5_TC_MATCH_SRV_NAMEONLY but also applies to the client -+ * principal) and no Heimdal equivalent for MIT krb5's KRB5_TC_SUPPORTED_KTYPES -+ * (which matches against enctypes from the krb5_context rather than the -+ * matching cred). -+ */ -+static inline krb5_flags -+map_tcflags(krb5_flags mitflags) -+{ -+ krb5_flags heimflags = 0; -+ -+ if (mitflags & KRB5_TC_MATCH_TIMES) -+ heimflags |= KCM_TC_MATCH_TIMES; -+ if (mitflags & KRB5_TC_MATCH_IS_SKEY) -+ heimflags |= KCM_TC_MATCH_IS_SKEY; -+ if (mitflags & KRB5_TC_MATCH_FLAGS) -+ heimflags |= KCM_TC_MATCH_FLAGS; -+ if (mitflags & KRB5_TC_MATCH_TIMES_EXACT) -+ heimflags |= KCM_TC_MATCH_TIMES_EXACT; -+ if (mitflags & KRB5_TC_MATCH_FLAGS_EXACT) -+ heimflags |= KCM_TC_MATCH_FLAGS_EXACT; -+ if (mitflags & KRB5_TC_MATCH_AUTHDATA) -+ heimflags |= KCM_TC_MATCH_AUTHDATA; -+ if (mitflags & KRB5_TC_MATCH_SRV_NAMEONLY) -+ heimflags |= KCM_TC_MATCH_SRV_NAMEONLY; -+ if (mitflags & KRB5_TC_MATCH_2ND_TKT) -+ heimflags |= KCM_TC_MATCH_2ND_TKT; -+ if (mitflags & KRB5_TC_MATCH_KTYPE) -+ heimflags |= KCM_TC_MATCH_KEYTYPE; -+ return heimflags; -+} -+ - /* Begin a request for the given opcode. If cache is non-null, supply the - * cache name as a request parameter. */ - static void -@@ -936,7 +970,7 @@ kcm_remove_cred(krb5_context context, krb5_ccache cache, krb5_flags flags, - struct kcmreq req; - - kcmreq_init(&req, KCM_OP_REMOVE_CRED, cache); -- k5_buf_add_uint32_be(&req.reqbuf, flags); -+ k5_buf_add_uint32_be(&req.reqbuf, map_tcflags(flags)); - k5_marshal_mcred(&req.reqbuf, mcred); - ret = cache_call(context, cache, &req); - kcmreq_free(&req); diff --git a/Fix-KCM-retrieval-support-for-sssd.patch b/Fix-KCM-retrieval-support-for-sssd.patch deleted file mode 100644 index 9c09507..0000000 --- a/Fix-KCM-retrieval-support-for-sssd.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 43be8fba5301d08fc4d5ddef14f8ae3d9655b0ba Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Tue, 11 May 2021 14:04:07 -0400 -Subject: [PATCH] Fix KCM retrieval support for sssd - -Commit 795ebba8c039be172ab93cd41105c73ffdba0fdb added a retrieval -handler using KCM_OP_RETRIEVE, falling back on the same error codes as -the previous KCM_OP_GET_CRED_LIST support. But sssd (as of 2.4) -returns KRB5_CC_NOSUPP instead of KRB5_CC_IO if it recognizes an -opcode but does not implement it. Add a helper function to recognize -all known unsupported-opcode error codes, and use it in kcm_retrieve() -and kcm_start_seq_get(). - -ticket: 8997 -(cherry picked from commit da103e36e13f3c846bcddbe38dd518a21e5260a0) ---- - src/lib/krb5/ccache/cc_kcm.c | 18 ++++++++++++++++-- - 1 file changed, 16 insertions(+), 2 deletions(-) - -diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c -index 23fcf13ea..18505cd3d 100644 ---- a/src/lib/krb5/ccache/cc_kcm.c -+++ b/src/lib/krb5/ccache/cc_kcm.c -@@ -144,6 +144,20 @@ map_tcflags(krb5_flags mitflags) - return heimflags; - } - -+/* -+ * Return true if code could indicate an unsupported operation. Heimdal's KCM -+ * returns KRB5_FCC_INTERNAL. sssd's KCM daemon (as of sssd 2.4) returns -+ * KRB5_CC_NO_SUPP if it recognizes the operation but does not implement it, -+ * and KRB5_CC_IO if it doesn't recognize the operation (which is unfortunate -+ * since it could also indicate a communication failure). -+ */ -+static krb5_boolean -+unsupported_op_error(krb5_error_code code) -+{ -+ return code == KRB5_FCC_INTERNAL || code == KRB5_CC_IO || -+ code == KRB5_CC_NOSUPP; -+} -+ - /* Begin a request for the given opcode. If cache is non-null, supply the - * cache name as a request parameter. */ - static void -@@ -841,7 +855,7 @@ kcm_retrieve(krb5_context context, krb5_ccache cache, krb5_flags flags, - ret = cache_call(context, cache, &req); - - /* Fall back to iteration if the server does not support retrieval. */ -- if (ret == KRB5_FCC_INTERNAL || ret == KRB5_CC_IO) { -+ if (unsupported_op_error(ret)) { - ret = k5_cc_retrieve_cred_default(context, cache, flags, mcred, - cred_out); - goto cleanup; -@@ -922,7 +936,7 @@ kcm_start_seq_get(krb5_context context, krb5_ccache cache, - ret = kcmreq_get_cred_list(&req, &creds); - if (ret) - goto cleanup; -- } else if (ret == KRB5_FCC_INTERNAL || ret == KRB5_CC_IO) { -+ } else if (unsupported_op_error(ret)) { - /* Fall back to GET_CRED_UUID_LIST. */ - kcmreq_free(&req); - kcmreq_init(&req, KCM_OP_GET_CRED_UUID_LIST, cache); diff --git a/Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch b/Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch deleted file mode 100644 index 24b9d95..0000000 --- a/Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch +++ /dev/null @@ -1,45 +0,0 @@ -From bb8fa495d00ccd931eec87a01b8920636cf7903e Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Tue, 3 Aug 2021 01:15:27 -0400 -Subject: [PATCH] Fix KDC null deref on TGS inner body null server - -After the KDC decodes a FAST inner body, it does not check for a null -server. Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this -would typically result in an error from krb5_unparse_name(), but with -the addition of get_local_tgt() it results in a null dereference. Add -a null check. - -Reported by Joseph Sutton of Catalyst. - -CVE-2021-37750: - -In MIT krb5 releases 1.14 and later, an authenticated attacker can -cause a null dereference in the KDC by sending a FAST TGS request with -no server field. - -ticket: 9008 (new) -tags: pullup -target_version: 1.19-next -target_version: 1.18-next - -(cherry picked from commit d775c95af7606a51bf79547a94fa52ddd1cb7f49) ---- - src/kdc/do_tgs_req.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c -index 6d244ffd4..39a504ca1 100644 ---- a/src/kdc/do_tgs_req.c -+++ b/src/kdc/do_tgs_req.c -@@ -207,6 +207,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt, - status = "FIND_FAST"; - goto cleanup; - } -+ if (sprinc == NULL) { -+ status = "NULL_SERVER"; -+ errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN; -+ goto cleanup; -+ } - - errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server, - &local_tgt, &local_tgt_storage, &local_tgt_key); diff --git a/Fix-integer-overflows-in-PAC-parsing.patch b/Fix-integer-overflows-in-PAC-parsing.patch deleted file mode 100644 index 272e34e..0000000 --- a/Fix-integer-overflows-in-PAC-parsing.patch +++ /dev/null @@ -1,106 +0,0 @@ -From 06d30f43a41029d83248bbac1a9b65fc09987597 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Mon, 17 Oct 2022 20:25:11 -0400 -Subject: [PATCH] Fix integer overflows in PAC parsing - -In krb5_parse_pac(), check for buffer counts large enough to threaten -integer overflow in the header length and memory length calculations. -Avoid potential integer overflows when checking the length of each -buffer. - -CVE-2022-42898: - -In MIT krb5 releases 1.8 and later, an authenticated attacker may be -able to cause a KDC or kadmind process to crash by reading beyond the -bounds of allocated memory, creating a denial of service. A -privileged attacker may similarly be able to cause a Kerberos or GSS -application service to crash. On 32-bit platforms, an attacker can -also cause insufficient memory to be allocated for the result, -potentially leading to remote code execution in a KDC, kadmind, or GSS -or Kerberos application server process. An attacker with the -privileges of a cross-realm KDC may be able to extract secrets from -the KDC process's memory by having them copied into the PAC of a new -ticket. - -ticket: 9074 (new) -tags: pullup -target_version: 1.20-next -target_version: 1.19-next ---- - src/lib/krb5/krb/pac.c | 9 +++++++-- - src/lib/krb5/krb/t_pac.c | 18 ++++++++++++++++++ - 2 files changed, 25 insertions(+), 2 deletions(-) - -diff --git a/src/lib/krb5/krb/pac.c b/src/lib/krb5/krb/pac.c -index 950beda657..1b9ef12276 100644 ---- a/src/lib/krb5/krb/pac.c -+++ b/src/lib/krb5/krb/pac.c -@@ -27,6 +27,8 @@ - #include "k5-int.h" - #include "authdata.h" - -+#define MAX_BUFFERS 4096 -+ - /* draft-brezak-win2k-krb-authz-00 */ - - /* -@@ -316,6 +318,9 @@ krb5_pac_parse(krb5_context context, - if (version != 0) - return EINVAL; - -+ if (cbuffers < 1 || cbuffers > MAX_BUFFERS) -+ return ERANGE; -+ - header_len = PACTYPE_LENGTH + (cbuffers * PAC_INFO_BUFFER_LENGTH); - if (len < header_len) - return ERANGE; -@@ -348,8 +353,8 @@ krb5_pac_parse(krb5_context context, - krb5_pac_free(context, pac); - return EINVAL; - } -- if (buffer->Offset < header_len || -- buffer->Offset + buffer->cbBufferSize > len) { -+ if (buffer->Offset < header_len || buffer->Offset > len || -+ buffer->cbBufferSize > len - buffer->Offset) { - krb5_pac_free(context, pac); - return ERANGE; - } -diff --git a/src/lib/krb5/krb/t_pac.c b/src/lib/krb5/krb/t_pac.c -index ee47152ee4..ccd165380d 100644 ---- a/src/lib/krb5/krb/t_pac.c -+++ b/src/lib/krb5/krb/t_pac.c -@@ -431,6 +431,16 @@ static const unsigned char s4u_pac_ent_xrealm[] = { - 0x8a, 0x81, 0x9c, 0x9c, 0x00, 0x00, 0x00, 0x00 - }; - -+static const unsigned char fuzz1[] = { -+ 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, -+ 0x06, 0xff, 0xff, 0xff, 0x00, 0x00, 0xf5 -+}; -+ -+static const unsigned char fuzz2[] = { -+ 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, -+ 0x20, 0x20 -+}; -+ - static const char *s4u_principal = "w2k8u@ACME.COM"; - static const char *s4u_enterprise = "w2k8u@abc@ACME.COM"; - -@@ -646,6 +656,14 @@ main(int argc, char **argv) - krb5_free_principal(context, sep); - } - -+ /* Check problematic PACs found by fuzzing. */ -+ ret = krb5_pac_parse(context, fuzz1, sizeof(fuzz1), &pac); -+ if (!ret) -+ err(context, ret, "krb5_pac_parse should have failed"); -+ ret = krb5_pac_parse(context, fuzz2, sizeof(fuzz2), &pac); -+ if (!ret) -+ err(context, ret, "krb5_pac_parse should have failed"); -+ - /* - * Test empty free - */ --- -2.37.3 - diff --git a/Fix-k5tls-module-for-OpenSSL-3.patch b/Fix-k5tls-module-for-OpenSSL-3.patch deleted file mode 100644 index a2b9e34..0000000 --- a/Fix-k5tls-module-for-OpenSSL-3.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 51938a8b731740299fe47d132b8840edba4141bc Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Sat, 29 May 2021 12:05:49 -0400 -Subject: [PATCH] Fix k5tls module for OpenSSL 3 - -Starting in OpenSSL 3, connection termination without a close_notify -alert causes SSL_read() to return SSL_ERROR_SSL instead of -SSL_ERROR_SYSCALL. OpenSSL 3 also provides a new option -SSL_OP_IGNORE_UNEXPECTED_EOF which allows an application to explicitly -ignore possible truncation attacks and receive SSL_ERROR_ZERO_RETURN -instead. - -Remove the call to SSL_CTX_get_options() since SSL_CTX_set_options() -doesn't clear existing options. - -[ghudson@mit.edu: edited commit message and comment] - -(cherry picked from commit aa9b4a2a64046afd2fab7cb49c346295874a5fb6) -(cherry picked from commit 201e38845e9f70234bcaa9ba7c25b28e38169b0a) ---- - src/plugins/tls/k5tls/openssl.c | 17 ++++++++++++++--- - 1 file changed, 14 insertions(+), 3 deletions(-) - -diff --git a/src/plugins/tls/k5tls/openssl.c b/src/plugins/tls/k5tls/openssl.c -index 76a43b3cd..99fda7ffc 100644 ---- a/src/plugins/tls/k5tls/openssl.c -+++ b/src/plugins/tls/k5tls/openssl.c -@@ -433,7 +433,7 @@ setup(krb5_context context, SOCKET fd, const char *servername, - char **anchors, k5_tls_handle *handle_out) - { - int e; -- long options; -+ long options = SSL_OP_NO_SSLv2; - SSL_CTX *ctx = NULL; - SSL *ssl = NULL; - k5_tls_handle handle = NULL; -@@ -448,8 +448,19 @@ setup(krb5_context context, SOCKET fd, const char *servername, - ctx = SSL_CTX_new(SSLv23_client_method()); - if (ctx == NULL) - goto error; -- options = SSL_CTX_get_options(ctx); -- SSL_CTX_set_options(ctx, options | SSL_OP_NO_SSLv2); -+ -+#ifdef SSL_OP_IGNORE_UNEXPECTED_EOF -+ /* -+ * For OpenSSL 3 and later, mark close_notify alerts as optional. We don't -+ * need to worry about truncation attacks because the protocols this module -+ * is used with (Kerberos and change-password) receive a single -+ * length-delimited message from the server. For prior versions of OpenSSL -+ * we check for SSL_ERROR_SYSCALL when reading instead (this error changes -+ * to SSL_ERROR_SSL in OpenSSL 3). -+ */ -+ options |= SSL_OP_IGNORE_UNEXPECTED_EOF; -+#endif -+ SSL_CTX_set_options(ctx, options); - - SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, verify_callback); - X509_STORE_set_flags(SSL_CTX_get_cert_store(ctx), 0); diff --git a/Fix-kadmin-k-with-fallback-or-referral-realm.patch b/Fix-kadmin-k-with-fallback-or-referral-realm.patch deleted file mode 100644 index a5162e7..0000000 --- a/Fix-kadmin-k-with-fallback-or-referral-realm.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 2d2bb9a14613b3283dabdd40c3ee28e5b680cf93 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Mon, 7 Jun 2021 15:00:41 -0400 -Subject: [PATCH] Fix kadmin -k with fallback or referral realm - -kadmin -k produces a client principal name with -krb5_sname_to_principal(), but it gets converted to a string and back -due to the signature of kadm5_init_with_skey(), which loses track of -the name type, so no canonicalization is performed. - -In libkadm5clnt initialization, recognize the important subset of this -case--an empty realm indicates either fallback processing or the -referral realm--and restore the host-based name type so that the -client principal can be canonicalized against the keytab. - -ticket: 9013 (new) -(cherry picked from commit dcb79089276624d7ddf44e08d35bd6d7d7e557d2) ---- - src/lib/kadm5/clnt/client_init.c | 7 +++++++ - src/tests/t_kadmin.py | 12 ++++++++++++ - 2 files changed, 19 insertions(+) - -diff --git a/src/lib/kadm5/clnt/client_init.c b/src/lib/kadm5/clnt/client_init.c -index aa1223bb3..0aaca701f 100644 ---- a/src/lib/kadm5/clnt/client_init.c -+++ b/src/lib/kadm5/clnt/client_init.c -@@ -221,9 +221,16 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - return KADM5_MISSING_KRB5_CONF_PARAMS; - } - -+ /* -+ * Parse the client name. If it has an empty realm, it is almost certainly -+ * a host-based principal using DNS fallback processing or the referral -+ * realm, so give it the appropriate name type for canonicalization. -+ */ - code = krb5_parse_name(handle->context, client_name, &client); - if (code) - goto error; -+ if (init_type == INIT_SKEY && client->realm.length == 0) -+ client->type = KRB5_NT_SRV_HST; - - /* - * Get credentials. Also does some fallbacks in case kadmin/fqdn -diff --git a/src/tests/t_kadmin.py b/src/tests/t_kadmin.py -index fe6a3cc2e..98453d92e 100644 ---- a/src/tests/t_kadmin.py -+++ b/src/tests/t_kadmin.py -@@ -51,4 +51,16 @@ for i in range(200): - realm.run_kadmin(['addprinc', '-randkey', 'foo%d' % i]) - realm.run_kadmin(['listprincs'], expected_msg='foo199') - -+# Test kadmin -k with the default principal, with and without -+# fallback. This operation requires canonicalization against the -+# keytab in krb5_get_init_creds_keytab() as the -+# krb5_sname_to_principal() result won't have a realm. Try with and -+# without without fallback processing since the code paths are -+# different. -+mark('kadmin -k') -+realm.run([kadmin, '-k', 'getprinc', realm.host_princ]) -+no_canon_conf = {'libdefaults': {'dns_canonicalize_hostname': 'false'}} -+no_canon = realm.special_env('no_canon', False, krb5_conf=no_canon_conf) -+realm.run([kadmin, '-k', 'getprinc', realm.host_princ], env=no_canon) -+ - success('kadmin and kpasswd tests') diff --git a/Fix-leaks-on-error-in-kadm5-init-functions.patch b/Fix-leaks-on-error-in-kadm5-init-functions.patch deleted file mode 100644 index bdacecb..0000000 --- a/Fix-leaks-on-error-in-kadm5-init-functions.patch +++ /dev/null @@ -1,664 +0,0 @@ -From a14e0fd3c1d00ba625e6d9eb72829f31527c6ad8 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Wed, 23 Jun 2021 16:53:16 -0400 -Subject: [PATCH] Fix leaks on error in kadm5 init functions - -In the GENERIC_CHECK_HANDLE function, separate out the -version-checking logic so we can call it in the init functions before -allocating resources. - -In the client and server library initialization functions, use a -single exit path after argument validation, and share the destruction -code with kadm5_destroy() via a helper. - -(cherry picked from commit 552d7b7626450f963b8e37345c472420c842402c) ---- - src/lib/kadm5/admin_internal.h | 39 ++++--- - src/lib/kadm5/clnt/client_init.c | 174 +++++++++++----------------- - src/lib/kadm5/srv/server_init.c | 191 ++++++++++--------------------- - 3 files changed, 145 insertions(+), 259 deletions(-) - -diff --git a/src/lib/kadm5/admin_internal.h b/src/lib/kadm5/admin_internal.h -index faf8e9c36..9be53883a 100644 ---- a/src/lib/kadm5/admin_internal.h -+++ b/src/lib/kadm5/admin_internal.h -@@ -11,29 +11,32 @@ - - #define KADM5_SERVER_HANDLE_MAGIC 0x12345800 - --#define GENERIC_CHECK_HANDLE(handle, old_api_version, new_api_version) \ -+#define CHECK_VERSIONS(struct_version, api_version, old_api_err, new_api_err) \ - { \ -- kadm5_server_handle_t srvr = \ -- (kadm5_server_handle_t) handle; \ -- \ -- if (! srvr) \ -- return KADM5_BAD_SERVER_HANDLE; \ -- if (srvr->magic_number != KADM5_SERVER_HANDLE_MAGIC) \ -- return KADM5_BAD_SERVER_HANDLE; \ -- if ((srvr->struct_version & KADM5_MASK_BITS) != \ -- KADM5_STRUCT_VERSION_MASK) \ -+ if ((struct_version & KADM5_MASK_BITS) != KADM5_STRUCT_VERSION_MASK) \ - return KADM5_BAD_STRUCT_VERSION; \ -- if (srvr->struct_version < KADM5_STRUCT_VERSION_1) \ -+ if (struct_version < KADM5_STRUCT_VERSION_1) \ - return KADM5_OLD_STRUCT_VERSION; \ -- if (srvr->struct_version > KADM5_STRUCT_VERSION_1) \ -+ if (struct_version > KADM5_STRUCT_VERSION_1) \ - return KADM5_NEW_STRUCT_VERSION; \ -- if ((srvr->api_version & KADM5_MASK_BITS) != \ -- KADM5_API_VERSION_MASK) \ -+ if ((api_version & KADM5_MASK_BITS) != KADM5_API_VERSION_MASK) \ - return KADM5_BAD_API_VERSION; \ -- if (srvr->api_version < KADM5_API_VERSION_2) \ -- return old_api_version; \ -- if (srvr->api_version > KADM5_API_VERSION_4) \ -- return new_api_version; \ -+ if (api_version < KADM5_API_VERSION_2) \ -+ return old_api_err; \ -+ if (api_version > KADM5_API_VERSION_4) \ -+ return new_api_err; \ -+ } -+ -+#define GENERIC_CHECK_HANDLE(handle, old_api_err, new_api_err) \ -+ { \ -+ kadm5_server_handle_t srvr = handle; \ -+ \ -+ if (srvr == NULL) \ -+ return KADM5_BAD_SERVER_HANDLE; \ -+ if (srvr->magic_number != KADM5_SERVER_HANDLE_MAGIC) \ -+ return KADM5_BAD_SERVER_HANDLE; \ -+ CHECK_VERSIONS(srvr->struct_version, srvr->api_version, \ -+ old_api_err, new_api_err); \ - } - - /* -diff --git a/src/lib/kadm5/clnt/client_init.c b/src/lib/kadm5/clnt/client_init.c -index 0aaca701f..75614bb19 100644 ---- a/src/lib/kadm5/clnt/client_init.c -+++ b/src/lib/kadm5/clnt/client_init.c -@@ -138,6 +138,36 @@ kadm5_init_with_skey(krb5_context context, char *client_name, - server_handle); - } - -+static kadm5_ret_t -+free_handle(kadm5_server_handle_t handle) -+{ -+ kadm5_ret_t ret = 0; -+ OM_uint32 minor_stat; -+ krb5_ccache ccache; -+ -+ if (handle == NULL) -+ return 0; -+ -+ if (handle->destroy_cache && handle->cache_name != NULL) { -+ ret = krb5_cc_resolve(handle->context, handle->cache_name, &ccache); -+ if (!ret) -+ ret = krb5_cc_destroy(handle->context, ccache); -+ } -+ free(handle->cache_name); -+ (void)gss_release_cred(&minor_stat, &handle->cred); -+ if (handle->clnt != NULL && handle->clnt->cl_auth != NULL) -+ AUTH_DESTROY(handle->clnt->cl_auth); -+ if (handle->clnt != NULL) -+ clnt_destroy(handle->clnt); -+ if (handle->client_socket != -1) -+ close(handle->client_socket); -+ free(handle->lhandle); -+ kadm5_free_config_params(handle->context, &handle->params); -+ free(handle); -+ -+ return ret; -+} -+ - static kadm5_ret_t - init_any(krb5_context context, char *client_name, enum init_type init_type, - char *pass, krb5_ccache ccache_in, char *service_name, -@@ -145,36 +175,34 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - krb5_ui_4 api_version, char **db_args, void **server_handle) - { - int fd = -1; -- OM_uint32 minor_stat; - krb5_boolean iprop_enable; - int port; - rpcprog_t rpc_prog; - rpcvers_t rpc_vers; -- krb5_ccache ccache; - krb5_principal client = NULL, server = NULL; - struct timeval timeout; - -- kadm5_server_handle_t handle; -+ kadm5_server_handle_t handle = NULL; - kadm5_config_params params_local; - -- int code = 0; -+ krb5_error_code code; - generic_ret r = { 0, 0 }; - - initialize_ovk_error_table(); - initialize_ovku_error_table(); - -- if (! server_handle) { -+ if (server_handle == NULL || client_name == NULL) - return EINVAL; -- } - -- if (! (handle = malloc(sizeof(*handle)))) { -- return ENOMEM; -- } -- memset(handle, 0, sizeof(*handle)); -- if (! (handle->lhandle = malloc(sizeof(*handle)))) { -- free(handle); -- return ENOMEM; -- } -+ CHECK_VERSIONS(struct_version, api_version, KADM5_OLD_LIB_API_VERSION, -+ KADM5_NEW_LIB_API_VERSION); -+ -+ handle = k5alloc(sizeof(*handle), &code); -+ if (handle == NULL) -+ goto cleanup; -+ handle->lhandle = k5alloc(sizeof(*handle), &code); -+ if (handle->lhandle == NULL) -+ goto cleanup; - - handle->magic_number = KADM5_SERVER_HANDLE_MAGIC; - handle->struct_version = struct_version; -@@ -192,33 +220,20 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - - handle->context = context; - -- if(client_name == NULL) { -- free(handle); -- return EINVAL; -- } -- -- /* -- * Verify the version numbers before proceeding; we can't use -- * CHECK_HANDLE because not all fields are set yet. -- */ -- GENERIC_CHECK_HANDLE(handle, KADM5_OLD_LIB_API_VERSION, -- KADM5_NEW_LIB_API_VERSION); -- - memset(¶ms_local, 0, sizeof(params_local)); - -- if ((code = kadm5_get_config_params(handle->context, 0, -- params_in, &handle->params))) { -- free(handle); -- return(code); -- } -+ code = kadm5_get_config_params(handle->context, 0, params_in, -+ &handle->params); -+ if (code) -+ goto cleanup; - - #define REQUIRED_PARAMS (KADM5_CONFIG_REALM | \ - KADM5_CONFIG_ADMIN_SERVER | \ - KADM5_CONFIG_KADMIND_PORT) - - if ((handle->params.mask & REQUIRED_PARAMS) != REQUIRED_PARAMS) { -- free(handle); -- return KADM5_MISSING_KRB5_CONF_PARAMS; -+ code = KADM5_MISSING_KRB5_CONF_PARAMS; -+ goto cleanup; - } - - /* -@@ -228,7 +243,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - */ - code = krb5_parse_name(handle->context, client_name, &client); - if (code) -- goto error; -+ goto cleanup; - if (init_type == INIT_SKEY && client->realm.length == 0) - client->type = KRB5_NT_SRV_HST; - -@@ -239,7 +254,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - code = get_init_creds(handle, client, init_type, pass, ccache_in, - service_name, handle->params.realm, &server); - if (code) -- goto error; -+ goto cleanup; - - /* If the service_name and client_name are iprop-centric, use the iprop - * port and RPC identifiers. */ -@@ -258,7 +273,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - - code = connect_to_server(handle->params.admin_server, port, &fd); - if (code) -- goto error; -+ goto cleanup; - - handle->clnt = clnttcp_create(NULL, rpc_prog, rpc_vers, &fd, 0, 0); - if (handle->clnt == NULL) { -@@ -266,7 +281,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - #ifdef DEBUG - clnt_pcreateerror("clnttcp_create"); - #endif -- goto error; -+ goto cleanup; - } - - /* Set a one-hour timeout. */ -@@ -278,10 +293,6 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - handle->lhandle->clnt = handle->clnt; - handle->lhandle->client_socket = fd; - -- /* now that handle->clnt is set, we can check the handle */ -- if ((code = _kadm5_check_handle((void *) handle))) -- goto error; -- - /* - * The RPC connection is open; establish the GSS-API - * authentication context. -@@ -289,7 +300,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - code = setup_gss(handle, params_in, - (init_type == INIT_CREDS) ? client : NULL, server); - if (code) -- goto error; -+ goto cleanup; - - /* - * Bypass the remainder of the code and return straight away -@@ -297,7 +308,8 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - */ - if (iprop_enable) { - code = 0; -- *server_handle = (void *) handle; -+ *server_handle = handle; -+ handle = NULL; - goto cleanup; - } - -@@ -306,7 +318,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - #ifdef DEBUG - clnt_perror(handle->clnt, "init_2 null resp"); - #endif -- goto error; -+ goto cleanup; - } - /* Drop down to v3 wire protocol if server does not support v4 */ - if (r.code == KADM5_NEW_SERVER_API_VERSION && -@@ -315,7 +327,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - memset(&r, 0, sizeof(generic_ret)); - if (init_2(&handle->api_version, &r, handle->clnt)) { - code = KADM5_RPC_ERROR; -- goto error; -+ goto cleanup; - } - } - /* Drop down to v2 wire protocol if server does not support v3 */ -@@ -325,47 +337,21 @@ init_any(krb5_context context, char *client_name, enum init_type init_type, - memset(&r, 0, sizeof(generic_ret)); - if (init_2(&handle->api_version, &r, handle->clnt)) { - code = KADM5_RPC_ERROR; -- goto error; -+ goto cleanup; - } - } - if (r.code) { - code = r.code; -- goto error; -+ goto cleanup; - } - -- *server_handle = (void *) handle; -- -- goto cleanup; -- --error: -- /* -- * Note that it is illegal for this code to execute if "handle" -- * has not been allocated and initialized. I.e., don't use "goto -- * error" before the block of code at the top of the function -- * that allocates and initializes "handle". -- */ -- if (handle->destroy_cache && handle->cache_name) { -- if (krb5_cc_resolve(handle->context, -- handle->cache_name, &ccache) == 0) -- (void) krb5_cc_destroy (handle->context, ccache); -- } -- if (handle->cache_name) -- free(handle->cache_name); -- (void)gss_release_cred(&minor_stat, &handle->cred); -- if(handle->clnt && handle->clnt->cl_auth) -- AUTH_DESTROY(handle->clnt->cl_auth); -- if(handle->clnt) -- clnt_destroy(handle->clnt); -- if (fd != -1) -- close(fd); -- free(handle->lhandle); -- kadm5_free_config_params(handle->context, &handle->params); -+ *server_handle = handle; -+ handle = NULL; - - cleanup: -- krb5_free_principal(handle->context, client); -- krb5_free_principal(handle->context, server); -- if (code) -- free(handle); -+ krb5_free_principal(context, client); -+ krb5_free_principal(context, server); -+ (void)free_handle(handle); - - return code; - } -@@ -695,38 +681,8 @@ rpc_auth(kadm5_server_handle_t handle, kadm5_config_params *params_in, - kadm5_ret_t - kadm5_destroy(void *server_handle) - { -- OM_uint32 minor_stat; -- krb5_ccache ccache = NULL; -- int code = KADM5_OK; -- kadm5_server_handle_t handle = -- (kadm5_server_handle_t) server_handle; -- - CHECK_HANDLE(server_handle); -- -- if (handle->destroy_cache && handle->cache_name) { -- if ((code = krb5_cc_resolve(handle->context, -- handle->cache_name, &ccache)) == 0) -- code = krb5_cc_destroy (handle->context, ccache); -- } -- if (handle->cache_name) -- free(handle->cache_name); -- if (handle->cred) -- (void)gss_release_cred(&minor_stat, &handle->cred); -- if (handle->clnt && handle->clnt->cl_auth) -- AUTH_DESTROY(handle->clnt->cl_auth); -- if (handle->clnt) -- clnt_destroy(handle->clnt); -- if (handle->client_socket != -1) -- close(handle->client_socket); -- if (handle->lhandle) -- free (handle->lhandle); -- -- kadm5_free_config_params(handle->context, &handle->params); -- -- handle->magic_number = 0; -- free(handle); -- -- return code; -+ return free_handle(server_handle); - } - /* not supported on client */ - kadm5_ret_t kadm5_lock(void *server_handle) -diff --git a/src/lib/kadm5/srv/server_init.c b/src/lib/kadm5/srv/server_init.c -index 3adc4b57d..2c0d51efd 100644 ---- a/src/lib/kadm5/srv/server_init.c -+++ b/src/lib/kadm5/srv/server_init.c -@@ -19,23 +19,6 @@ - #include "osconf.h" - #include "iprop_hdr.h" - --/* -- * Function check_handle -- * -- * Purpose: Check a server handle and return a com_err code if it is -- * invalid or 0 if it is valid. -- * -- * Arguments: -- * -- * handle The server handle. -- */ -- --static int check_handle(void *handle) --{ -- CHECK_HANDLE(handle); -- return 0; --} -- - static int dup_db_args(kadm5_server_handle_t handle, char **db_args) - { - int count = 0; -@@ -84,6 +67,23 @@ static void free_db_args(kadm5_server_handle_t handle) - } - } - -+static void -+free_handle(kadm5_server_handle_t handle) -+{ -+ if (handle == NULL) -+ return; -+ -+ destroy_pwqual(handle); -+ k5_kadm5_hook_free_handles(handle->context, handle->hook_handles); -+ ulog_fini(handle->context); -+ krb5_db_fini(handle->context); -+ krb5_free_principal(handle->context, handle->current_caller); -+ kadm5_free_config_params(handle->context, &handle->params); -+ free(handle->lhandle); -+ free_db_args(handle); -+ free(handle); -+} -+ - kadm5_ret_t kadm5_init_with_password(krb5_context context, char *client_name, - char *pass, char *service_name, - kadm5_config_params *params, -@@ -163,8 +163,8 @@ kadm5_ret_t kadm5_init(krb5_context context, char *client_name, char *pass, - char **db_args, - void **server_handle) - { -- int ret; -- kadm5_server_handle_t handle; -+ krb5_error_code ret; -+ kadm5_server_handle_t handle = NULL; - kadm5_config_params params_local; /* for v1 compat */ - - if (! server_handle) -@@ -173,17 +173,17 @@ kadm5_ret_t kadm5_init(krb5_context context, char *client_name, char *pass, - if (! client_name) - return EINVAL; - -- if (! (handle = (kadm5_server_handle_t) malloc(sizeof *handle))) -- return ENOMEM; -- memset(handle, 0, sizeof(*handle)); -+ CHECK_VERSIONS(struct_version, api_version, KADM5_OLD_SERVER_API_VERSION, -+ KADM5_NEW_SERVER_API_VERSION); -+ -+ handle = k5alloc(sizeof(*handle), &ret); -+ if (handle == NULL) -+ goto cleanup; -+ handle->context = context; - - ret = dup_db_args(handle, db_args); -- if (ret) { -- free(handle); -- return ret; -- } -- -- handle->context = context; -+ if (ret) -+ goto cleanup; - - initialize_ovk_error_table(); - initialize_ovku_error_table(); -@@ -192,13 +192,6 @@ kadm5_ret_t kadm5_init(krb5_context context, char *client_name, char *pass, - handle->struct_version = struct_version; - handle->api_version = api_version; - -- /* -- * Verify the version numbers before proceeding; we can't use -- * CHECK_HANDLE because not all fields are set yet. -- */ -- GENERIC_CHECK_HANDLE(handle, KADM5_OLD_SERVER_API_VERSION, -- KADM5_NEW_SERVER_API_VERSION); -- - /* - * Acquire relevant profile entries. Merge values - * in params_in with values from profile, based on -@@ -208,11 +201,8 @@ kadm5_ret_t kadm5_init(krb5_context context, char *client_name, char *pass, - - ret = kadm5_get_config_params(handle->context, 1, params_in, - &handle->params); -- if (ret) { -- free_db_args(handle); -- free(handle); -- return(ret); -- } -+ if (ret) -+ goto cleanup; - - #define REQUIRED_PARAMS (KADM5_CONFIG_REALM | KADM5_CONFIG_DBNAME | \ - KADM5_CONFIG_ENCTYPE | \ -@@ -226,132 +216,69 @@ kadm5_ret_t kadm5_init(krb5_context context, char *client_name, char *pass, - KADM5_CONFIG_IPROP_PORT) - - if ((handle->params.mask & REQUIRED_PARAMS) != REQUIRED_PARAMS) { -- kadm5_free_config_params(handle->context, &handle->params); -- free_db_args(handle); -- free(handle); -- return KADM5_MISSING_CONF_PARAMS; -+ ret = KADM5_MISSING_CONF_PARAMS; -+ goto cleanup; - } - if ((handle->params.mask & KADM5_CONFIG_IPROP_ENABLED) == KADM5_CONFIG_IPROP_ENABLED - && handle->params.iprop_enabled) { - if ((handle->params.mask & IPROP_REQUIRED_PARAMS) != IPROP_REQUIRED_PARAMS) { -- kadm5_free_config_params(handle->context, &handle->params); -- free_db_args(handle); -- free(handle); -- return KADM5_MISSING_CONF_PARAMS; -+ ret = KADM5_MISSING_CONF_PARAMS; -+ goto cleanup; - } - } - - ret = krb5_set_default_realm(handle->context, handle->params.realm); -- if (ret) { -- kadm5_free_config_params(handle->context, &handle->params); -- free_db_args(handle); -- free(handle); -- return ret; -- } -+ if (ret) -+ goto cleanup; - - ret = krb5_db_open(handle->context, db_args, - KRB5_KDB_OPEN_RW | KRB5_KDB_SRV_TYPE_ADMIN); -- if (ret) { -- kadm5_free_config_params(handle->context, &handle->params); -- free_db_args(handle); -- free(handle); -- return(ret); -- } -+ if (ret) -+ goto cleanup; - -- if ((ret = krb5_parse_name(handle->context, client_name, -- &handle->current_caller))) { -- kadm5_free_config_params(handle->context, &handle->params); -- krb5_db_fini(handle->context); -- free_db_args(handle); -- free(handle); -- return ret; -- } -+ ret = krb5_parse_name(handle->context, client_name, -+ &handle->current_caller); -+ if (ret) -+ goto cleanup; - -- if (! (handle->lhandle = malloc(sizeof(*handle)))) { -- kadm5_free_config_params(handle->context, &handle->params); -- krb5_db_fini(handle->context); -- free_db_args(handle); -- free(handle); -- return ENOMEM; -- } -+ handle->lhandle = k5alloc(sizeof(*handle), &ret); -+ if (handle->lhandle == NULL) -+ goto cleanup; - *handle->lhandle = *handle; - handle->lhandle->api_version = KADM5_API_VERSION_4; - handle->lhandle->struct_version = KADM5_STRUCT_VERSION; - handle->lhandle->lhandle = handle->lhandle; - -- /* can't check the handle until current_caller is set */ -- ret = check_handle((void *) handle); -- if (ret) { -- kadm5_free_config_params(handle->context, &handle->params); -- free_db_args(handle); -- free(handle); -- return ret; -- } -- - ret = kdb_init_master(handle, handle->params.realm, - (handle->params.mask & KADM5_CONFIG_MKEY_FROM_KBD) - && handle->params.mkey_from_kbd); -- if (ret) { -- kadm5_free_config_params(handle->context, &handle->params); -- krb5_db_fini(handle->context); -- free_db_args(handle); -- free(handle); -- return ret; -- } -+ if (ret) -+ goto cleanup; - - ret = kdb_init_hist(handle, handle->params.realm); -- if (ret) { -- kadm5_free_config_params(handle->context, &handle->params); -- krb5_db_fini(handle->context); -- free_db_args(handle); -- free(handle); -- return ret; -- } -+ if (ret) -+ goto cleanup; - - ret = k5_kadm5_hook_load(context,&handle->hook_handles); -- if (ret) { -- kadm5_free_config_params(handle->context, &handle->params); -- krb5_db_fini(handle->context); -- krb5_free_principal(handle->context, handle->current_caller); -- free_db_args(handle); -- free(handle); -- return ret; -- } -+ if (ret) -+ goto cleanup; - - ret = init_pwqual(handle); -- if (ret) { -- kadm5_free_config_params(handle->context, &handle->params); -- k5_kadm5_hook_free_handles(context, handle->hook_handles); -- krb5_db_fini(handle->context); -- krb5_free_principal(handle->context, handle->current_caller); -- free_db_args(handle); -- free(handle); -- return ret; -- } -+ if (ret) -+ goto cleanup; - -- *server_handle = (void *) handle; -+ *server_handle = handle; -+ handle = NULL; - -- return KADM5_OK; -+cleanup: -+ free_handle(handle); -+ return ret; - } - - kadm5_ret_t kadm5_destroy(void *server_handle) - { -- kadm5_server_handle_t handle = server_handle; -- - CHECK_HANDLE(server_handle); -- -- destroy_pwqual(handle); -- -- k5_kadm5_hook_free_handles(handle->context, handle->hook_handles); -- ulog_fini(handle->context); -- krb5_db_fini(handle->context); -- krb5_free_principal(handle->context, handle->current_caller); -- kadm5_free_config_params(handle->context, &handle->params); -- handle->magic_number = 0; -- free(handle->lhandle); -- free_db_args(handle); -- free(handle); -- -+ free_handle(server_handle); - return KADM5_OK; - } - diff --git a/Fix-softpkcs11-build-issues-with-openssl-3.0.patch b/Fix-softpkcs11-build-issues-with-openssl-3.0.patch deleted file mode 100644 index ba5a8b5..0000000 --- a/Fix-softpkcs11-build-issues-with-openssl-3.0.patch +++ /dev/null @@ -1,552 +0,0 @@ -From f85a818fe1a7438db7e1ea579818da67e0be017d Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Sat, 15 May 2021 17:35:25 -0400 -Subject: [PATCH] Fix softpkcs11 build issues with openssl 3.0 - -EVP_PKEY_get0_RSA() has been modified to have const return type. Remove -its usages in favor of the EVP_PKEY interface. Also remove calls to -RSA_blinding_off(), which we don't need and would require a non-const -object. Similarly, remove RSA_set_method() calls that set a pre-existing -default. - -Since softpkcs11 doesn't link against krb5 and can't use zap(), allocate -buffers with OPENSSL_malloc() so can use OPENSSL_clear_free(). - -Move several argument validation checks to the top of their functions. - -Fix some incorrect/inconsistent log messages. - -(cherry picked from commit 00de1aad7b3647b91017c7009b0bc65cd0c8b2e0) -(cherry picked from commit a86b780ef275b35e8dc1e6d1886ec8e8d941f7c4) ---- - src/tests/softpkcs11/main.c | 360 ++++++++++++++---------------------- - 1 file changed, 141 insertions(+), 219 deletions(-) - -diff --git a/src/tests/softpkcs11/main.c b/src/tests/softpkcs11/main.c -index 1cccdfb43..caa537b68 100644 ---- a/src/tests/softpkcs11/main.c -+++ b/src/tests/softpkcs11/main.c -@@ -375,10 +375,9 @@ add_st_object(void) - return NULL; - soft_token.object.objs = objs; - -- o = malloc(sizeof(*o)); -+ o = calloc(1, sizeof(*o)); - if (o == NULL) - return NULL; -- memset(o, 0, sizeof(*o)); - o->attrs = NULL; - o->num_attributes = 0; - o->object_handle = soft_token.object.num_objs; -@@ -424,7 +423,7 @@ add_pubkey_info(struct st_object *o, CK_KEY_TYPE key_type, EVP_PKEY *key) - CK_ULONG modulus_bits = 0; - CK_BYTE *exponent = NULL; - size_t exponent_len = 0; -- RSA *rsa; -+ const RSA *rsa; - const BIGNUM *n, *e; - - rsa = EVP_PKEY_get0_RSA(key); -@@ -445,8 +444,6 @@ add_pubkey_info(struct st_object *o, CK_KEY_TYPE key_type, EVP_PKEY *key) - add_object_attribute(o, 0, CKA_PUBLIC_EXPONENT, - exponent, exponent_len); - -- RSA_set_method(rsa, RSA_PKCS1_OpenSSL()); -- - free(modulus); - free(exponent); - } -@@ -679,10 +676,6 @@ add_certificate(char *label, - } else { - /* XXX verify keytype */ - -- if (key_type == CKK_RSA) -- RSA_set_method(EVP_PKEY_get0_RSA(o->u.private_key.key), -- RSA_PKCS1_OpenSSL()); -- - if (X509_check_private_key(cert, o->u.private_key.key) != 1) { - EVP_PKEY_free(o->u.private_key.key); - o->u.private_key.key = NULL; -@@ -695,7 +688,7 @@ add_certificate(char *label, - } - - ret = CKR_OK; -- out: -+out: - if (ret != CKR_OK) { - st_logf("something went wrong when adding cert!\n"); - -@@ -1224,8 +1217,6 @@ C_Login(CK_SESSION_HANDLE hSession, - } - - /* XXX check keytype */ -- RSA_set_method(EVP_PKEY_get0_RSA(o->u.private_key.key), -- RSA_PKCS1_OpenSSL()); - - if (X509_check_private_key(o->u.private_key.cert, o->u.private_key.key) != 1) { - EVP_PKEY_free(o->u.private_key.key); -@@ -1495,8 +1486,9 @@ C_Encrypt(CK_SESSION_HANDLE hSession, - struct st_object *o; - void *buffer = NULL; - CK_RV ret; -- RSA *rsa; -- int padding, len, buffer_len, padding_len; -+ size_t buffer_len = 0; -+ int padding; -+ EVP_PKEY_CTX *ctx = NULL; - - st_logf("Encrypt\n"); - -@@ -1512,70 +1504,58 @@ C_Encrypt(CK_SESSION_HANDLE hSession, - return CKR_ARGUMENTS_BAD; - } - -- rsa = EVP_PKEY_get0_RSA(o->u.public_key); -- -- if (rsa == NULL) -- return CKR_ARGUMENTS_BAD; -- -- RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */ -- -- buffer_len = RSA_size(rsa); -- -- buffer = malloc(buffer_len); -- if (buffer == NULL) { -- ret = CKR_DEVICE_MEMORY; -- goto out; -- } -- -- ret = CKR_OK; -- switch(state->encrypt_mechanism->mechanism) { -- case CKM_RSA_PKCS: -- padding = RSA_PKCS1_PADDING; -- padding_len = RSA_PKCS1_PADDING_SIZE; -- break; -- case CKM_RSA_X_509: -- padding = RSA_NO_PADDING; -- padding_len = 0; -- break; -- default: -- ret = CKR_FUNCTION_NOT_SUPPORTED; -- goto out; -- } -- -- if ((CK_ULONG)buffer_len + padding_len < ulDataLen) { -- ret = CKR_ARGUMENTS_BAD; -- goto out; -- } -- - if (pulEncryptedDataLen == NULL) { - st_logf("pulEncryptedDataLen NULL\n"); - ret = CKR_ARGUMENTS_BAD; - goto out; - } - -- if (pData == NULL_PTR) { -+ if (pData == NULL) { - st_logf("data NULL\n"); - ret = CKR_ARGUMENTS_BAD; - goto out; - } - -- len = RSA_public_encrypt(ulDataLen, pData, buffer, rsa, padding); -- if (len <= 0) { -+ switch(state->encrypt_mechanism->mechanism) { -+ case CKM_RSA_PKCS: -+ padding = RSA_PKCS1_PADDING; -+ break; -+ case CKM_RSA_X_509: -+ padding = RSA_NO_PADDING; -+ break; -+ default: -+ ret = CKR_FUNCTION_NOT_SUPPORTED; -+ goto out; -+ } -+ -+ ctx = EVP_PKEY_CTX_new(o->u.public_key, NULL); -+ if (ctx == NULL || EVP_PKEY_encrypt_init(ctx) <= 0 || -+ EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 || -+ EVP_PKEY_encrypt(ctx, NULL, &buffer_len, pData, ulDataLen) <= 0) { - ret = CKR_DEVICE_ERROR; - goto out; - } -- if (len > buffer_len) -- abort(); - -- if (pEncryptedData != NULL_PTR) -- memcpy(pEncryptedData, buffer, len); -- *pulEncryptedDataLen = len; -- -- out: -- if (buffer) { -- memset(buffer, 0, buffer_len); -- free(buffer); -+ buffer = OPENSSL_malloc(buffer_len); -+ if (buffer == NULL) { -+ ret = CKR_DEVICE_MEMORY; -+ goto out; - } -+ -+ if (EVP_PKEY_encrypt(ctx, buffer, &buffer_len, pData, ulDataLen) <= 0) { -+ ret = CKR_DEVICE_ERROR; -+ goto out; -+ } -+ st_logf("Encrypt done\n"); -+ -+ if (pEncryptedData != NULL) -+ memcpy(pEncryptedData, buffer, buffer_len); -+ *pulEncryptedDataLen = buffer_len; -+ -+ ret = CKR_OK; -+out: -+ OPENSSL_clear_free(buffer, buffer_len); -+ EVP_PKEY_CTX_free(ctx); - return ret; - } - -@@ -1646,8 +1626,9 @@ C_Decrypt(CK_SESSION_HANDLE hSession, - struct st_object *o; - void *buffer = NULL; - CK_RV ret; -- RSA *rsa; -- int padding, len, buffer_len, padding_len; -+ size_t buffer_len = 0; -+ int padding; -+ EVP_PKEY_CTX *ctx = NULL; - - st_logf("Decrypt\n"); - -@@ -1663,41 +1644,6 @@ C_Decrypt(CK_SESSION_HANDLE hSession, - return CKR_ARGUMENTS_BAD; - } - -- rsa = EVP_PKEY_get0_RSA(o->u.private_key.key); -- -- if (rsa == NULL) -- return CKR_ARGUMENTS_BAD; -- -- RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */ -- -- buffer_len = RSA_size(rsa); -- -- buffer = malloc(buffer_len); -- if (buffer == NULL) { -- ret = CKR_DEVICE_MEMORY; -- goto out; -- } -- -- ret = CKR_OK; -- switch(state->decrypt_mechanism->mechanism) { -- case CKM_RSA_PKCS: -- padding = RSA_PKCS1_PADDING; -- padding_len = RSA_PKCS1_PADDING_SIZE; -- break; -- case CKM_RSA_X_509: -- padding = RSA_NO_PADDING; -- padding_len = 0; -- break; -- default: -- ret = CKR_FUNCTION_NOT_SUPPORTED; -- goto out; -- } -- -- if ((CK_ULONG)buffer_len + padding_len < ulEncryptedDataLen) { -- ret = CKR_ARGUMENTS_BAD; -- goto out; -- } -- - if (pulDataLen == NULL) { - st_logf("pulDataLen NULL\n"); - ret = CKR_ARGUMENTS_BAD; -@@ -1710,24 +1656,48 @@ C_Decrypt(CK_SESSION_HANDLE hSession, - goto out; - } - -- len = RSA_private_decrypt(ulEncryptedDataLen, pEncryptedData, buffer, -- rsa, padding); -- if (len <= 0) { -+ switch(state->decrypt_mechanism->mechanism) { -+ case CKM_RSA_PKCS: -+ padding = RSA_PKCS1_PADDING; -+ break; -+ case CKM_RSA_X_509: -+ padding = RSA_NO_PADDING; -+ break; -+ default: -+ ret = CKR_FUNCTION_NOT_SUPPORTED; -+ goto out; -+ } -+ -+ ctx = EVP_PKEY_CTX_new(o->u.private_key.key, NULL); -+ if (ctx == NULL || EVP_PKEY_decrypt_init(ctx) <= 0 || -+ EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 || -+ EVP_PKEY_decrypt(ctx, NULL, &buffer_len, pEncryptedData, -+ ulEncryptedDataLen) <= 0) { - ret = CKR_DEVICE_ERROR; - goto out; - } -- if (len > buffer_len) -- abort(); -+ -+ buffer = OPENSSL_malloc(buffer_len); -+ if (buffer == NULL) { -+ ret = CKR_DEVICE_MEMORY; -+ goto out; -+ } -+ -+ if (EVP_PKEY_decrypt(ctx, buffer, &buffer_len, pEncryptedData, -+ ulEncryptedDataLen) <= 0) { -+ ret = CKR_DEVICE_ERROR; -+ goto out; -+ } -+ st_logf("Decrypt done\n"); - - if (pData != NULL_PTR) -- memcpy(pData, buffer, len); -- *pulDataLen = len; -+ memcpy(pData, buffer, buffer_len); -+ *pulDataLen = buffer_len; - -- out: -- if (buffer) { -- memset(buffer, 0, buffer_len); -- free(buffer); -- } -+ ret = CKR_OK; -+out: -+ OPENSSL_clear_free(buffer, buffer_len); -+ EVP_PKEY_CTX_free(ctx); - return ret; - } - -@@ -1806,8 +1776,9 @@ C_Sign(CK_SESSION_HANDLE hSession, - struct st_object *o; - void *buffer = NULL; - CK_RV ret; -- RSA *rsa; -- int padding, len, buffer_len, padding_len; -+ int padding; -+ size_t buffer_len = 0; -+ EVP_PKEY_CTX *ctx = NULL; - - st_logf("Sign\n"); - VERIFY_SESSION_HANDLE(hSession, &state); -@@ -1822,40 +1793,6 @@ C_Sign(CK_SESSION_HANDLE hSession, - return CKR_ARGUMENTS_BAD; - } - -- rsa = EVP_PKEY_get0_RSA(o->u.private_key.key); -- -- if (rsa == NULL) -- return CKR_ARGUMENTS_BAD; -- -- RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */ -- -- buffer_len = RSA_size(rsa); -- -- buffer = malloc(buffer_len); -- if (buffer == NULL) { -- ret = CKR_DEVICE_MEMORY; -- goto out; -- } -- -- switch(state->sign_mechanism->mechanism) { -- case CKM_RSA_PKCS: -- padding = RSA_PKCS1_PADDING; -- padding_len = RSA_PKCS1_PADDING_SIZE; -- break; -- case CKM_RSA_X_509: -- padding = RSA_NO_PADDING; -- padding_len = 0; -- break; -- default: -- ret = CKR_FUNCTION_NOT_SUPPORTED; -- goto out; -- } -- -- if ((CK_ULONG)buffer_len < ulDataLen + padding_len) { -- ret = CKR_ARGUMENTS_BAD; -- goto out; -- } -- - if (pulSignatureLen == NULL) { - st_logf("signature len NULL\n"); - ret = CKR_ARGUMENTS_BAD; -@@ -1868,26 +1805,46 @@ C_Sign(CK_SESSION_HANDLE hSession, - goto out; - } - -- len = RSA_private_encrypt(ulDataLen, pData, buffer, rsa, padding); -- st_logf("private encrypt done\n"); -- if (len <= 0) { -+ switch(state->sign_mechanism->mechanism) { -+ case CKM_RSA_PKCS: -+ padding = RSA_PKCS1_PADDING; -+ break; -+ case CKM_RSA_X_509: -+ padding = RSA_NO_PADDING; -+ break; -+ default: -+ ret = CKR_FUNCTION_NOT_SUPPORTED; -+ goto out; -+ } -+ -+ ctx = EVP_PKEY_CTX_new(o->u.private_key.key, NULL); -+ if (ctx == NULL || EVP_PKEY_sign_init(ctx) <= 0 || -+ EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 || -+ EVP_PKEY_sign(ctx, NULL, &buffer_len, pData, ulDataLen) <= 0) { - ret = CKR_DEVICE_ERROR; - goto out; - } -- if (len > buffer_len) -- abort(); - -- if (pSignature != NULL_PTR) -- memcpy(pSignature, buffer, len); -- *pulSignatureLen = len; -+ buffer = OPENSSL_malloc(buffer_len); -+ if (buffer == NULL) { -+ ret = CKR_DEVICE_MEMORY; -+ goto out; -+ } -+ -+ if (EVP_PKEY_sign(ctx, buffer, &buffer_len, pData, ulDataLen) <= 0) { -+ ret = CKR_DEVICE_ERROR; -+ goto out; -+ } -+ st_logf("Sign done\n"); -+ -+ if (pSignature != NULL) -+ memcpy(pSignature, buffer, buffer_len); -+ *pulSignatureLen = buffer_len; - - ret = CKR_OK; -- -- out: -- if (buffer) { -- memset(buffer, 0, buffer_len); -- free(buffer); -- } -+out: -+ OPENSSL_clear_free(buffer, buffer_len); -+ EVP_PKEY_CTX_free(ctx); - return ret; - } - -@@ -1951,10 +1908,9 @@ C_Verify(CK_SESSION_HANDLE hSession, - { - struct session_state *state; - struct st_object *o; -- void *buffer = NULL; - CK_RV ret; -- RSA *rsa; -- int padding, len, buffer_len; -+ int padding; -+ EVP_PKEY_CTX *ctx = NULL; - - st_logf("Verify\n"); - VERIFY_SESSION_HANDLE(hSession, &state); -@@ -1969,39 +1925,6 @@ C_Verify(CK_SESSION_HANDLE hSession, - return CKR_ARGUMENTS_BAD; - } - -- rsa = EVP_PKEY_get0_RSA(o->u.public_key); -- -- if (rsa == NULL) -- return CKR_ARGUMENTS_BAD; -- -- RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */ -- -- buffer_len = RSA_size(rsa); -- -- buffer = malloc(buffer_len); -- if (buffer == NULL) { -- ret = CKR_DEVICE_MEMORY; -- goto out; -- } -- -- ret = CKR_OK; -- switch(state->verify_mechanism->mechanism) { -- case CKM_RSA_PKCS: -- padding = RSA_PKCS1_PADDING; -- break; -- case CKM_RSA_X_509: -- padding = RSA_NO_PADDING; -- break; -- default: -- ret = CKR_FUNCTION_NOT_SUPPORTED; -- goto out; -- } -- -- if ((CK_ULONG)buffer_len < ulDataLen) { -- ret = CKR_ARGUMENTS_BAD; -- goto out; -- } -- - if (pSignature == NULL) { - st_logf("signature NULL\n"); - ret = CKR_ARGUMENTS_BAD; -@@ -2014,34 +1937,34 @@ C_Verify(CK_SESSION_HANDLE hSession, - goto out; - } - -- len = RSA_public_decrypt(ulDataLen, pData, buffer, rsa, padding); -- st_logf("private encrypt done\n"); -- if (len <= 0) { -+ switch(state->verify_mechanism->mechanism) { -+ case CKM_RSA_PKCS: -+ padding = RSA_PKCS1_PADDING; -+ break; -+ case CKM_RSA_X_509: -+ padding = RSA_NO_PADDING; -+ break; -+ default: -+ ret = CKR_FUNCTION_NOT_SUPPORTED; -+ goto out; -+ } -+ -+ ctx = EVP_PKEY_CTX_new(o->u.public_key, NULL); -+ if (ctx == NULL || EVP_PKEY_verify_init(ctx) <= 0 || -+ EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 || -+ EVP_PKEY_verify(ctx, pSignature, ulSignatureLen, pData, -+ ulDataLen) <= 0) { - ret = CKR_DEVICE_ERROR; - goto out; - } -- if (len > buffer_len) -- abort(); -+ st_logf("Verify done\n"); - -- if ((CK_ULONG)len != ulSignatureLen) { -- ret = CKR_GENERAL_ERROR; -- goto out; -- } -- -- if (memcmp(pSignature, buffer, len) != 0) { -- ret = CKR_GENERAL_ERROR; -- goto out; -- } -- -- out: -- if (buffer) { -- memset(buffer, 0, buffer_len); -- free(buffer); -- } -+ ret = CKR_OK; -+out: -+ EVP_PKEY_CTX_free(ctx); - return ret; - } - -- - CK_RV - C_VerifyUpdate(CK_SESSION_HANDLE hSession, - CK_BYTE_PTR pPart, -@@ -2072,7 +1995,6 @@ C_GenerateRandom(CK_SESSION_HANDLE hSession, - return CKR_FUNCTION_NOT_SUPPORTED; - } - -- - CK_FUNCTION_LIST funcs = { - { 2, 11 }, - C_Initialize, diff --git a/Fix-some-principal-realm-canonicalization-cases.patch b/Fix-some-principal-realm-canonicalization-cases.patch deleted file mode 100644 index 81fde7f..0000000 --- a/Fix-some-principal-realm-canonicalization-cases.patch +++ /dev/null @@ -1,96 +0,0 @@ -From 0779309f52f4c05bb1f01f638261ef1b8ca82488 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Mon, 7 Jun 2021 13:27:29 -0400 -Subject: [PATCH] Fix some principal realm canonicalization cases - -The no_hostrealm and subst_defrealm flags in struct canonprinc were -only applied when dns_canonicalize_hostname=fallback; in the other -cases, the initial krb5_sname_to_principal() result is treated as -canonical. For no_hostrealm this limitation doesn't currently matter, -because all uses pass a principal with no realm as input. However, -subst_defrealm is used to convert the referral realm to the default -realm in krb5_get_init_creds_keytab(), krb5_cc_cache_match(), and -gss_acquire_cred() when it needs to check the desired name against a -specified ccache. - -In k5_canonprinc(), if the input principal is a -krb5_sname_to_principal() result and fallback isn't in effect, apply -subst_defrealm. Document in os-proto.h that no_hostrealm doesn't -remove an existing realm and that krb5_sname_to_principal() may -already have looked one up. - -ticket: 9011 (new) -(cherry picked from commit c077d0c6430c4ac163443aacc03d14d206a4cbb8) ---- - src/lib/krb5/os/os-proto.h | 13 +++++++++---- - src/lib/krb5/os/sn2princ.c | 24 +++++++++++++++++++++--- - 2 files changed, 30 insertions(+), 7 deletions(-) - -diff --git a/src/lib/krb5/os/os-proto.h b/src/lib/krb5/os/os-proto.h -index 7d5e7978f..a985f2aec 100644 ---- a/src/lib/krb5/os/os-proto.h -+++ b/src/lib/krb5/os/os-proto.h -@@ -85,10 +85,15 @@ struct sendto_callback_info { - - /* - * Initialize with all zeros except for princ. Set no_hostrealm to disable -- * host-to-realm lookup, which ordinarily happens after canonicalizing the host -- * part. Set subst_defrealm to substitute the default realm for the referral -- * realm after realm lookup (this has no effect if no_hostrealm is set). Free -- * with free_canonprinc() when done. -+ * host-to-realm lookup, which ordinarily happens during fallback processing -+ * after canonicalizing the host part. Set subst_defrealm to substitute the -+ * default realm for the referral realm after realm lookup. Do not set both -+ * flags. Free with free_canonprinc() when done. -+ * -+ * no_hostrealm only applies if fallback processing is in use -+ * (dns_canonicalize_hostname = fallback). It will not remove the realm if -+ * krb5_sname_to_principal() already canonicalized the hostname and looked up a -+ * realm. subst_defrealm applies whether or not fallback processing is in use. - */ - struct canonprinc { - krb5_const_principal princ; -diff --git a/src/lib/krb5/os/sn2princ.c b/src/lib/krb5/os/sn2princ.c -index c99b7da17..93c155932 100644 ---- a/src/lib/krb5/os/sn2princ.c -+++ b/src/lib/krb5/os/sn2princ.c -@@ -271,18 +271,36 @@ krb5_error_code - k5_canonprinc(krb5_context context, struct canonprinc *iter, - krb5_const_principal *princ_out) - { -+ krb5_error_code ret; - int step = ++iter->step; - - *princ_out = NULL; - -- /* If we're not doing fallback, the input principal is canonical. */ -- if (context->dns_canonicalize_hostname != CANONHOST_FALLBACK || -- iter->princ->type != KRB5_NT_SRV_HST || iter->princ->length != 2 || -+ /* If the hostname isn't from krb5_sname_to_principal(), the input -+ * principal is canonical. */ -+ if (iter->princ->type != KRB5_NT_SRV_HST || iter->princ->length != 2 || - iter->princ->data[1].length == 0) { - *princ_out = (step == 1) ? iter->princ : NULL; - return 0; - } - -+ /* If we're not doing fallback, the hostname is canonical, but we may need -+ * to substitute the default realm. */ -+ if (context->dns_canonicalize_hostname != CANONHOST_FALLBACK) { -+ if (step > 1) -+ return 0; -+ iter->copy = *iter->princ; -+ if (iter->subst_defrealm && iter->copy.realm.length == 0) { -+ ret = krb5_get_default_realm(context, &iter->realm); -+ if (ret) -+ return ret; -+ iter->copy = *iter->princ; -+ iter->copy.realm = string2data(iter->realm); -+ } -+ *princ_out = &iter->copy; -+ return 0; -+ } -+ - /* Canonicalize without DNS at step 1, with DNS at step 2. */ - if (step > 2) - return 0; diff --git a/Handle-OpenSSL-3-s-providers.patch b/Handle-OpenSSL-3-s-providers.patch deleted file mode 100644 index d7b0d90..0000000 --- a/Handle-OpenSSL-3-s-providers.patch +++ /dev/null @@ -1,301 +0,0 @@ -From e3f3d31a3db23f6c8437cd0efe45f67a7f4fc6aa Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Sat, 15 May 2021 21:18:06 -0400 -Subject: [PATCH] Handle OpenSSL 3's providers - -OpenSSL 3 compartmentalizes what algorithms it uses, which for us means -another hoop to jump through to use dubious cryptography. (Right now, -we need to load "legacy" in order to access MD4 and RC4.) - -Use our normal initializer logic to set up providers both in the OpenSSL -provider an the PKINIT plugin. Since DT_FINI is too late, release them -using atexit() as OpenSSL does. - -(cherry picked from commit bea5a703a06da1f1ab56821b77a2d3661cb0dda4) -[rharwood@redhat.com: work around des3 removal and rc4 fips changes] ---- - src/configure.ac | 1 + - src/lib/crypto/openssl/enc_provider/aes.c | 16 ++++++ - .../crypto/openssl/enc_provider/camellia.c | 16 ++++++ - src/lib/crypto/openssl/enc_provider/rc4.c | 4 ++ - .../crypto/openssl/hash_provider/hash_evp.c | 5 ++ - src/lib/crypto/openssl/init.c | 53 +++++++++++++++++++ - src/plugins/preauth/pkinit/Makefile.in | 1 + - .../preauth/pkinit/pkinit_crypto_openssl.c | 33 ++++++++++-- - 8 files changed, 126 insertions(+), 3 deletions(-) - -diff --git a/src/configure.ac b/src/configure.ac -index 9c2e816fe..20066918b 100644 ---- a/src/configure.ac -+++ b/src/configure.ac -@@ -284,6 +284,7 @@ AC_SUBST(CRYPTO_IMPL_LIBS) - - if test "$CRYPTO_IMPL" = openssl; then - AC_CHECK_FUNCS(EVP_KDF_fetch) -+ AC_CHECK_FUNCS(OSSL_PROVIDER_load) - fi - - AC_ARG_WITH([prng-alg], -diff --git a/src/lib/crypto/openssl/enc_provider/aes.c b/src/lib/crypto/openssl/enc_provider/aes.c -index 6b4622fe9..31c90a69d 100644 ---- a/src/lib/crypto/openssl/enc_provider/aes.c -+++ b/src/lib/crypto/openssl/enc_provider/aes.c -@@ -68,6 +68,10 @@ cbc_enc(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, - EVP_CIPHER_CTX *ctx; - struct iov_cursor cursor; - -+ ret = krb5int_crypto_init(); -+ if (ret) -+ return ret; -+ - ctx = EVP_CIPHER_CTX_new(); - if (ctx == NULL) - return ENOMEM; -@@ -102,6 +106,10 @@ cbc_decr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, - EVP_CIPHER_CTX *ctx; - struct iov_cursor cursor; - -+ ret = krb5int_crypto_init(); -+ if (ret) -+ return ret; -+ - ctx = EVP_CIPHER_CTX_new(); - if (ctx == NULL) - return ENOMEM; -@@ -137,6 +145,10 @@ cts_encr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, - struct iov_cursor cursor; - AES_KEY enck; - -+ ret = krb5int_crypto_init(); -+ if (ret) -+ return ret; -+ - memset(iv_cts,0,sizeof(iv_cts)); - if (ivec && ivec->data){ - if (ivec->length != sizeof(iv_cts)) -@@ -190,6 +202,10 @@ cts_decr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, - struct iov_cursor cursor; - AES_KEY deck; - -+ ret = krb5int_crypto_init(); -+ if (ret) -+ return ret; -+ - memset(iv_cts,0,sizeof(iv_cts)); - if (ivec && ivec->data){ - if (ivec->length != sizeof(iv_cts)) -diff --git a/src/lib/crypto/openssl/enc_provider/camellia.c b/src/lib/crypto/openssl/enc_provider/camellia.c -index f79679a0b..7cc7fc6fb 100644 ---- a/src/lib/crypto/openssl/enc_provider/camellia.c -+++ b/src/lib/crypto/openssl/enc_provider/camellia.c -@@ -92,6 +92,10 @@ cbc_enc(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, - EVP_CIPHER_CTX *ctx; - struct iov_cursor cursor; - -+ ret = krb5int_crypto_init(); -+ if (ret) -+ return ret; -+ - ctx = EVP_CIPHER_CTX_new(); - if (ctx == NULL) - return ENOMEM; -@@ -126,6 +130,10 @@ cbc_decr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, - EVP_CIPHER_CTX *ctx; - struct iov_cursor cursor; - -+ ret = krb5int_crypto_init(); -+ if (ret) -+ return ret; -+ - ctx = EVP_CIPHER_CTX_new(); - if (ctx == NULL) - return ENOMEM; -@@ -161,6 +169,10 @@ cts_encr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, - struct iov_cursor cursor; - CAMELLIA_KEY enck; - -+ ret = krb5int_crypto_init(); -+ if (ret) -+ return ret; -+ - memset(iv_cts,0,sizeof(iv_cts)); - if (ivec && ivec->data){ - if (ivec->length != sizeof(iv_cts)) -@@ -214,6 +226,10 @@ cts_decr(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, - struct iov_cursor cursor; - CAMELLIA_KEY deck; - -+ ret = krb5int_crypto_init(); -+ if (ret) -+ return ret; -+ - memset(iv_cts,0,sizeof(iv_cts)); - if (ivec && ivec->data){ - if (ivec->length != sizeof(iv_cts)) -diff --git a/src/lib/crypto/openssl/enc_provider/rc4.c b/src/lib/crypto/openssl/enc_provider/rc4.c -index 9bf407899..a10cb5192 100644 ---- a/src/lib/crypto/openssl/enc_provider/rc4.c -+++ b/src/lib/crypto/openssl/enc_provider/rc4.c -@@ -66,6 +66,10 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data, - EVP_CIPHER_CTX *ctx = NULL; - struct arcfour_state *arcstate; - -+ ret = krb5int_crypto_init(); -+ if (ret) -+ return ret; -+ - if (FIPS_mode()) - return KRB5_CRYPTO_INTERNAL; - -diff --git a/src/lib/crypto/openssl/hash_provider/hash_evp.c b/src/lib/crypto/openssl/hash_provider/hash_evp.c -index 2eb5139c0..09d7b3896 100644 ---- a/src/lib/crypto/openssl/hash_provider/hash_evp.c -+++ b/src/lib/crypto/openssl/hash_provider/hash_evp.c -@@ -41,6 +41,11 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data, - const krb5_data *d; - size_t i; - int ok; -+ krb5_error_code ret; -+ -+ ret = krb5int_crypto_init(); -+ if (ret) -+ return ret; - - if (output->length != (unsigned int)EVP_MD_size(type)) - return KRB5_CRYPTO_INTERNAL; -diff --git a/src/lib/crypto/openssl/init.c b/src/lib/crypto/openssl/init.c -index 1139bce53..f72dbfe81 100644 ---- a/src/lib/crypto/openssl/init.c -+++ b/src/lib/crypto/openssl/init.c -@@ -26,12 +26,65 @@ - - #include "crypto_int.h" - -+#ifdef HAVE_OSSL_PROVIDER_LOAD -+ -+/* -+ * Starting in OpenSSL 3, algorithms are grouped into containers called -+ * "providers", not all of which are loaded by default. At time of writing, -+ * we need MD4 and RC4 from the legacy provider. Oddly, 3DES is not in -+ * legacy. -+ */ -+ -+#include -+ -+static OSSL_PROVIDER *legacy_provider = NULL; -+static OSSL_PROVIDER *default_provider = NULL; -+ -+static void -+unload_providers(void) -+{ -+ if (default_provider != NULL) -+ (void)OSSL_PROVIDER_unload(default_provider); -+ if (legacy_provider != NULL) -+ (void)OSSL_PROVIDER_unload(legacy_provider); -+ default_provider = NULL; -+ legacy_provider = NULL; -+} -+ -+int -+krb5int_crypto_impl_init(void) -+{ -+ legacy_provider = OSSL_PROVIDER_load(NULL, "legacy"); -+ default_provider = OSSL_PROVIDER_load(NULL, "default"); -+ -+ /* -+ * Someone might build openssl without the legacy provider. They will -+ * have a bad time, but some things will still work. I don't know think -+ * this configuration is worth supporting. -+ */ -+ if (legacy_provider == NULL || default_provider == NULL) -+ abort(); -+ -+ /* -+ * If we attempt to do this with our normal LIBFINIFUNC logic (DT_FINI), -+ * OpenSSL will have cleaned itself up by the time we're invoked. OpenSSL -+ * registers its cleanup (OPENSSL_cleanup) with atexit() - do the same and -+ * we'll be higher on the stack. -+ */ -+ atexit(unload_providers); -+ return 0; -+} -+ -+#else /* !HAVE_OSSL_PROVIDER_LOAD */ -+ - int - krb5int_crypto_impl_init(void) - { - return 0; - } - -+#endif -+ - void - krb5int_crypto_impl_cleanup(void) - { -diff --git a/src/plugins/preauth/pkinit/Makefile.in b/src/plugins/preauth/pkinit/Makefile.in -index 15ca0eb48..d20fb18a8 100644 ---- a/src/plugins/preauth/pkinit/Makefile.in -+++ b/src/plugins/preauth/pkinit/Makefile.in -@@ -5,6 +5,7 @@ MODULE_INSTALL_DIR = $(KRB5_PA_MODULE_DIR) - LIBBASE=pkinit - LIBMAJOR=0 - LIBMINOR=0 -+LIBINITFUNC=pkinit_openssl_init - RELDIR=../plugins/preauth/pkinit - # Depends on libk5crypto and libkrb5 - SHLIB_EXPDEPS = \ -diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -index 350c2118a..42e5c581d 100644 ---- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -@@ -44,6 +44,13 @@ - #include - #endif - -+#ifdef HAVE_OSSL_PROVIDER_LOAD -+#include -+ -+static OSSL_PROVIDER *legacy_provider = NULL; -+static OSSL_PROVIDER *default_provider = NULL; -+#endif -+ - static krb5_error_code pkinit_init_pkinit_oids(pkinit_plg_crypto_context ); - static void pkinit_fini_pkinit_oids(pkinit_plg_crypto_context ); - -@@ -2937,12 +2944,32 @@ cleanup: - return retval; - } - -+/* pkinit_openssl_init() and unload_providers() are largely duplicated from -+ * lib/crypto/openssl/init.c - see explanations there. */ -+static void -+unload_providers(void) -+{ -+ if (default_provider != NULL) -+ (void)OSSL_PROVIDER_unload(default_provider); -+ if (legacy_provider != NULL) -+ (void)OSSL_PROVIDER_unload(legacy_provider); -+ default_provider = NULL; -+ legacy_provider = NULL; -+} -+ - int - pkinit_openssl_init() - { -- /* Initialize OpenSSL. */ -- ERR_load_crypto_strings(); -- OpenSSL_add_all_algorithms(); -+#ifdef HAVE_OSSL_PROVIDER_LOAD -+ legacy_provider = OSSL_PROVIDER_load(NULL, "legacy"); -+ default_provider = OSSL_PROVIDER_load(NULL, "default"); -+ -+ if (legacy_provider == NULL || default_provider == NULL) -+ abort(); -+ -+ atexit(unload_providers); -+#endif -+ - return 0; - } - diff --git a/Make-KCM-iteration-fallback-work-with-sssd-kcm.patch b/Make-KCM-iteration-fallback-work-with-sssd-kcm.patch deleted file mode 100644 index a0e28a9..0000000 --- a/Make-KCM-iteration-fallback-work-with-sssd-kcm.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 32ee800fa31d3bbda660bb9270f9aa20718ab202 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Pavel=20B=C5=99ezina?= -Date: Tue, 30 Mar 2021 14:35:28 +0200 -Subject: [PATCH] Make KCM iteration fallback work with sssd-kcm - -sssd-kcm returns KRB5_CC_IO if the operation code is not known. - -ticket: 8990 -(cherry picked from commit 06afae820a44c1dc96ad88a0b16c3e50bc938b2a) ---- - src/lib/krb5/ccache/cc_kcm.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c -index 1f81a2190..46705f1da 100644 ---- a/src/lib/krb5/ccache/cc_kcm.c -+++ b/src/lib/krb5/ccache/cc_kcm.c -@@ -876,7 +876,7 @@ kcm_start_seq_get(krb5_context context, krb5_ccache cache, - ret = kcmreq_get_cred_list(&req, &creds); - if (ret) - goto cleanup; -- } else if (ret == KRB5_FCC_INTERNAL) { -+ } else if (ret == KRB5_FCC_INTERNAL || ret == KRB5_CC_IO) { - /* Fall back to GET_CRED_UUID_LIST. */ - kcmreq_free(&req); - kcmreq_init(&req, KCM_OP_GET_CRED_UUID_LIST, cache); diff --git a/Move-some-dejagnu-kadmin-tests-to-Python-tests.patch b/Move-some-dejagnu-kadmin-tests-to-Python-tests.patch deleted file mode 100644 index 1c97190..0000000 --- a/Move-some-dejagnu-kadmin-tests-to-Python-tests.patch +++ /dev/null @@ -1,1750 +0,0 @@ -From 2fd38805a159020722395e79213540d9bcfa6c71 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Thu, 22 Apr 2021 15:51:36 -0400 -Subject: [PATCH] Move some dejagnu kadmin tests to Python tests - -Remove the dejagnu scripts kadmin.exp, pwchange.exp, and pwhist.exp. - -Add a new Python test script t_kadmin.py for the miscellaneous kadmin -tests from kadmin.exp. - -In t_changepw.py, use modprinc +needchange for one of the kinit -password change tests to gain the same coverage as pwchange.exp had, -and add the "password changes are usable by kinit" tests from -kadmin.exp. - -In t_policy.py, add the ticket 929 regression tests from kadmin.exp -and the ticket 2841 regression tests from pwhist.exp. - -(cherry picked from commit 8027531caf6911bb07bf13de087da0e6bef5a348) ---- - src/tests/Makefile.in | 1 + - src/tests/dejagnu/krb-standalone/kadmin.exp | 1133 ----------------- - src/tests/dejagnu/krb-standalone/pwchange.exp | 145 --- - src/tests/dejagnu/krb-standalone/pwhist.exp | 217 ---- - src/tests/t_changepw.py | 34 +- - src/tests/t_kadmin.py | 54 + - src/tests/t_policy.py | 62 + - 7 files changed, 143 insertions(+), 1503 deletions(-) - delete mode 100644 src/tests/dejagnu/krb-standalone/kadmin.exp - delete mode 100644 src/tests/dejagnu/krb-standalone/pwchange.exp - delete mode 100644 src/tests/dejagnu/krb-standalone/pwhist.exp - create mode 100644 src/tests/t_kadmin.py - -diff --git a/src/tests/Makefile.in b/src/tests/Makefile.in -index fd714eedb..20f27d748 100644 ---- a/src/tests/Makefile.in -+++ b/src/tests/Makefile.in -@@ -147,6 +147,7 @@ check-pytests: unlockiter s4u2self - $(RUNPYTEST) $(srcdir)/t_referral.py $(PYTESTFLAGS) - $(RUNPYTEST) $(srcdir)/t_skew.py $(PYTESTFLAGS) - $(RUNPYTEST) $(srcdir)/t_keytab.py $(PYTESTFLAGS) -+ $(RUNPYTEST) $(srcdir)/t_kadmin.py $(PYTESTFLAGS) - $(RUNPYTEST) $(srcdir)/t_kadmin_acl.py $(PYTESTFLAGS) - $(RUNPYTEST) $(srcdir)/t_kadmin_parsing.py $(PYTESTFLAGS) - $(RUNPYTEST) $(srcdir)/t_kdb.py $(PYTESTFLAGS) -diff --git a/src/tests/dejagnu/krb-standalone/kadmin.exp b/src/tests/dejagnu/krb-standalone/kadmin.exp -deleted file mode 100644 -index fa50a61fb..000000000 ---- a/src/tests/dejagnu/krb-standalone/kadmin.exp -+++ /dev/null -@@ -1,1133 +0,0 @@ --# Kerberos kadmin test. --# This is a DejaGnu test script. --# This script tests Kerberos kadmin5 using kadmin.local as verification. -- --#++ --# kadmin_add - Test add new v5 principal function of kadmin. --# --# Adds principal $pname with password $password. Returns 1 on success. --#-- --proc kadmin_add { pname password } { -- global REALMNAME -- global KADMIN -- global KADMIN_LOCAL -- global KEY -- global spawn_id -- global tmppwd -- -- set good 0 -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "ank $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin add $pname lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin add $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin add $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*:" { -- send "adminpass$KEY\r" -- } -- expect "Enter password for principal \"$pname@$REALMNAME\":" { send "$password\r" } -- expect "Re-enter password for principal \"$pname@$REALMNAME\":" { send "$password\r" } -- expect "Principal \"$pname@$REALMNAME\" created." { set good 1 } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin add)" -- catch "close -i $spawn_id" -- if { $good == 1 } { -- # -- # use kadmin.local to verify that a principal was created and that its -- # salt types are 0 (normal). -- # -- envstack_push -- setup_kerberos_env kdc -- spawn $KADMIN_LOCAL -r $REALMNAME -- envstack_pop -- expect_after { -- -i $spawn_id -- timeout { -- fail "kadmin add $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin add $pname" -- catch "expect_after" -- return 0 -- } -- } -- set good 0 -- expect "kadmin.local: " { send "getprinc $pname\r" } -- expect "Principal: $pname@$REALMNAME" { set good 1 } -- expect "Expiration date:" { verbose "got expiration date" } -- expect "Last password change:" { verbose "got last pwchange" } -- expect "Password expiration date:" { verbose "got pwexpire date" } -- expect "Maximum ticket life:" { verbose "got max life" } -- expect "Maximum renewable life:" { verbose "got max rlife" } -- expect "Last modified:" { verbose "got last modified" } -- expect "Last successful authentication:" { verbose "last succ auth" } -- expect "Last failed authentication:" { verbose "last pw failed" } -- expect "Failed password attempts:" { verbose "num failed attempts" } -- expect "Number of keys:" { verbose "num keys"} -- expect { -- "Key: " { verbose "Key listed" -- exp_continue -- } -- "Attributes:" { verbose "attributes" } -- } -- expect "kadmin.local: " { send "q\r" } -- -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin.local show)" -- catch "close -i $spawn_id" -- if { $good == 1 } { -- pass "kadmin add $pname" -- return 1 -- } -- else { -- fail "kadmin add $pname" -- return 0 -- } -- } -- else { -- fail "kadmin add $pname" -- return 0 -- } --} -- --#++ --# kadmin_add_rnd - Test add new v5 principal with random key function. --# --# Adds principal $pname with random key. Returns 1 on success. --#-- --proc kadmin_add_rnd { pname { flags "" } } { -- global REALMNAME -- global KADMIN -- global KADMIN_LOCAL -- global KEY -- global spawn_id -- global tmppwd -- -- set good 0 -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "ank -randkey $flags $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin add rnd $pname lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin add_rnd $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin add_rnd $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" { -- send "adminpass$KEY\r" -- } -- expect "Principal \"$pname@$REALMNAME\" created." { set good 1 } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin add_rnd)" -- catch "close -i $spawn_id" -- if { $good == 1 } { -- # -- # use kadmin.local to verify that a principal was created and that its -- # salt types are 0 (normal). -- # -- envstack_push -- setup_kerberos_env kdc -- spawn $KADMIN_LOCAL -r $REALMNAME -- envstack_pop -- expect_after { -- -i $spawn_id -- timeout { -- fail "kadmin add_rnd $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin add_rnd $pname" -- catch "expect_after" -- return 0 -- } -- } -- set good 0 -- expect "kadmin.local:" { send "getprinc $pname\r" } -- expect "Principal: $pname@$REALMNAME" { set good 1 } -- expect "kadmin.local:" { send "q\r" } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin.local show)" -- catch "close -i $spawn_id" -- if { $good == 1 } { -- pass "kadmin add_rnd $pname" -- return 1 -- } -- else { -- fail "kadmin add_rnd $pname" -- return 0 -- } -- } -- else { -- fail "kadmin add_rnd $pname" -- return 0 -- } --} -- --#++ --# kadmin_show - Test show principal function of kadmin. --# --# Retrieves entry for $pname. Returns 1 on success. --#-- --proc kadmin_show { pname } { -- global REALMNAME -- global KADMIN -- global KEY -- global spawn_id -- -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "get_principal $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin show $pname lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin show $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin show $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" -- send "adminpass$KEY\r" -- expect -re "\r.*Principal: $pname@$REALMNAME.*Key: .*Attributes:.*Policy: .*\r" -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin show)" -- catch "close -i $spawn_id" -- pass "kadmin show $pname" -- return 1 --} -- --#++ --# kadmin_cpw - Test change password function of kadmin --# --# Change password of $pname to $password. Returns 1 on success. --#-- --proc kadmin_cpw { pname password } { -- global REALMNAME -- global KADMIN -- global KEY -- global spawn_id -- -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "cpw $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin cpw $pname lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin cpw $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin cpw $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" { -- send "adminpass$KEY\r" -- } -- -- expect "Enter password for principal \"$pname@$REALMNAME\":" { send "$password\r" } -- expect "Re-enter password for principal \"$pname@$REALMNAME\":" { send "$password\r" } -- # When in doubt, jam one of these in there. -- expect "\r" -- expect "Password for \"$pname@$REALMNAME\" changed." -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin cpw)" -- catch "close -i $spawn_id" -- pass "kadmin cpw $pname" -- return 1 --} -- --#++ --# kadmin_cpw_rnd - Test change random key function of kadmin. --# --# Changes principal $pname's key to a new random key. Returns 1 on success. --#-- --proc kadmin_cpw_rnd { pname } { -- global REALMNAME -- global KADMIN -- global KEY -- global spawn_id -- -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "cpw -randkey $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin cpw_rnd $pname lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin cpw_rnd $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin cpw_rnd $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" { -- send "adminpass$KEY\r" -- } -- # When in doubt, jam one of these in there. -- expect "\r" -- expect "Key for \"$pname@$REALMNAME\" randomized." -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin cpw_rnd)" -- catch "close -i $spawn_id" -- pass "kadmin cpw_rnd $pname" -- return 1 --} -- --#++ --# kadmin_modify - Test modify principal function of kadmin. --# --# Modifies principal $pname with flags $flags. Returns 1 on success. --#-- --proc kadmin_modify { pname flags } { -- global REALMNAME -- global KADMIN -- global KEY -- global spawn_id -- -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "modprinc $flags $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin modify $pname ($flags) lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin modify $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin modify $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" -- send "adminpass$KEY\r" -- # When in doubt, jam one of these in there. -- expect "\r" -- expect "Principal \"$pname@$REALMNAME\" modified." -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin modify)" -- catch "close -i $spawn_id" -- pass "kadmin modify $pname" -- return 1 --} -- -- --#++ --# kadmin_list - Test list database function of kadmin. --# --# Lists the database and verifies that output matches regular expression --# "(.*@$REALMNAME)*". Returns 1 on success. --#-- --proc kadmin_list { } { -- global REALMNAME -- global KADMIN -- global KEY -- global spawn_id -- -- # "*" would match everything -- # "*n" should match a few like kadmin/admin but see ticket 5667 -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "get_principals *n" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin ldb lost KDC" -- catch "expect_after" -- return 0 -- } -- "Communication failure" { -- fail "kadmin ldb got RPC error" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin ldb" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin ldb" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" { -- send "adminpass$KEY\r" -- } -- expect -re "\(.*@$REALMNAME\r\n\)+" -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin list)" -- catch "close -i $spawn_id" -- pass "kadmin ldb" -- return 1 --} -- --#++ --# kadmin_extract - Test extract service key function of kadmin. --# --# Extracts service key for service name $name instance $instance. Returns --# 1 on success. --#-- --proc kadmin_extract { instance name } { -- global REALMNAME -- global KADMIN -- global KEY -- global spawn_id -- global tmppwd -- -- catch "exec rm -f $tmppwd/keytab" -- -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "xst -k $tmppwd/keytab $name/$instance" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin xst $instance $name lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin xst $instance $name" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin xst $instance $name" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" { -- send "adminpass$KEY\r" -- } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin xst)" -- catch "close -i $spawn_id" -- catch "exec rm -f $instance-new-keytab" -- pass "kadmin xst $instance $name" -- return 1 --} -- --#++ --# kadmin_delete - Test delete principal function of kadmin. --# --# Deletes principal $pname. Returns 1 on success. --#-- --proc kadmin_delete { pname } { -- global REALMNAME -- global KADMIN -- global KADMIN_LOCAL -- global KEY -- global spawn_id -- global tmppwd -- -- set good 0 -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "delprinc -force $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin_delete $pname lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin delprinc $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin delprinc $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" { -- send "adminpass$KEY\r" -- } -- expect "Principal \"$pname@$REALMNAME\" deleted." { set good 1 } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin delprinc)" -- catch "close -i $spawn_id" -- if { $good == 1 } { -- # -- # use kadmin.local to verify that the old principal is not present. -- # -- envstack_push -- setup_kerberos_env kdc -- spawn $KADMIN_LOCAL -r $REALMNAME -- envstack_pop -- expect_after { -- -i $spawn_id -- timeout { -- fail "kadmin delprinc $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin delprinc $pname" -- catch "expect_after" -- return 0 -- } -- } -- set good 0 -- expect "kadmin.local: " { send "getprinc $pname\r" } -- expect "Principal does not exist while retrieving \"$pname@$REALMNAME\"." { set good 1 } -- expect "kadmin.local: " { send "quit\r" } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin.local show)" -- catch "close -i $spawn_id" -- if { $good == 1 } { -- pass "kadmin delprinc $pname" -- return 1 -- } -- else { -- fail "kadmin delprinc $pname" -- return 0 -- } -- } -- else { -- fail "kadmin delprinc $pname" -- return 0 -- } --} -- --#++ --# kadmin_delete - Test delete principal function of kadmin. --# --# Deletes principal $pname. Returns 1 on success. --#-- --proc kadmin_delete_locked_down { pname } { -- global REALMNAME -- global KADMIN -- global KADMIN_LOCAL -- global KEY -- global spawn_id -- global tmppwd -- -- # -- # First test that we fail, then unlock and retry -- # -- -- set good 0 -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "delprinc -force $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin_delete $pname lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin delprinc $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin delprinc $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" { -- send "adminpass$KEY\r" -- } -- expect "delete_principal: Operation requires ``delete'' privilege while deleting principal \"$pname@$REALMNAME\"" { set good 1 } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin delprinc)" -- catch "close -i $spawn_id" -- if { $good == 1 } { -- # -- # use kadmin.local to remove lockdown. -- # -- envstack_push -- setup_kerberos_env kdc -- spawn $KADMIN_LOCAL -r $REALMNAME -- envstack_pop -- expect_after { -- -i $spawn_id -- timeout { -- fail "kadmin delprinc $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin delprinc $pname" -- catch "expect_after" -- return 0 -- } -- } -- set good 0 -- expect "kadmin.local: " { send "modprinc -lockdown_keys $pname\r" } -- expect "Principal \"$pname@$REALMNAME\" modified." { set good 1 } -- expect "kadmin.local: " { send "quit\r" } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin.local show)" -- catch "close -i $spawn_id" -- if { $good == 1 } { -- set good 0 -- if {[kadmin_delete $pname]} { set good 1 } -- } -- if { $good == 1 } { -- pass "kadmin delprinc $pname" -- return 1 -- } -- else { -- fail "kadmin delprinc $pname" -- return 0 -- } -- } -- else { -- fail "kadmin delprinc $pname" -- return 0 -- } --} -- --#++ --# kpasswd_cpw - Test password changing using kpasswd. --# --# Change $princ's password from $opw to $npw. Returns 1 on success. --#-- --proc kpasswd_cpw { princ opw npw } { -- global KPASSWD -- global REALMNAME -- -- spawn $KPASSWD $princ -- expect_after { -- timeout { -- fail "kpasswd $princ $npw" --# catch "expect_after" -- return 0 -- } -- eof { -- fail "kpasswd $princ $npw" --# catch "expect_after" -- return 0 -- } -- } -- --# expect "Changing password for $princ." --# expect "Old password:" { send "$opw\r" } --# expect "New password:" { send "$npw\r" } --# expect "New password (again):" { send "$npw\r" } -- expect "Password for $princ@$REALMNAME:" { send "$opw\r" } -- expect "Enter new password:" { send "$npw\r" } -- expect "Enter it again:" { send "$npw\r" } --# expect "Kerberos password changed." -- expect "Password changed." -- expect_after -- expect eof -- -- if ![check_exit_status "kpasswd"] { -- fail "kpasswd $princ $npw" -- return 0 -- } -- pass "kpasswd $princ $npw" -- return 1 --} -- --#++ --# kadmin_addpol - Test add new policy function of kadmin. --# --# Adds policy $pname. Returns 1 on success. --#-- --proc kadmin_addpol { pname } { -- global REALMNAME -- global KADMIN -- global KADMIN_LOCAL -- global KEY -- global spawn_id -- global tmppwd -- -- set good 0 -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "addpol $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin addpol $pname lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin addpol $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin addpol $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" { -- send "adminpass$KEY\r" -- } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin addpol)" -- catch "close -i $spawn_id" -- # -- # use kadmin.local to verify that a policy was created -- # -- envstack_push -- setup_kerberos_env kdc -- spawn $KADMIN_LOCAL -r $REALMNAME -- envstack_pop -- expect_after { -- -i $spawn_id -- timeout { -- fail "kadmin addpol $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin addpol $pname" -- catch "expect_after" -- return 0 -- } -- } -- set good 0 -- expect "kadmin.local: " { send "getpol $pname\r" } -- expect "Policy: $pname" { set good 1 } -- expect "Maximum password life:" { verbose "got max pw life" } -- expect "Minimum password life:" { verbose "got min pw life" } -- expect "Minimum password length:" { verbose "got min pw length" } -- expect "Minimum number of password character classes:" { -- verbose "got min pw character classes" } -- expect "Number of old keys kept:" { verbose "got num old keys kept" } -- expect "kadmin.local: " { send "q\r" } -- -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin.local showpol)" -- catch "close -i $spawn_id" -- if { $good == 1 } { -- pass "kadmin addpol $pname" -- return 1 -- } -- else { -- fail "kadmin addpol $pname" -- return 0 -- } --} -- --#++ --# kadmin_delpol - Test delete policy function of kadmin. --# --# Deletes policy $pname. Returns 1 on success. --#-- --proc kadmin_delpol { pname } { -- global REALMNAME -- global KADMIN -- global KADMIN_LOCAL -- global KEY -- global spawn_id -- global tmppwd -- -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "delpol -force $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin_delpol $pname lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin delpol $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin delpol $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" { -- send "adminpass$KEY\r" -- } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin delpol)" -- catch "close -i $spawn_id" -- # -- # use kadmin.local to verify that the old policy is not present. -- # -- envstack_push -- setup_kerberos_env kdc -- spawn $KADMIN_LOCAL -r $REALMNAME -- envstack_pop -- expect_after { -- -i $spawn_id -- timeout { -- fail "kadmin delpol $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin delpol $pname" -- catch "expect_after" -- return 0 -- } -- } -- set good 0 -- expect "kadmin.local: " { send "getpol $pname\r" } -- expect "Policy does not exist while retrieving policy \"$pname\"." { -- set good 1 -- } -- expect "kadmin.local: " { send "quit\r" } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin.local showpol)" -- catch "close -i $spawn_id" -- if { $good == 1 } { -- pass "kadmin delpol $pname" -- return 1 -- } -- else { -- fail "kadmin delpol $pname" -- return 0 -- } --} -- --#++ --# kadmin_listpols - Test list policy database function of kadmin. --# --# Lists the policies. Returns 1 on success. --#-- --proc kadmin_listpols { } { -- global REALMNAME -- global KADMIN -- global KEY -- global spawn_id -- -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "get_policies *" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin lpols lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin lpols" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin lpols" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" { -- send "adminpass$KEY\r" -- } -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin listpols)" -- catch "close -i $spawn_id" -- pass "kadmin lpols" -- return 1 --} -- --#++ --# kadmin_modpol - Test modify policy function of kadmin. --# --# Modifies policy $pname with flags $flags. Returns 1 on success. --#-- --proc kadmin_modpol { pname flags } { -- global REALMNAME -- global KADMIN -- global KEY -- global spawn_id -- -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "modpol $flags $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin modpol $pname ($flags) lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin modpol $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin modpol $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" -- send "adminpass$KEY\r" -- # When in doubt, jam one of these in there. -- expect "\r" -- # Sadly, kadmin doesn't print a confirmation message for policy operations. -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin modpol)" -- catch "close -i $spawn_id" -- pass "kadmin modpol $pname" -- return 1 --} -- --#++ --# kadmin_showpol - Test show policy function of kadmin. --# --# Retrieves entry for $pname. Returns 1 on success. --#-- --proc kadmin_showpol { pname } { -- global REALMNAME -- global KADMIN -- global KEY -- global spawn_id -- -- spawn $KADMIN -p krbtest/admin@$REALMNAME -q "get_policy $pname" -- expect_after { -- "Cannot contact any KDC" { -- fail "kadmin showpol $pname lost KDC" -- catch "expect_after" -- return 0 -- } -- timeout { -- fail "kadmin showpol $pname" -- catch "expect_after" -- return 0 -- } -- eof { -- fail "kadmin showpol $pname" -- catch "expect_after" -- return 0 -- } -- } -- expect -re "assword\[^\r\n\]*: *" -- send "adminpass$KEY\r" -- expect -re "\r.*Policy: $pname.*Number of old keys kept: .*\r" -- expect_after -- expect eof -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin showpol)" -- catch "close -i $spawn_id" -- pass "kadmin showpol $pname" -- return 1 --} -- --#++ --# kdestroy --#-- --proc kdestroy { } { -- global KDESTROY -- -- spawn $KDESTROY -5 -- if ![check_exit_status "kdestroy"] { -- return 0 -- } -- return 1 --} -- --# Wrap the tests in a procedure, so that we can kill the daemons if --# we get some sort of error. -- --proc kadmin_test { } { -- global hostname -- -- # Start up the kerberos and kadmind daemons -- if {![start_kerberos_daemons 0] } { -- return -- } -- -- # Test basic kadmin functions. -- if {![kadmin_add v5principal/instance1 v5principal] \ -- || ![kadmin_addpol standardpol] \ -- || ![kadmin_showpol standardpol] \ -- || ![kadmin_listpols] \ -- || ![kadmin_modpol standardpol "-minlength 5"] \ -- || ![kadmin_add v4principal/instance2 v4principal] \ -- || ![kadmin_add_rnd v5random] \ -- || ![kadmin_show v5principal/instance1] \ -- || ![kadmin_show v4principal/instance2] \ -- || ![kadmin_show v5random] \ -- || ![kadmin_cpw v5principal/instance1 faroutman] \ -- || ![kadmin_cpw v4principal/instance2 honkydory] \ -- || ![kadmin_cpw_rnd v5random] \ -- || ![kadmin_modify v5random -allow_tix] \ -- || ![kadmin_modify v5random +allow_tix] \ -- || ![kadmin_modify v5random "-policy standardpol"] \ -- || ![kadmin_list] \ -- || ![kadmin_extract instance1 v5principal] \ -- || ![kadmin_delete v5random] \ -- || ![kadmin_delete v4principal/instance2] \ -- || ![kadmin_delete v5principal/instance1] \ -- || ![kadmin_delpol standardpol]} { -- return -- } -- --# You cannot extract a v4 key... --# || ![kadmin_extractv4 instance2 v4principal] \ -- -- # now test kpasswd -- if {![kadmin_add testprinc/instance thisisatest] \ -- || ![kpasswd_cpw testprinc/instance thisisatest anothertest] \ -- || ![kpasswd_cpw testprinc/instance anothertest goredsox] \ -- || ![kadmin_delete testprinc/instance]} { -- return -- } -- -- # now test that we can kinit with principals/passwords. -- # We defer kdestroying until after kpasswd at least once to test FAST automatic use in kpasswd -- if {![kadmin_add testprinc1/instance thisisatest] \ -- || ![kinit testprinc1/instance thisisatest 0] \ -- || ![kpasswd_cpw testprinc1/instance thisisatest anothertest] \ -- || ![kdestroy] \ -- || ![kinit testprinc1/instance anothertest 0] \ -- || ![kdestroy] \ -- || ![kpasswd_cpw testprinc1/instance anothertest goredsox] \ -- || ![kinit testprinc1/instance goredsox 0] \ -- || ![kdestroy] \ -- || ![kadmin_cpw testprinc1/instance betterwork] \ -- || ![kinit testprinc1/instance betterwork 0] \ -- || ![kdestroy] \ -- || ![kadmin_delete testprinc1/instance]} { -- return -- } -- -- # now test modify changes. -- if {![kadmin_add testuser longtestpw] \ -- || ![kinit testuser longtestpw 0] \ -- || ![kdestroy] \ -- || ![kadmin_modify testuser "-maxlife \"2500 seconds\""] \ -- || ![kinit testuser longtestpw 0] \ -- || ![kdestroy] \ -- || ![kadmin_delete testuser]} { -- return -- } -- -- # now test that reducing the history number doesn't make kadmind vulnerable. -- if {![kadmin_addpol crashpol] \ -- || ![kadmin_modpol crashpol "-history 5"] \ -- || ![kadmin_add crash first] \ -- || ![kadmin_modify crash "-policy crashpol"] \ -- || ![kadmin_cpw crash second] \ -- || ![kadmin_cpw crash third] \ -- || ![kadmin_cpw crash fourth] \ -- || ![kadmin_modpol crashpol "-history 3"] \ -- || ![kadmin_cpw crash fifth] \ -- || ![kadmin_delete crash] \ -- || ![kadmin_delpol crashpol]} { -- return -- } -- -- # test retrieval of large number of principals -- # bug [2877] -- for { set i 0 } { $i < 200 } { incr i } { -- if { ![kadmin_add "foo$i" foopass] } { -- return -- } -- } -- -- if { ![kadmin_list] } { -- return -- } -- -- # test fallback to kadmin/hostname -- if {![kadmin_add_rnd kadmin/$hostname] \ -- || ![kadmin_delete_locked_down kadmin/admin] \ -- || ![kadmin_list] \ -- || ![kadmin_add_rnd kadmin/admin -allow_tgs_req] \ -- || ![kadmin_list]} { -- return -- } -- -- verbose "kadmin_test succeeded" --} -- --run_once kadmin { -- # Set up the kerberos database. -- if {![get_hostname] \ -- || ![setup_kerberos_files] \ -- || ![setup_kerberos_env] \ -- || ![setup_kerberos_db 0]} { -- return -- } -- -- # Run the test. -- set status [catch kadmin_test msg] -- -- # Shut down the kerberos daemons and the rsh daemon. -- stop_kerberos_daemons -- -- if { $status != 0 } { -- send_error "ERROR: error in kadmin.exp\n" -- send_error "$msg\n" -- exit 1 -- } --} -diff --git a/src/tests/dejagnu/krb-standalone/pwchange.exp b/src/tests/dejagnu/krb-standalone/pwchange.exp -deleted file mode 100644 -index 010e8344a..000000000 ---- a/src/tests/dejagnu/krb-standalone/pwchange.exp -+++ /dev/null -@@ -1,145 +0,0 @@ --# Password-changing Kerberos test. --# This is a DejaGnu test script. -- --# We are about to start up a couple of daemon processes. We do all --# the rest of the tests inside a proc, so that we can easily kill the --# processes when the procedure ends. -- --proc kinit_expecting_pwchange { name pass newpass } { -- global REALMNAME -- global KINIT -- global spawn_id -- -- # Use kinit to get a ticket. -- # -- # For now always get forwardable tickets. Later when we need to make -- # tests that distinguish between forwardable tickets and otherwise -- # we should but another option to this proc. --proven -- # -- spawn $KINIT -5 -f $name@$REALMNAME -- expect { -- "Password for $name@$REALMNAME:" { -- verbose "kinit started" -- } -- timeout { -- fail "kinit" -- return 0 -- } -- eof { -- fail "kinit" -- return 0 -- } -- } -- send "$pass\r" -- expect { -- "Enter new password: " { } -- timeout { -- fail "kinit (new password prompt)" -- return 0 -- } -- eof { -- fail "kinit (new password prompt)" -- return 0 -- } -- } -- send "$newpass\r" -- expect { -- " again: " { } -- timeout { -- fail "kinit (new password prompt2)" -- return 0 -- } -- eof { -- fail "kinit (new password prompt2)" -- return 0 -- } -- } -- send "$newpass\r" -- expect eof -- if ![check_exit_status kinit] { -- return 0 -- } -- -- return 1 --} -- --proc doit { } { -- global REALMNAME -- global KLIST -- global KDESTROY -- global KEY -- global KADMIN_LOCAL -- global KTUTIL -- global hostname -- global tmppwd -- global spawn_id -- global supported_enctypes -- global KRBIV -- global portbase -- global mode -- -- # Start up the kerberos and kadmind daemons. -- if ![start_kerberos_daemons 0] { -- return -- } -- -- # Use kadmin to add a key. -- if ![add_kerberos_key pwchanger 0] { -- return -- } -- -- setup_kerberos_env kdc -- spawn $KADMIN_LOCAL -q "modprinc +needchange pwchanger" -- catch expect_after -- expect { -- timeout { -- fail "kadmin.local modprinc +needchange" -- } -- eof { -- pass "kadmin.local modprinc +needchange" -- } -- } -- set k_stat [wait -i $spawn_id] -- verbose "wait -i $spawn_id returned $k_stat (kadmin modprinc +needchange)" -- catch "close -i $spawn_id" -- -- setup_kerberos_env client -- if ![kinit_expecting_pwchange pwchanger pwchanger$KEY floople] { -- return -- } -- pass "kinit (password change)" -- if ![kinit pwchanger floople 0] { -- return -- } -- pass "kinit (new password)" -- -- # Destroy the ticket. -- spawn $KDESTROY -5 -- if ![check_exit_status "kdestroy"] { -- return -- } -- pass "kdestroy" --} -- --run_once pwchange { -- # Set up the Kerberos files and environment. -- if {![get_hostname] || ![setup_kerberos_files] || ![setup_kerberos_env]} { -- return -- } -- -- # Initialize the Kerberos database. The argument tells -- # setup_kerberos_db that it is being called from here. -- if ![setup_kerberos_db 0] { -- return -- } -- -- set status [catch doit msg] -- -- stop_kerberos_daemons -- -- if { $status != 0 } { -- send_error "ERROR: error in pwchange.exp\n" -- send_error "$msg\n" -- exit 1 -- } --} -diff --git a/src/tests/dejagnu/krb-standalone/pwhist.exp b/src/tests/dejagnu/krb-standalone/pwhist.exp -deleted file mode 100644 -index ed7a3771a..000000000 ---- a/src/tests/dejagnu/krb-standalone/pwhist.exp -+++ /dev/null -@@ -1,217 +0,0 @@ --# password history tests -- --# one *non-interactive* kadmin.local request --proc onerq { rq pname str {flags ""} } { -- global REALMNAME -- global KADMIN_LOCAL -- -- spawn $KADMIN_LOCAL -r $REALMNAME -q "$rq $flags $pname" -- expect_after { -- timeout { -- verbose "kadmin.local $rq $flags $pname timed out" -- catch expect_after -- kill [exp_pid] -- close -- expect eof -- wait -- return 0 -- } eof { -- verbose "kadmin.local $rq $flags $pname got EOF" -- catch expect_after -- wait -- return 0 -- } -- } -- expect $str -- expect_after -- expect eof -- wait -- return 1 --} -- --proc addprinc { pname pw } { -- global REALMNAME -- -- return [onerq addprinc $pname \ -- "Principal \"$pname@$REALMNAME\" created." "-pw $pw"] --} -- --proc delprinc { pname } { -- global REALMNAME -- return [onerq delprinc $pname \ -- "Principal \"$pname@$REALMNAME\" deleted." "-force"] --} -- --proc cpw { pname pw } { -- global REALMNAME -- -- return [onerq cpw $pname \ -- "Password for \"$pname@$REALMNAME\" changed." "-pw $pw"] --} -- --proc modprinc { pname flags } { -- global REALMNAME -- -- return [onerq modprinc $pname \ -- "Principal \"$pname@$REALMNAME\" modified." $flags] --} -- --proc addpol { pname } { -- if ![onerq addpol $pname ""] { -- return 0 -- } -- return [onerq getpol $pname "Policy: $pname"] --} -- --proc delpol { pname } { -- onerq delpol $pname "" -force -- return [onerq getpol $pname \ -- "Policy does not exist while retrieving policy \"$pname\"."] --} -- --proc modpol { pname flags } { -- return [onerq modpol $pname "" $flags] --} -- --# Mandatory command must return true. --# Issues a break in its parent on failure. --proc mustrun { cmd } { -- if ![eval $cmd] { -- perror "mandatory command failed: $cmd" -- uplevel break -- } --} -- --# Fail test if command fails. --# Issues a break in its parent on failure. --proc chkpass { cmd } { -- upvar test test -- if ![eval $cmd] { -- verbose "unexpected failure: $cmd" -- fail $test -- uplevel break -- } --} -- --# Fail test if command succeeds. --# Issues a break in its parent on failure. --proc chkfail { cmd } { -- upvar test test -- if [eval $cmd] { -- verbose "unexpected success: $cmd" -- fail $test -- uplevel break -- } --} -- --# wrapper to run command (actually usually sequence of commands) --# --# If any part of CMD throws an exception, set failall, otherwise pass. --# If failall is already true, report unresolved. --proc wraptest { test cmd } { -- upvar failall failall -- if $failall { -- unresolved $test -- return -- } -- if [catch $cmd] { -- set failall 1 -- } else { -- pass $test -- } --} -- --run_once pwhist { -- # Set up the kerberos database. -- if {![get_hostname] \ -- || ![setup_kerberos_files] \ -- || ![setup_kerberos_env kdc] \ -- || ![setup_kerberos_db 0]} { -- return -- } -- -- set failall 0 -- wraptest "nkeys=1, nhist=3" { -- mustrun { addpol crashpol } -- mustrun { modpol crashpol "-history 3"} -- mustrun { addprinc crash 1111 } -- mustrun { modprinc crash "-policy crashpol" } -- chkpass { cpw crash 2222 } -- chkfail { cpw crash 2222 } -- chkfail { cpw crash 1111 } -- } -- verbose {old_keys [ 1111 ->[] ]} -- -- # The following will result in reading/writing past array bounds if -- # add_to_history() is not patched. -- # -- # NOTE: A pass from this test does not mean the bug isn't present; -- # check with Purify, valgrind, etc. -- wraptest "array bounds ok on nkeys=1, nhist 3->2" { -- mustrun { modpol crashpol "-history 2" } -- chkpass { cpw crash 3333 } -- } -- verbose {old_keys [ ->2222 ]} -- -- wraptest "verify nhist=2" { -- mustrun { delprinc crash } -- mustrun { addprinc crash 1111 } -- mustrun { modprinc crash "-policy crashpol" } -- chkpass { cpw crash 2222 } -- chkfail { cpw crash 2222 } -- chkfail { cpw crash 1111 } -- } -- verbose {old_keys [ ->1111 ]} -- -- # The following will fail if growing the history array causes an extra -- # key to be lost due to failure to shift entries. -- wraptest "grow nhist 2->3" { -- mustrun { modpol crashpol "-history 3" } -- chkpass { cpw crash 3333 } -- chkfail { cpw crash 3333 } -- chkfail { cpw crash 2222 } -- chkfail { cpw crash 1111 } -- } -- verbose {old_keys [ 2222 ->1111 ]} -- -- wraptest "grow nhist 3->4" { -- mustrun { modpol crashpol "-history 4" } -- chkfail { cpw crash 3333 } -- chkfail { cpw crash 2222 } -- chkfail { cpw crash 1111 } -- chkpass { cpw crash 4444 } -- chkfail { cpw crash 3333 } -- chkfail { cpw crash 2222 } -- chkfail { cpw crash 1111 } -- } -- verbose {old_keys [ 2222 3333 ->1111 ]} -- wraptest "shrink nhist 4->3" { -- mustrun { modpol crashpol "-history 3" } -- chkfail { cpw crash 4444 } -- chkfail { cpw crash 3333 } -- chkfail { cpw crash 2222 } -- chkfail { cpw crash 1111 } -- chkpass { cpw crash 5555 } -- } -- verbose {old_keys [ 4444 ->3333 ]} -- wraptest "verify nhist=3" { -- chkfail { cpw crash 5555 } -- chkfail { cpw crash 4444 } -- chkfail { cpw crash 3333 } -- chkpass { cpw crash 2222 } -- } -- verbose {old_keys [ ->4444 5555 ]} -- wraptest "shrink nhist 3->2" { -- mustrun { modpol crashpol "-history 2" } -- chkfail { cpw crash 2222 } -- chkfail { cpw crash 5555 } -- chkfail { cpw crash 4444 } -- chkpass { cpw crash 3333 } -- } -- verbose {old_keys [ ->2222 ]} -- -- delprinc crash -- delpol crashpol -- -- stop_kerberos_daemons --} -diff --git a/src/tests/t_changepw.py b/src/tests/t_changepw.py -index 573bdbd49..bf8e3a9eb 100755 ---- a/src/tests/t_changepw.py -+++ b/src/tests/t_changepw.py -@@ -1,23 +1,24 @@ - from k5test import * - --# This file is intended to cover any password-changing mechanism. For --# now it only contains a regression test for #7868. -- - realm = K5Realm(create_host=False, get_creds=False, start_kadmind=True) -+realm.prep_kadmin() - - # Mark a principal as expired and change its password through kinit. -+mark('password change via kinit') - realm.run([kadminl, 'modprinc', '-pwexpire', '1 day ago', 'user']) - pwinput = password('user') + '\nabcd\nabcd\n' - realm.run([kinit, realm.user_princ], input=pwinput) - --# Do the same thing with FAST, with tracing turned on. --realm.run([kadminl, 'modprinc', '-pwexpire', '1 day ago', 'user']) -+# Regression test for #7868 (preauth options ignored when -+# krb5_get_init_creds_password() initiates a password change). This -+# time use the REQUIRES_PWCHANGE bit instead of the password -+# expiration time. -+mark('password change via kinit with FAST') -+realm.run([kadminl, 'modprinc', '+needchange', 'user']) - pwinput = 'abcd\nefgh\nefgh\n' - out, trace = realm.run([kinit, '-T', realm.ccache, realm.user_princ], - input=pwinput, return_trace=True) -- --# Read the trace and check that FAST was used when getting the --# kadmin/changepw ticket. -+# Check that FAST was used when getting the kadmin/changepw ticket. - getting_changepw = fast_used_for_changepw = False - for line in trace.splitlines(): - if 'Getting initial credentials for user@' in line: -@@ -29,4 +30,21 @@ for line in trace.splitlines(): - if not fast_used_for_changepw: - fail('FAST was not used to get kadmin/changepw ticket') - -+# Test that passwords specified via kadmin and kpasswd are usable with -+# kinit. -+mark('password change usability by kinit') -+realm.run([kadminl, 'addprinc', '-pw', 'pw1', 'testprinc']) -+# Run kpasswd with an active cache to exercise automatic FAST use. -+realm.kinit('testprinc', 'pw1') -+realm.run([kpasswd, 'testprinc'], input='pw1\npw2\npw2\n') -+realm.kinit('testprinc', 'pw2') -+realm.run([kdestroy]) -+realm.run([kpasswd, 'testprinc'], input='pw2\npw3\npw3\n') -+realm.kinit('testprinc', 'pw3') -+realm.run([kdestroy]) -+realm.run_kadmin(['cpw', '-pw', 'pw4', 'testprinc']) -+realm.kinit('testprinc', 'pw4') -+realm.run([kdestroy]) -+realm.run([kadminl, 'delprinc', 'testprinc']) -+ - success('Password change tests') -diff --git a/src/tests/t_kadmin.py b/src/tests/t_kadmin.py -new file mode 100644 -index 000000000..fe6a3cc2e ---- /dev/null -+++ b/src/tests/t_kadmin.py -@@ -0,0 +1,54 @@ -+from k5test import * -+ -+realm = K5Realm(start_kadmind=True) -+ -+# Create a principal. Test -q option and keyboard entry of the admin -+# password and principal password. Verify creation with kadmin.local. -+realm.run([kadmin, '-q', 'addprinc princ/pw'], -+ input=password('admin') + '\npw1\npw1\n') -+realm.run([kadminl, 'getprinc', 'princ/pw'], -+ expected_msg='Principal: princ/pw@KRBTEST.COM') -+ -+# Run the remaining tests with a cache for efficiency. -+realm.prep_kadmin() -+ -+realm.run_kadmin(['addpol', 'standardpol']) -+realm.run_kadmin(['listpols'], expected_msg='standardpol') -+realm.run_kadmin(['modpol', '-minlength', '5', 'standardpol']) -+realm.run_kadmin(['getpol', 'standardpol'], -+ expected_msg='Minimum password length: 5') -+ -+realm.run_kadmin(['addprinc', '-randkey', 'princ/random']) -+realm.run([kadminl, 'getprinc', 'princ/random'], -+ expected_msg='Principal: princ/random@KRBTEST.COM') -+ -+realm.run_kadmin(['cpw', 'princ/pw'], input='newpw\nnewpw\n') -+realm.run_kadmin(['cpw', '-randkey', 'princ/random']) -+ -+realm.run_kadmin(['modprinc', '-allow_tix', 'princ/random']) -+realm.run_kadmin(['modprinc', '+allow_tix', 'princ/random']) -+realm.run_kadmin(['modprinc', '-policy', 'standardpol', 'princ/random']) -+ -+realm.run_kadmin(['listprincs'], expected_msg='princ/random@KRBTEST.COM') -+ -+realm.run_kadmin(['ktadd', 'princ/pw']) -+ -+realm.run_kadmin(['delprinc', 'princ/random']) -+realm.run([kadminl, 'getprinc', 'princ/random'], expected_code=1, -+ expected_msg='Principal does not exist') -+realm.run_kadmin(['delprinc', 'princ/pw']) -+realm.run([kadminl, 'getprinc', 'princ/pw'], expected_code=1, -+ expected_msg='Principal does not exist') -+ -+realm.run_kadmin(['delpol', 'standardpol']) -+realm.run([kadminl, 'getpol', 'standardpol'], expected_code=1, -+ expected_msg='Policy does not exist') -+ -+# Regression test for #2877 (fixed-sized GSSRPC buffers can't -+# accomodate large listprinc results). -+mark('large listprincs result') -+for i in range(200): -+ realm.run_kadmin(['addprinc', '-randkey', 'foo%d' % i]) -+realm.run_kadmin(['listprincs'], expected_msg='foo199') -+ -+success('kadmin and kpasswd tests') -diff --git a/src/tests/t_policy.py b/src/tests/t_policy.py -index 5a0c06b86..2bb4f5f18 100755 ---- a/src/tests/t_policy.py -+++ b/src/tests/t_policy.py -@@ -25,6 +25,68 @@ realm.run([kadminl, 'cpw', '-pw', 'l0ngenough', 'pwuser'], expected_code=1, - realm.run([kadminl, 'cpw', '-pw', '3rdpassword', 'pwuser']) - realm.run([kadminl, 'cpw', '-pw', 'l0ngenough', 'pwuser']) - -+# Regression test for #929 (kadmind crash with more historical -+# passwords in a principal entry than current policy history setting). -+mark('password history (policy value reduced below current array size)') -+realm.run([kadminl, 'addpol', '-history', '5', 'histpol']) -+realm.addprinc('histprinc', 'first') -+realm.run([kadminl, 'modprinc', '-policy', 'histpol', 'histprinc']) -+realm.run([kadminl, 'cpw', '-pw', 'second', 'histprinc']) -+realm.run([kadminl, 'cpw', '-pw', 'third', 'histprinc']) -+realm.run([kadminl, 'cpw', '-pw', 'fourth', 'histprinc']) -+realm.run([kadminl, 'modpol', '-history', '3', 'histpol']) -+realm.run([kadminl, 'cpw', '-pw', 'fifth', 'histprinc']) -+realm.run([kadminl, 'delprinc', 'histprinc']) -+ -+# Regression test for #2841 (heap buffer overflow when policy history -+# value is reduced to match the number of historical passwords for a -+# principal). -+mark('password history (policy value reduced to current array size)') -+def histfail(*pwlist): -+ for pw in pwlist: -+ realm.run([kadminl, 'cpw', '-pw', pw, 'histprinc'], expected_code=1, -+ expected_msg='Cannot reuse password') -+realm.run([kadminl, 'modpol', '-history', '3', 'histpol']) -+realm.addprinc('histprinc', '1111') -+realm.run([kadminl, 'modprinc', '-policy', 'histpol', 'histprinc']) -+realm.run([kadminl, 'cpw', '-pw', '2222', 'histprinc']) -+histfail('2222', '1111') -+realm.run([kadminl, 'modpol', '-history', '2', 'histpol']) -+realm.run([kadminl, 'cpw', '-pw', '3333', 'histprinc']) -+ -+# Test that the history array is properly resized if the policy -+# history value is increased after the array is filled. -+mark('password history (policy value increase)') -+realm.run([kadminl, 'delprinc', 'histprinc']) -+realm.addprinc('histprinc', '1111') -+realm.run([kadminl, 'modprinc', '-policy', 'histpol', 'histprinc']) -+realm.run([kadminl, 'cpw', '-pw', '2222', 'histprinc']) -+histfail('2222', '1111') -+realm.run([kadminl, 'cpw', '-pw', '2222', 'histprinc'], expected_code=1, -+ expected_msg='Cannot reuse password') -+realm.run([kadminl, 'cpw', '-pw', '1111', 'histprinc'], expected_code=1, -+ expected_msg='Cannot reuse password') -+realm.run([kadminl, 'modpol', '-history', '3', 'histpol']) -+realm.run([kadminl, 'cpw', '-pw', '3333', 'histprinc']) -+histfail('3333', '2222', '1111') -+realm.run([kadminl, 'modpol', '-history', '4', 'histpol']) -+histfail('3333', '2222', '1111') -+realm.run([kadminl, 'cpw', '-pw', '4444', 'histprinc']) -+histfail('4444', '3333', '2222', '1111') -+ -+# Test that when the policy history value is reduced, all currently -+# known old passwords still fail until the next password change, after -+# which the new number of old passwords fails (but no more). -+mark('password history (policy value reduction)') -+realm.run([kadminl, 'modpol', '-history', '3', 'histpol']) -+histfail('4444', '3333', '2222', '1111') -+realm.run([kadminl, 'cpw', '-pw', '5555', 'histprinc']) -+histfail('5555', '3333', '3333') -+realm.run([kadminl, 'cpw', '-pw', '2222', 'histprinc']) -+realm.run([kadminl, 'modpol', '-history', '2', 'histpol']) -+histfail('2222', '5555', '4444') -+realm.run([kadminl, 'cpw', '-pw', '3333', 'histprinc']) -+ - # Test references to nonexistent policies. - mark('nonexistent policy references') - realm.run([kadminl, 'addprinc', '-randkey', '-policy', 'newpol', 'newuser']) diff --git a/Read-GSS-configuration-files-with-mtime-0.patch b/Read-GSS-configuration-files-with-mtime-0.patch deleted file mode 100644 index 5bcae39..0000000 --- a/Read-GSS-configuration-files-with-mtime-0.patch +++ /dev/null @@ -1,71 +0,0 @@ -From f8747c22fd159ad3556fdf6ec4f269c754c1eadb Mon Sep 17 00:00:00 2001 -From: Simo Sorce -Date: Thu, 19 May 2022 12:27:40 -0400 -Subject: [PATCH] Read GSS configuration files with mtime 0 - -There is at least one case (with flatpaks) where configuration files -in the special read-only /etc all have an mtime of 0. Using an -initial last modified time of 0 in g_initialize.c causes these files -to never be read. - -Change the initial high value to the be the "invalid" value -(time_t)-1. Since the C and POSIX standards do not require time_t to -be signed, special-case the checks in load_if_changed() and -updateMechList() to treat all mod times as newer than -1. - -[ghudson@mit.edu: edited commit message; slightly modified approach] - -ticket: 9060 (new) -target_version: 1.20 -tags: pullup ---- - src/lib/gssapi/mechglue/g_initialize.c | 11 ++++++----- - 1 file changed, 6 insertions(+), 5 deletions(-) - -diff --git a/src/lib/gssapi/mechglue/g_initialize.c b/src/lib/gssapi/mechglue/g_initialize.c -index 6d49700a5..857d4a4f2 100644 ---- a/src/lib/gssapi/mechglue/g_initialize.c -+++ b/src/lib/gssapi/mechglue/g_initialize.c -@@ -93,7 +93,7 @@ static void free_mechSet(void); - static gss_mech_info g_mechList = NULL; - static gss_mech_info g_mechListTail = NULL; - static k5_mutex_t g_mechListLock = K5_MUTEX_PARTIAL_INITIALIZER; --static time_t g_confFileModTime = (time_t)0; -+static time_t g_confFileModTime = (time_t)-1; - static time_t g_confLastCall = (time_t)0; - - static gss_OID_set_desc g_mechSet = { 0, NULL }; -@@ -469,9 +469,9 @@ load_if_changed(const char *pathname, time_t last, time_t *highest) - mtime = check_link_mtime(pathname, &mtime); - if (mtime == (time_t)-1) - return; -- if (mtime > *highest) -+ if (mtime > *highest || *highest == (time_t)-1) - *highest = mtime; -- if (mtime > last) -+ if (mtime > last || last == (time_t)-1) - loadConfigFile(pathname); - } - -@@ -482,7 +482,7 @@ static void - loadConfigFiles() - { - glob_t globbuf; -- time_t highest = 0, now; -+ time_t highest = (time_t)-1, now; - char **path; - const char *val; - -@@ -522,7 +522,8 @@ updateMechList(void) - - #if defined(_WIN32) - time_t lastConfModTime = getRegConfigModTime(MECH_KEY); -- if (g_confFileModTime >= lastConfModTime) -+ if (g_confFileModTime >= lastConfModTime && -+ g_confFileModTime != (time_t)-1) - return; - g_confFileModTime = lastConfModTime; - loadConfigFromRegistry(HKEY_CURRENT_USER, MECH_KEY); --- -2.35.3 - diff --git a/Remove-TCL-based-libkadm5-API-tests.patch b/Remove-TCL-based-libkadm5-API-tests.patch deleted file mode 100644 index 7819198..0000000 --- a/Remove-TCL-based-libkadm5-API-tests.patch +++ /dev/null @@ -1,18229 +0,0 @@ -From ddb189ff95350afc0e3e063016a0f0dd5213dc4c Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Fri, 16 Apr 2021 10:24:04 -0400 -Subject: [PATCH] Remove TCL-based libkadm5 API tests - -[antorres@redhat.com: remove diff for .gitignore] ---- - .gitignore | 20 - - doc/kadm5/api-unit-test.tex | 2680 ----------------- - src/config/pre.in | 18 +- - src/configure.ac | 31 +- - src/kadmin/Makefile.in | 2 +- - src/kadmin/testing/Makefile.in | 8 - - src/kadmin/testing/deps | 1 - - src/kadmin/testing/proto/kdc.conf.proto | 16 - - src/kadmin/testing/proto/krb5.conf.proto | 32 - - src/kadmin/testing/proto/ovsec_adm.dict | 3 - - src/kadmin/testing/scripts/Makefile.in | 18 - - src/kadmin/testing/scripts/deps | 1 - - src/kadmin/testing/scripts/env-setup.shin | 104 - - src/kadmin/testing/scripts/init_db | 229 -- - src/kadmin/testing/scripts/start_servers | 69 - - .../testing/scripts/start_servers_local | 157 - - src/kadmin/testing/scripts/stop_servers | 60 - - src/kadmin/testing/scripts/stop_servers_local | 44 - - src/kadmin/testing/tcl/util.t | 58 - - src/kadmin/testing/util/Makefile.in | 42 - - src/kadmin/testing/util/bsddb_dump.c | 65 - - src/kadmin/testing/util/deps | 16 - - src/kadmin/testing/util/tcl_kadm5.c | 2566 ---------------- - src/kadmin/testing/util/tcl_kadm5.h | 3 - - src/kadmin/testing/util/tcl_kadm5_syntax | 57 - - src/kadmin/testing/util/tcl_krb5_hash.c | 167 - - src/kadmin/testing/util/test.c | 38 - - src/lib/kadm5/Makefile.in | 3 +- - src/lib/kadm5/unit-test/Makefile.in | 143 - - src/lib/kadm5/unit-test/api.2/crte-policy.exp | 927 ------ - src/lib/kadm5/unit-test/api.2/get-policy.exp | 199 -- - src/lib/kadm5/unit-test/api.2/mod-policy.exp | 675 ----- - .../api.current/chpass-principal-v2.exp | 68 - - .../api.current/chpass-principal.exp | 176 -- - .../unit-test/api.current/crte-policy.exp | 927 ------ - .../unit-test/api.current/crte-principal.exp | 1336 -------- - .../kadm5/unit-test/api.current/destroy.exp | 203 -- - .../unit-test/api.current/dlte-policy.exp | 208 -- - .../unit-test/api.current/dlte-principal.exp | 253 -- - .../unit-test/api.current/get-policy.exp | 199 -- - .../api.current/get-principal-v2.exp | 250 -- - .../unit-test/api.current/get-principal.exp | 346 --- - .../kadm5/unit-test/api.current/init-v2.exp | 506 ---- - src/lib/kadm5/unit-test/api.current/init.exp | 699 ----- - .../unit-test/api.current/mod-policy.exp | 711 ----- - .../api.current/mod-principal-v2.exp | 115 - - .../unit-test/api.current/mod-principal.exp | 1606 ---------- - .../api.current/randkey-principal-v2.exp | 61 - - .../api.current/randkey-principal.exp | 297 -- - src/lib/kadm5/unit-test/config/unix.exp | 222 -- - src/lib/kadm5/unit-test/deps | 86 - - src/lib/kadm5/unit-test/destroy-test.c | 48 - - src/lib/kadm5/unit-test/diff-files/destroy-1 | 2 - - src/lib/kadm5/unit-test/diff-files/no-diffs | 2 - - src/lib/kadm5/unit-test/handle-test.c | 140 - - src/lib/kadm5/unit-test/init-test.c | 39 - - src/lib/kadm5/unit-test/iter-test.c | 51 - - src/lib/kadm5/unit-test/lib/lib.t | 306 -- - src/lib/kadm5/unit-test/lock-test.c | 105 - - src/lib/kadm5/unit-test/randkey-test.c | 42 - - src/lib/kadm5/unit-test/setkey-test.c | 246 -- - src/lib/kadm5/unit-test/site.exp | 2 - - 62 files changed, 7 insertions(+), 17697 deletions(-) - delete mode 100644 doc/kadm5/api-unit-test.tex - delete mode 100644 src/kadmin/testing/Makefile.in - delete mode 100644 src/kadmin/testing/deps - delete mode 100644 src/kadmin/testing/proto/kdc.conf.proto - delete mode 100644 src/kadmin/testing/proto/krb5.conf.proto - delete mode 100644 src/kadmin/testing/proto/ovsec_adm.dict - delete mode 100644 src/kadmin/testing/scripts/Makefile.in - delete mode 100644 src/kadmin/testing/scripts/deps - delete mode 100755 src/kadmin/testing/scripts/env-setup.shin - delete mode 100755 src/kadmin/testing/scripts/init_db - delete mode 100755 src/kadmin/testing/scripts/start_servers - delete mode 100755 src/kadmin/testing/scripts/start_servers_local - delete mode 100755 src/kadmin/testing/scripts/stop_servers - delete mode 100755 src/kadmin/testing/scripts/stop_servers_local - delete mode 100644 src/kadmin/testing/tcl/util.t - delete mode 100644 src/kadmin/testing/util/Makefile.in - delete mode 100644 src/kadmin/testing/util/bsddb_dump.c - delete mode 100644 src/kadmin/testing/util/deps - delete mode 100644 src/kadmin/testing/util/tcl_kadm5.c - delete mode 100644 src/kadmin/testing/util/tcl_kadm5.h - delete mode 100644 src/kadmin/testing/util/tcl_kadm5_syntax - delete mode 100644 src/kadmin/testing/util/tcl_krb5_hash.c - delete mode 100644 src/kadmin/testing/util/test.c - delete mode 100644 src/lib/kadm5/unit-test/Makefile.in - delete mode 100644 src/lib/kadm5/unit-test/api.2/crte-policy.exp - delete mode 100644 src/lib/kadm5/unit-test/api.2/get-policy.exp - delete mode 100644 src/lib/kadm5/unit-test/api.2/mod-policy.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/chpass-principal.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/crte-policy.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/crte-principal.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/destroy.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/dlte-policy.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/dlte-principal.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/get-policy.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/get-principal-v2.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/get-principal.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/init-v2.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/init.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/mod-policy.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/mod-principal-v2.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/mod-principal.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp - delete mode 100644 src/lib/kadm5/unit-test/api.current/randkey-principal.exp - delete mode 100644 src/lib/kadm5/unit-test/config/unix.exp - delete mode 100644 src/lib/kadm5/unit-test/deps - delete mode 100644 src/lib/kadm5/unit-test/destroy-test.c - delete mode 100644 src/lib/kadm5/unit-test/diff-files/destroy-1 - delete mode 100644 src/lib/kadm5/unit-test/diff-files/no-diffs - delete mode 100644 src/lib/kadm5/unit-test/handle-test.c - delete mode 100644 src/lib/kadm5/unit-test/init-test.c - delete mode 100644 src/lib/kadm5/unit-test/iter-test.c - delete mode 100644 src/lib/kadm5/unit-test/lib/lib.t - delete mode 100644 src/lib/kadm5/unit-test/lock-test.c - delete mode 100644 src/lib/kadm5/unit-test/randkey-test.c - delete mode 100644 src/lib/kadm5/unit-test/setkey-test.c - delete mode 100644 src/lib/kadm5/unit-test/site.exp - -diff --git a/doc/kadm5/api-unit-test.tex b/doc/kadm5/api-unit-test.tex -deleted file mode 100644 -index 014242037..000000000 ---- a/doc/kadm5/api-unit-test.tex -+++ /dev/null -@@ -1,2680 +0,0 @@ --% This document is included for historical purposes only, and does not --% apply to krb5 today. -- --\documentstyle[times,fullpage]{article} -- --%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% --%% Make _ actually generate an _, and allow line-breaking after it. --\let\underscore=\_ --\catcode`_=13 --\def_{\underscore\penalty75\relax} --%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% -- --\newcommand{\test}[1]{\begin{description} --\setlength{\itemsep}{0pt} --#1 --\end{description} -- --} -- --\newcommand{\numtest}[2]{\begin{description} --\setlength{\itemsep}{0pt} --\Number{#1} --#2 --\end{description} -- --} -- --\newcommand{\Number}[1]{\item[Number:] #1} --\newcommand{\Reason}[1]{\item[Reason:] #1} --\newcommand{\Expected}[1]{\item[Expected:] #1} --\newcommand{\Conditions}[1]{\item[Conditions:] #1} --\newcommand{\Priority}[1]{\item[Priority:] #1} --\newcommand{\Status}[1]{\item[Status:] #1} --\newcommand{\Vtwonote}[1]{\item[V2 note:] #1} --\newcommand{\Version}[1]{\item[Version:] #1} --\newcommand{\Call}[1]{} --%\newcommand{\Call}[1]{\item[Call:] #1} --%\newcommand{\Number}[1]{} --%\newcommand{\Reason}[1]{} --%\newcommand{\Expected}[1]{} --%\newcommand{\Conditions}[1]{} --%\newcommand{\Priority}[1]{} -- --\title{KADM5 Admin API\\ --Unit Test Description} --\author{Jonathan I. Kamens} -- --\begin{document} -- --\maketitle -- --%\tableofcontents -- --\section{Introduction} -- --The following is a description of a black-box unit test of the KADM5 --API. Each API function is listed, followed by the tests that should be --performed on it. -- --The tests described here are based on the ``Kerberos Administration --System KADM5 API Functional Specifications'', revision 1.68. This --document was originally written based on the OpenVision API functional --specifications, version 1.41, dated August 18, 1994, and many --indications of the original version remain. -- --All tests which test for success should verify, using some means other --than the return value of the function being tested, that the requested --operation was successfully performed. For example: for init, test --that other operations can be performed after init; for destroy, test --that other operations can't be performed after destroy; for modify --functions, verify that all modifications to the database which should --have taken place did, and that the new, modified data is in effect; --for get operations, verify that the data retrieved is the data that --should actually be in the database. -- --The tests would be better if they compared the actual contents of the --database before and after each test, rather than relying on the KADM5 --API to report the results of changes. -- --Similarly, all tests which test for failure should verify that the --no component of the requested operation took place. For example: if --init fails, other operations should not work. If a modify fails, all --data in the database should be the same as it was before the attempt --to modify, and the old data should still be what is enforced. --Furthermore, tests which test for failure should verify that the --failure code returned is correct for the specific failure condition --tested. -- --Most of the tests listed below should be run twice -- once locally on --the server after linking against the server API library, and once --talking to the server via authenticated Sun RPC after linking against --the client API library. Tests which should only be run locally or via --RPC are labelled with a ``local'' or ``RPC''. -- --Furthermore, in addition to the tests labelled below, a test should be --implemented to verify that a client can't perform operations on the --server through the client API library when it's linked against --standard Sun RPC instead of OpenV*Secure's authenticated Sun RPC. --This will require a client with a modified version of ovsec_kadm_init --which doesn't call auth_gssapi_create. This client should call this --modified ovsec_kadm_init and then call some other admin API function, --specifying arguments to both functions that would work if the --authenticated Sun RPC had been used, but shouldn't if authentication --wasn't used. The test should verify that the API function call after --the init doesn't succeed. -- --There is also another test to see if all the API functions handle getting an --invalid server handle correctly. This is not done as part of the tests that --are run through the TCL program cause the TCL program has no way of --invalidating a server handle. So there is a program that calls init and --changes the handle magic number, and then attempts to call each API function --with the corrupted server handle. -- --A number of tests have been added or changed to correspond with KADM5 --API version 2. Tests which are only performed against the newer --version specify the version number in the test description. -- --\section{ovsec_kadm_init} -- --\numtest{1}{ --\Reason{An empty string realm is rejected.} --\Status{Implemented} --\Vtwonote{The empty string is now passed as the realm field of the --parameters structure.} --} -- --\numtest{2}{ --\Reason{A realm containing invalid characters is rejected.} --\Status{Implemented} --\Vtwonote{The invalid character is now passed as the realm field of the --parameters structure.} --} -- --\numtest{2.5}{ --\Reason{A non-existent realm is rejected.} --\Status{Implemented} --\Vtwonote{The non-existent realm is now passed as the realm field of the --parameters structure.} --} -- --\numtest{3}{ --\Reason{A bad service name representing an existing principal -- (different from the client principal) is rejected.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{4}{ --\Reason{A bad service name representing a non-existent -- principal is rejected.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{5}{ --\Reason{A bad service name identical to the (existing) client -- name is rejected.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{6}{ --\Reason{A null password causes password prompting.} --\Status{Implemented} --} -- --\numtest{7}{ --\Reason{An empty-string causes password prompting} --\Status{Implemented} --} -- --\numtest{8}{ --\Reason{An incorrect password which is the password of another -- user is rejected.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{9}{ --\Reason{An incorrect password which isn't the password of any -- user is rejected.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{10}{ --\Reason{A null client_name is rejected.} --\Status{Implemented} --} -- --% Empty string client name is legal. --%\numtest{11}{ --%\Reason{An empty-string client_name is rejected.} --%} -- --\numtest{12}{ --\Reason{A client_name referring to a non-existent principal in -- the default realm is rejected.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{13}{ --\Reason{A client_name referring to a non-existent principal -- with the local realm specified explicitly is rejected.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{14}{ --\Reason{A client_name referring to a non-existent principal in -- a nonexistent realm is rejected.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{15}{ --\Reason{A client_name referring to an existing principal in a -- nonexistent realm is rejected.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{16}{ --\Reason{Valid invocation.} --\Status{Implemented} --} -- --\numtest{17}{ --\Reason{Valid invocation (explicit client realm).} --\Status{Implemented} --} -- --\numtest{18}{ --\Reason{Valid invocation (CHANGEPW_SERVICE).} --\Status{Implemented} --} -- --\numtest{19}{ --\Reason{Valid invocation (explicit service realm).} --\Status{Implemented} --\Vtwonote{The explicit realm is now passed as the realm field of the --configuration parameters.} --} -- --\numtest{20}{ --\Reason{Valid invocation (database access allowed after init).} --\Status{Implemented} --} -- --%\numtest{21}{ --%\Reason{Init fails when called twice in a row.} --%\Status{Implemented} --%} -- --\numtest{22}{ --\Reason{A null password causes master-key prompting.} --\Conditions{local} --\Status{Implemented} --\Vtwonote{Obsolete.} --} -- --\numtest{22.5}{ --\Reason{A empty string password causes master-key prompting.} --\Conditions{local} --\Status{Implemented} --\Vtwonote{Obsolete.} --} -- --%\numtest{23}{ --%\Reason{A non-null password causes reading from the kstash.} --%\Conditions{local} --%\Status{Implemented} --%} -- --\numtest{24}{ --\Reason{Null service name is ignored in local invocation.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{25}{ --\Reason{Non-null service name is ignored in local invocation.} --\Conditions{local} --\Status{Implemented} --} -- --%\numtest{26}{ --%\Reason{Can't do ``get'' operation before calling init.} --%\Status{Implemented} --%} -- --%\numtest{27}{ --%\Reason{Can't do ``add'' operation before calling init.} --%\Status{Implemented} --%} -- --%\numtest{28}{ --%\Reason{Can't do ``modify'' operation before calling init.} --%\Status{Implemented} --%} -- --%\numtest{29}{ --%\Reason{Can't do ``delete'' operation before calling init.} --%\Status{Implemented} --%} -- --\numtest{30}{ --\Reason{Can init after failed init attempt.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{31}{ --\Priority{High} --\Reason{Return BAD_STRUCT_VERSION when the mask bits are set to invalid values} --\Status{Implemented} --} -- --\numtest{32}{ --\Priority{High} --\Reason{Return BAD_STRUCT_VERSION when the mask bits are not set} --\Status{Implemented} --} -- --\numtest{33}{ --\Priority{High} --\Reason{Return OLD_STRUCT_VERSION when attempting to use an old/unsupported -- structure version} --\Status{Implemented} --} -- --\numtest{34}{ --\Priority{High} --\Reason{Return NEW_STRUCT_VERSION when attempting to use a newer version of -- of the structure then what is supported} --\Status{Implemented} --} -- --\numtest{35}{ --\Priority{High} --\Reason{Return BAD_API_VERSION when the mask bits are set to invalid values} --\Status{Implemented} --} -- --\numtest{36}{ --\Priority{High} --\Reason{Return BAD_API_VERSION when the mask bits are not set} --\Status{Implemented} --} -- --\numtest{37}{ --\Priority{High} --\Reason{Return OLD_LIB_API_VERSION when using an old/unsuppored -- api version number} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{38}{ --\Priority{High} --\Reason{Return OLD_SERVER_API_VERSION attempting to use an -- old/unsupported api version number} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{39}{ --\Priority{High} --\Reason{Return NEW_LIB_API_VERSION when using a newer api -- version number then supported} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{40}{ --\Priority{High} --\Reason{Return NEW_SERVER_API_VERSION when using a newer api version -- number then supported} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{41}{ --\Priority{High} --\Reason{Return BAD_XXX_VERSION when the API and the structure -- version numbers are reversed} --\Status{Implemented} --} -- --\numtest{42}{ --\Priority{High} --\Reason{Succeeds when using valid api and struct version numbers and masks} --\Status{Implemented} --} -- --\numtest{43}{ --\Priority{Low} --\Reason{Returns two different server handle when called twice with same info} --} -- --\numtest{44}{ --\Priority{Low} --\Reason{Returns two different server handles when called twice with -- different info} --} -- --\numtest{45}{ --\Priority{Bug fix, secure-install/3390} --\Reason{Returns SECURE_PRINC_MISSING when ADMIN_SERVICE does not --exist.} --\Status{Implemented} --} -- --\numtest{46}{ --\Priority{Bug fix, secure-install/3390} --\Reason{Returns SECURE_PRINC_MISSING when CHANGEPW_SERVICE does not --exist.} --\Status{Implemented} --} -- --\numtest{100}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the profile field of the configuration parameters, if --set.} --\Status{Implemented} --} -- --\numtest{101}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the kadmind_port field of the configuration parameters, --if set.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{102}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the admin_server field of the configuration parameters, --if set with only an admin server name.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{102.5}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the admin_server field of the configuration parameters, --if set with a host name and port number.} --\Conditions{RPC} --} -- --\numtest{103}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the dbname field of the configuration parameters, if --set.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{104}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the admin_dbname field of the configuration parameters, if --set.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{105}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the admin_lockfile field of the configuration parameters, if --set.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{106}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the mkey_from_kbd field of the configuration parameters, if --set.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{107}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the stash_file field of the configuration parameters, if --set.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{108}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the mkey_name field of the configuration parameters, if --set.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{109}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the max_life field of the configuration parameters, if --set.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{110}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the max_rlife field of the configuration parameters, if --set.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{111}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the expiration field of the configuration parameters, if --set.} --\Status{Implemented} --\Conditions{local} --} -- --\numtest{112}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the flags field of the configuration parameters, if --set.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{113}{ --\Version{KADM5_API_VERSION_2} --\Reason{Obeys the keysalts and num_keysalts field of the configuration --parameters, if set.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{114}{ --\Version{KADM5_API_VERSION_2} --\Reason{Returns KADM5_BAD_SERVER_PARAMS if any client-only parameters --are specified to server-side init.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{115}{ --\Version{KADM5_API_VERSION_2} --\Reason{Returns KADM5_BAD_CLIENT_PARAMS if any client-only parameters --are specified to server-side init.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{116}{ --\Version{KADM5_API_VERSION_2} --\Reason{Two calls to init with clients having different privileges --succeeds, and both clients maintain their correct privileges.} --\Priority{Bug fix} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{117}{ --\Version{KADM5_API_VERSION_2} --\Reason{The max_life field defaults to value specified in the API --Functional Specification when kdc.conf is unreadable.} --\Priority{Bug fix, krb5-admin/18} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{150}{ --\Version{KADM5_API_VERSION_2} --\Reason{init_with_creds works when given an open ccache with a valid --credential for ADMIN_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{151}{ --\Version{KADM5_API_VERSION_2} --\Reason{init_with_creds works when given an open ccache with a valid --credential for CHANGEPW_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{152}{ --\Version{KADM5_API_VERSION_2} --\Reason{init_with_creds fails with KRB5_FCC_NOFILE (was -- KADM5_GSS_ERROR) when given an open --ccache with no credentials.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{153}{ --\Version{KADM5_API_VERSION_2} --\Reason{init_with_creds fails with KRB5_CC_NOTFOUND (was -- KADM5_GSS_ERROR) when given an open --ccache without credentials for ADMIN_SERVICE or CHANGEPW_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{154}{ --\Version{KADM5_API_VERSION_2} --\Reason{If the KRB5_KDC_PROFILE environment variable is set to a filename --that does not exist, init fails with ENOENT.} --\Conditions{RPC} --\Status{Implemented} --} -- --\section{ovsec_kadm_destroy} -- --\numtest{1}{ --\Reason{Valid invocation.} --\Status{Implemented} --} -- --%\numtest{2}{ --%\Reason{Valid invocation (``get'' not allowed after destroy).} --%\Status{Implemented} --%} -- --%\numtest{3}{ --%\Reason{Valid invocation (``add'' not allowed after destroy).} --%\Status{Implemented} --%} -- --%\numtest{4}{ --%\Reason{Valid invocation (``modify'' not allowed after destroy).} --%\Status{Implemented} --%} -- --%\numtest{5}{ --%\Reason{Valid invocation (``delete'' not allowed after destroy).} --%\Status{Implemented} --%} -- --%\numtest{6}{ --%\Reason{Fails if database not initialized.} --%\Status{Implemented} --%} -- --%\numtest{7}{ --%\Reason{Fails if invoked twice in a row.} --%\Status{Implemented} --%} -- --\numtest{8}{ --\Reason{Database can be reinitialized after destroy.} --\Status{Implemented} --} -- --\numtest{9}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{10}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{client} --} -- --\section{ovsec_kadm_create_principal} -- --%In the tests below, ``getu'' refers to a user who has only ``get'' access, --%''addu'' refers to a user who has only ``add'' access, ``modifyu'' refers to --%a user who has only ``modify'' access, and ``deleteu'' refers to a user --%who has only ``delete'' access. ``amu'' refers to a user with ``add'' and --%''modify'' access. ``new_princ'' refers to a principal entry structure --%filled in as follows: --% --% krb5_parse_name("newuser", \&new_princ.principal); --% krb5_timeofday(\&new_princ.princ_expire_time); --% new_princ.princ_expire_time += 130; --% krb5_timeofday(\&new_princ.last_pwd_change); --% new_princ.last_pwd_change += 140; --% krb5_timeofday(\&new_princ.pw_expiration); --% new_princ.pw_expiration += 150; --% new_princ.max_life = 160; --% krb5_parse_name("usera", \&new_princ.mod_name); --% krb5_timeofday(\&new_princ.mod_date); --% new_princ.mod_date += 170; --% new_princ.attributes = 0xabcdabcd; --% new_princ.kvno = 180; --% new_princ.mkvno = 190; --% new_princ.policy = null; --% new_princ.aux_attributes = 0xdeadbeef; --% --%The offsets of 130 through 190 above are used to ensure that the --%fields are all known to be different from each other, so that --%accidentally switched fields can be detected. Some of the fields in --%this structure may be changed by the tests, but they should clean up --%after themselves. -- --%\numtest{1}{ --%\Reason{Fails if database not initialized.} --%\Status{Implemented} --%} -- --\numtest{2}{ --\Reason{Fails on null princ argument.} --\Status{Implemented} --} -- --\numtest{3}{ --\Reason{Fails on null password argument.} --\Status{Implemented} --} -- --\numtest{4}{ --\Reason{Fails on empty-string password argument.} --\Status{Implemented} --} -- --\numtest{5}{ --\Reason{Fails when mask contains undefined bit.} --\Status{Implemented} --} -- --\numtest{6}{ --\Reason{Fails when mask contains LAST_PWD_CHANGE bit.} --\Status{Implemented} --} -- --\numtest{7}{ --\Reason{Fails when mask contains MOD_TIME bit.} --\Status{Implemented} --} -- --\numtest{8}{ --\Reason{Fails when mask contains MOD_NAME bit.} --\Status{Implemented} --} -- --\numtest{9}{ --\Reason{Fails when mask contains MKVNO bit.} --\Status{Implemented} --} -- --\numtest{10}{ --\Reason{Fails when mask contains AUX_ATTRIBUTES bit.} --\Status{Implemented} --} -- --\numtest{11}{ --\Reason{Fails when mask contains POLICY_CLR bit.} --\Status{Implemented} --} -- --\numtest{12}{ --\Reason{Fails for caller with no access bits.} --\Status{Implemented} --} -- --\numtest{13}{ --\Reason{Fails when caller has ``get'' access and not ``add''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{14}{ --\Reason{Fails when caller has ``modify'' access and not ``add''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{15}{ --\Reason{Fails when caller has ``delete'' access and not ``add''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{16}{ --\Reason{Fails when caller connected with CHANGEPW_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{17}{ --\Reason{Fails on attempt to create existing principal.} --\Status{Implemented} --} -- --\numtest{18}{ --\Reason{Fails when password is too short.} --\Status{Implemented} --} -- --\numtest{19}{ --\Reason{Fails when password has too few classes.} --\Status{Implemented} --} -- --\numtest{20}{ --\Reason{Fails when password is in dictionary.} --\Status{Implemented} --} -- --\numtest{21}{ --\Reason{Nonexistent policy is rejected.} --\Status{Implemented} --} -- --\numtest{22}{ --\Reason{Fails on invalid principal name.} --\Status{Implemented} --} -- --\numtest{23}{ --\Reason{Valid invocation.} --\Status{Implemented} --} -- --\numtest{24}{ --\Reason{Succeeds when caller has ``add'' access and another one.} --\Status{Implemented} --} -- --%\numtest{25}{ --%\Reason{Fails when password is too short, when override_qual is true.} --%} -- --%\numtest{26}{ --%\Reason{Fails when password has too few classes, when --% override_qual is true.} --%} -- --%\numtest{27}{ --%\Reason{Fails when password is in dictionary, when override_qual is --% true.} --%} -- --\numtest{28}{ --\Reason{Succeeds when assigning policy.} --\Status{Implemented} --} -- --\numtest{29}{ --\Priority{High} --\Reason{Allows 0 (never) for princ_expire_time.} --\Status{Implemented} --} -- --\numtest{30}{ --\Reason{Allows 0 (never) for pw_expiration when there's no policy.} --\Status{Implemented} --} -- --\numtest{31}{ --\Reason{Allows 0 (never) for pw_expiration when there's a policy with -- 0 for pw_max_life.} --\Status{Implemented} --} -- --\numtest{32}{ --\Reason{Accepts 0 (never) for pw_expiration when there's a policy with -- non-zero pw_max_life, and sets pw_expiration to zero.} --\Status{Implemented} --} -- --\numtest{33}{ --\Reason{Accepts and sets non-zero pw_expiration when no policy.} --\Status{Implemented} --} -- --\numtest{34}{ --\Reason{Accepts and sets non-zero pw_expiration when there's a policy -- with zero pw_max_life.} --\Status{Implemented} --} -- --\numtest{35}{ --\Reason{Accepts and sets non-zero pw_expiration when there's a policy -- with pw_max_life later than the specified pw_expiration.} --\Status{Implemented} --} -- --\numtest{36}{ --\Reason{Accepts and sets non-zero pw_expiration greater than now_pw_max_life.} --\Status{Implemented} --} -- --\numtest{37}{ --\Priority{High} --\Reason{Sets pw_expiration to 0 (never) if there's no policy and no -- specified pw_expiration.} --\Status{Implemented} --} -- --\numtest{38}{ --\Priority{High} --\Reason{Sets pw_expiration to 0 (never) if it isn't specified and the -- policy has a 0 (never) pw_max_life.} --\Status{Implemented} --} -- --\numtest{39}{ --\Priority{High} --\Reason{Sets pw_expiration to now + pw_max_life if it isn't specified -- and the policy has a non-zero pw_max_life.} --\Status{Implemented} --} -- --\numtest{40}{ --\Priority{High} --\Reason{Allows 0 (forever) for max_life.} --\Status{Implemented} --} -- --\numtest{41}{ --\Priority{High} --\Reason{Doesn't modify or free mod_name on success.} --} -- --\numtest{42}{ --\Priority{High} --\Reason{Doesn't modify or free mod_name on failure.} --} -- --\numtest{43}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{44}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{RPC} --} -- -- --\section{ovsec_kadm_delete_principal} -- --%\numtest{1}{ --%\Reason{Fails if database not initialized.} --%\Status{Implemented} --%} -- --\numtest{2}{ --\Reason{Fails on null principal.} --\Status{Implemented} --} -- --% Empty string principal is legal. --%\numtest{3}{ --%\Reason{Fails on empty-string principal.} --%} -- --% There is not invalid principal names --%\numtest{4}{ --%\Reason{Fails on invalid principal name.} --%} -- --\numtest{5}{ --\Priority{High} --\Reason{Fails on nonexistent principal.} --\Status{Implemented} --} -- --\numtest{6}{ --\Priority{High} --\Reason{Fails when caller connected with CHANGEPW_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{7}{ --\Priority{High} --\Reason{Fails if caller has ``add'' access and not ``delete''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{8}{ --\Priority{High} --\Reason{Fails if caller has ``modify'' access and not ``delete''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{9}{ --\Priority{High} --\Reason{Fails if caller has ``get'' access and not ``delete''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{10}{ --\Priority{High} --\Reason{Fails if caller has no access bits.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{11}{ --\Priority{High} --\Reason{Valid invocation.} --\Status{Implemented} --} -- --\numtest{12}{ --\Priority{High} --\Reason{Valid invocation (on principal with policy).} --\Status{Implemented} --} -- --\numtest{13}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{14}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{RPC} --} -- -- --\section{ovsec_kadm_modify_principal} -- --%\numtest{1}{ --%\Reason{Fails if database not initialized.} --%\Status{Implemented} --%} -- --\numtest{2}{ --\Priority{High} --\Reason{Fails if user connected with CHANGEPW_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{3}{ --\Reason{Fails on mask with undefined bit set.} --\Status{Implemented} --} -- --\numtest{4}{ --\Reason{Fails on mask with PRINCIPAL set.} --\Status{Implemented} --} -- --\numtest{5}{ --\Priority{High} --\Reason{Fails on mask with LAST_PWD_CHANGE set.} --\Status{Implemented} --} -- --\numtest{6}{ --\Reason{Fails on mask with MOD_TIME set.} --\Status{Implemented} --} -- --\numtest{7}{ --\Reason{Fails on mask with MOD_NAME set.} --\Status{Implemented} --} -- --\numtest{8}{ --\Reason{Fails on mask with MKVNO set.} --\Status{Implemented} --} -- --\numtest{9}{ --\Priority{High} --\Reason{Fails on mask with AUX_ATTRIBUTES set.} --\Status{Implemented} --} -- --\numtest{10}{ --\Reason{Fails on nonexistent principal.} --\Status{Implemented} --} -- --\numtest{11}{ --\Priority{High} --\Reason{Fails for user with no access bits.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{12}{ --\Priority{High} --\Reason{Fails for user with ``get'' access.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{13}{ --\Priority{High} --\Reason{Fails for user with ``add'' access.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{14}{ --\Priority{High} --\Reason{Fails for user with ``delete'' access.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{15}{ --\Priority{High} --\Reason{Succeeds for user with ``modify'' access.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{16}{ --\Reason{Succeeds for user with ``modify'' and another access.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{17}{ --\Priority{High} --\Reason{Fails when nonexistent policy is specified.} --\Status{Implemented} --} -- --\numtest{18}{ --\Priority{High} --\Reason{Succeeds when existent policy is specified.} --\Status{Implemented} --} -- --\numtest{19}{ --\Reason{Updates policy count when setting policy from none.} --\Status{Implemented} --} -- --\numtest{20}{ --\Reason{Updates policy count when clearing policy from set.} --\Status{Implemented} --} -- --\numtest{21}{ --\Reason{Updates policy count when setting policy from other policy.} --\Status{Implemented} --} -- --\numtest{21.5}{ --\Reason{Policy reference count remains unchanged when policy is -- changed to itself.} --\Status{Implemented.} --} -- --\numtest{22}{ --\Reason{Allows 0 (never) for pw_expiration when there's no policy.} --\Status{Implemented} --} -- --\numtest{23}{ --\Reason{Allows 0 (never) for pw_expiration when there's a policy with -- 0 for pw_max_life.} --\Status{Implemented} --} -- --\numtest{24}{ --\Reason{Accepts 0 (never) for pw_expiration when there's a policy with -- non-zero pw_max_life, but actually sets pw_expiration to -- last_pwd_change + pw_max_life.} --\Status{Implemented} --} -- --\numtest{25}{ --\Reason{Accepts and sets non-zero pw_expiration when no policy.} --\Status{Implemented} --} -- --\numtest{26}{ --\Reason{Accepts and sets non-zero pw_expiration when there's a policy -- with zero pw_max_life.} --\Status{Implemented} --} -- --\numtest{27}{ --\Reason{Accepts and sets non-zero pw_expiration when there's a policy -- with pw_max_life later than the specified pw_expiration.} --\Status{Implemented} --} -- --\numtest{28}{ --\Reason{Accepts non-zero pw_expiration and limits it to last_pwd_change + -- pw_max_life when it's later than last_pwd_change + non-zero -- pw_max_life in policy.} --\Status{Implemented} --} -- --\numtest{29}{ --\Priority{High} --\Reason{Sets pw_expiration to 0 (never) when a policy is cleared and --no pw_expiration is specified.} --\Status{Implemented} --} -- --\numtest{30}{ --\Priority{High} --\Reason{Sets pw_expiration to 0 (never) if it isn't specified and the -- new policy has a 0 (never) pw_max_life.} --\Status{Implemented} --} -- --\numtest{31}{ --\Priority{High} --\Reason{Sets pw_expiration to now + pw_max_life if it isn't specified -- and the new policy has a non-zero pw_max_life.} --\Status{Implemented} --} -- --\numtest{32}{ --\Priority{High} --\Reason{Accepts princ_expire_time change.} --\Status{Implemented} --} -- -- -- --\numtest{33}{ --\Priority{High} --\Reason{Accepts attributes change.} --\Status{Implemented} --} -- --\numtest{33.25}{ --\Priority{High} --\Reason{Accepts attributes change (KRB5_KDB_REQUIRES_PW_CHANGE).} --\Status{Implemented} --} -- --\numtest{33.5}{ --\Priority{High} --\Reason{Accepts attributes change (KRB5_DISALLOW_TGT_BASE).} --\Status{Implemented} --} -- --\numtest{33.75}{ --\Priority{High} --\Reason{Accepts attributes change (KRB5_PW_CHANGE_SERVICE).} --\Status{Implemented} --} -- --\numtest{34}{ --\Priority{High} --\Reason{Accepts max_life change.} --\Status{Implemented} --} -- --\numtest{35}{ --\Priority{High} --\Reason{Accepts kvno change.} --\Status{Implemented} --} -- --\numtest{36}{ --\Reason{Behaves correctly when policy is set to the same as it was -- before.} --\Status{Implemented} --} -- --\numtest{37}{ --\Reason{Behaves properly when POLICY_CLR is specified and there was no -- policy before.} --\Status{Implemented} --} -- --\numtest{38}{ --\Priority{High} --\Reason{Accepts 0 (never) for princ_expire_time.} --\Status{Implemented} --} -- --\numtest{39}{ --\Priority{High} --\Reason{Accepts 0 for max_life.} --\Status{Implemented} --} -- --\numtest{40}{ --\Reason{Rejects null principal argument.} --\Status{Implemented} --} -- --\numtest{41}{ --\Priority{High} --\Reason{Doesn't modify or free mod_name on success.} --} -- --\numtest{42}{ --\Priority{High} --\Reason{Doesn't modify or free mod_name on failure.} --} -- --\numtest{43}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{44}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{RPC} --} -- --\numtest{100}{ --\Version{KADM5_API_VERSION_2} --\Priority{bug-fix} --\Reason{Accepts max_rlife change.} --\Status{Implemented} --} -- --\numtest{101}{ --\Version{KADM5_API_VERSION_2} --\Reason{Rejects last_success change.} --\Status{Implemented} --} -- --\numtest{102}{ --\Version{KADM5_API_VERSION_2} --\Reason{Rejects last_failed change.} --\Status{Implemented} --} -- --\numtest{103}{ --\Version{KADM5_API_VERSION_2} --\Reason{Rejects fail_auth_count change.} --\Status{Implemented} --} -- --\numtest{103.5}{ --\Version{KADM5_API_VERSION_2} --\Reason{Rejects key_data change.} --\Status{Implemented} --} -- --\numtest{104}{ --\Version{KADM5_API_VERSION_2} --\Reason{Accepts tl_data change when all types are greater than 256.} --\Status{Implemented} --} -- --\numtest{105}{ --\Version{KADM5_API_VERSION_2} --\Reason{Returns KADM5_BAD_TL_TYPE when given tl_data with a type less --than 256.} --\Status{Implemented} --} -- --\section{ovsec_kadm_rename_principal} -- --%\numtest{1}{ --%\Reason{Fails if database not initialized.} --%\Status{Implemented} --%} -- --\numtest{2}{ --\Priority{High} --\Reason{Fails if user connected with CHANGEPW_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{3}{ --\Priority{High} --\Reason{Fails for user with no access bits.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{4}{ --\Reason{Fails for user with ``modify'' access and not ``add'' or --``delete''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{5}{ --\Reason{Fails for user with ``get'' access and not ``add'' or --``delete''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{6}{ --\Reason{Fails for user with ``modify'' and ``add'' but not ``delete''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{7}{ --\Reason{Fails for user with ``modify'' and ``delete'' but not ``add''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{8}{ --\Reason{Fails for user with ``get'' and ``add'' but not ``delete''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{9}{ --\Reason{Fails for user with ``get'' and ``delete'' but not ``add.''} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{10}{ --\Reason{Fails for user with ``modify'', ``get'' and ``add'', but not -- ``delete''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{11}{ --\Reason{Fails for user with ``modify'', ``get'' and ``delete'', but -- not ``add''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{12}{ --\Priority{High} --\Reason{Fails for user with ``add'' but not ``delete''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{13}{ --\Priority{High} --\Reason{Fails for user with ``delete'' but not ``add''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{14}{ --\Priority{High} --\Reason{Succeeds for user with ``add'' and ``delete'', when that user --has non-name-based salt.} --\Status{Implemented} --} -- --\numtest{15}{ --\Priority{High} --\Reason{Fails if target principal name exists.} --\Status{Implemented} --} -- --\numtest{16}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{17}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{RPC} --} -- --\numtest{18}{ --\Priority{bug fix} --\Reason{Returns NO_RENAME_SALT when asked to rename a principal whose --salt depends on the principal name.} --\Status{Implemented} --} -- --\section{ovsec_kadm_chpass_principal} --\label{ovseckadmchpassprincipal} -- --\subsection{Quality/history enforcement tests} -- --This section lists a series of tests which will be run a number of --times, with various parameter settings (e.g., which access bits user --has, whether user connected with ADMIN_SERVICE or CHANGEPW_SERVICE, --etc.). The table following the --list of tests gives the various parameter settings under which the --tests should be run, as well which should succeed and which should --fail for each choice of parameter settings. -- --\subsubsection{List of tests} -- --The test number of each of these tests is an offset from the base --given in the table below. -- --\numtest{1}{ --\Priority{High} --\Reason{With history setting of 1, change password to itself.} --} -- --\numtest{2}{ --\Reason{With history setting of 2 but no password changes since -- principal creation, change password to itself.} --} -- --\numtest{3}{ --\Reason{With history setting of 2 and one password change since -- principal creation, change password to itself -- and directly previous password.} --} -- --\numtest{4}{ --\Priority{High} --\Reason{With a history setting of 3 and no password changes, -- change password to itself.} --} -- --\numtest{5}{ --\Priority{High} --\Reason{With a history setting of 3 and 1 password change, -- change password to itself or previous password.} --} -- --\numtest{6}{ --\Priority{High} --\Reason{With a history setting of 3 and 2 password changes, -- change password to itself and the two previous passwords.} --} -- --\numtest{7}{ --\Priority{High} --\Reason{Change to previously unused password when now - -- last_pwd_change $<$ pw_min_life.} --} -- --\numtest{8}{ --\Priority{High} --\Reason{Change to previously unused password that doesn't contain enough -- character classes.} --} -- --\numtest{9}{ --\Priority{High} --\Reason{Change to previously unused password that's too short.} --} -- --\numtest{10}{ --\Priority{High} --\Reason{Change to previously unused password that's in the dictionary.} --} -- --\subsubsection{List of parameter settings} -- --In the table below, ``7 passes'' means that test 7 above passes and --the rest of the tests fail. -- --\begin{tabular}{llllll} --Base & Modify access? & Own password? & Service & Pass/Fail \\ \hline --0 & No & Yes & ADMIN & all fail \\ --20 & No & Yes & CHANGEPW & all fail \\ --40 & No & No & ADMIN & all fail \\ --60 & No & No & CHANGEPW & all fail \\ --80 & Yes & Yes & ADMIN & 7 passes \\ --100 & Yes & Yes & CHANGEPW & all fail \\ --120 & Yes & No & ADMIN & 7 passes \\ --140 & Yes & No & CHANGEPW & all fail \\ --\end{tabular} -- --\subsection{Other quality/history tests} -- --\numtest{161}{ --\Priority{High} --\Reason{With history of 1, can change password to anything other than -- itself that doesn't conflict with other quality -- rules.} --} -- --\numtest{162}{ --\Reason{With history of 2 and 2 password changes, can change password -- to original password.} --} -- --\numtest{163}{ --\Priority{High} --\Reason{With history of 3 and 3 password changes, can change password -- to original password.} --} -- --\numtest{164}{ --\Priority{High} --\Reason{Can change password when now - last_pwd_change $>$ pw_min_life.} --} -- --\numtest{165}{ --\Priority{High} --\Reason{Can change password when it contains exactly the number of -- classes required by the policy.} --} -- --\numtest{166}{ --\Priority{High} --\Reason{Can change password when it is exactly the length required by -- the policy.} --} -- --\numtest{167}{ --\Priority{High} --\Reason{Can change password to a word that isn't in the dictionary.} --} -- -- --\subsection{Other tests} -- --%\numtest{168}{ --%\Reason{Fails if database not initialized.} --%} -- --\numtest{169}{ --\Reason{Fails for non-existent principal.} --} -- --\numtest{170}{ --\Reason{Fails for null password.} --} -- --\numtest{171}{ --\Priority{High} --\Reason{Fails for empty-string password.} --} -- --\numtest{172}{ --\Priority{High} --\Reason{Pw_expiration is set to now + max_pw_life if policy exists and -- has non-zero max_pw_life.} --} -- --\numtest{173}{ --\Priority{High} --\Reason{Pw_expiration is set to 0 if policy exists and has zero -- max_pw_life.} --} -- --\numtest{174}{ --\Priority{High} --\Reason{Pw_expiration is set to 0 if no policy.} --} -- --\numtest{175}{ --\Priority{High} --\Reason{KRB5_KDC_REQUIRES_PWCHANGE bit is cleared when password is -- successfully changed.} --} -- --\numtest{176}{ --\Priority{High} --\Reason{Fails for user with no access bits, on other's password.} --} -- --\numtest{177}{ --\Priority{High} --\Reason{Fails for user with ``get'' but not ``modify'' access, on -- other's password.} --} -- --\numtest{178}{ --\Reason{Fails for user with ``delete'' but not ``modify'' access, on -- other's password.} --} -- --\numtest{179}{ --\Reason{Fails for user with ``add'' but not ``modify'' access, on -- other's password.} --} -- --\numtest{180}{ --\Reason{Succeeds for user with ``get'' and ``modify'' access, on -- other's password.} --\Status{Implemented} --} -- --\numtest{180.5}{ --\Priority{High} --\Reason{Succeeds for user with ``modify'' but not ``get'' access, on -- other's password.} --\Conditions{RPC} --\Status{Implemented} --} --\numtest{180.625}{ --\Priority{High} --\Reason{Fails for user with modify when connecting with CHANGEPW_SERVICE on -- others password} --\Conditions{RPC} --\Status{Implemented} --} --\numtest{180.75}{ --\Priority{High} --\Reason{Fails for user with modify when connecting with CHANGEPW_SERVICE -- on other's password which has expired} --\Conditions{RPC} --\Status{Implemented} --} -- --%\numtest{181}{ --%\Reason{Password that would succeed if override_qual were false fails --% if override_qual is true.} --%\Expected{Returns CANNOT_OVERRIDE.} --%} -- --\numtest{182}{ --\Priority{High} --\Reason{Can not change key of ovsec_adm/history principal.} --\Status{Implemented} --} -- --\numtest{183}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{184}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{RPC} --} -- --\numtest{200}{ --\Version{KADM5_API_VERSION_2} --\Reason{Creates a key for the principal for each unique encryption --type/salt type in use.} --\Status{Implemented} --} -- --\section{ovsec_kadm_chpass_principal_util} -- --Rerun all the tests listed for ovsec_kadm_chpass_principal above in --Section \ref{ovseckadmchpassprincipal}. Verify that they succeed --and fail in the same circumstances. Also verify that in each failure --case, the error message returned in msg_ret is as specified in the --functional specification. -- --Also, run the following additional tests. -- --\numtest{1}{ --\Reason{Null msg_ret is rejected.} --} -- --\numtest{2}{ --\Priority{High} --\Reason{New password is put into pw_ret, when it's prompted for.} --} -- --\numtest{3}{ --\Priority{High} --Reason{New password is put into pw_ret, when it's supplied by the -- caller.} --} -- --\numtest{4}{ --\Priority{High} --\Reason{Successful invocation when pw_ret is null.} --} -- -- -- --\section{ovsec_kadm_randkey_principal} -- --\subsection{TOOSOON enforcement tests} -- --This test should be run a number of times, as indicated in the table --following it. The table also indicates the expected result of each --run of the test. -- --\test{ --\Reason{Change key when now - last_pwd_change $<$ pw_min_life.} --} -- --\subsubsection{List of parameter settings} -- --\begin{tabular}{llllll} --Number & Modify Access? & Own Key? & Service & Pass/Fail & Implemented? \\ \hline --1 & No & Yes & ADMIN & fail & Yes \\ --3 & No & Yes & CHANGEPW & fail & Yes \\ --5 & No & No & ADMIN & fail \\ --7 & No & No & CHANGEPW & fail \\ --9 & Yes & Yes & ADMIN & pass \\ --11 & Yes & Yes & CHANGEPW & fail \\ --13 & Yes & No & ADMIN & pass & Yes \\ --15 & Yes & No & CHANGEPW & fail & Yes \\ --\end{tabular} -- --\subsection{Other tests} -- --\numtest{17}{ --\Reason{Fails if database not initialized.} --} -- --\numtest{18}{ --\Reason{Fails for non-existent principal.} --} -- --\numtest{19}{ --\Reason{Fails for null keyblock pointer.} --} -- --\numtest{20}{ --\Priority{High} --\Reason{Pw_expiration is set to now + max_pw_life if policy exists and -- has non-zero max_pw_life.} --} -- --\numtest{21}{ --\Priority{High} --\Reason{Pw_expiration is set to 0 if policy exists and has zero -- max_pw_life.} --} -- --\numtest{22}{ --\Priority{High} --\Reason{Pw_expiration is set to 0 if no policy.} --} -- --\numtest{23}{ --\Priority{High} --\Reason{KRB5_KDC_REQUIRES_PWCHANGE bit is cleared when key is -- successfully changed.} --} -- --\numtest{24}{ --\Priority{High} --\Reason{Fails for user with no access bits, on other's password.} --} -- --\numtest{25}{ --\Priority{High} --\Reason{Fails for user with ``get'' but not ``modify'' access, on -- other's password.} --\Vtwonote{Change-password instead of modify access.} --} -- --\numtest{26}{ --\Reason{Fails for user with ``delete'' but not ``modify'' access, on -- other's password.} --\Vtwonote{Change-password instead of modify access.} --} -- --\numtest{27}{ --\Reason{Fails for user with ``add'' but not ``modify'' access, on -- other's password.} --\Vtwonote{Change-password instead of modify access.} --} -- --\numtest{28}{ --\Reason{Succeeds for user with ``get'' and ``modify'' access, on -- other's password.} --\Status{Implemented} --\Vtwonote{Change-password instead of modify access.} --} -- --\numtest{28.25}{ --\Priority{High} --\Reason{Fails for user with get and modify access on others password -- When conneceted with CHANGEPW_SERVICE} --\Status{Implemented} --\Vtwonote{Change-password instead of modify access.} --} -- --\numtest{28.5}{ --\Priority{High} --\Reason{Succeeds for user with ``modify'' but not ``get'' access, on -- other's password.} --\Status{Implemented} --\Vtwonote{Change-password instead of modify access.} --} -- --\numtest{29}{ --\Reason{The new key that's assigned is truly random. XXX not sure how -- to test this.} --} -- --\numtest{30}{ --\Reason{Succeeds for own key, no other access bits when connecting with CHANGEPW service} --\Status{Implemented} --} --\numtest{31}{ --\Reason{Succeeds for own key, no other access bits when connecting with ADMIM service} --\Status{Implemented} --} -- --\numtest{32}{ --\Reason{Cannot change ovsec_adm/history key} --\Status{Implemented} --} -- --\numtest{33}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{34}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{RPC} --} -- --\numtest{100}{ --\Version{KADM5_API_VERSION_2} --\Reason{Returns a key for each unique encryption type specified in the --keysalts.} --} -- --\section{ovsec_kadm_get_principal} -- --\numtest{1}{ --\Reason{Fails for null ent.} --\Status{Implemented} --} -- --\numtest{2}{ --\Reason{Fails for non-existent principal.} --\Status{Implemented} --} -- --\numtest{3}{ --\Priority{High} --\Reason{Fails for user with no access bits, retrieving other principal.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{4}{ --\Priority{High} --\Reason{Fails for user with ``add'' but not ``get'', getting principal -- other than his own, using ADMIN_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{5}{ --\Reason{Fails for user with ``modify'' but not ``get'', getting -- principal other than his own, using ADMIN_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{6}{ --\Reason{Fails for user with ``delete'' but not ``get'', getting -- principal other than his own, using ADMIN_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{7}{ --\Reason{Fails for user with ``delete'' but not ``get'', getting -- principal other than his own, using CHANGEPW_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{8}{ --\Priority{High} --\Reason{Fails for user with ``get'', getting principal other than his -- own, using CHANGEPW_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{9}{ --\Priority{High} --\Reason{Succeeds for user without ``get'', retrieving self, using -- ADMIN_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{10}{ --\Reason{Succeeds for user without ``get'', retrieving self, using -- CHANGEPW_SERVICE.} --\Status{Implemented} --} -- --\numtest{11}{ --\Reason{Succeeds for user with ``get'', retrieving self, using -- ADMIN_SERVICE.} --\Status{Implemented} --} -- --\numtest{12}{ --\Reason{Succeeds for user with ``get'', retrieving self, using -- CHANGEPW_SERVICE.} --\Status{Implemented} --} -- --\numtest{13}{ --\Priority{High} --\Reason{Succeeds for user with ``get'', retrieving other user, using -- ADMIN_SERVICE.} --\Status{Implemented} --} -- --\numtest{14}{ --\Reason{Succeeds for user with ``get'' and ``modify'', retrieving -- other principal, using ADMIN_SERVICE.} --\Status{Implemented} --} -- --\numtest{15}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{16}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{RPC} --} -- --\numtest{100}{ --\Version{KADM5_API_VERSION_2} --\Reason{If KADM5_PRINCIPAL_NORMAL_MASK is specified, the key_data and --tl_data fields are NULL/zero.} --\Status{Implemented} --} -- --\numtest{101}{ --\Version{KADM5_API_VERSION_2} --\Reason{If KADM5_KEY_DATA is specified, the key_data fields contain --data but the contents are all NULL.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{102}{ --\Version{KADM5_API_VERSION_2} --\Reason{If KADM5_KEY_DATA is specified, the key_data fields contain --data and the contents are all non-NULL.} --\Conditions{local} --\Status{Implemented} --} -- --\numtest{103}{ --\Version{KADM5_API_VERSION_2} --\Reason{If KADM5_TL_DATA is specified, the tl_data field contains the --correct tl_data and no entries whose type is less than 256.} --\Status{Implemented} --} -- -- --\section{ovsec_kadm_create_policy} -- --\numtest{1}{ --\Reason{Fails for mask with undefined bit set.} --\Status{Implemented - untested} --} -- --\numtest{2}{ --\Priority{High} --\Reason{Fails if caller connected with CHANGEPW_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{3}{ --\Reason{Fails for mask without POLICY bit set.} --\Status{Implemented - untested} --} -- --\numtest{4}{ --\Reason{Fails for mask with REF_COUNT bit set.} --\Status{Implemented} --} -- --\numtest{5}{ --\Reason{Fails for invalid policy name.} --\Status{Implemented - untested} --} -- --\numtest{6}{ --\Priority{High} --\Reason{Fails for existing policy name.} --\Status{Implemented} --} -- --\numtest{7}{ --\Reason{Fails for null policy name.} --\Status{Implemented - untested} --} -- --\numtest{8}{ --\Priority{High} --\Reason{Fails for empty-string policy name.} --\Status{Implemented} --} -- --\numtest{9}{ --\Priority{High} --\Reason{Accepts 0 for pw_min_life.} --\Status{Implemented} --} -- --\numtest{10}{ --\Priority{High} --\Reason{Accepts non-zero for pw_min_life.} --\Status{Implemented} --} -- --\numtest{11}{ --\Priority{High} --\Reason{Accepts 0 for pw_max_life.} --\Status{Implemented} --} -- --\numtest{12}{ --\Priority{High} --\Reason{Accepts non-zero for pw_max_life.} --\Status{Implemented} --} -- --\numtest{13}{ --\Priority{High} --\Reason{Rejects 0 for pw_min_length.} --\Status{Implemented} --} -- --\numtest{14}{ --\Priority{High} --\Reason{Accepts non-zero for pw_min_length.} --\Status{Implemented} --} -- --\numtest{15}{ --\Priority{High} --\Reason{Rejects 0 for pw_min_classes.} --\Status{Implemented} --} -- --\numtest{16}{ --\Priority{High} --\Reason{Accepts 1 for pw_min_classes.} --\Status{Implemented} --} -- --\numtest{17}{ --\Priority{High} --\Reason{Accepts 4 for pw_min_classes.} --\Status{Implemented} --} -- --\numtest{18}{ --\Priority{High} --\Reason{Rejects 5 for pw_min_classes.} --\Status{Implemented} --} -- --\numtest{19}{ --\Priority{High} --\Reason{Rejects 0 for pw_history_num.} --\Status{Implemented} --} -- --\numtest{20}{ --\Priority{High} --\Reason{Accepts 1 for pw_history_num.} --\Status{Implemented} --} -- --\numtest{21}{ --\Priority{High} --\Reason{Accepts 10 for pw_history_num.} --\Status{Implemented} --} -- --\numtest{21.5}{ --\Reason{Rejects 11 for pw_history_num.} --\Status{Implemented - untested} --} -- --\numtest{22}{ --\Priority{High} --\Reason{Fails for user with no access bits.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{23}{ --\Priority{High} --\Reason{Fails for user with ``get'' but not ``add''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{24}{ --\Reason{Fails for user with ``modify'' but not ``add.''} --\Conditions{RPC} --\Status{Implemented - untested} --} -- --\numtest{25}{ --\Reason{Fails for user with ``delete'' but not ``add.''} --\Conditions{RPC} --\Status{Implemented - untested} --} -- --\numtest{26}{ --\Priority{High} --\Reason{Succeeds for user with ``add.''} --\Status{Implemented} --} -- --\numtest{27}{ --\Reason{Succeeds for user with ``get'' and ``add.''} --\Status{Implemented - untested} --} -- --\numtest{28}{ --\Reason{Rejects null policy argument.} --\Status{Implemented - untested} --} -- --\numtest{29}{ --\Reason{Rejects pw_min_life greater than pw_max_life.} --} -- --\numtest{30}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{31}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{RPC} --} -- -- --\section{ovsec_kadm_delete_policy} -- --\numtest{1}{ --\Reason{Fails for null policy name.} --} -- --\numtest{2}{ --\Priority{High} --\Reason{Fails for empty-string policy name.} --\Status{Implemented} --} -- --\numtest{3}{ --\Reason{Fails for non-existent policy name.} --} -- --\numtest{4}{ --\Reason{Fails for bad policy name.} --} -- --\numtest{5}{ --\Priority{High} --\Reason{Fails if caller connected with CHANGEPW_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{6}{ --\Priority{High} --\Reason{Fails for user with no access bits.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{7}{ --\Priority{High} --\Reason{Fails for user with ``add'' but not ``delete''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{8}{ --\Reason{Fails for user with ``modify'' but not ``delete''.} --\Conditions{RPC} --} -- --\numtest{9}{ --\Reason{Fails for user with ``get'' but not ``delete.''} --\Conditions{RPC} --} -- --\numtest{10}{ --\Priority{High} --\Reason{Succeeds for user with only ``delete''.} --\Status{Implemented} --} -- --\numtest{11}{ --\Reason{Succeeds for user with ``delete'' and ``add''.} --} -- --\numtest{12}{ --\Priority{High} --\Reason{Fails for policy with non-zero reference count.} --\Status{Implemented} --} -- --\numtest{13}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{14}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{RPC} --} -- -- --\section{ovsec_kadm_modify_policy} -- --\numtest{1}{ --\Reason{Fails for mask with undefined bit set.} --\Conditions{RPC} --} -- --\numtest{2}{ --\Priority{High} --\Reason{Fails if caller connected with CHANGEPW_SERVICE.} --\Status{Implemented} --} -- --\numtest{3}{ --\Reason{Fails for mask with POLICY bit set.} --} -- --\numtest{4}{ --\Reason{Fails for mask with REF_COUNT bit set.} --\Status{Implemented} --} -- --\numtest{5}{ --\Reason{Fails for invalid policy name.} --} -- --\numtest{6}{ --\Reason{Fails for non-existent policy name.} --} -- --\numtest{7}{ --\Reason{Fails for null policy name.} --} -- --\numtest{8}{ --\Priority{High} --\Reason{Fails for empty-string policy name.} --\Status{Implemented} --} -- --\numtest{9}{ --\Priority{High} --\Reason{Accepts 0 for pw_min_life.} --\Status{Implemented} --} -- --\numtest{10}{ --\Priority{High} --\Reason{Accepts non-zero for pw_min_life.} --\Status{Implemented} --} -- --\numtest{11}{ --\Priority{High} --\Reason{Accepts 0 for pw_max_life.} --\Status{Implemented} --} -- --\numtest{12}{ --\Priority{High} --\Reason{Accepts non-zero for pw_max_life.} --\Status{Implemented} --} -- --\numtest{13}{ --\Priority{High} --\Reason{Accepts 0 for pw_min_length.} --\Status{Implemented} --} -- --\numtest{14}{ --\Priority{High} --\Reason{Accepts non-zero for pw_min_length.} --\Status{Implemented} --} -- --\numtest{15}{ --\Priority{High} --\Reason{Rejects 0 for pw_min_classes.} --\Status{Implemented} --} -- --\numtest{16}{ --\Priority{High} --\Reason{Accepts 1 for pw_min_classes.} --\Status{Implemented} --} -- --\numtest{17}{ --\Priority{High} --\Reason{Accepts 4 for pw_min_classes.} --\Status{Implemented} --} -- --\numtest{18}{ --\Priority{High} --\Reason{Rejects 5 for pw_min_classes.} --\Status{Implemented} --} -- --\numtest{19}{ --\Priority{High} --\Reason{Rejects 0 for pw_history_num.} --\Status{Implemented} --} -- --\numtest{20}{ --\Priority{High} --\Reason{Accepts 1 for pw_history_num.} --\Status{Implemented} --} -- --\numtest{21}{ --\Priority{High} --\Reason{Accepts 10 for pw_history_num.} --\Status{Implemented} --} -- --\numtest{22}{ --\Priority{High} --\Reason{Fails for user with no access bits.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{23}{ --\Priority{High} --\Reason{Fails for user with ``get'' but not ``modify''.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{24}{ --\Reason{Fails for user with ``add'' but not ``modify.''} --\Conditions{RPC} --} -- --\numtest{25}{ --\Reason{Fails for user with ``delete'' but not ``modify.''} --\Conditions{RPC} --} -- --\numtest{26}{ --\Priority{High} --\Reason{Succeeds for user with ``modify.''} --\Status{Implemented} --} -- --\numtest{27}{ --\Reason{Succeeds for user with ``get'' and ``modify.''} --} -- --\numtest{28}{ --\Reason{Rejects null policy argument.} --} -- --\numtest{29}{ --\Reason{Rejects change which makes pw_min_life greater than -- pw_max_life.} --} -- --\numtest{30}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{31}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{RPC} --} -- --\section{ovsec_kadm_get_policy} -- --\numtest{1}{ --\Reason{Fails for null policy.} --} -- --\numtest{2}{ --\Reason{Fails for invalid policy name.} --} -- --\numtest{3}{ --\Priority{High} --\Reason{Fails for empty-string policy name.} --\Status{Implemented} --} -- --\numtest{4}{ --\Reason{Fails for non-existent policy name.} --} -- --\numtest{5}{ --\Reason{Fails for null ent.} --} -- --\numtest{6}{ --\Priority{High} --\Reason{Fails for user with no access bits trying to get other's -- policy, using ADMIN_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{7}{ --\Priority{High} --\Reason{Fails for user with ``add'' but not ``get'' trying to get -- other's policy, using ADMIN_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{8}{ --\Reason{Fails for user with ``modify'' but not ``get'' trying to get -- other's policy, using ADMIN_SERVICE.} --\Conditions{RPC} --} -- --\numtest{9}{ --\Reason{Fails for user with ``delete'' but not ``get'' trying to get -- other's policy, using ADMIN_SERVICE.} --\Conditions{RPC} --} -- --\numtest{10}{ --\Reason{Fails for user with ``delete'' but not ``get'' trying to get -- other's policy, using CHANGEPW_SERVICE.} --\Conditions{RPC} --} -- --\numtest{11}{ --\Priority{High} --\Reason{Succeeds for user with only ``get'', trying to get own policy, -- using ADMIN_SERVICE.} --\Status{Implemented} --} -- --\numtest{12}{ --\Priority{High} --\Reason{Succeeds for user with only ``get'', trying to get own policy, -- using CHANGEPW_SERVICE.} --\Status{Implemented} --} -- --\numtest{13}{ --\Reason{Succeeds for user with ``add'' and ``get'', trying to get own -- policy, using ADMIN_SERVICE.} --} -- --\numtest{14}{ --\Reason{Succeeds for user with ``add'' and ``get'', trying to get own -- policy, using CHANGEPW_SERVICE.} --} -- --\numtest{15}{ --\Reason{Succeeds for user without ``get'', trying to get own policy, -- using ADMIN_SERVICE.} --} -- --\numtest{16}{ --\Priority{High} --\Reason{Succeeds for user without ``get'', trying to get own policy, -- using CHANGEPW_SERVICE.} --\Status{Implemented} --} -- --\numtest{17}{ --\Priority{High} --\Reason{Succeeds for user with ``get'', trying to get other's policy, -- using ADMIN_SERVICE.} --\Status{Implemented} --} -- --\numtest{18}{ --\Priority{High} --\Reason{Fails for user with ``get'', trying to get other's policy, -- using CHANGEPW_SERVICE.} --\Conditions{RPC} --\Status{Implemented} --} -- --\numtest{19}{ --\Reason{Succeeds for user with ``modify'' and ``get'', trying to get -- other's policy, using ADMIN_SERVICE.} --} -- --\numtest{20}{ --\Reason{Fails for user with ``modify'' and ``get'', trying to get -- other's policy, using CHANGEPW_SERVICE.} --} -- --\numtest{21}{ --\Priority{High} --\Reason{Returns BAD_SERVER_HANDLE when a null server handle is passed in} --\Status{Implemented} --} -- --\numtest{22}{ --\Priority{Low} --\Reason{Connects to correct server when multiple handles exist} --\Conditions{RPC} --} -- -- --\section{ovsec_kadm_free_principal_ent} -- --In addition to the tests listed here, a memory-leak detector such as --TestCenter, Purify or dbmalloc should be used to verify that the --memory freed by this function is really freed. -- --\numtest{1}{ --\Reason{Null princ succeeds.} --} -- --\numtest{2}{ --\Reason{Non-null princ succeeds.} --} -- -- --\section{ovsec_kadm_free_policy_ent} -- --In addition to the tests listed here, a memory-leak detector such as --TestCenter, Purify or dbmalloc should be used to verify that the --memory freed by this function is really freed. -- --\numtest{1}{ --\Reason{Null policy succeeds.} --} -- --\numtest{2}{ --\Reason{Non-null policy succeeds.} --} -- -- -- --\section{ovsec_kadm_get_privs} -- --\numtest{1}{ --\Reason{Fails for null pointer argument.} --} -- --This test should be run with the 16 possible combinations of access --bits (since there are 4 access bits, there are $2^4 = 16$ possible --combinations of them): -- --\numtest{2}{ --\Priority{High} --\Reason{Returns correct bit mask for access bits of user.} --\Conditions{RPC} --} -- --This test should be run locally: -- --\numtest{3}{ --\Priority{High} --\Reason{Returns 0x0f.} --\Conditions{local} --} -- --\end{document} -diff --git a/src/config/pre.in b/src/config/pre.in -index 3752174c7..b2d17b077 100644 ---- a/src/config/pre.in -+++ b/src/config/pre.in -@@ -228,16 +228,8 @@ KRB5_INCSUBDIRS = \ - $(KRB5_INCDIR)/gssapi \ - $(KRB5_INCDIR)/gssrpc - --# --# Macros used by the KADM5 (OV-based) unit test system. --# XXX check which of these are actually used! --# - SKIPTESTS = $(BUILDTOP)/skiptests --TESTDIR = $(BUILDTOP)/kadmin/testing --STESTDIR = $(top_srcdir)/kadmin/testing --ENV_SETUP = $(TESTDIR)/scripts/env-setup.sh --CLNTTCL = $(TESTDIR)/util/kadm5_clnt_tcl --SRVTCL = $(TESTDIR)/util/kadm5_srv_tcl -+ - # Dejagnu variables. - # We have to set the host with --host so that setup_xfail will work. - # If we don't set it, then the host type used is "native", which -@@ -249,14 +241,6 @@ RUNTEST = runtest $(DEJAFLAGS) - RUNPYTEST = PYTHONPATH=$(top_srcdir)/util VALGRIND="$(VALGRIND)" \ - $(PYTHON) - --START_SERVERS = $(STESTDIR)/scripts/start_servers $(TEST_SERVER) $(TEST_PATH) --START_SERVERS_LOCAL = $(STESTDIR)/scripts/start_servers_local -- --STOP_SERVERS = $(STESTDIR)/scripts/stop_servers $(TEST_SERVER) $(TEST_PATH) --STOP_SERVERS_LOCAL = $(STESTDIR)/scripts/stop_servers_local --# --# End of macros for the KADM5 unit test system. --# - - transform = @program_transform_name@ - -diff --git a/src/configure.ac b/src/configure.ac -index 61778dcd0..4f16fee45 100644 ---- a/src/configure.ac -+++ b/src/configure.ac -@@ -991,33 +991,9 @@ ath_compat= - AC_ARG_ENABLE([athena], - [ --enable-athena build with MIT Project Athena configuration], - ath_compat=compat,) --# The following are tests for the presence of programs required for --# kadmin testing. --AC_CHECK_PROG(have_RUNTEST,runtest,runtest) --AC_CHECK_PROG(have_PERL,perl,perl) --if test "$have_PERL" = perl -a "$have_RUNTEST" = runtest -a "$TCL_LIBS" != ""; then -- DO_TEST=ok --fi --AC_SUBST(DO_TEST) -- --# The following are substituted into kadmin/testing/scripts/env-setup.sh --RBUILD=`pwd` --AC_SUBST(RBUILD) --case "$srcdir" in --/*) S_TOP=$srcdir ;; --*) S_TOP=`pwd`/$srcdir ;; --esac --AC_SUBST(S_TOP) --AC_PATH_PROG(EXPECT,expect) --# For kadmin/testing/util/Makefile.in --if test "$TCL_LIBS" != "" ; then -- DO_ALL=tcl --fi --AC_SUBST(DO_ALL) -+ - KRB5_AC_PRIOCNTL_HACK --K5_GEN_FILE(kadmin/testing/scripts/env-setup.sh:kadmin/testing/scripts/env-setup.shin) --# for lib/kadm5 --AC_CHECK_PROG(RUNTEST,runtest,runtest) -+ - AC_CHECK_PROG(PERL,perl,perl) - - # lib/gssapi -@@ -1552,7 +1528,7 @@ V5_AC_OUTPUT_MAKEFILE(. - - lib/rpc lib/rpc/unit-test - -- lib/kadm5 lib/kadm5/clnt lib/kadm5/srv lib/kadm5/unit-test -+ lib/kadm5 lib/kadm5/clnt lib/kadm5/srv - lib/krad - lib/apputils - -@@ -1588,7 +1564,6 @@ V5_AC_OUTPUT_MAKEFILE(. - clients/kdestroy clients/kpasswd clients/ksu clients/kswitch - - kadmin kadmin/cli kadmin/dbutil kadmin/ktutil kadmin/server -- kadmin/testing kadmin/testing/scripts kadmin/testing/util - - appl - appl/sample appl/sample/sclient appl/sample/sserver -diff --git a/src/kadmin/Makefile.in b/src/kadmin/Makefile.in -index f4061f4f7..87cfa43fd 100644 ---- a/src/kadmin/Makefile.in -+++ b/src/kadmin/Makefile.in -@@ -1,6 +1,6 @@ - mydir=kadmin - BUILDTOP=$(REL).. --SUBDIRS = cli dbutil ktutil server testing -+SUBDIRS = cli dbutil ktutil server - - all: - -diff --git a/src/kadmin/testing/Makefile.in b/src/kadmin/testing/Makefile.in -deleted file mode 100644 -index 5b803cb23..000000000 ---- a/src/kadmin/testing/Makefile.in -+++ /dev/null -@@ -1,8 +0,0 @@ --mydir=kadmin$(S)testing --BUILDTOP=$(REL)..$(S).. --SUBDIRS = scripts util -- --all: -- --clean: -- -$(RM) -r krb5-test-root admin_* init-* *.rcache2 ovsec-* -diff --git a/src/kadmin/testing/deps b/src/kadmin/testing/deps -deleted file mode 100644 -index 2feac3c9d..000000000 ---- a/src/kadmin/testing/deps -+++ /dev/null -@@ -1 +0,0 @@ --# No dependencies here. -diff --git a/src/kadmin/testing/proto/kdc.conf.proto b/src/kadmin/testing/proto/kdc.conf.proto -deleted file mode 100644 -index 8a4b87de1..000000000 ---- a/src/kadmin/testing/proto/kdc.conf.proto -+++ /dev/null -@@ -1,16 +0,0 @@ --[kdcdefaults] -- kdc_listen = 1750 -- kdc_tcp_listen = 1750 -- --[realms] -- __REALM__ = { -- profile = __K5ROOT__/krb5.conf -- database_name = __K5ROOT__/kdb5 -- key_stash_file = __K5ROOT__/.k5.__REALM__ -- acl_file = __K5ROOT__/ovsec_adm.acl -- dict_file = __K5ROOT__/ovsec_adm.dict -- kadmind_port = 1751 -- kpasswd_port = 1752 -- master_key_type = des3-hmac-sha1 -- supported_enctypes = des3-hmac-sha1:normal aes256-cts:normal aes128-cts:normal aes256-sha2:normal aes128-sha2:normal -- } -diff --git a/src/kadmin/testing/proto/krb5.conf.proto b/src/kadmin/testing/proto/krb5.conf.proto -deleted file mode 100644 -index a1c57119c..000000000 ---- a/src/kadmin/testing/proto/krb5.conf.proto -+++ /dev/null -@@ -1,32 +0,0 @@ --[libdefaults] -- default_realm = __REALM__ -- default_keytab_name = FILE:__K5ROOT__/keytab -- dns_fallback = no -- dns_canonicalize_hostname = fallback -- qualify_shortname = "" -- plugin_base_dir = __PLUGIN_DIR__ -- allow_weak_crypto = true -- --[realms] -- __REALM__ = { -- kdc = __HOSTNAME__:1750 -- admin_server = __HOSTNAME__:1751 -- database_module = foobar_db2_module_blah -- } -- --[domain_realm] -- __HOSTNAME__ = __REALM__ -- --[logging] -- admin_server = FILE:__K5ROOT__/syslog -- kdc = FILE:__K5ROOT__/syslog -- default = FILE:__K5ROOT__/syslog -- -- --# THIS SHOULD BE IN KDC.CONF INSTEAD! --[dbmodules] -- db_module_dir = __MODDIR__ -- foobar_db2_module_blah = { -- db_library = db2 -- database_name = __K5ROOT__/kdb5 -- } -diff --git a/src/kadmin/testing/proto/ovsec_adm.dict b/src/kadmin/testing/proto/ovsec_adm.dict -deleted file mode 100644 -index b54e3a85e..000000000 ---- a/src/kadmin/testing/proto/ovsec_adm.dict -+++ /dev/null -@@ -1,3 +0,0 @@ --Abyssinia --Discordianism --foo -diff --git a/src/kadmin/testing/scripts/Makefile.in b/src/kadmin/testing/scripts/Makefile.in -deleted file mode 100644 -index 635930511..000000000 ---- a/src/kadmin/testing/scripts/Makefile.in -+++ /dev/null -@@ -1,18 +0,0 @@ --mydir=kadmin$(S)testing$(S)scripts --BUILDTOP=$(REL)..$(S)..$(S).. -- --all: env-setup.sh runenv.sh $(GEN_SCRIPTS) -- --# Should only rebuild env_setup.sh here (use CONFIG_FILES=), but the weird krb5 --# makefile post-processing is unconditional and would trash the makefile. --env-setup.sh: env-setup.stamp --env-setup.stamp: $(srcdir)/env-setup.shin $(BUILDTOP)/config.status \ -- Makefile -- (cd $(BUILDTOP) && \ -- CONFIG_FILES=$(mydir)/env-setup.sh:$(mydir)/env-setup.shin $(SHELL) \ -- config.status) -- chmod +x env-setup.sh -- touch env-setup.stamp -- --clean: -- -rm -f env-setup.sh env-setup.stamp -diff --git a/src/kadmin/testing/scripts/deps b/src/kadmin/testing/scripts/deps -deleted file mode 100644 -index 2feac3c9d..000000000 ---- a/src/kadmin/testing/scripts/deps -+++ /dev/null -@@ -1 +0,0 @@ --# No dependencies here. -diff --git a/src/kadmin/testing/scripts/env-setup.shin b/src/kadmin/testing/scripts/env-setup.shin -deleted file mode 100755 -index 88f8ad1aa..000000000 ---- a/src/kadmin/testing/scripts/env-setup.shin -+++ /dev/null -@@ -1,104 +0,0 @@ --#!/bin/sh --# --# The KADM5 unit tests were developed to work under gmake. As a --# result, they expect to inherit a number of environment variables. --# Rather than rewrite the tests, we simply use this script as an --# execution wrapper that sets all the necessary environment variables --# before running the program specified on its command line. --# --# The variable settings all came from OV's config.mk. --# --# Usage: env-setup.sh --# -- --TOP=@RBUILD@/kadmin --STOP=@S_TOP@/kadmin --export TOP --export STOP --# These two may be needed in case $libdir references them. --prefix=@prefix@ --exec_prefix=@exec_prefix@ --libdir=@libdir@ ; eval "libdir=$libdir"; export libdir -- --# The shared library run time setup --TOPLIBD=@RBUILD@/lib --PROG_LIBPATH=-L@RBUILD@/lib --BUILDTOP=@RBUILD@ --# XXX kludge! --PROG_RPATH=@RBUILD@/lib --# This converts $(TOPLIBD) to $TOPLIBD --cat > /tmp/env_setup$$ <<\EOF --@KRB5_RUN_ENV@ --EOF -- --foo=`sed -e 's/(//g' -e 's/)//g' -e 's/\\\$\\\$/\$/g' /tmp/env_setup$$` --eval $foo --export @KRB5_RUN_VARS@ -- --# This will get put in setup.csh for convenience --KRB5_RUN_ENV_CSH=`eval echo "$foo" | \ -- sed -e 's/\([^=]*\)=\(.*\)/setenv \1 \2/g'` --export KRB5_RUN_ENV_CSH --rm /tmp/env_setup$$ -- --TESTDIR=$TOP/testing; export TESTDIR --STESTDIR=$STOP/testing; export STESTDIR --if [ "$K5ROOT" = "" ]; then -- K5ROOT="`cd $TESTDIR; pwd`/krb5-test-root" -- export K5ROOT --fi -- --# If $VERBOSE_TEST is non-null, enter verbose mode. Set $VERBOSE to --# true or false so its exit status identifies the mode. --if test x$VERBOSE_TEST = x; then -- VERBOSE=false --else -- VERBOSE=true --fi --export VERBOSE -- --REALM=SECURE-TEST.OV.COM; export REALM -- --if test x$EXPECT = x; then -- EXPECT=@EXPECT@; export EXPECT --fi -- --COMPARE_DUMP=$TESTDIR/scripts/compare_dump.pl; export COMPARE_DUMP --INITDB=$STESTDIR/scripts/init_db; export INITDB --SIMPLE_DUMP=$TESTDIR/scripts/simple_dump.pl; export SIMPLE_DUMP --TCLUTIL=$STESTDIR/tcl/util.t; export TCLUTIL --BSDDB_DUMP=$TESTDIR/util/bsddb_dump; export BSDDB_DUMP --CLNTTCL=$TESTDIR/util/kadm5_clnt_tcl; export CLNTTCL --SRVTCL=$TESTDIR/util/kadm5_srv_tcl; export SRVTCL -- --HOSTNAME=`hostname | tr '[A-Z]' '[a-z]'` --export HOSTNAME -- --KRB5_CONFIG=$K5ROOT/krb5.conf; export KRB5_CONFIG --KRB5_KDC_PROFILE=$K5ROOT/kdc.conf; export KRB5_KDC_PROFILE --KRB5_KTNAME=$K5ROOT/ovsec_adm.keytab; export KRB5_KTNAME --KRB5_CLIENT_KTNAME=$K5ROOT/client_keytab; export KRB5_CLIENT_KTNAME --KRB5CCNAME=$K5ROOT/krb5cc_unit-test; export KRB5CCNAME --GSS_MECH_CONFIG=$K5ROOT/mech.conf; export GSS_MECH_CONFIG -- --# Make sure we don't get confused by translated messages --# or localized times. --LC_ALL=C; export LC_ALL -- --if [ "x$PS_ALL" = "x" ]; then -- if ps auxww >/dev/null 2>&1; then -- PS_ALL="ps auxww" -- PS_PID="ps uwwp" -- elif ps -ef >/dev/null 2>&1; then -- PS_ALL="ps -ef" -- PS_PID="ps -fp" -- else -- PS_ALL="ps auxww" -- PS_PID="ps uwwp" -- echo "WARNING! Cannot auto-detect ps type, assuming BSD." -- fi -- -- export PS_ALL PS_PID --fi -- --exec ${1+"$@"} -diff --git a/src/kadmin/testing/scripts/init_db b/src/kadmin/testing/scripts/init_db -deleted file mode 100755 -index 216f62793..000000000 ---- a/src/kadmin/testing/scripts/init_db -+++ /dev/null -@@ -1,229 +0,0 @@ --#!/bin/sh -- --if $VERBOSE; then -- REDIRECT= --else -- REDIRECT='>/dev/null' --fi -- --# Requires that $K5ROOT, /etc/krb.conf, and .k5.$REALM be world-writeable. -- --if [ "$TOP" = "" ]; then -- echo "init_db: Environment variable \$TOP must point to top of build tree" 1>&2 -- exit 1 --fi -- --if [ "$STOP" = "" ]; then -- echo "init_db: Environment variable \$STOP must point to top of source tree" 1>&2 -- exit 1 --fi -- --if [ "$libdir" = "" ]; then -- echo "init_db: Environment variable \$libdir must point to library install directory" 1>&2 -- exit 1 --fi -- --IROOT=$TOP/.. --ADMIN=$TOP/dbutil --BIN=$IROOT/bin --ETC=$IROOT/etc --MODDIR=$TOP/../plugins/kdb --SBIN=$TOP/keytab:$TOP/server --DUMMY=${REALM=SECURE-TEST.OV.COM}; export REALM -- --. ./runenv.sh -- --if [ ! -d $MODDIR ]; then -- echo "+++" 1>&2 -- echo "+++ Error! $MODDIR does not exist!" 1>&2 -- echo "+++ The MODDIR variable should point to the directory in which" 1>&2 -- echo "+++ database modules have been installed for testing." 1>&2 -- echo "+++" 1>&2 -- exit 1 --fi -- --DUMMY=${TESTDIR=$TOP/testing}; export TESTDIR --DUMMY=${STESTDIR=$STOP/testing} --DUMMY=${SRVTCL=$TESTDIR/util/kadm5_srv_tcl}; export SRVTCL --DUMMY=${TCLUTIL=$STESTDIR/tcl/util.t}; export TCLUTIL -- --PATH=$ADMIN:$BIN:$ETC:$SBIN:$PATH; export PATH -- --if [ ! -x $SRVTCL ]; then -- echo "+++" 1>&2 -- echo "+++ Error! $SRVTCL does not exist!" 1>&2 -- echo "+++ It was probably not compiled because TCL was not available. If you" 1>&2 -- echo "+++ now have TCL installed, cd into that directory, re-run configure" 1>&2 -- echo "+++ with the --with-tcl option, and then re-run make." 1>&2 -- echo "+++" 1>&2 -- -- exit 1 --fi -- --rm -rf $K5ROOT/* --if [ -d $K5ROOT ]; then -- true --else -- mkdir $K5ROOT --fi -- --# touch $K5ROOT/syslog --# for pid in `$PS_ALL | awk '/syslogd/ && !/awk/ {print $2}'` ; do --# case "$pid" in --# xxx) ;; --# *) --# if $VERBOSE; then $PS_PID$pid | grep -v COMMAND; fi --# kill -1 $pid --# ;; --# esac --# done -- --sed -e "s/__REALM__/$REALM/g" -e "s#__K5ROOT__#$K5ROOT#g" \ -- -e "s/__HOSTNAME__/$HOSTNAME/g" \ -- -e "s#__MODDIR__#$MODDIR#g" \ -- < $STESTDIR/proto/krb5.conf.proto > $K5ROOT/krb5.conf --sed -e "s/__REALM__/$REALM/g" -e "s#__K5ROOT__#$K5ROOT#g" \ -- < $STESTDIR/proto/kdc.conf.proto > $K5ROOT/kdc.conf -- --eval kdb5_util -r $REALM create -W -P mrroot -s $REDIRECT || exit 1 -- --cp $STESTDIR/proto/ovsec_adm.dict $K5ROOT/ovsec_adm.dict -- --cat - > /tmp/init_db$$ <<\EOF --source $env(TCLUTIL) --set r $env(REALM) --if {[info exists env(USER)]} { -- set whoami $env(USER) --} else { -- set whoami [exec whoami] --} -- --set cmds { -- {kadm5_init $env(SRVTCL) mrroot null \ -- [config_params {KADM5_CONFIG_REALM} $r] $KADM5_STRUCT_VERSION \ -- $KADM5_API_VERSION_3 server_handle} -- -- {kadm5_create_policy $server_handle "test-pol 0 10000 8 2 3 0 2 90 180" \ -- {KADM5_POLICY KADM5_PW_MIN_LENGTH KADM5_PW_MIN_CLASSES KADM5_PW_MAX_LIFE KADM5_PW_HISTORY_NUM KADM5_PW_MAX_FAILURE KADM5_PW_FAILURE_COUNT_INTERVAL KADM5_PW_LOCKOUT_DURATION}} -- {kadm5_create_policy $server_handle "once-a-min 10 0 0 0 0 0 0 0 0" \ -- {KADM5_POLICY KADM5_PW_MIN_LIFE}} -- {kadm5_create_policy $server_handle "dict-only 0 0 0 0 0 0 0 0 0" \ -- {KADM5_POLICY}} -- {kadm5_create_policy $server_handle [simple_policy test-pol-nopw] \ -- {KADM5_POLICY}} -- -- {kadm5_create_principal $server_handle \ -- [simple_principal testuser@$r] {KADM5_PRINCIPAL} notathena} -- {kadm5_create_principal $server_handle \ -- [simple_principal test1@$r] {KADM5_PRINCIPAL} test1} -- {kadm5_create_principal $server_handle \ -- [simple_principal test2@$r] {KADM5_PRINCIPAL} test2} -- {kadm5_create_principal $server_handle \ -- [simple_principal test3@$r] {KADM5_PRINCIPAL} test3} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/get@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/modify@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/delete@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/add@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/none@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/rename@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/mod-add@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/mod-delete@$r] {KADM5_PRINCIPAL} \ -- admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/get-add@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/get-delete@$r] {KADM5_PRINCIPAL} \ -- admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/get-mod@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/no-add@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [simple_principal admin/no-delete@$r] {KADM5_PRINCIPAL} admin} -- {kadm5_create_principal $server_handle \ -- [princ_w_pol pol1@$r test-pol] {KADM5_PRINCIPAL \ -- KADM5_POLICY} pol111111} -- {kadm5_create_principal $server_handle \ -- [princ_w_pol pol2@$r once-a-min] {KADM5_PRINCIPAL \ -- KADM5_POLICY} pol222222} -- {kadm5_create_principal $server_handle \ -- [princ_w_pol pol3@$r dict-only] {KADM5_PRINCIPAL \ -- KADM5_POLICY} pol333333} -- {kadm5_create_principal $server_handle \ -- [princ_w_pol admin/get-pol@$r test-pol-nopw] \ -- {KADM5_PRINCIPAL KADM5_POLICY} StupidAdmin} -- {kadm5_create_principal $server_handle \ -- [princ_w_pol admin/pol@$r test-pol-nopw] {KADM5_PRINCIPAL \ -- KADM5_POLICY} StupidAdmin} -- -- {kadm5_create_principal $server_handle \ -- [simple_principal changepw/kerberos] \ -- {KADM5_PRINCIPAL} {XXX THIS IS WRONG}} -- -- {kadm5_create_principal $server_handle \ -- [simple_principal $whoami] \ -- {KADM5_PRINCIPAL} $whoami} -- -- {kadm5_create_principal $server_handle \ -- [simple_principal testkeys@$r] {KADM5_PRINCIPAL} testkeys} -- -- {kadm5_destroy $server_handle} --} -- --foreach cmd $cmds { -- if {[catch $cmd output]} { -- puts stderr "Error! Command: $cmd\nError: $output" -- exit 1 -- } else { -- puts stdout $output -- } --} --EOF --eval "$SRVTCL < /tmp/init_db$$ $REDIRECT" --rm /tmp/init_db$$ -- --if [ $? -ne 0 ]; then -- echo "Error in $SRVTCL!" 1>&2 -- exit 1 --fi -- --cat > $K5ROOT/ovsec_adm.acl < $K5ROOT/setup.csh <&2 -- exit 1 -- fi -- -- local=0 -- hostname=$1 -- if [ $# = 1 ]; then -- rempath=`sh -c "cd $TOP && pwd"` -- else -- rempath=$2 -- fi --fi -- --if [ $local = 0 ]; then -- -- # Fix up the local krb5.conf to point to the remote -- sed -e "s/__REALM__/$REALM/g" -e "s#__K5ROOT__#$K5ROOT#g" \ -- -e "s/__HOSTNAME__/$HOSTNAME/g" \ -- -e "s#__MODDIR__#$TOP/../plugins/kdb#g"\ -- -e "s#__PLUGIN_DIR__#$TOP/../plugins#g"\ -- < $STESTDIR/proto/krb5.conf.proto > $K5ROOT/krb5.conf -- --# Using /usr/ucb/rsh and getting rid of "-k $REALM" until we get --# around to fixing the fact that Kerberos rsh doesn't strip out "-k --# REALM" when falling back. -- -- START_SERVERS_LOCAL=`echo $START_SERVERS_LOCAL|sed "s%$TOP%$rempath%"` -- CMD="$RSH_CMD $hostname -n \ -- \"sh -c 'VERBOSE_TEST=$VERBOSE_TEST TOP=$rempath \ -- $rempath/testing/scripts/env-setup.sh \ -- $START_SERVERS_LOCAL $rempath'\"" -- -- if $VERBOSE; then -- echo "+++" -- echo "+++ Begin execution of start_servers_local on $hostname" -- echo "+++" -- echo $CMD -- fi -- eval $CMD -- if $VERBOSE; then -- echo "+++" -- echo "+++ End execution of start_servers_local on $hostname" -- echo "+++" -- fi --else -- $START_SERVERS_LOCAL --fi -- -diff --git a/src/kadmin/testing/scripts/start_servers_local b/src/kadmin/testing/scripts/start_servers_local -deleted file mode 100755 -index 858e88031..000000000 ---- a/src/kadmin/testing/scripts/start_servers_local -+++ /dev/null -@@ -1,157 +0,0 @@ --#!/bin/sh -- --DUMMY=${TESTDIR=$TOP/testing} --DUMMY=${STESTDIR=$STOP/testing} --DUMMY=${INITDB=$STESTDIR/scripts/init_db} --DUMMY=${SRVTCL=$TESTDIR/util/kadm5_srv_tcl}; export SRVTCL --DUMMY=${STOP_SERVERS_LOCAL=$STESTDIR/scripts/stop_servers_local} --DUMMY=${KRB5RCACHEDIR=$TESTDIR} ; export KRB5RCACHEDIR -- --. ./runenv.sh -- --if [ -d /usr/tmp ]; then -- usrtmp=/usr/tmp --else -- usrtmp=/var/tmp --fi -- --$STOP_SERVERS_LOCAL -start_servers -- --if $VERBOSE; then -- REDIRECT= --else -- REDIRECT='>/dev/null' --fi -- --while :; do -- case $1 in -- -keysalt) -- shift -- if [ $# -gt 0 ]; then -- keysalts="$keysalts $1" -- else -- break -- fi -- ;; -- -kdcport) -- shift -- if [ $# -gt 0 ]; then -- kdcport=$1 -- else -- break -- fi -- ;; -- *) -- break -- ;; -- esac -- shift --done -- --if [ $# -gt 1 ]; then -- echo "Usage: $0 [-kdcport port] [-keysalts tuple] ... [top]" 1>&2 -- exit 1 --elif [ $# = 1 ]; then -- TOP=$1 -- export TOP --fi -- --# create a fresh db -- --$INITDB "$keysalts" || exit 1 -- --# Post-process the config files based on our arguments --if [ "$keysalts" != "" ]; then -- sedcmd="s/\([ ]*supported_enctypes =\).*/\1 $keysalts/" -- sed -e "$sedcmd" < $K5ROOT/kdc.conf > $K5ROOT/kdc.conf.new -- mv $K5ROOT/kdc.conf.new $K5ROOT/kdc.conf --fi --if [ "$kdcport" != "" ] ; then -- sedcmd="s/\(kdc_ports = .*\)[ ]*/\1, $kdcport/" -- sed -e "$sedcmd" < $K5ROOT/kdc.conf > $K5ROOT/kdc.conf.new -- mv $K5ROOT/kdc.conf.new $K5ROOT/kdc.conf --fi -- --# allow admin to krlogin as root (for cleanup) --DUMMY=${REALM=SECURE-TEST.OV.COM}; export REALM -- --cat - > /tmp/start_servers_local$$ <<\EOF --if { [catch { -- source $env(STOP)/testing/tcl/util.t -- set r $env(REALM) -- set q $env(HOSTNAME) -- puts stdout [kadm5_init $env(SRVTCL) mrroot null \ -- [config_params {KADM5_CONFIG_REALM} $r] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 server_handle] -- puts stdout [kadm5_create_principal $server_handle \ -- [simple_principal host/$q@$r] {KADM5_PRINCIPAL} notathena] -- puts stdout [kadm5_destroy $server_handle] --} err]} { -- puts stderr "initialization error: $err" -- exit 1 --} --exit 0 --EOF --eval "$SRVTCL < /tmp/start_servers_local$$ $REDIRECT" --x=$? --rm /tmp/start_servers_local$$ --if test $x != 0 ; then exit 1 ; fi -- --# run the servers (from the build tree) -- --adm_start_file=/tmp/adm_server_start.$$ --kdc_start_file=/tmp/kdc_server_start.$$ -- --rm -f $kdc_start_file -- --if test "x$USER" = x ; then -- USER=$LOGNAME ; export USER --fi -- --kdc_args="-R dfl:kdc_rcache.$USER" -- --(trap "" 2; $TOP/../kdc/krb5kdc $kdc_args; touch $kdc_start_file) \ -- < /dev/null > $usrtmp/kdc-log.$USER 2>&1 & -- --s=1 --max_s=60 --sofar_s=0 --timewait_s=300 -- --ovadm_args=-W -- --rm -f $adm_start_file -- --(sleep 1; $TOP/server/kadmind $ovadm_args; \ -- touch $adm_start_file) < /dev/null > $usrtmp/kadm-log.$USER 2>&1 & -- --# wait until they start -- --while [ $sofar_s -le $max_s ]; do -- if $VERBOSE; then -- echo "Sleeping for $s seconds to allow servers" \ -- "to start..." -- fi -- -- sofar_s=`expr $sofar_s + $s` -- -- sleep $s -- -- if [ -f $adm_start_file -a -f $kdc_start_file ]; then -- break -- fi --done -- --if [ $sofar_s -gt $max_s ]; then -- echo "Admin server or KDC failed to start after $sofar_s" \ -- "seconds." 1>&2 -- if [ ! -f $adm_start_file ]; then -- echo " No admin server start file $adm_start_file." 1>&2 -- fi -- if [ ! -f $kdc_start_file ]; then -- echo " No KDC start file $adm_start_file." 1>&2 -- fi -- exit 1 --fi -- --rm -f $kdc_start_file $adm_start_file -diff --git a/src/kadmin/testing/scripts/stop_servers b/src/kadmin/testing/scripts/stop_servers -deleted file mode 100755 -index b7f8384ca..000000000 ---- a/src/kadmin/testing/scripts/stop_servers -+++ /dev/null -@@ -1,60 +0,0 @@ --#!/bin/sh --# --# Usage: stop_servers [hostname [path]] --# --# This script turns a host into a OpenV*Secure primary server for the --# realm SECURE-TEST.OV.COM. If no arguments are specified, --# the local host is affected. Otherwise, the host hostname is --# affected; the path argument is the top of the Secure install tree on --# that host, and if it is not specified the current canonical value of --# TOP is used. -- --DUMMY=${TESTDIR=$TOP/testing} --DUMMY=${STESTDIR=$STOP/testing} --DUMMY=${STOP_SERVERS_LOCAL=$STESTDIR/scripts/stop_servers_local} --# This'll be wrong sometimes --DUMMY=${RSH_CMD=rsh} -- --local=1 -- --if [ $# -gt 0 ]; then -- if [ $# != 1 -a $# != 2 ]; then -- echo "Usage: $0 [hostname [path]]" 1>&2 -- exit 1 -- fi -- -- local=0 -- hostname=$1 -- if [ $# = 1 ]; then -- rempath=`sh -c "cd $TOP && pwd"` -- else -- rempath=$2 -- fi --fi -- --if [ $local = 0 ]; then -- if $VERBOSE; then -- echo "+++ Stopping servers on remote host $hostname..." -- fi -- -- STOP_SERVERS_LOCAL=`echo $STOP_SERVERS_LOCAL | sed "s%$TOP%$rempath%"` -- CMD="$RSH_CMD $hostname -n \ -- \"sh -c 'VERBOSE_TEST=$VERBOSE_TEST TOP=$rempath \ -- $rempath/testing/scripts/env-setup.sh \ -- $STOP_SERVERS_LOCAL $rempath'\"" -- -- if $VERBOSE; then -- echo "+++" -- echo "+++ Begin execution of stop_servers_local on $hostname" -- echo "+++" -- echo $CMD -- fi -- eval $CMD -- if $VERBOSE; then -- echo "+++" -- echo "+++ End execution of stop_servers_local on $hostname" -- echo "+++" -- fi --else -- $STOP_SERVERS_LOCAL --fi -diff --git a/src/kadmin/testing/scripts/stop_servers_local b/src/kadmin/testing/scripts/stop_servers_local -deleted file mode 100755 -index 24a9de7b3..000000000 ---- a/src/kadmin/testing/scripts/stop_servers_local -+++ /dev/null -@@ -1,44 +0,0 @@ --#!/bin/sh -- --DUMMY=${TESTDIR=$TOP/testing} --DUMMY=${KRB5RCACHEDIR=$TESTDIR} -- --while [ $# -gt 0 ] ; do -- case $1 in -- -start_servers) -- start_servers=$1 -- ;; -- *) -- TOP=$1 -- export TOP -- ;; -- esac -- shift --done -- --# kill any running servers. -- --if $VERBOSE; then echo "Killing servers:"; fi -- --for pid in xxx \ -- `$PS_ALL | grep krb5kdc | grep -v grep | awk '{print $2}'` \ -- `$PS_ALL | grep kadmind | grep -v grep | awk '{print $2}'` \ -- ; do -- case "$pid" in -- xxx) -- ;; -- *) -- if $VERBOSE; then $PS_PID$pid | grep -v COMMAND; fi -- kill $pid -- ;; -- esac --done -- --# Destroy the kdc replay cache so we don't lose if we try to run the --# KDC as another unix user. --if test "x$USER" = x ; then -- USER=$LOGNAME --fi --rm -f $KRB5RCACHEDIR/krb5kdc_rcache.$USER -- --exit 0 -diff --git a/src/kadmin/testing/tcl/util.t b/src/kadmin/testing/tcl/util.t -deleted file mode 100644 -index 6751f89e6..000000000 ---- a/src/kadmin/testing/tcl/util.t -+++ /dev/null -@@ -1,58 +0,0 @@ --proc simple_principal {name} { -- return "{$name} 0 0 0 0 {$name} 0 0 0 0 null 0" --} -- --proc princ_w_pol {name policy} { -- return "{$name} 0 0 0 0 {$name} 0 0 0 0 {$policy} 0" --} -- --proc simple_policy {name} { -- return "{$name} 0 0 0 0 0 0 0 0 0" --} -- --proc config_params {masks values} { -- if {[llength $masks] != [llength $values]} { -- error "config_params: length of mask and values differ" -- } -- -- set params [list $masks 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 {}] -- for {set i 0} {$i < [llength $masks]} {incr i} { -- set mask [lindex $masks $i] -- set value [lindex $values $i] -- switch -glob -- $mask { -- "KADM5_CONFIG_REALM" {set params [lreplace $params 1 1 $value]} -- "KADM5_CONFIG_KADMIND_PORT" { -- set params [lreplace $params 2 2 $value]} -- "KADM5_CONFIG_ADMIN_SERVER" { -- set params [lreplace $params 3 3 $value]} -- "KADM5_CONFIG_DBNAME" {set params [lreplace $params 4 4 $value]} -- "KADM5_CONFIG_ADBNAME" {set params [lreplace $params 5 5 $value]} -- "KADM5_CONFIG_ADB_LOCKFILE" { -- set params [lreplace $params 6 6 $value]} -- "KADM5_CONFIG_ACL_FILE" {set params [lreplace $params 8 8 $value]} -- "KADM5_CONFIG_DICT_FILE" { -- set params [lreplace $params 9 9 $value]} -- "KADM5_CONFIG_MKEY_FROM_KBD" { -- set params [lreplace $params 10 10 $value]} -- "KADM5_CONFIG_STASH_FILE" { -- set params [lreplace $params 11 11 $value]} -- "KADM5_CONFIG_MKEY_NAME" { -- set params [lreplace $params 12 12 $value]} -- "KADM5_CONFIG_ENCTYPE" {set params [lreplace $params 13 13 $value]} -- "KADM5_CONFIG_MAX_LIFE" { -- set params [lreplace $params 14 14 $value]} -- "KADM5_CONFIG_MAX_RLIFE" { -- set params [lreplace $params 15 15 $value]} -- "KADM5_CONFIG_EXPIRATION" { -- set params [lreplace $params 16 16 $value]} -- "KADM5_CONFIG_FLAGS" {set params [lreplace $params 17 17 $value]} -- "KADM5_CONFIG_ENCTYPES" { -- set params [lreplace $params 18 19 [llength $value] $value]} -- "*" {error "config_params: unknown mask $mask"} -- } -- } -- return $params --} -- -- -- -diff --git a/src/kadmin/testing/util/Makefile.in b/src/kadmin/testing/util/Makefile.in -deleted file mode 100644 -index 7785c742e..000000000 ---- a/src/kadmin/testing/util/Makefile.in -+++ /dev/null -@@ -1,42 +0,0 @@ --mydir=kadmin$(S)testing$(S)util --BUILDTOP=$(REL)..$(S)..$(S).. --LOCALINCLUDES = $(TCL_INCLUDES) -I$(BUILDTOP)/lib/kdb/ --# Force Tcl headers to use stdarg.h, because krb5 does too, and if --# Tcl uses varargs.h it'll just mess things up. --DEFINES= -DHAS_STDARG --KRB5_PTHREAD_LIB=$(THREAD_LINKOPTS) -- --PROG_LIBPATH=-L$(TOPLIBD) $(TCL_LIBPATH) --PROG_RPATH=$(KRB5_LIBDIR)$(TCL_RPATH) -- --SRCS = $(srcdir)/tcl_kadm5.c $(srcdir)/test.c --OBJS = tcl_kadm5.o test.o -- --CLNTPROG= kadm5_clnt_tcl --SRVPROG = kadm5_srv_tcl -- --DO_ALL=@DO_ALL@ -- --all: all-$(DO_ALL) -- --all-: -- @echo "+++" -- @echo "+++ WARNING: Tcl not available. The kadm5 tests will not be run." -- @echo "+++" -- @echo 'Skipped kadm5 tests: Tcl not found' >> $(SKIPTESTS) -- --all-tcl: $(CLNTPROG) $(SRVPROG) -- --$(SRVPROG): $(OBJS) $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o $(SRVPROG) $(OBJS) $(TCL_MAYBE_RPATH) \ -- $(KADMSRV_LIBS) $(KRB5_PTHREAD_LIB) $(KRB5_BASE_LIBS) $(TCL_LIBS) -- --$(CLNTPROG): $(OBJS) $(KADMCLNT_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o $(CLNTPROG) $(OBJS) $(TCL_MAYBE_RPATH) \ -- $(KRB5_PTHREAD_LIB) $(KADMCLNT_LIBS) $(KRB5_BASE_LIBS) $(TCL_LIBS) -- --bsddb_dump: bsddb_dump.o -- $(CC_LINK) -o bsddb_dump bsddb_dump.o $(KADMSRV_LIBS) -- --clean: -- $(RM) $(CLNTPROG) $(SRVPROG) -diff --git a/src/kadmin/testing/util/bsddb_dump.c b/src/kadmin/testing/util/bsddb_dump.c -deleted file mode 100644 -index 5dbe7ae9c..000000000 ---- a/src/kadmin/testing/util/bsddb_dump.c -+++ /dev/null -@@ -1,65 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --/* -- * $Id$ -- */ -- --#include --#include --#include --#include -- --main(int argc, char *argv[]) --{ -- char *file; -- DB *db; -- DBT dbkey, dbdata; -- int code, i; -- -- HASHINFO info; -- -- info.hash = NULL; -- info.bsize = 256; -- info.ffactor = 8; -- info.nelem = 25000; -- info.lorder = 0; -- -- if (argc != 2) { -- fprintf(stderr, "usage: argv[0] dbfile\n"); -- exit(2); -- } -- -- file = argv[1]; -- -- if((db = dbopen(file, O_RDWR, 0666, DB_HASH, &info)) == NULL) { -- perror("Opening db file"); -- exit(1); -- } -- -- if ((code = (*db->seq)(db, &dbkey, &dbdata, R_FIRST)) == -1) { -- perror("starting db iteration"); -- exit(1); -- } -- -- while (code == 0) { -- for (i=0; iseq)(db, &dbkey, &dbdata, R_NEXT); -- } -- -- if (code == -1) { -- perror("during db iteration"); -- exit(1); -- } -- -- if ((*db->close)(db) == -1) { -- perror("closing db"); -- exit(1); -- } -- -- exit(0); --} -diff --git a/src/kadmin/testing/util/deps b/src/kadmin/testing/util/deps -deleted file mode 100644 -index ca828a85c..000000000 ---- a/src/kadmin/testing/util/deps -+++ /dev/null -@@ -1,16 +0,0 @@ --# --# Generated makefile dependencies follow. --# --$(OUTPRE)tcl_kadm5.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ -- $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssrpc/types.h \ -- $(BUILDTOP)/include/kadm5/admin.h $(BUILDTOP)/include/kadm5/chpass_util_strings.h \ -- $(BUILDTOP)/include/kadm5/kadm_err.h $(BUILDTOP)/include/krb5/krb5.h \ -- $(BUILDTOP)/lib/kdb/adb_err.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ -- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ -- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ -- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ -- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ -- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \ -- $(top_srcdir)/include/krb5.h tcl_kadm5.c tcl_kadm5.h --$(OUTPRE)test.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ -- tcl_kadm5.h test.c -diff --git a/src/kadmin/testing/util/tcl_kadm5.c b/src/kadmin/testing/util/tcl_kadm5.c -deleted file mode 100644 -index 864a929c8..000000000 ---- a/src/kadmin/testing/util/tcl_kadm5.c -+++ /dev/null -@@ -1,2566 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --#include "autoconf.h" --#include --#include --#if HAVE_TCL_H --#include --#elif HAVE_TCL_TCL_H --#include --#endif --#define USE_KADM5_API_VERSION 2 --#include --#include --#include --#include --#include --#include "tcl_kadm5.h" -- --struct flagval { -- char *name; -- krb5_flags val; --}; -- --/* XXX This should probably be in the hash table like server_handle */ --static krb5_context context; -- --static struct flagval krb5_flags_array[] = { -- {"KRB5_KDB_DISALLOW_POSTDATED", KRB5_KDB_DISALLOW_POSTDATED}, -- {"KRB5_KDB_DISALLOW_FORWARDABLE", KRB5_KDB_DISALLOW_FORWARDABLE}, -- {"KRB5_KDB_DISALLOW_TGT_BASED", KRB5_KDB_DISALLOW_TGT_BASED}, -- {"KRB5_KDB_DISALLOW_RENEWABLE", KRB5_KDB_DISALLOW_RENEWABLE}, -- {"KRB5_KDB_DISALLOW_PROXIABLE", KRB5_KDB_DISALLOW_PROXIABLE}, -- {"KRB5_KDB_DISALLOW_DUP_SKEY", KRB5_KDB_DISALLOW_DUP_SKEY}, -- {"KRB5_KDB_DISALLOW_ALL_TIX", KRB5_KDB_DISALLOW_ALL_TIX}, -- {"KRB5_KDB_REQUIRES_PRE_AUTH", KRB5_KDB_REQUIRES_PRE_AUTH}, -- {"KRB5_KDB_REQUIRES_HW_AUTH", KRB5_KDB_REQUIRES_HW_AUTH}, -- {"KRB5_KDB_REQUIRES_PWCHANGE", KRB5_KDB_REQUIRES_PWCHANGE}, -- {"KRB5_KDB_DISALLOW_SVR", KRB5_KDB_DISALLOW_SVR}, -- {"KRB5_KDB_PWCHANGE_SERVICE", KRB5_KDB_PWCHANGE_SERVICE} --}; -- --static struct flagval aux_attributes[] = { -- {"KADM5_POLICY", KADM5_POLICY} --}; -- --static struct flagval principal_mask_flags[] = { -- {"KADM5_PRINCIPAL", KADM5_PRINCIPAL}, -- {"KADM5_PRINC_EXPIRE_TIME", KADM5_PRINC_EXPIRE_TIME}, -- {"KADM5_PW_EXPIRATION", KADM5_PW_EXPIRATION}, -- {"KADM5_LAST_PWD_CHANGE", KADM5_LAST_PWD_CHANGE}, -- {"KADM5_ATTRIBUTES", KADM5_ATTRIBUTES}, -- {"KADM5_MAX_LIFE", KADM5_MAX_LIFE}, -- {"KADM5_MOD_TIME", KADM5_MOD_TIME}, -- {"KADM5_MOD_NAME", KADM5_MOD_NAME}, -- {"KADM5_KVNO", KADM5_KVNO}, -- {"KADM5_MKVNO", KADM5_MKVNO}, -- {"KADM5_AUX_ATTRIBUTES", KADM5_AUX_ATTRIBUTES}, -- {"KADM5_POLICY", KADM5_POLICY}, -- {"KADM5_POLICY_CLR", KADM5_POLICY_CLR}, -- {"KADM5_MAX_RLIFE", KADM5_MAX_RLIFE}, -- {"KADM5_LAST_SUCCESS", KADM5_LAST_SUCCESS}, -- {"KADM5_LAST_FAILED", KADM5_LAST_FAILED}, -- {"KADM5_FAIL_AUTH_COUNT", KADM5_FAIL_AUTH_COUNT}, -- {"KADM5_KEY_DATA", KADM5_KEY_DATA}, -- {"KADM5_TL_DATA", KADM5_TL_DATA}, -- {"KADM5_PRINCIPAL_NORMAL_MASK", KADM5_PRINCIPAL_NORMAL_MASK} --}; -- --static struct flagval policy_mask_flags[] = { -- {"KADM5_POLICY", KADM5_POLICY}, -- {"KADM5_PW_MAX_LIFE", KADM5_PW_MAX_LIFE}, -- {"KADM5_PW_MIN_LIFE", KADM5_PW_MIN_LIFE}, -- {"KADM5_PW_MIN_LENGTH", KADM5_PW_MIN_LENGTH}, -- {"KADM5_PW_MIN_CLASSES", KADM5_PW_MIN_CLASSES}, -- {"KADM5_PW_HISTORY_NUM", KADM5_PW_HISTORY_NUM}, -- {"KADM5_REF_COUNT", KADM5_REF_COUNT}, -- {"KADM5_PW_MAX_FAILURE", KADM5_PW_MAX_FAILURE}, -- {"KADM5_PW_FAILURE_COUNT_INTERVAL", KADM5_PW_FAILURE_COUNT_INTERVAL}, -- {"KADM5_PW_LOCKOUT_DURATION", KADM5_PW_LOCKOUT_DURATION}, --}; -- --static struct flagval config_mask_flags[] = { -- {"KADM5_CONFIG_REALM", KADM5_CONFIG_REALM}, -- {"KADM5_CONFIG_DBNAME", KADM5_CONFIG_DBNAME}, -- {"KADM5_CONFIG_MKEY_NAME", KADM5_CONFIG_MKEY_NAME}, -- {"KADM5_CONFIG_MAX_LIFE", KADM5_CONFIG_MAX_LIFE}, -- {"KADM5_CONFIG_MAX_RLIFE", KADM5_CONFIG_MAX_RLIFE}, -- {"KADM5_CONFIG_EXPIRATION", KADM5_CONFIG_EXPIRATION}, -- {"KADM5_CONFIG_FLAGS", KADM5_CONFIG_FLAGS}, -- {"KADM5_CONFIG_STASH_FILE", KADM5_CONFIG_STASH_FILE}, -- {"KADM5_CONFIG_ENCTYPE", KADM5_CONFIG_ENCTYPE}, -- {"KADM5_CONFIG_ADBNAME", KADM5_CONFIG_ADBNAME}, -- {"KADM5_CONFIG_ADB_LOCKFILE", KADM5_CONFIG_ADB_LOCKFILE}, -- {"KADM5_CONFIG_ACL_FILE", KADM5_CONFIG_ACL_FILE}, -- {"KADM5_CONFIG_KADMIND_PORT", KADM5_CONFIG_KADMIND_PORT}, -- {"KADM5_CONFIG_ENCTYPES", KADM5_CONFIG_ENCTYPES}, -- {"KADM5_CONFIG_ADMIN_SERVER", KADM5_CONFIG_ADMIN_SERVER}, -- {"KADM5_CONFIG_DICT_FILE", KADM5_CONFIG_DICT_FILE}, -- {"KADM5_CONFIG_MKEY_FROM_KBD", KADM5_CONFIG_MKEY_FROM_KBD}, --}; -- --static struct flagval priv_flags[] = { -- {"KADM5_PRIV_GET", KADM5_PRIV_GET}, -- {"KADM5_PRIV_ADD", KADM5_PRIV_ADD}, -- {"KADM5_PRIV_MODIFY", KADM5_PRIV_MODIFY}, -- {"KADM5_PRIV_DELETE", KADM5_PRIV_DELETE} --}; -- -- --static char *arg_error = "wrong # args"; -- --static Tcl_HashTable *struct_table = 0; -- --static int put_server_handle(Tcl_Interp *interp, void *handle, char **name) --{ -- int i = 1, newPtr = 0; -- static char buf[20]; -- Tcl_HashEntry *entry; -- -- if (! struct_table) { -- if (! (struct_table = -- malloc(sizeof(*struct_table)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- Tcl_InitHashTable(struct_table, TCL_STRING_KEYS); -- } -- -- do { -- sprintf(buf, "kadm5_handle%d", i); -- entry = Tcl_CreateHashEntry(struct_table, buf, &newPtr); -- i++; -- } while (! newPtr); -- -- Tcl_SetHashValue(entry, handle); -- -- *name = buf; -- -- return TCL_OK; --} -- --static int get_server_handle(Tcl_Interp *interp, const char *name, -- void **handle) --{ -- Tcl_HashEntry *entry; -- -- if(!strcasecmp(name, "null")) -- *handle = 0; -- else { -- if (! (struct_table && -- (entry = Tcl_FindHashEntry(struct_table, name)))) { -- Tcl_AppendResult(interp, "unknown server handle ", name, 0); -- return TCL_ERROR; -- } -- *handle = (void *) Tcl_GetHashValue(entry); -- } -- return TCL_OK; --} -- --static int remove_server_handle(Tcl_Interp *interp, const char *name) --{ -- Tcl_HashEntry *entry; -- -- if (! (struct_table && -- (entry = Tcl_FindHashEntry(struct_table, name)))) { -- Tcl_AppendResult(interp, "unknown server handle ", name, 0); -- return TCL_ERROR; -- } -- -- Tcl_SetHashValue(entry, NULL); -- return TCL_OK; --} -- --#define GET_HANDLE(num_args, ignored) \ -- void *server_handle; \ -- const char *whoami = argv[0]; \ -- argv++, argc--; \ -- if (argc != num_args + 1) { \ -- Tcl_AppendResult(interp, whoami, ": ", arg_error, 0); \ -- return TCL_ERROR; \ -- } \ -- { \ -- int ltcl_ret; \ -- if ((ltcl_ret = get_server_handle(interp, argv[0], &server_handle)) \ -- != TCL_OK) { \ -- return ltcl_ret; \ -- } \ -- } \ -- argv++, argc--; -- --static Tcl_HashTable *create_flag_table(struct flagval *flags, int size) --{ -- Tcl_HashTable *table; -- Tcl_HashEntry *entry; -- int i; -- -- if (! (table = (Tcl_HashTable *) malloc(sizeof(Tcl_HashTable)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- Tcl_InitHashTable(table, TCL_STRING_KEYS); -- -- for (i = 0; i < size; i++) { -- int newPtr; -- -- if (! (entry = Tcl_CreateHashEntry(table, flags[i].name, &newPtr))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- Tcl_SetHashValue(entry, &flags[i].val); -- } -- -- return table; --} -- -- --static Tcl_DString *unparse_str(char *in_str) --{ -- Tcl_DString *str; -- -- if (! (str = malloc(sizeof(*str)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- Tcl_DStringInit(str); -- -- if (! in_str) { -- Tcl_DStringAppend(str, "null", -1); -- } -- else { -- Tcl_DStringAppend(str, in_str, -1); -- } -- -- return str; --} -- -- -- --static int parse_str(Tcl_Interp *interp, const char *in_str, char **out_str) --{ -- if (! in_str) { -- *out_str = 0; -- } -- else if (! strcasecmp(in_str, "null")) { -- *out_str = 0; -- } -- else { -- *out_str = (char *) in_str; -- } -- return TCL_OK; --} -- -- --static void set_ok(Tcl_Interp *interp, char *string) --{ -- Tcl_SetResult(interp, "OK", TCL_STATIC); -- Tcl_AppendElement(interp, "KADM5_OK"); -- Tcl_AppendElement(interp, string); --} -- -- -- --static Tcl_DString *unparse_err(kadm5_ret_t code) --{ -- char *code_string; -- const char *error_string; -- Tcl_DString *dstring; -- -- switch (code) { -- case KADM5_FAILURE: code_string = "KADM5_FAILURE"; break; -- case KADM5_AUTH_GET: code_string = "KADM5_AUTH_GET"; break; -- case KADM5_AUTH_ADD: code_string = "KADM5_AUTH_ADD"; break; -- case KADM5_AUTH_MODIFY: -- code_string = "KADM5_AUTH_MODIFY"; break; -- case KADM5_AUTH_DELETE: -- code_string = "KADM5_AUTH_DELETE"; break; -- case KADM5_AUTH_INSUFFICIENT: -- code_string = "KADM5_AUTH_INSUFFICIENT"; break; -- case KADM5_BAD_DB: code_string = "KADM5_BAD_DB"; break; -- case KADM5_DUP: code_string = "KADM5_DUP"; break; -- case KADM5_RPC_ERROR: code_string = "KADM5_RPC_ERROR"; break; -- case KADM5_NO_SRV: code_string = "KADM5_NO_SRV"; break; -- case KADM5_BAD_HIST_KEY: -- code_string = "KADM5_BAD_HIST_KEY"; break; -- case KADM5_NOT_INIT: code_string = "KADM5_NOT_INIT"; break; -- case KADM5_INIT: code_string = "KADM5_INIT"; break; -- case KADM5_BAD_PASSWORD: -- code_string = "KADM5_BAD_PASSWORD"; break; -- case KADM5_UNK_PRINC: code_string = "KADM5_UNK_PRINC"; break; -- case KADM5_UNK_POLICY: code_string = "KADM5_UNK_POLICY"; break; -- case KADM5_BAD_MASK: code_string = "KADM5_BAD_MASK"; break; -- case KADM5_BAD_CLASS: code_string = "KADM5_BAD_CLASS"; break; -- case KADM5_BAD_LENGTH: code_string = "KADM5_BAD_LENGTH"; break; -- case KADM5_BAD_POLICY: code_string = "KADM5_BAD_POLICY"; break; -- case KADM5_BAD_HISTORY: code_string = "KADM5_BAD_HISTORY"; break; -- case KADM5_BAD_PRINCIPAL: -- code_string = "KADM5_BAD_PRINCIPAL"; break; -- case KADM5_BAD_AUX_ATTR: -- code_string = "KADM5_BAD_AUX_ATTR"; break; -- case KADM5_PASS_Q_TOOSHORT: -- code_string = "KADM5_PASS_Q_TOOSHORT"; break; -- case KADM5_PASS_Q_CLASS: -- code_string = "KADM5_PASS_Q_CLASS"; break; -- case KADM5_PASS_Q_DICT: -- code_string = "KADM5_PASS_Q_DICT"; break; -- case KADM5_PASS_REUSE: code_string = "KADM5_PASS_REUSE"; break; -- case KADM5_PASS_TOOSOON: -- code_string = "KADM5_PASS_TOOSOON"; break; -- case KADM5_POLICY_REF: -- code_string = "KADM5_POLICY_REF"; break; -- case KADM5_PROTECT_PRINCIPAL: -- code_string = "KADM5_PROTECT_PRINCIPAL"; break; -- case KADM5_BAD_SERVER_HANDLE: -- code_string = "KADM5_BAD_SERVER_HANDLE"; break; -- case KADM5_BAD_STRUCT_VERSION: -- code_string = "KADM5_BAD_STRUCT_VERSION"; break; -- case KADM5_OLD_STRUCT_VERSION: -- code_string = "KADM5_OLD_STRUCT_VERSION"; break; -- case KADM5_NEW_STRUCT_VERSION: -- code_string = "KADM5_NEW_STRUCT_VERSION"; break; -- case KADM5_BAD_API_VERSION: -- code_string = "KADM5_BAD_API_VERSION"; break; -- case KADM5_OLD_LIB_API_VERSION: -- code_string = "KADM5_OLD_LIB_API_VERSION"; break; -- case KADM5_OLD_SERVER_API_VERSION: -- code_string = "KADM5_OLD_SERVER_API_VERSION"; break; -- case KADM5_NEW_LIB_API_VERSION: -- code_string = "KADM5_NEW_LIB_API_VERSION"; break; -- case KADM5_NEW_SERVER_API_VERSION: -- code_string = "KADM5_NEW_SERVER_API_VERSION"; break; -- case KADM5_SECURE_PRINC_MISSING: -- code_string = "KADM5_SECURE_PRINC_MISSING"; break; -- case KADM5_NO_RENAME_SALT: -- code_string = "KADM5_NO_RENAME_SALT"; break; -- case KADM5_BAD_CLIENT_PARAMS: -- code_string = "KADM5_BAD_CLIENT_PARAMS"; break; -- case KADM5_BAD_SERVER_PARAMS: -- code_string = "KADM5_BAD_SERVER_PARAMS"; break; -- case KADM5_AUTH_LIST: -- code_string = "KADM5_AUTH_LIST"; break; -- case KADM5_AUTH_CHANGEPW: -- code_string = "KADM5_AUTH_CHANGEPW"; break; -- case KADM5_GSS_ERROR: code_string = "KADM5_GSS_ERROR"; break; -- case KADM5_BAD_TL_TYPE: code_string = "KADM5_BAD_TL_TYPE"; break; -- case KADM5_MISSING_CONF_PARAMS: -- code_string = "KADM5_MISSING_CONF_PARAMS"; break; -- case KADM5_BAD_SERVER_NAME: -- code_string = "KADM5_BAD_SERVER_NAME"; break; -- case KADM5_MISSING_KRB5_CONF_PARAMS: -- code_string = "KADM5_MISSING_KRB5_CONF_PARAMS"; break; -- case KADM5_XDR_FAILURE: code_string = "KADM5_XDR_FAILURE"; break; -- case KADM5_CANT_RESOLVE: code_string = "KADM5_CANT_RESOLVE"; break; -- -- -- case OSA_ADB_DUP: code_string = "OSA_ADB_DUP"; break; -- case OSA_ADB_NOENT: code_string = "ENOENT"; break; -- case OSA_ADB_DBINIT: code_string = "OSA_ADB_DBINIT"; break; -- case OSA_ADB_BAD_POLICY: code_string = "Bad policy name"; break; -- case OSA_ADB_BAD_PRINC: code_string = "Bad principal name"; break; -- case OSA_ADB_BAD_DB: code_string = "Invalid database."; break; -- case OSA_ADB_XDR_FAILURE: code_string = "OSA_ADB_XDR_FAILURE"; break; -- case OSA_ADB_BADLOCKMODE: code_string = "OSA_ADB_BADLOCKMODE"; break; -- case OSA_ADB_CANTLOCK_DB: code_string = "OSA_ADB_CANTLOCK_DB"; break; -- case OSA_ADB_NOTLOCKED: code_string = "OSA_ADB_NOTLOCKED"; break; -- case OSA_ADB_NOLOCKFILE: code_string = "OSA_ADB_NOLOCKFILE"; break; -- case OSA_ADB_NOEXCL_PERM: code_string = "OSA_ADB_NOEXCL_PERM"; break; -- -- case KRB5_KDB_INUSE: code_string = "KRB5_KDB_INUSE"; break; -- case KRB5_KDB_UK_SERROR: code_string = "KRB5_KDB_UK_SERROR"; break; -- case KRB5_KDB_UK_RERROR: code_string = "KRB5_KDB_UK_RERROR"; break; -- case KRB5_KDB_UNAUTH: code_string = "KRB5_KDB_UNAUTH"; break; -- case KRB5_KDB_NOENTRY: code_string = "KRB5_KDB_NOENTRY"; break; -- case KRB5_KDB_ILL_WILDCARD: code_string = "KRB5_KDB_ILL_WILDCARD"; break; -- case KRB5_KDB_DB_INUSE: code_string = "KRB5_KDB_DB_INUSE"; break; -- case KRB5_KDB_DB_CHANGED: code_string = "KRB5_KDB_DB_CHANGED"; break; -- case KRB5_KDB_TRUNCATED_RECORD: -- code_string = "KRB5_KDB_TRUNCATED_RECORD"; break; -- case KRB5_KDB_RECURSIVELOCK: -- code_string = "KRB5_KDB_RECURSIVELOCK"; break; -- case KRB5_KDB_NOTLOCKED: code_string = "KRB5_KDB_NOTLOCKED"; break; -- case KRB5_KDB_BADLOCKMODE: code_string = "KRB5_KDB_BADLOCKMODE"; break; -- case KRB5_KDB_DBNOTINITED: code_string = "KRB5_KDB_DBNOTINITED"; break; -- case KRB5_KDB_DBINITED: code_string = "KRB5_KDB_DBINITED"; break; -- case KRB5_KDB_ILLDIRECTION: code_string = "KRB5_KDB_ILLDIRECTION"; break; -- case KRB5_KDB_NOMASTERKEY: code_string = "KRB5_KDB_NOMASTERKEY"; break; -- case KRB5_KDB_BADMASTERKEY: code_string = "KRB5_KDB_BADMASTERKEY"; break; -- case KRB5_KDB_INVALIDKEYSIZE: -- code_string = "KRB5_KDB_INVALIDKEYSIZE"; break; -- case KRB5_KDB_CANTREAD_STORED: -- code_string = "KRB5_KDB_CANTREAD_STORED"; break; -- case KRB5_KDB_BADSTORED_MKEY: -- code_string = "KRB5_KDB_BADSTORED_MKEY"; break; -- case KRB5_KDB_CANTLOCK_DB: code_string = "KRB5_KDB_CANTLOCK_DB"; break; -- case KRB5_KDB_DB_CORRUPT: code_string = "KRB5_KDB_DB_CORRUPT"; break; -- -- case KRB5_PARSE_ILLCHAR: code_string = "KRB5_PARSE_ILLCHAR"; break; -- case KRB5_PARSE_MALFORMED: code_string = "KRB5_PARSE_MALFORMED"; break; -- case KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN: code_string = "KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN"; break; -- case KRB5_REALM_UNKNOWN: code_string = "KRB5_REALM_UNKNOWN"; break; -- case KRB5_KDC_UNREACH: code_string = "KRB5_KDC_UNREACH"; break; -- case KRB5_KDCREP_MODIFIED: code_string = "KRB5_KDCREP_MODIFIED"; break; -- case KRB5KRB_AP_ERR_BAD_INTEGRITY: code_string = "KRB5KRB_AP_ERR_BAD_INTEGRITY"; break; -- case KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN: code_string = "KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN"; break; -- case KRB5_CONFIG_BADFORMAT: code_string = "KRB5_CONFIG_BADFORMAT"; break; -- -- case KRB5_CC_NOTFOUND: code_string = "KRB5_CC_NOTFOUND"; break; -- case KRB5_FCC_NOFILE: code_string = "KRB5_FCC_NOFILE"; break; -- -- case EINVAL: code_string = "EINVAL"; break; -- case ENOENT: code_string = "ENOENT"; break; -- -- default: -- fprintf(stderr, "**** CODE %ld (%s) ***\n", (long) code, -- error_message (code)); -- code_string = "UNKNOWN"; -- break; -- } -- -- error_string = error_message(code); -- -- if (! (dstring = (Tcl_DString *) malloc(sizeof(Tcl_DString)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX Do we really want to exit? Ok if this is */ -- /* just a test program, but what about if it gets */ -- /* used for other things later? */ -- } -- -- Tcl_DStringInit(dstring); -- -- if (! (Tcl_DStringAppendElement(dstring, "ERROR") && -- Tcl_DStringAppendElement(dstring, code_string) && -- Tcl_DStringAppendElement(dstring, error_string))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- return dstring; --} -- -- -- --static void stash_error(Tcl_Interp *interp, krb5_error_code code) --{ -- Tcl_DString *dstring = unparse_err(code); -- Tcl_DStringResult(interp, dstring); -- Tcl_DStringFree(dstring); -- free(dstring); --} -- --static Tcl_DString *unparse_key_data(krb5_key_data *key_data, int n_key_data) --{ -- Tcl_DString *str; -- char buf[2048]; -- int i, j; -- -- if (! (str = malloc(sizeof(*str)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- Tcl_DStringInit(str); -- for (i = 0; i < n_key_data; i++) { -- krb5_key_data *key = &key_data[i]; -- -- Tcl_DStringStartSublist(str); -- sprintf(buf, "%d", key->key_data_type[0]); -- Tcl_DStringAppendElement(str, buf); -- sprintf(buf, "%d", key->key_data_ver > 1 ? -- key->key_data_type[1] : -1); -- Tcl_DStringAppendElement(str, buf); -- if (key->key_data_contents[0]) { -- sprintf(buf, "0x"); -- for (j = 0; j < key->key_data_length[0]; j++) { -- sprintf(buf + 2*(j+1), "%02x", -- key->key_data_contents[0][j]); -- } -- } else *buf = '\0'; -- Tcl_DStringAppendElement(str, buf); -- Tcl_DStringEndSublist(str); -- } -- -- return str; --} -- --static Tcl_DString *unparse_tl_data(krb5_tl_data *tl_data, int n_tl_data) --{ -- Tcl_DString *str; -- char buf[2048]; -- -- if (! (str = malloc(sizeof(*str)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- Tcl_DStringInit(str); -- Tcl_DStringStartSublist(str); -- for (; tl_data; tl_data = tl_data->tl_data_next) { -- Tcl_DStringStartSublist(str); -- sprintf(buf, "%d", tl_data->tl_data_type); -- Tcl_DStringAppendElement(str, buf); -- sprintf(buf, "%d", tl_data->tl_data_length); -- Tcl_DStringAppendElement(str, buf); -- Tcl_DStringAppend(str, " ", 1); -- Tcl_DStringAppend(str, (char *) tl_data->tl_data_contents, -- tl_data->tl_data_length); -- Tcl_DStringEndSublist(str); -- } -- Tcl_DStringEndSublist(str); -- -- return str; --} -- --static Tcl_DString *unparse_flags(struct flagval *array, int size, -- krb5_int32 flags) --{ -- int i; -- Tcl_DString *str; -- -- if (! (str = malloc(sizeof(*str)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- Tcl_DStringInit(str); -- -- for (i = 0; i < size; i++) { -- if (flags & array[i].val) { -- Tcl_DStringAppendElement(str, array[i].name); -- } -- } -- -- return str; --} -- -- --static int parse_flags(Tcl_Interp *interp, Tcl_HashTable *table, -- struct flagval *array, int size, const char *str, -- krb5_flags *flags) --{ -- int tmp, argc, i, retcode = TCL_OK; -- const char **argv; -- Tcl_HashEntry *entry; -- -- if (Tcl_GetInt(interp, str, &tmp) == TCL_OK) { -- *flags = tmp; -- return TCL_OK; -- } -- Tcl_ResetResult(interp); -- -- if (Tcl_SplitList(interp, str, &argc, &argv) != TCL_OK) { -- return TCL_ERROR; -- } -- -- if (! table) { -- table = create_flag_table(array, size); -- } -- -- *flags = 0; -- -- for (i = 0; i < argc; i++) { -- if (! (entry = Tcl_FindHashEntry(table, argv[i]))) { -- Tcl_AppendResult(interp, "unknown krb5 flag ", argv[i], 0); -- retcode = TCL_ERROR; -- break; -- } -- *flags |= *(krb5_flags *) Tcl_GetHashValue(entry); -- } -- -- Tcl_Free((char *) argv); -- return(retcode); --} -- --static Tcl_DString *unparse_privs(krb5_flags flags) --{ -- return unparse_flags(priv_flags, sizeof(priv_flags) / -- sizeof(struct flagval), flags); --} -- -- --static Tcl_DString *unparse_krb5_flags(krb5_flags flags) --{ -- return unparse_flags(krb5_flags_array, sizeof(krb5_flags_array) / -- sizeof(struct flagval), flags); --} -- --static int parse_krb5_flags(Tcl_Interp *interp, const char *str, -- krb5_flags *flags) --{ -- krb5_flags tmp; -- static Tcl_HashTable *table = 0; -- int tcl_ret; -- -- if ((tcl_ret = parse_flags(interp, table, krb5_flags_array, -- sizeof(krb5_flags_array) / -- sizeof(struct flagval), -- str, &tmp)) != TCL_OK) { -- return tcl_ret; -- } -- -- *flags = tmp; -- return TCL_OK; --} -- --static Tcl_DString *unparse_aux_attributes(krb5_int32 flags) --{ -- return unparse_flags(aux_attributes, sizeof(aux_attributes) / -- sizeof(struct flagval), flags); --} -- -- --static int parse_aux_attributes(Tcl_Interp *interp, const char *str, -- long *flags) --{ -- krb5_flags tmp; -- static Tcl_HashTable *table = 0; -- int tcl_ret; -- -- if ((tcl_ret = parse_flags(interp, table, aux_attributes, -- sizeof(aux_attributes) / -- sizeof(struct flagval), -- str, &tmp)) != TCL_OK) { -- return tcl_ret; -- } -- -- *flags = tmp; -- return TCL_OK; --} -- --static int parse_principal_mask(Tcl_Interp *interp, const char *str, -- krb5_int32 *flags) --{ -- krb5_flags tmp; -- static Tcl_HashTable *table = 0; -- int tcl_ret; -- -- if ((tcl_ret = parse_flags(interp, table, principal_mask_flags, -- sizeof(principal_mask_flags) / -- sizeof(struct flagval), -- str, &tmp)) != TCL_OK) { -- return tcl_ret; -- } -- -- *flags = tmp; -- return TCL_OK; --} -- --static int parse_policy_mask(Tcl_Interp *interp, const char *str, -- krb5_int32 *flags) --{ -- krb5_flags tmp; -- static Tcl_HashTable *table = 0; -- int tcl_ret; -- -- if ((tcl_ret = parse_flags(interp, table, policy_mask_flags, -- sizeof(policy_mask_flags) / -- sizeof(struct flagval), -- str, &tmp)) != TCL_OK) { -- return tcl_ret; -- } -- -- *flags = tmp; -- return TCL_OK; --} -- -- --static Tcl_DString *unparse_principal_ent(kadm5_principal_ent_t princ, -- krb5_int32 mask) --{ -- Tcl_DString *str, *tmp_dstring; -- char *tmp; -- char buf[20]; -- krb5_error_code krb5_ret; -- -- if (! (str = malloc(sizeof(*str)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- Tcl_DStringInit(str); -- -- tmp = 0; /* It looks to me from looking at the library source */ -- /* code for krb5_parse_name that the pointer passed into */ -- /* it should be initialized to 0 if I want it do be */ -- /* allocated automatically. */ -- if (mask & KADM5_PRINCIPAL) { -- krb5_ret = krb5_unparse_name(context, princ->principal, &tmp); -- if (krb5_ret) { -- /* XXX Do we want to return an error? Not sure. */ -- Tcl_DStringAppendElement(str, "[unparsable principal]"); -- } -- else { -- Tcl_DStringAppendElement(str, tmp); -- free(tmp); -- } -- } else -- Tcl_DStringAppendElement(str, "null"); -- -- sprintf(buf, "%u", (unsigned int)princ->princ_expire_time); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%u", (unsigned int)princ->last_pwd_change); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%u", (unsigned int)princ->pw_expiration); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%d", princ->max_life); -- Tcl_DStringAppendElement(str, buf); -- -- tmp = 0; -- if (mask & KADM5_MOD_NAME) { -- if ((krb5_ret = krb5_unparse_name(context, princ->mod_name, &tmp))) { -- /* XXX */ -- Tcl_DStringAppendElement(str, "[unparsable principal]"); -- } -- else { -- Tcl_DStringAppendElement(str, tmp); -- free(tmp); -- } -- } else -- Tcl_DStringAppendElement(str, "null"); -- -- sprintf(buf, "%u", (unsigned int)princ->mod_date); -- Tcl_DStringAppendElement(str, buf); -- -- if (mask & KADM5_ATTRIBUTES) { -- tmp_dstring = unparse_krb5_flags(princ->attributes); -- Tcl_DStringAppendElement(str, tmp_dstring->string); -- Tcl_DStringFree(tmp_dstring); -- free(tmp_dstring); -- } else -- Tcl_DStringAppendElement(str, "null"); -- -- sprintf(buf, "%d", princ->kvno); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%d", princ->mkvno); -- Tcl_DStringAppendElement(str, buf); -- -- /* XXX This may be dangerous, because the contents of the policy */ -- /* field are undefined if the POLICY bit isn't set. However, I */ -- /* think it's a bug for the field not to be null in that case */ -- /* anyway, so we should assume that it will be null so that we'll */ -- /* catch it if it isn't. */ -- -- tmp_dstring = unparse_str(princ->policy); -- Tcl_DStringAppendElement(str, tmp_dstring->string); -- Tcl_DStringFree(tmp_dstring); -- free(tmp_dstring); -- -- tmp_dstring = unparse_aux_attributes(princ->aux_attributes); -- Tcl_DStringAppendElement(str, tmp_dstring->string); -- Tcl_DStringFree(tmp_dstring); -- free(tmp_dstring); -- -- sprintf(buf, "%d", princ->max_renewable_life); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%u", (unsigned int)princ->last_success); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%u", (unsigned int)princ->last_failed); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%d", princ->fail_auth_count); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%d", princ->n_key_data); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%d", princ->n_tl_data); -- Tcl_DStringAppendElement(str, buf); -- -- tmp_dstring = unparse_key_data(princ->key_data, princ->n_key_data); -- Tcl_DStringAppendElement(str, tmp_dstring->string); -- Tcl_DStringFree(tmp_dstring); -- free(tmp_dstring); -- -- tmp_dstring = unparse_tl_data(princ->tl_data, princ->n_tl_data); -- Tcl_DStringAppendElement(str, tmp_dstring->string); -- Tcl_DStringFree(tmp_dstring); -- free(tmp_dstring); -- -- return str; --} -- --static int parse_keysalts(Tcl_Interp *interp, const char *list, -- krb5_key_salt_tuple **keysalts, -- int num_keysalts) --{ -- const char **argv, **argv1 = NULL; -- int i, tmp, argc, argc1, retcode; -- -- *keysalts = NULL; -- if (list == NULL) -- return TCL_OK; -- -- if ((retcode = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) { -- return retcode; -- } -- if (argc != num_keysalts) { -- Tcl_SetResult(interp, "wrong number of keysalts", TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } -- *keysalts = (krb5_key_salt_tuple *) -- malloc(sizeof(krb5_key_salt_tuple)*num_keysalts); -- for (i = 0; i < num_keysalts; i++) { -- if ((retcode = Tcl_SplitList(interp, argv[i], &argc1, &argv1)) != -- TCL_OK) { -- goto finished; -- } -- if (argc1 != 2) { -- Tcl_SetResult(interp, "wrong # of fields in keysalt", TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } -- /* XXX this used to be argv1[1] too! */ -- if ((retcode = Tcl_GetInt(interp, argv1[0], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing ks_enctype"); -- retcode = TCL_ERROR; -- goto finished; -- } -- (*keysalts)[i].ks_enctype = tmp; -- if ((retcode = Tcl_GetInt(interp, argv1[1], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing ks_salttype"); -- goto finished; -- } -- (*keysalts)[i].ks_salttype = tmp; -- -- Tcl_Free((char *) argv1); -- argv1 = NULL; -- } -- --finished: -- if (argv1) { -- Tcl_Free((char *) argv1); -- } -- Tcl_Free((char *) argv); -- return retcode; --} -- --static int parse_key_data(Tcl_Interp *interp, const char *list, -- krb5_key_data **key_data, -- int n_key_data) --{ -- const char **argv = NULL; -- int argc, retcode; -- -- *key_data = NULL; -- if (list == NULL) { -- if (n_key_data != 0) { -- Tcl_SetResult(interp, "wrong number of key_datas", TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } else -- return TCL_OK; -- } -- -- if ((retcode = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) { -- return retcode; -- } -- if (argc != n_key_data) { -- Tcl_SetResult(interp, "wrong number of key_datas", TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- if (argc != 0) { -- Tcl_SetResult(interp, "cannot parse key_data yet", TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } -- --finished: -- Tcl_Free((char *) argv); -- return retcode; --} -- --static int parse_tl_data(Tcl_Interp *interp, const char *list, -- krb5_tl_data **tlp, -- int n_tl_data) --{ -- krb5_tl_data *tl, *tl2; -- const char **argv = NULL, **argv1 = NULL; -- int i, tmp, argc, argc1, retcode; -- -- *tlp = NULL; -- if (list == NULL) { -- if (n_tl_data != 0) { -- Tcl_SetResult(interp, "wrong number of tl_datas", TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } else -- return TCL_OK; -- } -- -- if ((retcode = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) { -- return retcode; -- } -- if (argc != n_tl_data) { -- Tcl_SetResult(interp, "wrong number of tl_datas", TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- tl = tl2 = NULL; -- for (i = 0; i < n_tl_data; i++) { -- tl2 = (krb5_tl_data *) malloc(sizeof(krb5_tl_data)); -- memset(tl2, 0, sizeof(krb5_tl_data)); -- tl2->tl_data_next = tl; -- tl = tl2; -- } -- tl2 = tl; -- -- for (i = 0; i < n_tl_data; i++) { -- if ((retcode = Tcl_SplitList(interp, argv[i], &argc1, &argv1)) != -- TCL_OK) { -- goto finished; -- } -- if (argc1 != 3) { -- Tcl_SetResult(interp, "wrong # of fields in tl_data", TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } -- if ((retcode = Tcl_GetInt(interp, argv1[0], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing tl_data_type"); -- retcode = TCL_ERROR; -- goto finished; -- } -- tl->tl_data_type = tmp; -- if ((retcode = Tcl_GetInt(interp, argv1[1], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing tl_data_length"); -- retcode = TCL_ERROR; -- goto finished; -- } -- tl->tl_data_length = tmp; -- if (tl->tl_data_length != strlen(argv1[2])) { -- Tcl_SetResult(interp, "length != string length", TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } -- tl->tl_data_contents = (krb5_octet *) strdup(argv1[2]); -- -- Tcl_Free((char *) argv1); -- argv1 = NULL; -- tl = tl->tl_data_next; -- } -- if (tl != NULL) { -- Tcl_SetResult(interp, "tl is not NULL!", TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } -- *tlp = tl2; -- --finished: -- if (argv1) { -- Tcl_Free((char *) argv1); -- } -- Tcl_Free((char *) argv); -- return retcode; --} -- --static int parse_config_params(Tcl_Interp *interp, char *list, -- kadm5_config_params *params) --{ -- static Tcl_HashTable *table = 0; -- const char **argv = NULL; -- int tmp, argc, retcode; -- -- memset(params, 0, sizeof(kadm5_config_params)); -- if (list == NULL) -- return TCL_OK; -- -- if ((retcode = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) { -- return retcode; -- } -- -- if (argc != 20) { -- Tcl_SetResult(interp, "wrong # args in config params structure", -- TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- if ((retcode = parse_flags(interp, table, config_mask_flags, -- sizeof(config_mask_flags) / -- sizeof(struct flagval), -- argv[0], &tmp)) != TCL_OK) { -- goto finished; -- } -- params->mask = tmp; -- -- if ((retcode = parse_str(interp, argv[1], ¶ms->realm)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing realm name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- if ((retcode = Tcl_GetInt(interp, argv[2], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing kadmind_port"); -- retcode = TCL_ERROR; -- goto finished; -- } -- params->kadmind_port = tmp; -- if ((retcode = parse_str(interp, argv[3], ¶ms->admin_server)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing profile name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- if ((retcode = parse_str(interp, argv[4], ¶ms->dbname)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing profile name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- /* Ignore argv[5], which used to set the admin_dbname field. */ -- /* Ignore argv[6], which used to set the admin_lockfile field. */ -- /* Ignore argv[7], which used to set the admin_keytab field. */ -- if ((retcode = parse_str(interp, argv[8], ¶ms->acl_file)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing acl_file name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- if ((retcode = parse_str(interp, argv[9], ¶ms->dict_file)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing dict_file name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- if ((retcode = Tcl_GetInt(interp, argv[10], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing mkey_from_kbd"); -- retcode = TCL_ERROR; -- goto finished; -- } -- params->mkey_from_kbd = tmp; -- if ((retcode = parse_str(interp, argv[11], ¶ms->stash_file)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing stash_file name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- if ((retcode = parse_str(interp, argv[12], ¶ms->mkey_name)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing mkey_name name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- if ((retcode = Tcl_GetInt(interp, argv[13], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing enctype"); -- retcode = TCL_ERROR; -- goto finished; -- } -- params->enctype = tmp; -- if ((retcode = Tcl_GetInt(interp, argv[14], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing max_life"); -- retcode = TCL_ERROR; -- goto finished; -- } -- params->max_life = tmp; -- if ((retcode = Tcl_GetInt(interp, argv[15], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing max_rlife"); -- retcode = TCL_ERROR; -- goto finished; -- } -- params->max_rlife = tmp; -- if ((retcode = Tcl_GetInt(interp, argv[16], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing expiration"); -- retcode = TCL_ERROR; -- goto finished; -- } -- params->expiration = tmp; -- if ((retcode = parse_krb5_flags(interp, argv[17], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing flags"); -- retcode = TCL_ERROR; -- goto finished; -- } -- params->flags = tmp; -- if ((retcode = Tcl_GetInt(interp, argv[18], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing num_keysalts"); -- retcode = TCL_ERROR; -- goto finished; -- } -- params->num_keysalts = tmp; -- if ((retcode = parse_keysalts(interp, argv[19], ¶ms->keysalts, -- params->num_keysalts)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing keysalts"); -- retcode = TCL_ERROR; -- goto finished; -- } -- --finished: -- return retcode; --} -- --static int parse_principal_ent(Tcl_Interp *interp, char *list, -- kadm5_principal_ent_t *out_princ) --{ -- kadm5_principal_ent_t princ = 0; -- krb5_error_code krb5_ret; -- int tcl_ret; -- int argc; -- const char **argv; -- int tmp; -- int retcode = TCL_OK; -- -- if ((tcl_ret = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) { -- return tcl_ret; -- } -- -- if (argc != 12 && argc != 20) { -- Tcl_SetResult(interp, "wrong # args in principal structure", -- TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- if (! (princ = malloc(sizeof *princ))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- memset(princ, 0, sizeof(*princ)); -- -- if ((krb5_ret = krb5_parse_name(context, argv[0], &princ->principal)) != 0) { -- stash_error(interp, krb5_ret); -- Tcl_AppendElement(interp, "while parsing principal"); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- /* -- * All of the numerical values parsed here are parsed into an -- * "int" and then assigned into the structure in case the actual -- * width of the field in the Kerberos structure is different from -- * the width of an integer. -- */ -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[1], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing princ_expire_time"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->princ_expire_time = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[2], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing last_pwd_change"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->last_pwd_change = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[3], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing pw_expiration"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->pw_expiration = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[4], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing max_life"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->max_life = tmp; -- -- if ((krb5_ret = krb5_parse_name(context, argv[5], &princ->mod_name)) != 0) { -- stash_error(interp, krb5_ret); -- Tcl_AppendElement(interp, "while parsing mod_name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[6], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing mod_date"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->mod_date = tmp; -- -- if ((tcl_ret = parse_krb5_flags(interp, argv[7], &princ->attributes)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing attributes"); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[8], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing kvno"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->kvno = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[9], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing mkvno"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->mkvno = tmp; -- -- if ((tcl_ret = parse_str(interp, argv[10], &princ->policy)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing policy"); -- retcode = TCL_ERROR; -- goto finished; -- } -- if(princ->policy != NULL) { -- if(!(princ->policy = strdup(princ->policy))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); -- } -- } -- -- if ((tcl_ret = parse_aux_attributes(interp, argv[11], -- &princ->aux_attributes)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing aux_attributes"); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- if (argc == 12) goto finished; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[12], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing max_renewable_life"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->max_renewable_life = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[13], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing last_success"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->last_success = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[14], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing last_failed"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->last_failed = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[15], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing fail_auth_count"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->fail_auth_count = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[16], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing n_key_data"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->n_key_data = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[17], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing n_tl_data"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->n_tl_data = tmp; -- -- if ((tcl_ret = parse_key_data(interp, argv[18], -- &princ->key_data, -- princ->n_key_data)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing key_data"); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- if ((tcl_ret = parse_tl_data(interp, argv[19], -- &princ->tl_data, -- princ->n_tl_data)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing tl_data"); -- retcode = TCL_ERROR; -- goto finished; -- } -- princ->n_tl_data = tmp; -- --finished: -- Tcl_Free((char *) argv); -- *out_princ = princ; -- return retcode; --} -- -- --static void free_principal_ent(kadm5_principal_ent_t *princ) --{ -- krb5_free_principal(context, (*princ)->principal); -- krb5_free_principal(context, (*princ)->mod_name); -- free((*princ)->policy); -- free(*princ); -- *princ = 0; --} -- --static Tcl_DString *unparse_policy_ent(kadm5_policy_ent_t policy) --{ -- Tcl_DString *str, *tmp_dstring; -- char buf[20]; -- -- if (! (str = malloc(sizeof(*str)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- Tcl_DStringInit(str); -- -- tmp_dstring = unparse_str(policy->policy); -- Tcl_DStringAppendElement(str, tmp_dstring->string); -- Tcl_DStringFree(tmp_dstring); -- free(tmp_dstring); -- -- sprintf(buf, "%ld", policy->pw_min_life); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%ld", policy->pw_max_life); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%ld", policy->pw_min_length); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%ld", policy->pw_min_classes); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%ld", policy->pw_history_num); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%ld", policy->policy_refcnt); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%d", policy->pw_max_fail); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%d", policy->pw_failcnt_interval); -- Tcl_DStringAppendElement(str, buf); -- -- sprintf(buf, "%d", policy->pw_lockout_duration); -- Tcl_DStringAppendElement(str, buf); -- -- return str; --} -- -- -- --static int parse_policy_ent(Tcl_Interp *interp, char *list, -- kadm5_policy_ent_t *out_policy) --{ -- kadm5_policy_ent_t policy = 0; -- int tcl_ret; -- int argc; -- const char **argv; -- int tmp; -- int retcode = TCL_OK; -- -- if ((tcl_ret = Tcl_SplitList(interp, list, &argc, &argv)) != TCL_OK) { -- return tcl_ret; -- } -- -- if (argc != 7 && argc != 10) { -- Tcl_SetResult(interp, "wrong # args in policy structure", TCL_STATIC); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- if (! (policy = malloc(sizeof *policy))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- if ((tcl_ret = parse_str(interp, argv[0], &policy->policy)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing policy name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- if(policy->policy != NULL) { -- if (! (policy->policy = strdup(policy->policy))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- } -- -- /* -- * All of the numerical values parsed here are parsed into an -- * "int" and then assigned into the structure in case the actual -- * width of the field in the Kerberos structure is different from -- * the width of an integer. -- */ -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[1], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing pw_min_life"); -- retcode = TCL_ERROR; -- goto finished; -- } -- policy->pw_min_life = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[2], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing pw_max_life"); -- retcode = TCL_ERROR; -- goto finished; -- } -- policy->pw_max_life = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[3], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing pw_min_length"); -- retcode = TCL_ERROR; -- goto finished; -- } -- policy->pw_min_length = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[4], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing pw_min_classes"); -- retcode = TCL_ERROR; -- goto finished; -- } -- policy->pw_min_classes = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[5], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing pw_history_num"); -- retcode = TCL_ERROR; -- goto finished; -- } -- policy->pw_history_num = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[6], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing policy_refcnt"); -- retcode = TCL_ERROR; -- goto finished; -- } -- policy->policy_refcnt = tmp; -- -- if (argc == 7) goto finished; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[7], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing pw_max_fail"); -- retcode = TCL_ERROR; -- goto finished; -- } -- policy->pw_max_fail = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[8], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing pw_failcnt_interval"); -- retcode = TCL_ERROR; -- goto finished; -- } -- policy->pw_failcnt_interval = tmp; -- -- if ((tcl_ret = Tcl_GetInt(interp, argv[9], &tmp)) -- != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing pw_lockout_duration"); -- retcode = TCL_ERROR; -- goto finished; -- } -- policy->pw_lockout_duration = tmp; -- --finished: -- Tcl_Free((char *) argv); -- *out_policy = policy; -- return retcode; --} -- -- --static void free_policy_ent(kadm5_policy_ent_t *policy) --{ -- free((*policy)->policy); -- free(*policy); -- *policy = 0; --} -- --static Tcl_DString *unparse_keytype(krb5_enctype enctype) --{ -- Tcl_DString *str; -- char buf[50]; -- -- if (! (str = malloc(sizeof(*str)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- Tcl_DStringInit(str); -- -- switch (enctype) { -- /* XXX is this right? */ -- case ENCTYPE_NULL: Tcl_DStringAppend(str, "ENCTYPE_NULL", -1); break; -- default: -- sprintf(buf, "UNKNOWN KEYTYPE (0x%x)", enctype); -- Tcl_DStringAppend(str, buf, -1); -- break; -- } -- -- return str; --} -- -- --static Tcl_DString *unparse_keyblocks(krb5_keyblock *keyblocks, int num_keys) --{ -- Tcl_DString *str; -- Tcl_DString *keytype; -- unsigned int i; -- int j; -- -- if (! (str = malloc(sizeof(*str)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- -- Tcl_DStringInit(str); -- -- for (j = 0; j < num_keys; j++) { -- krb5_keyblock *keyblock = &keyblocks[j]; -- -- Tcl_DStringStartSublist(str); -- -- keytype = unparse_keytype(keyblock->enctype); -- Tcl_DStringAppendElement(str, keytype->string); -- Tcl_DStringFree(keytype); -- free(keytype); -- if (keyblock->length == 0) { -- Tcl_DStringAppendElement(str, "0x00"); -- } -- else { -- Tcl_DStringAppendElement(str, "0x"); -- for (i = 0; i < keyblock->length; i++) { -- char buf[3]; -- sprintf(buf, "%02x", (int) keyblock->contents[i]); -- Tcl_DStringAppend(str, buf, -1); -- } -- } -- -- Tcl_DStringEndSublist(str); -- } -- -- -- return str; --} -- --enum init_type { INIT_NONE, INIT_PASS, INIT_CREDS }; -- --static int _tcl_kadm5_init_any(enum init_type init_type, ClientData clientData, -- Tcl_Interp *interp, int argc, const char *argv[]) --{ -- kadm5_ret_t ret; -- char *client_name, *pass, *service_name; -- int tcl_ret; -- krb5_ui_4 struct_version, api_version; -- const char *handle_var; -- void *server_handle; -- char *handle_name, *params_str; -- const char *whoami = argv[0]; -- kadm5_config_params params; -- -- argv++, argc--; -- -- kadm5_init_krb5_context(&context); -- -- if (argc != 7) { -- Tcl_AppendResult(interp, whoami, ": ", arg_error, 0); -- return TCL_ERROR; -- } -- -- if (((tcl_ret = parse_str(interp, argv[0], &client_name)) != TCL_OK) || -- ((tcl_ret = parse_str(interp, argv[1], &pass)) != TCL_OK) || -- ((tcl_ret = parse_str(interp, argv[2], &service_name)) != TCL_OK) || -- ((tcl_ret = parse_str(interp, argv[3], ¶ms_str)) != TCL_OK) || -- ((tcl_ret = parse_config_params(interp, params_str, ¶ms)) -- != TCL_OK) || -- ((tcl_ret = Tcl_GetInt(interp, argv[4], (int *) &struct_version)) != -- TCL_OK) || -- ((tcl_ret = Tcl_GetInt(interp, argv[5], (int *) &api_version)) != -- TCL_OK)) { -- return tcl_ret; -- } -- -- handle_var = argv[6]; -- -- if (! (handle_var && *handle_var)) { -- Tcl_SetResult(interp, "must specify server handle variable name", -- TCL_STATIC); -- return TCL_ERROR; -- } -- -- if (init_type == INIT_CREDS) { -- krb5_ccache cc; -- -- if (pass == NULL) { -- if ((ret = krb5_cc_default(context, &cc))) { -- stash_error(interp, ret); -- return TCL_ERROR; -- } -- } else { -- if ((ret = krb5_cc_resolve(context, pass, &cc))) { -- stash_error(interp, ret); -- return TCL_ERROR; -- } -- } -- -- ret = kadm5_init_with_creds(context, client_name, cc, service_name, -- ¶ms, struct_version, -- api_version, NULL, &server_handle); -- -- (void) krb5_cc_close(context, cc); -- } else -- ret = kadm5_init(context, client_name, pass, service_name, ¶ms, -- struct_version, api_version, NULL, &server_handle); -- -- /* The string fields of params are aliases into argv[3], but -- * params.keysalts is allocated, so clean it up. */ -- free(params.keysalts); -- -- if (ret != KADM5_OK) { -- stash_error(interp, ret); -- return TCL_ERROR; -- } -- -- if ((tcl_ret = put_server_handle(interp, server_handle, &handle_name)) -- != TCL_OK) { -- return tcl_ret; -- } -- -- if (! Tcl_SetVar(interp, handle_var, handle_name, TCL_LEAVE_ERR_MSG)) { -- return TCL_ERROR; -- } -- -- set_ok(interp, "KADM5 API initialized."); -- return TCL_OK; --} -- --static int tcl_kadm5_init(ClientData clientData, Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- return _tcl_kadm5_init_any(INIT_PASS, clientData, interp, argc, argv); --} -- --static int tcl_kadm5_init_with_creds(ClientData clientData, Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- return _tcl_kadm5_init_any(INIT_CREDS, clientData, interp, argc, argv); --} -- --static int tcl_kadm5_destroy(ClientData clientData, Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- kadm5_ret_t ret; -- int tcl_ret; -- -- GET_HANDLE(0, 0); -- -- ret = kadm5_destroy(server_handle); -- -- if (ret != KADM5_OK) { -- stash_error(interp, ret); -- return TCL_ERROR; -- } -- -- if ((tcl_ret = remove_server_handle(interp, argv[-1])) != TCL_OK) { -- return tcl_ret; -- } -- -- set_ok(interp, "KADM5 API deinitialized."); -- return TCL_OK; --} -- --static int tcl_kadm5_create_principal(ClientData clientData, -- Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- int tcl_ret; -- kadm5_ret_t ret; -- int retcode = TCL_OK; -- char *princ_string; -- kadm5_principal_ent_t princ = 0; -- krb5_int32 mask; -- char *pw; --#ifdef OVERRIDE -- int override_qual; --#endif -- -- GET_HANDLE(3, 0); -- -- if ((tcl_ret = parse_str(interp, argv[0], &princ_string)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing principal"); -- return tcl_ret; -- } -- -- if (princ_string && -- ((tcl_ret = parse_principal_ent(interp, princ_string, &princ)) -- != TCL_OK)) { -- return tcl_ret; -- } -- -- if ((tcl_ret = parse_principal_mask(interp, argv[1], &mask)) != TCL_OK) { -- retcode = tcl_ret; -- goto finished; -- } -- -- if ((tcl_ret = parse_str(interp, argv[2], &pw)) != TCL_OK) { -- retcode = tcl_ret; -- goto finished; -- } --#ifdef OVERRIDE -- if ((tcl_ret = Tcl_GetBoolean(interp, argv[3], &override_qual)) != -- TCL_OK) { -- retcode = tcl_ret; -- goto finished; -- } --#endif -- --#ifdef OVERRIDE -- ret = kadm5_create_principal(server_handle, princ, mask, pw, -- override_qual); --#else -- ret = kadm5_create_principal(server_handle, princ, mask, pw); --#endif -- -- if (ret != KADM5_OK) { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- goto finished; -- } -- else { -- set_ok(interp, "Principal created."); -- } -- --finished: -- if (princ) { -- free_principal_ent(&princ); -- } -- return retcode; --} -- -- -- --static int tcl_kadm5_delete_principal(ClientData clientData, -- Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- krb5_principal princ; -- krb5_error_code krb5_ret; -- kadm5_ret_t ret; -- int tcl_ret; -- char *name; -- -- GET_HANDLE(1, 0); -- -- if((tcl_ret = parse_str(interp, argv[0], &name)) != TCL_OK) -- return tcl_ret; -- if(name != NULL) { -- if ((krb5_ret = krb5_parse_name(context, name, &princ))) { -- stash_error(interp, krb5_ret); -- Tcl_AppendElement(interp, "while parsing principal"); -- return TCL_ERROR; -- } -- } else princ = NULL; -- ret = kadm5_delete_principal(server_handle, princ); -- -- if(princ != NULL) -- krb5_free_principal(context, princ); -- -- if (ret != KADM5_OK) { -- stash_error(interp, ret); -- return TCL_ERROR; -- } -- else { -- set_ok(interp, "Principal deleted."); -- return TCL_OK; -- } --} -- -- -- --static int tcl_kadm5_modify_principal(ClientData clientData, -- Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- char *princ_string; -- kadm5_principal_ent_t princ = 0; -- int tcl_ret; -- krb5_int32 mask; -- int retcode = TCL_OK; -- kadm5_ret_t ret; -- -- GET_HANDLE(2, 0); -- -- if ((tcl_ret = parse_str(interp, argv[0], &princ_string)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing principal"); -- return tcl_ret; -- } -- -- if (princ_string && -- ((tcl_ret = parse_principal_ent(interp, princ_string, &princ)) -- != TCL_OK)) { -- return tcl_ret; -- } -- -- if ((tcl_ret = parse_principal_mask(interp, argv[1], &mask)) != TCL_OK) { -- retcode = TCL_ERROR; -- goto finished; -- } -- -- ret = kadm5_modify_principal(server_handle, princ, mask); -- -- if (ret != KADM5_OK) { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- } -- else { -- set_ok(interp, "Principal modified."); -- } -- --finished: -- if (princ) { -- free_principal_ent(&princ); -- } -- return retcode; --} -- -- --static int tcl_kadm5_rename_principal(ClientData clientData, -- Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- krb5_principal source, target; -- krb5_error_code krb5_ret; -- kadm5_ret_t ret; -- int retcode = TCL_OK; -- -- GET_HANDLE(2, 0); -- -- if ((krb5_ret = krb5_parse_name(context, argv[0], &source)) != 0) { -- stash_error(interp, krb5_ret); -- Tcl_AppendElement(interp, "while parsing source"); -- return TCL_ERROR; -- } -- -- if ((krb5_ret = krb5_parse_name(context, argv[1], &target)) != 0) { -- stash_error(interp, krb5_ret); -- Tcl_AppendElement(interp, "while parsing target"); -- krb5_free_principal(context, source); -- return TCL_ERROR; -- } -- -- ret = kadm5_rename_principal(server_handle, source, target); -- -- if (ret == KADM5_OK) { -- set_ok(interp, "Principal renamed."); -- } -- else { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- } -- -- krb5_free_principal(context, source); -- krb5_free_principal(context, target); -- return retcode; --} -- -- -- --static int tcl_kadm5_chpass_principal(ClientData clientData, -- Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- krb5_principal princ; -- char *pw; --#ifdef OVERRIDE -- int override_qual; --#endif -- krb5_error_code krb5_ret; -- int retcode = TCL_OK; -- kadm5_ret_t ret; -- -- GET_HANDLE(2, 0); -- -- if ((krb5_ret = krb5_parse_name(context, argv[0], &princ)) != 0) { -- stash_error(interp, krb5_ret); -- Tcl_AppendElement(interp, "while parsing principal name"); -- return TCL_ERROR; -- } -- -- if (parse_str(interp, argv[1], &pw) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing password"); -- retcode = TCL_ERROR; -- goto finished; -- } -- --#ifdef OVERRIDE -- if (Tcl_GetBoolean(interp, argv[2], &override_qual) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing override_qual"); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- ret = kadm5_chpass_principal(server_handle, -- princ, pw, override_qual); --#else -- ret = kadm5_chpass_principal(server_handle, princ, pw); --#endif -- -- if (ret == KADM5_OK) { -- set_ok(interp, "Password changed."); -- goto finished; -- } -- else { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- } -- --finished: -- krb5_free_principal(context, princ); -- return retcode; --} -- -- -- --static int tcl_kadm5_chpass_principal_util(ClientData clientData, -- Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- krb5_principal princ; -- char *new_pw; --#ifdef OVERRIDE -- int override_qual; --#endif -- char *pw_ret, *pw_ret_var; -- char msg_ret[1024], *msg_ret_var; -- krb5_error_code krb5_ret; -- kadm5_ret_t ret; -- int retcode = TCL_OK; -- -- GET_HANDLE(4, 0); -- -- if ((krb5_ret = krb5_parse_name(context, argv[0], &princ)) != 0) { -- stash_error(interp, krb5_ret); -- Tcl_AppendElement(interp, "while parsing principal name"); -- return TCL_ERROR; -- } -- -- if (parse_str(interp, argv[1], &new_pw) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing new password"); -- retcode = TCL_ERROR; -- goto finished; -- } --#ifdef OVERRIDE -- if (Tcl_GetBoolean(interp, argv[2], &override_qual) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing override_qual"); -- retcode = TCL_ERROR; -- goto finished; -- } --#endif -- if (parse_str(interp, argv[3], &pw_ret_var) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing pw_ret variable name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- if (parse_str(interp, argv[4], &msg_ret_var) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing msg_ret variable name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- ret = kadm5_chpass_principal_util(server_handle, princ, new_pw, --#ifdef OVERRIDE -- override_qual, --#endif -- pw_ret_var ? &pw_ret : 0, -- msg_ret_var ? msg_ret : 0, -- msg_ret_var ? sizeof(msg_ret) : 0); -- -- if (ret == KADM5_OK) { -- if (pw_ret_var && -- (! Tcl_SetVar(interp, pw_ret_var, pw_ret, -- TCL_LEAVE_ERR_MSG))) { -- Tcl_AppendElement(interp, "while setting pw_ret variable"); -- retcode = TCL_ERROR; -- goto finished; -- } -- if (msg_ret_var && -- (! Tcl_SetVar(interp, msg_ret_var, msg_ret, -- TCL_LEAVE_ERR_MSG))) { -- Tcl_AppendElement(interp, -- "while setting msg_ret variable"); -- retcode = TCL_ERROR; -- goto finished; -- } -- set_ok(interp, "Password changed."); -- } -- else { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- } -- --finished: -- krb5_free_principal(context, princ); -- return retcode; --} -- -- -- --static int tcl_kadm5_randkey_principal(ClientData clientData, -- Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- krb5_principal princ; -- krb5_keyblock *keyblocks; -- int num_keys; -- char *keyblock_var, *num_var, buf[50]; -- Tcl_DString *keyblock_dstring = 0; -- krb5_error_code krb5_ret; -- kadm5_ret_t ret; -- int retcode = TCL_OK; -- -- GET_HANDLE(3, 0); -- -- if ((krb5_ret = krb5_parse_name(context, argv[0], &princ)) != 0) { -- stash_error(interp, krb5_ret); -- Tcl_AppendElement(interp, "while parsing principal name"); -- return TCL_ERROR; -- } -- -- if (parse_str(interp, argv[1], &keyblock_var) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing keyblock variable name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- if (parse_str(interp, argv[2], &num_var) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing keyblock variable name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- ret = kadm5_randkey_principal(server_handle, -- princ, keyblock_var ? &keyblocks : 0, -- &num_keys); -- -- if (ret == KADM5_OK) { -- if (keyblock_var) { -- keyblock_dstring = unparse_keyblocks(keyblocks, num_keys); -- if (! Tcl_SetVar(interp, keyblock_var, -- keyblock_dstring->string, -- TCL_LEAVE_ERR_MSG)) { -- Tcl_AppendElement(interp, -- "while setting keyblock variable"); -- retcode = TCL_ERROR; -- goto finished; -- } -- } -- if (num_var) { -- sprintf(buf, "%d", num_keys); -- if (! Tcl_SetVar(interp, num_var, buf, -- TCL_LEAVE_ERR_MSG)) { -- Tcl_AppendElement(interp, -- "while setting num_keys variable"); -- } -- } -- set_ok(interp, "Key randomized."); -- } -- else { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- } -- --finished: -- krb5_free_principal(context, princ); -- if (keyblock_dstring) { -- Tcl_DStringFree(keyblock_dstring); -- free(keyblock_dstring); -- } -- return retcode; --} -- -- -- --static int tcl_kadm5_get_principal(ClientData clientData, Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- krb5_principal princ; -- kadm5_principal_ent_rec ent; -- Tcl_DString *ent_dstring = 0; -- char *ent_var; -- char *name; -- krb5_error_code krb5_ret; -- int tcl_ret; -- kadm5_ret_t ret = -1; -- krb5_int32 mask; -- int retcode = TCL_OK; -- -- GET_HANDLE(3, 1); -- -- if((tcl_ret = parse_str(interp, argv[0], &name)) != TCL_OK) -- return tcl_ret; -- if(name != NULL) { -- if ((krb5_ret = krb5_parse_name(context, name, &princ)) != 0) { -- stash_error(interp, krb5_ret); -- Tcl_AppendElement(interp, "while parsing principal name"); -- return TCL_ERROR; -- } -- } else princ = NULL; -- -- if ((tcl_ret = parse_str(interp, argv[1], &ent_var)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing entry variable name"); -- retcode = TCL_ERROR; -- goto finished; -- } -- if ((tcl_ret = parse_principal_mask(interp, argv[2], &mask)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing principal mask"); -- retcode = TCL_ERROR; -- goto finished; -- } -- -- ret = kadm5_get_principal(server_handle, princ, ent_var ? &ent : 0, -- mask); -- -- if (ret == KADM5_OK) { -- if (ent_var) { -- ent_dstring = unparse_principal_ent(&ent, mask); -- if (! Tcl_SetVar(interp, ent_var, ent_dstring->string, -- TCL_LEAVE_ERR_MSG)) { -- Tcl_AppendElement(interp, -- "while setting entry variable"); -- retcode = TCL_ERROR; -- goto finished; -- } -- set_ok(interp, "Principal retrieved."); -- } -- } -- else { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- } -- --finished: -- if (ent_dstring) { -- Tcl_DStringFree(ent_dstring); -- free(ent_dstring); -- } -- if(princ != NULL) -- krb5_free_principal(context, princ); -- if (ret == KADM5_OK && ent_var && -- (ret = kadm5_free_principal_ent(server_handle, &ent)) && -- (retcode == TCL_OK)) { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- } -- return retcode; --} -- --static int tcl_kadm5_create_policy(ClientData clientData, Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- int tcl_ret; -- kadm5_ret_t ret; -- int retcode = TCL_OK; -- char *policy_string; -- kadm5_policy_ent_t policy = 0; -- krb5_int32 mask; -- -- GET_HANDLE(2, 0); -- -- if ((tcl_ret = parse_str(interp, argv[0], &policy_string)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing policy"); -- return tcl_ret; -- } -- -- if (policy_string && -- ((tcl_ret = parse_policy_ent(interp, policy_string, &policy)) -- != TCL_OK)) { -- return tcl_ret; -- } -- -- if ((tcl_ret = parse_policy_mask(interp, argv[1], &mask)) != TCL_OK) { -- retcode = tcl_ret; -- goto finished; -- } -- -- ret = kadm5_create_policy(server_handle, policy, mask); -- -- if (ret != KADM5_OK) { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- goto finished; -- } -- else { -- set_ok(interp, "Policy created."); -- } -- --finished: -- if (policy) { -- free_policy_ent(&policy); -- } -- return retcode; --} -- -- -- --static int tcl_kadm5_delete_policy(ClientData clientData, Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- kadm5_ret_t ret; -- char *policy; -- -- GET_HANDLE(1, 0); -- -- if (parse_str(interp, argv[0], &policy) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing policy name"); -- return TCL_ERROR; -- } -- -- ret = kadm5_delete_policy(server_handle, policy); -- -- if (ret != KADM5_OK) { -- stash_error(interp, ret); -- return TCL_ERROR; -- } -- else { -- set_ok(interp, "Policy deleted."); -- return TCL_OK; -- } --} -- -- -- --static int tcl_kadm5_modify_policy(ClientData clientData, Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- char *policy_string; -- kadm5_policy_ent_t policy = 0; -- int tcl_ret; -- krb5_int32 mask; -- int retcode = TCL_OK; -- kadm5_ret_t ret; -- -- GET_HANDLE(2, 0); -- -- if ((tcl_ret = parse_str(interp, argv[0], &policy_string)) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing policy"); -- return tcl_ret; -- } -- -- if (policy_string && -- ((tcl_ret = parse_policy_ent(interp, policy_string, &policy)) -- != TCL_OK)) { -- return tcl_ret; -- } -- -- if ((tcl_ret = parse_policy_mask(interp, argv[1], &mask)) != TCL_OK) { -- retcode = TCL_ERROR; -- goto finished; -- } -- -- ret = kadm5_modify_policy(server_handle, policy, mask); -- -- if (ret != KADM5_OK) { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- } -- else { -- set_ok(interp, "Policy modified."); -- } -- --finished: -- if (policy) { -- free_policy_ent(&policy); -- } -- return retcode; --} -- -- --static int tcl_kadm5_get_policy(ClientData clientData, Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- kadm5_policy_ent_rec ent; -- Tcl_DString *ent_dstring = 0; -- char *policy; -- char *ent_var; -- kadm5_ret_t ret; -- int retcode = TCL_OK; -- -- GET_HANDLE(2, 1); -- -- if (parse_str(interp, argv[0], &policy) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing policy name"); -- return TCL_ERROR; -- } -- -- if (parse_str(interp, argv[1], &ent_var) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing entry variable name"); -- return TCL_ERROR; -- } -- -- ret = kadm5_get_policy(server_handle, policy, ent_var ? &ent : 0); -- -- if (ret == KADM5_OK) { -- if (ent_var) { -- ent_dstring = unparse_policy_ent(&ent); -- if (! Tcl_SetVar(interp, ent_var, ent_dstring->string, -- TCL_LEAVE_ERR_MSG)) { -- Tcl_AppendElement(interp, -- "while setting entry variable"); -- retcode = TCL_ERROR; -- goto finished; -- } -- set_ok(interp, "Policy retrieved."); -- } -- } -- else { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- } -- --finished: -- if (ent_dstring) { -- Tcl_DStringFree(ent_dstring); -- free(ent_dstring); -- } -- if (ent_var && ret == KADM5_OK && -- (ret = kadm5_free_policy_ent(server_handle, &ent)) && -- (retcode == TCL_OK)) { -- stash_error(interp, ret); -- retcode = TCL_ERROR; -- } -- return retcode; --} -- -- -- --static int tcl_kadm5_free_principal_ent(ClientData clientData, -- Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- char *ent_name; -- kadm5_principal_ent_t ent; -- kadm5_ret_t ret; -- -- GET_HANDLE(1, 0); -- -- if (parse_str(interp, argv[0], &ent_name) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing entry name"); -- return TCL_ERROR; -- } -- -- if ((! ent_name) && -- (ret = kadm5_free_principal_ent(server_handle, 0))) { -- stash_error(interp, ret); -- return TCL_ERROR; -- } -- else { -- Tcl_HashEntry *entry; -- -- if (strncmp(ent_name, "principal", sizeof("principal")-1)) { -- Tcl_AppendResult(interp, "invalid principal handle \"", -- ent_name, "\"", 0); -- return TCL_ERROR; -- } -- if (! struct_table) { -- if (! (struct_table = malloc(sizeof(*struct_table)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- Tcl_InitHashTable(struct_table, TCL_STRING_KEYS); -- } -- -- if (! (entry = Tcl_FindHashEntry(struct_table, ent_name))) { -- Tcl_AppendResult(interp, "principal handle \"", ent_name, -- "\" not found", 0); -- return TCL_ERROR; -- } -- -- ent = (kadm5_principal_ent_t) Tcl_GetHashValue(entry); -- -- ret = kadm5_free_principal_ent(server_handle, ent); -- if (ret != KADM5_OK) { -- stash_error(interp, ret); -- return TCL_ERROR; -- } -- Tcl_DeleteHashEntry(entry); -- } -- set_ok(interp, "Principal freed."); -- return TCL_OK; --} -- -- --static int tcl_kadm5_free_policy_ent(ClientData clientData, -- Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- char *ent_name; -- kadm5_policy_ent_t ent; -- kadm5_ret_t ret; -- -- GET_HANDLE(1, 0); -- -- if (parse_str(interp, argv[0], &ent_name) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing entry name"); -- return TCL_ERROR; -- } -- -- if ((! ent_name) && -- (ret = kadm5_free_policy_ent(server_handle, 0))) { -- stash_error(interp, ret); -- return TCL_ERROR; -- } -- else { -- Tcl_HashEntry *entry; -- -- if (strncmp(ent_name, "policy", sizeof("policy")-1)) { -- Tcl_AppendResult(interp, "invalid principal handle \"", -- ent_name, "\"", 0); -- return TCL_ERROR; -- } -- if (! struct_table) { -- if (! (struct_table = malloc(sizeof(*struct_table)))) { -- fprintf(stderr, "Out of memory!\n"); -- exit(1); /* XXX */ -- } -- Tcl_InitHashTable(struct_table, TCL_STRING_KEYS); -- } -- -- if (! (entry = Tcl_FindHashEntry(struct_table, ent_name))) { -- Tcl_AppendResult(interp, "policy handle \"", ent_name, -- "\" not found", 0); -- return TCL_ERROR; -- } -- -- ent = (kadm5_policy_ent_t) Tcl_GetHashValue(entry); -- -- if ((ret = kadm5_free_policy_ent(server_handle, ent)) != KADM5_OK) { -- stash_error(interp, ret); -- return TCL_ERROR; -- } -- Tcl_DeleteHashEntry(entry); -- } -- set_ok(interp, "Policy freed."); -- return TCL_OK; --} -- -- --static int tcl_kadm5_get_privs(ClientData clientData, Tcl_Interp *interp, -- int argc, const char *argv[]) --{ -- const char *set_ret; -- kadm5_ret_t ret; -- char *priv_var; -- long privs; -- -- GET_HANDLE(1, 0); -- -- if (parse_str(interp, argv[0], &priv_var) != TCL_OK) { -- Tcl_AppendElement(interp, "while parsing privs variable name"); -- return TCL_ERROR; -- } -- -- ret = kadm5_get_privs(server_handle, priv_var ? &privs : 0); -- -- if (ret == KADM5_OK) { -- if (priv_var) { -- Tcl_DString *str = unparse_privs(privs); -- set_ret = Tcl_SetVar(interp, priv_var, str->string, -- TCL_LEAVE_ERR_MSG); -- Tcl_DStringFree(str); -- free(str); -- if (! set_ret) { -- Tcl_AppendElement(interp, "while setting priv variable"); -- return TCL_ERROR; -- } -- } -- set_ok(interp, "Privileges retrieved."); -- return TCL_OK; -- } -- else { -- stash_error(interp, ret); -- return TCL_ERROR; -- } --} -- -- --void Tcl_kadm5_init(Tcl_Interp *interp) --{ -- char buf[20]; -- -- Tcl_SetVar(interp, "KADM5_ADMIN_SERVICE", -- KADM5_ADMIN_SERVICE, TCL_GLOBAL_ONLY); -- Tcl_SetVar(interp, "KADM5_CHANGEPW_SERVICE", -- KADM5_CHANGEPW_SERVICE, TCL_GLOBAL_ONLY); -- (void) sprintf(buf, "%d", KADM5_STRUCT_VERSION); -- Tcl_SetVar(interp, "KADM5_STRUCT_VERSION", buf, TCL_GLOBAL_ONLY); -- (void) sprintf(buf, "%d", KADM5_API_VERSION_2); -- Tcl_SetVar(interp, "KADM5_API_VERSION_2", buf, TCL_GLOBAL_ONLY); -- (void) sprintf(buf, "%d", KADM5_API_VERSION_3); -- Tcl_SetVar(interp, "KADM5_API_VERSION_3", buf, TCL_GLOBAL_ONLY); -- (void) sprintf(buf, "%d", KADM5_API_VERSION_4); -- Tcl_SetVar(interp, "KADM5_API_VERSION_4", buf, TCL_GLOBAL_ONLY); -- (void) sprintf(buf, "%d", KADM5_API_VERSION_MASK); -- Tcl_SetVar(interp, "KADM5_API_VERSION_MASK", buf, TCL_GLOBAL_ONLY); -- (void) sprintf(buf, "%d", KADM5_STRUCT_VERSION_MASK); -- Tcl_SetVar(interp, "KADM5_STRUCT_VERSION_MASK", buf, -- TCL_GLOBAL_ONLY); -- -- Tcl_CreateCommand(interp, "kadm5_init", tcl_kadm5_init, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_init_with_creds", -- tcl_kadm5_init_with_creds, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_destroy", tcl_kadm5_destroy, 0, -- 0); -- Tcl_CreateCommand(interp, "kadm5_create_principal", -- tcl_kadm5_create_principal, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_delete_principal", -- tcl_kadm5_delete_principal, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_modify_principal", -- tcl_kadm5_modify_principal, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_rename_principal", -- tcl_kadm5_rename_principal, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_chpass_principal", -- tcl_kadm5_chpass_principal, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_chpass_principal_util", -- tcl_kadm5_chpass_principal_util, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_randkey_principal", -- tcl_kadm5_randkey_principal, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_get_principal", -- tcl_kadm5_get_principal, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_create_policy", -- tcl_kadm5_create_policy, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_delete_policy", -- tcl_kadm5_delete_policy, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_modify_policy", -- tcl_kadm5_modify_policy, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_get_policy", -- tcl_kadm5_get_policy, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_free_principal_ent", -- tcl_kadm5_free_principal_ent, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_free_policy_ent", -- tcl_kadm5_free_policy_ent, 0, 0); -- Tcl_CreateCommand(interp, "kadm5_get_privs", -- tcl_kadm5_get_privs, 0, 0); --} -diff --git a/src/kadmin/testing/util/tcl_kadm5.h b/src/kadmin/testing/util/tcl_kadm5.h -deleted file mode 100644 -index 1f91a11a1..000000000 ---- a/src/kadmin/testing/util/tcl_kadm5.h -+++ /dev/null -@@ -1,3 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ -- --void Tcl_kadm5_init(Tcl_Interp *interp); -diff --git a/src/kadmin/testing/util/tcl_kadm5_syntax b/src/kadmin/testing/util/tcl_kadm5_syntax -deleted file mode 100644 -index 5f16e58e0..000000000 ---- a/src/kadmin/testing/util/tcl_kadm5_syntax -+++ /dev/null -@@ -1,57 +0,0 @@ --Here's a brief summary of the syntax of the tcl versions of the --kadm5 functions: -- --string Can be a string or "null" which will turn into a null pointer --principal_ent A 12-field list in the order of the principal_ent -- structure: {string number number number number string -- number mask number number string mask} -- It can also be "null", like a string, to indicate that -- a null structure pointer should be used. --mask Either a number, representing the actual value of the -- mask, or a sequence of symbols in a list. Example: -- {PRINCIPAL ATTRIBUTES} is a valid principal mask. --boolean "1", "0", "true", "false", etc. --varname The name of a Tcl variable, or "null" to not assign. --policy_ent Similar to principal_ent, but with seven fields, -- instead of 12. The first is a string, and the rest -- are numbers. -- --init -- client_name:string pass:string service_name:string -- realm:string struct_version:int api_version:int -- server_handle_ret:varname --destroy -- server_handle:string --create_principal -- server_handle:string principal:principal_ent -- mask:principal_mask password:string --delete_principal -- server_handle:string name:string --modify_principal -- server_handle:string principal_principal_ent -- mask:principal_mask --rename_principal -- server_handle:string source:string target:string --chpass_principal -- server_handle:string name:string password:string --chpass_principal_util -- server_handle:string name:string password:string -- pw_ret:varname msg_ret:varname --randkey_principal -- server_handle:string name:string keyblock_var:varname --get_principal [-struct] -- server_handle:string name:string princ_var:varname --create_policy -- server_handle:string policy:policy_ent mask:policy_mask --delete_policy -- server_handle:string name:string --modify_policy -- server_handle:string policy:policy_ent mask:policy_mask --get_policy [-struct] -- server_handle:string name:string policy_var:varname --free_principal_ent -- server_handle:string handle:string --free_policy_ent -- server_handle:string handle:string --get_privs -- server_handle:string privs:priv_var -diff --git a/src/kadmin/testing/util/tcl_krb5_hash.c b/src/kadmin/testing/util/tcl_krb5_hash.c -deleted file mode 100644 -index 35c6bb0b3..000000000 ---- a/src/kadmin/testing/util/tcl_krb5_hash.c -+++ /dev/null -@@ -1,167 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --/* -- * All of the TCL krb5 functions which return (or place into output -- * variables) structures or pointers to structures that can't be -- * represented as tcl native types, do so by returning a handle for -- * the appropriate structure. The handle is a string of the form -- * "type$id", where "type" is the type of datum represented by the -- * handle and "id" is a unique identifier for it. This handle can -- * then be used later by the caller to refer to the object, and -- * internally to retrieve the actually datum from the appropriate hash -- * table. -- * -- * The functions in this file do four things: -- * -- * 1) Given a pointer to a datum and a string representing the type of -- * datum to which the pointer refers, create a new handle for the -- * datum, store the datum in the hash table using the new handle as -- * its key, and return the new handle. -- * -- * 2) Given a handle, locate and return the appropriate hash table -- * datum. -- * -- * 3) Given a handle, look through a table of types and unparse -- * functions to figure out what function to call to get a string -- * representation of the datum, call it with the appropriate pointer -- * (obtained from the hash table) as an argument, and return the -- * resulting string as the unparsed form of the datum. -- * -- * 4) Given a handle, remove that handle and its associated datum from -- * the hash table (but don't free it -- it's assumed to have already -- * been freed by the caller). -- */ -- --#if HAVE_TCL_H --#include --#elif HAVE_TCL_TCL_H --#include --#endif --#include -- --#define SEP_STR "$" -- --static char *memory_error = "out of memory"; -- --/* -- * Right now, we're only using one hash table. However, at some point -- * in the future, we might decide to use a separate hash table for -- * every type. Therefore, I'm putting this function in as an -- * abstraction so it's the only thing we'll have to change if we -- * decide to do that. -- * -- * Also, this function allows us to put in just one place the code for -- * checking to make sure that the hash table exists and initializing -- * it if it doesn't. -- */ -- --static TclHashTable *get_hash_table(Tcl_Interp *interp, -- char *type) --{ -- static Tcl_HashTable *hash_table = 0; -- -- if (! hash_table) { -- if (! (hash_table = malloc(sizeof(*hash_table)))) { -- Tcl_SetResult(interp, memory_error, TCL_STATIC); -- return 0; -- } -- Tcl_InitHashTable(hash_table, TCL_STRING_KEYS); -- } -- return hash_table; --} -- --#define MAX_ID 999999999 --#define ID_BUF_SIZE 10 -- --static Tcl_HashEntry *get_new_handle(Tcl_Interp *interp, -- char *type) --{ -- static unsigned long int id_counter = 0; -- Tcl_DString *handle; -- char int_buf[ID_BUF_SIZE]; -- -- if (! (handle = malloc(sizeof(*handle)))) { -- Tcl_SetResult(interp, memory_error, TCL_STATIC); -- return 0; -- } -- Tcl_DStringInit(handle); -- -- assert(id_counter <= MAX_ID); -- -- sprintf(int_buf, "%d", id_counter++); -- -- Tcl_DStringAppend(handle, type, -1); -- Tcl_DStringAppend(handle, SEP_STR, -1); -- Tcl_DStringAppend(handle, int_buf, -1); -- -- return handle; --} -- -- --Tcl_DString *tcl_krb5_create_object(Tcl_Interp *interp, -- char *type, -- ClientData datum) --{ -- Tcl_HashTable *table; -- Tcl_DString *handle; -- Tcl_HashEntry *entry; -- int entry_created = 0; -- -- if (! (table = get_hash_table(interp, type))) { -- return 0; -- } -- -- if (! (handle = get_new_handle(interp, type))) { -- return 0; -- } -- -- if (! (entry = Tcl_CreateHashEntry(table, handle, &entry_created))) { -- Tcl_SetResult(interp, "error creating hash entry", TCL_STATIC); -- Tcl_DStringFree(handle); -- return TCL_ERROR; -- } -- -- assert(entry_created); -- -- Tcl_SetHashValue(entry, datum); -- -- return handle; --} -- --ClientData tcl_krb5_get_object(Tcl_Interp *interp, -- char *handle) --{ -- char *myhandle, *id_ptr; -- Tcl_HashTable *table; -- Tcl_HashEntry *entry; -- -- if (! (myhandle = strdup(handle))) { -- Tcl_SetResult(interp, memory_error, TCL_STATIC); -- return 0; -- } -- -- if (! (id_ptr = index(myhandle, *SEP_STR))) { -- free(myhandle); -- Tcl_ResetResult(interp); -- Tcl_AppendResult(interp, "malformatted handle \"", handle, -- "\"", 0); -- return 0; -- } -- -- *id_ptr = '\0'; -- -- if (! (table = get_hash_table(interp, myhandle))) { -- free(myhandle); -- return 0; -- } -- -- free(myhandle); -- -- if (! (entry = Tcl_FindHashEntry(table, handle))) { -- Tcl_ResetResult(interp); -- Tcl_AppendResult(interp, "no object corresponding to handle \"", -- handle, "\"", 0); -- return 0; -- } -- -- return(Tcl_GetHashValue(entry)); --} -diff --git a/src/kadmin/testing/util/test.c b/src/kadmin/testing/util/test.c -deleted file mode 100644 -index 37e49d680..000000000 ---- a/src/kadmin/testing/util/test.c -+++ /dev/null -@@ -1,38 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --#include "autoconf.h" --#if HAVE_TCL_H --#include --#elif HAVE_TCL_TCL_H --#include --#endif --#include "tcl_kadm5.h" -- --#define _TCL_MAIN ((TCL_MAJOR_VERSION * 100 + TCL_MINOR_VERSION) >= 704) -- --#if _TCL_MAIN --int --main(argc, argv) -- int argc; /* Number of command-line arguments. */ -- char **argv; /* Values of command-line arguments. */ --{ -- Tcl_Main(argc, argv, Tcl_AppInit); -- return 0; /* Needed only to prevent compiler warning. */ --} --#else --/* -- * The following variable is a special hack that allows applications -- * to be linked using the procedure "main" from the Tcl library. The -- * variable generates a reference to "main", which causes main to -- * be brought in from the library (and all of Tcl with it). -- */ -- --extern int main(); --int *tclDummyMainPtr = (int *) main; --#endif -- --int Tcl_AppInit(Tcl_Interp *interp) --{ -- Tcl_kadm5_init(interp); -- -- return(TCL_OK); --} -diff --git a/src/lib/kadm5/Makefile.in b/src/lib/kadm5/Makefile.in -index f94c0a7da..3ff71c42b 100644 ---- a/src/lib/kadm5/Makefile.in -+++ b/src/lib/kadm5/Makefile.in -@@ -1,6 +1,6 @@ - mydir=lib$(S)kadm5 - BUILDTOP=$(REL)..$(S).. --SUBDIRS = clnt srv unit-test -+SUBDIRS = clnt srv - - ##DOSBUILDTOP = ..\.. - -@@ -98,6 +98,7 @@ generate-files-mac-prerecurse: includes - check-windows: - - clean-unix:: clean-libobjs -+ $(RM) t_kadm5clnt t_kadm5srv t_kadm5.o - - clean-windows:: - -diff --git a/src/lib/kadm5/unit-test/Makefile.in b/src/lib/kadm5/unit-test/Makefile.in -deleted file mode 100644 -index 68fa097ff..000000000 ---- a/src/lib/kadm5/unit-test/Makefile.in -+++ /dev/null -@@ -1,143 +0,0 @@ --mydir=lib$(S)kadm5$(S)unit-test --BUILDTOP=$(REL)..$(S)..$(S).. --KDB_DEP_LIB=$(DL_LIB) $(THREAD_LINKOPTS) -- --SRCS= init-test.c destroy-test.c handle-test.c iter-test.c setkey-test.c \ -- randkey-test.c lock-test.c -- --# --# The client-side test programs. --# -- --init-test: init-test.o $(KADMCLNT_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o init-test init-test.o \ -- $(KADMCLNT_LIBS) $(KRB5_BASE_LIBS) -- --destroy-test: destroy-test.o $(KADMCLNT_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o destroy-test destroy-test.o \ -- $(KADMCLNT_LIBS) $(KRB5_BASE_LIBS) -- --client-handle-test: client-handle-test.o $(KADMCLNT_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o client-handle-test client-handle-test.o \ -- $(KADMCLNT_LIBS) $(KRB5_BASE_LIBS) -- --client-handle-test.o: handle-test.c -- $(CC) $(ALL_CFLAGS) -DCLIENT_TEST -o client-handle-test.o -c $(srcdir)/handle-test.c -- --client-iter-test: iter-test.o $(KADMLCNT_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o client-iter-test iter-test.o \ -- $(KADMCLNT_LIBS) $(KRB5_BASE_LIBS) -- --client-setkey-test: setkey-test.o $(KADMCLNT_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o client-setkey-test setkey-test.o \ -- $(KADMCLNT_LIBS) $(KRB5_BASE_LIBS) -- --# --# The server-side test programs. --# -- --randkey-test: randkey-test.o $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o randkey-test randkey-test.o \ -- $(KADMSRV_LIBS) $(KDB_DEP_LIB) $(KRB5_BASE_LIBS) -- --server-handle-test: handle-test.o $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o server-handle-test handle-test.o \ -- $(KADMSRV_LIBS) $(KDB_DEP_LIB) $(KRB5_BASE_LIBS) -- --lock-test: lock-test.o $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o lock-test lock-test.o \ -- $(KADMSRV_LIBS) $(KDB_DEP_LIB) $(KRB5_BASE_LIBS) -- --server-iter-test: iter-test.o $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o server-iter-test iter-test.o \ -- $(KADMSRV_LIBS) $(KDB_DEP_LIB) $(KRB5_BASE_LIBS) -- --server-setkey-test: setkey-test.o $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIBS) -- $(CC_LINK) -o server-setkey-test setkey-test.o \ -- $(KADMSRV_LIBS) $(KDB_DEP_LIB) $(KRB5_BASE_LIBS) -- --runenv.exp: Makefile -- $(RUN_SETUP); for i in $(RUN_VARS); do \ -- eval echo "set env\($$i\) \$$$$i"; done > runenv.exp -- --# --# The unit-test targets --# -- --check: check-@DO_TEST@ -- --check-: -- @echo "+++" -- @echo "+++ WARNING: lib/kadm5 unit tests not run." -- @echo "+++ Either tcl, runtest, or Perl is unavailable." -- @echo "+++" -- --check-ok unit-test: unit-test-client unit-test-server -- --unit-test-client: unit-test-client-setup unit-test-client-body \ -- unit-test-client-cleanup -- --unit-test-server: unit-test-server-setup unit-test-server-body \ -- unit-test-server-cleanup -- --test-randkey: randkey-test -- $(ENV_SETUP) $(VALGRIND) ./randkey-test -- --test-handle-server: server-handle-test -- $(ENV_SETUP) $(VALGRIND) ./server-handle-test -- --test-handle-client: client-handle-test -- $(ENV_SETUP) $(VALGRIND) ./client-handle-test -- --test-noauth: init-test -- $(ENV_SETUP) $(VALGRIND) ./init-test -- --test-destroy: destroy-test -- $(ENV_SETUP) $(VALGRIND) ./destroy-test -- --test-setkey-client: client-setkey-test -- $(ENV_SETUP) $(VALGRIND) ./client-setkey-test testkeys admin admin -- --unit-test-client-setup: runenv.sh -- $(ENV_SETUP) $(VALGRIND) $(START_SERVERS) -- --unit-test-client-cleanup: -- $(ENV_SETUP) $(STOP_SERVERS) -- --unit-test-server-setup: runenv.sh -- $(ENV_SETUP) $(VALGRIND) $(START_SERVERS_LOCAL) -- --unit-test-server-cleanup: -- $(ENV_SETUP) $(STOP_SERVERS_LOCAL) -- --unit-test-client-body: site.exp test-noauth test-destroy test-handle-client \ -- test-setkey-client runenv.exp -- $(ENV_SETUP) $(RUNTEST) --tool api RPC=1 API=$(CLNTTCL) \ -- KINIT=$(BUILDTOP)/clients/kinit/kinit \ -- KDESTROY=$(BUILDTOP)/clients/kdestroy/kdestroy \ -- KADMIN_LOCAL=$(BUILDTOP)/kadmin/cli/kadmin.local \ -- PRIOCNTL_HACK=@PRIOCNTL_HACK@ VALGRIND="$(VALGRIND)" \ -- $(RUNTESTFLAGS) -- -mv api.log capi.log -- -mv api.sum capi.sum -- --unit-test-server-body: site.exp test-handle-server lock-test -- $(ENV_SETUP) $(RUNTEST) --tool api RPC=0 API=$(SRVTCL) \ -- LOCKTEST=./lock-test \ -- KADMIN_LOCAL=$(BUILDTOP)/kadmin/cli/kadmin.local \ -- PRIOCNTL_HACK=@PRIOCNTL_HACK@ VALGRIND="$(VALGRIND)" \ -- $(RUNTESTFLAGS) -- -mv api.log sapi.log -- -mv api.sum sapi.sum -- --clean: -- $(RM) init-test client_init.o init-test.o -- $(RM) destroy-test destroy-test.o -- $(RM) client-handle-test handle-test.o client-handle-test.o -- $(RM) client-iter-test iter-test.o -- $(RM) randkey-test randkey-test.o -- $(RM) server-handle-test handle-test.o -- $(RM) lock-test lock-test.o -- $(RM) server-iter-test iter-test.o -- $(RM) server-setkey-test client-setkey-test setkey-test.o -- $(RM) *.log *.plog *.sum *.psum unit-test-log.* runenv.exp -diff --git a/src/lib/kadm5/unit-test/api.2/crte-policy.exp b/src/lib/kadm5/unit-test/api.2/crte-policy.exp -deleted file mode 100644 -index 4902ea59f..000000000 ---- a/src/lib/kadm5/unit-test/api.2/crte-policy.exp -+++ /dev/null -@@ -1,927 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --# Description: (1) Fails for mask with undefined bit set. --# 01/24/94: pshuang: untried. --test "create-policy 1" --proc test1 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete policy \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- 0xF01000 -- } $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test1 -- --# Description: (2) Fails if caller connected with CHANGEPW_SERVICE. --test "create-policy 2" --proc test2 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy"; -- return -- } --} --if {$RPC} { test2 } -- --# Description: (3) Fails for mask without POLICY bit set. --# 01/24/94: pshuang: untried. --test "create-policy 3" --proc test3 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete policy \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- 0x000000 -- } $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test3 -- --# Description: (5) Fails for invalid policy name. --# 01/24/94: pshuang: untried. --test "create-policy 5" --proc test5 {} { -- global test -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/"] \ -- {KADM5_POLICY} -- } $test] "BAD_POLICY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test5 -- --# Description: (6) Fails for existing policy name. --test "create-policy 6" --proc test6 {} { -- global test --# set prms_id 777 --# setup_xfail {*-*-*} $prms_id -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_create_policy $server_handle [simple_policy test-pol] \ -- {KADM5_POLICY} -- } "DUP" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test6 -- --# Description: (7) Fails for null policy name. --# 01/24/94: pshuang: untried. --test "create-policy 7" --proc test7 {} { -- global test --# set prms_id 1977 --# setup_xfail {*-*-*} $prms_id -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_create_policy $server_handle [simple_policy null] \ -- {KADM5_POLICY} -- } "EINVAL" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test7 -- --# Description: (8) Fails for empty-string policy name. --test "create-policy 8" --proc test8 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_create_policy $server_handle [simple_policy ""] \ -- {KADM5_POLICY} -- } "BAD_POLICY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test8 -- --# Description: (9) Accepts 0 for pw_min_life. --test "create-policy 9" --proc test9 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY KADM5_PW_MIN_LIFE} -- } $test]]} { -- fail "$test: create failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 1\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test9 -- --# Description: (10) Accepts non-zero for pw_min_life. --test "create-policy 10" --proc test10 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 32 0 0 0 0 0 } \ -- {KADM5_POLICY KADM5_PW_MIN_LIFE} -- } $test]]} { -- fail "$test" -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 1\n" -- expect { -- -re "32\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test10 -- --# Description: (11) Accepts 0 for pw_max_life. --test "create-policy 11" --proc test11 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY KADM5_PW_MAX_LIFE} -- } $test]]} { -- fail "$test" -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 2\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test11 -- --# Description: (12) Accepts non-zero for pw_max_life. --test "create-policy 12" --proc test12 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 32 0 0 0 0 } \ -- {KADM5_POLICY KADM5_PW_MAX_LIFE} -- } $test]]} { -- fail "$test" -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 2\n" -- expect { -- -re "32\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test12 -- --# Description: (13) Rejects 0 for pw_min_length. --test "create-policy 13" --proc test13 {} { -- global test -- global prompt -- -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY KADM5_PW_MIN_LENGTH} -- } $test] "BAD_LENGTH" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test13 -- --# Description: (14) Accepts non-zero for pw_min_length. --test "create-policy 14" --proc test14 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 8 0 0 0 } \ -- {KADM5_POLICY KADM5_PW_MIN_LENGTH} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 3\n" -- expect { -- -re "8\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test14 -- --# Description: (15) Rejects 0 for pw_min_classes. --test "create-policy 15" --proc test15 {} { -- global test -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY KADM5_PW_MIN_CLASSES} -- } $test] "BAD_CLASS" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test15 -- --# Description: (16) Accepts 1 for pw_min_classes. --test "create-policy 16" --proc test16 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 0 1 0 0 } \ -- {KADM5_POLICY KADM5_PW_MIN_CLASSES} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 4\n" -- expect { -- -re "1\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test16 -- --# Description: (17) Accepts 4 for pw_min_classes. --test "create-policy 17" --proc test17 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 0 5 0 0} \ -- {KADM5_POLICY KADM5_PW_MIN_CLASSES} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 4\n" -- expect { -- -re "5\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test17 -- --# Description: (18) Rejects 5 for pw_min_classes. --test "create-policy 18" --proc test18 {} { -- global test -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 0 6 0 0} \ -- {KADM5_POLICY KADM5_PW_MIN_CLASSES} -- } $test] "BAD_CLASS" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test18 -- --# Description: (19) Rejects 0 for pw_history_num. --test "create-policy 19" --proc test19 {} { -- global test -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY KADM5_PW_HISTORY_NUM} -- } $test] "BAD_HISTORY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test19 -- --# Description: (20) Accepts 1 for pw_history_num. --test "create-policy 20" --proc test20 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 0 0 1 0} \ -- {KADM5_POLICY KADM5_PW_HISTORY_NUM} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 5\n" -- expect { -- -re "1\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test20 -- --# Description: (21) Accepts 10 for pw_history_num. --test "create-policy 21" --proc test21 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 0 0 10 0} \ -- {KADM5_POLICY KADM5_PW_HISTORY_NUM} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 5\n" -- expect { -- -re "10\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test21 -- --# Description: (22) Fails for user with no access bits. --test "create-policy 22" --proc test22 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test22 -- --# Description: (23) Fails for user with "get" but not "add". --test "create-policy 23" --proc test23 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test23 -- --# Description: (24) Fails for user with "modify" but not "add". --# 01/24/94: pshuang: untried. --test "create-policy 24" --proc test24 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test24 -- --# Description: (25) Fails for user with "delete" but not "add". --# 01/24/94: pshuang: untried. --test "create-policy 25" --proc test25 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test25 -- --# Description: Succeeds for user with "add". --test "create-policy 26" --proc test26 {} { -- global test -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test26 -- --# Description: Succeeds for user with "get" and "add". --# 01/24/94: pshuang: untried. --test "create-policy 27" --proc test27 {} { -- global test -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/get-add admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test27 -- --# Description: (28) Rejects null policy argument. --# 01/24/94: pshuang: untried. --test "create-policy 28" --proc test28 {} { -- global test -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_create_policy $server_handle null {KADM5_POLICY} -- } "EINVAL" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test28 -- --test "create-policy 30" --proc test30 {} { -- global test -- one_line_fail_test [format { -- kadm5_create_policy null [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "BAD_SERVER_HANDLE" --} --test30 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.2/get-policy.exp b/src/lib/kadm5/unit-test/api.2/get-policy.exp -deleted file mode 100644 -index 83aef80e8..000000000 ---- a/src/lib/kadm5/unit-test/api.2/get-policy.exp -+++ /dev/null -@@ -1,199 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "get-policy 3" --proc test3 {} { -- global test --# set prms_id 744 --# setup_xfail {*-*-*} $prms_id -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test {kadm5_get_policy $server_handle "" p} "BAD_POLICY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test3 -- --test "get-policy 6" --proc test6 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \ -- "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } test6 -- --test "get-policy 7" --proc test7 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \ -- "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } test7 -- --test "get-policy 11" --proc test11 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/get-pol StupidAdmin $KADM5_ADMIN_SERVICE \ -- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test {kadm5_get_policy $server_handle test-pol p} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test11 -- --test "get-policy 12" --proc test12 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/get-pol StupidAdmin \ -- $KADM5_CHANGEPW_SERVICE null $KADM5_STRUCT_VERSION \ -- $KADM5_API_VERSION_2 server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test \ -- {kadm5_get_policy $server_handle test-pol-nopw p} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test12 -- --test "get-policy 15" --proc test15 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/pol StupidAdmin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test \ -- {kadm5_get_policy $server_handle test-pol-nopw p} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test15 -- --test "get-policy 16" --proc test16 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/pol StupidAdmin $KADM5_CHANGEPW_SERVICE \ -- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test \ -- {kadm5_get_policy $server_handle test-pol-nopw p} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test16 -- --test "get-policy 17" --proc test17 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test {kadm5_get_policy $server_handle test-pol p} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test17 -- --test "get-policy 18" --proc test18 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \ -- "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } test18 -- --test "get-policy 21" --proc test21 {} { -- global test -- -- one_line_fail_test {kadm5_get_policy null "pol1" p} "BAD_SERVER_HANDLE" --} --test21 -diff --git a/src/lib/kadm5/unit-test/api.2/mod-policy.exp b/src/lib/kadm5/unit-test/api.2/mod-policy.exp -deleted file mode 100644 -index 904edca8a..000000000 ---- a/src/lib/kadm5/unit-test/api.2/mod-policy.exp -+++ /dev/null -@@ -1,675 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "modify-policy 2" --proc test2 {} { -- global test -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test] "AUTH_MODIFY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test2 } -- --test "modify-policy 8" --proc test8 {} { -- global test --# set prms_id 744 --# setup_xfail {*-*-*} $prms_id -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_modify_policy $server_handle [simple_policy ""] \ -- {KADM5_PW_MAX_LIFE} -- } "BAD_POLICY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test8 -- --test "modify-policy 9" --proc test9 {} { -- global test -- global prompt -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MIN_LIFE} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 1\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test9 -- --test "modify-policy 10" --proc test10 {} { -- global test -- global prompt -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 32 0 0 0 0 0} \ -- {KADM5_PW_MIN_LIFE} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 1\n" -- expect { -- -re "32\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test10 -- -- --test "modify-policy 11" --proc test11 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 2\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test11 -- --test "modify-policy 12" --proc test12 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 32 0 0 0 0} \ -- {KADM5_PW_MAX_LIFE} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 2\n" -- expect { -- -re "32\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test12 -- --test "modify-policy 13" --proc test13 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MIN_LENGTH} -- } $test] "BAD_LENGTH" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test13 -- --test "modify-policy 14" --proc test14 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 8 0 0 0} \ -- {KADM5_PW_MIN_LENGTH} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 3\n" -- expect { -- -re "8\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test14 -- --test "modify-policy 15" --proc test15 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MIN_CLASSES} -- } $test] "BAD_CLASS" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test15 -- --test "modify-policy 16" --proc test16 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 1 0 0} \ -- {KADM5_PW_MIN_CLASSES} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 4\n" -- expect { -- -re "1\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test16 -- --test "modify-policy 17" --proc test17 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 5 0 0} \ -- {KADM5_PW_MIN_CLASSES} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 4\n" -- expect { -- -re "5\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test17 -- --test "modify-policy 18" --proc test18 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 6 0 0} \ -- {KADM5_PW_MIN_CLASSES} -- } $test] "BAD_CLASS" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test18 -- --test "modify-policy 19" --proc test19 {} { -- global test -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_HISTORY_NUM} -- } $test] "BAD_HISTORY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test19 -- --test "modify-policy 20" --proc test20 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 0 1 0} \ -- {KADM5_PW_HISTORY_NUM} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 5\n" -- expect { -- -re "1\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test20 -- --test "modify-policy 21" --proc test21 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 0 10 0} \ -- {KADM5_PW_HISTORY_NUM} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 5\n" -- expect { -- -re "10\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test21 -- --test "modify-policy 22" --proc test22 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test] "AUTH_MODIFY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test22 -- --test "modify-policy 23" --proc test23 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test] "AUTH_MODIFY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test23 -- --test "modify-policy 26" --proc test26 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_2 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test26 -- --test "modify-policy 30" --proc test30 {} { -- global test -- -- one_line_fail_test [format { -- kadm5_modify_policy null [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test] "BAD_SERVER_HANDLE" --} --test30 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp -deleted file mode 100644 -index 740425c69..000000000 ---- a/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp -+++ /dev/null -@@ -1,68 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "chpass-principal 200" --proc test200 {} { -- global test prompt -- -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [create_principal "$test/a"]} { -- error_and_restart "$test: creating principal" -- return -- } -- -- # I'd like to specify a long list of keysalt tuples and make sure -- # that chpass does the right thing, but we can only use those -- # enctypes that krbtgt has a key for: the AES enctypes, according to -- # the prototype kdc.conf. -- if {! [cmd [format { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_chpass_principal $server_handle "%s/a" newpassword -- } $test]]} { -- perror "$test: unexpected failure in chpass_principal" -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" p \ -- {KADM5_PRINCIPAL_NORMAL_MASK KADM5_KEY_DATA} -- } $test]]} { -- perror "$test: unexpected failure in get_principal" -- } -- send "lindex \$p 16\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" { set num_keys $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting num_keys" -- return -- } -- eof { -- error_and_restart "$test: eof getting num_keys" -- return -- } -- } -- -- # XXX Perhaps I should actually check the key type returned. -- if {$num_keys == 5} { -- pass "$test" -- } else { -- fail "$test: $num_keys keys, should be 5" -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test200 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.current/chpass-principal.exp b/src/lib/kadm5/unit-test/api.current/chpass-principal.exp -deleted file mode 100644 -index 47a19dc20..000000000 ---- a/src/lib/kadm5/unit-test/api.current/chpass-principal.exp -+++ /dev/null -@@ -1,176 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "chpass-principal 180" --proc test180 {} { -- global test -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [create_principal_pol "$test/a" once-a-min]} { -- error_and_restart "$test: creating principal" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_chpass_principal $server_handle "%s/a" FoobarBax -- } $test] -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } { test180 } -- --test "chpass-principal 180.5" --proc test1805 {} { -- global test -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [create_principal_pol "$test/a" once-a-min]} { -- error_and_restart "$test: creating principal" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_chpass_principal $server_handle "%s/a" FoobarBax -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } { test1805 } -- --# --# admin with changepw service tickets try to change other principals --# password, fails with AUTH error --test "chpass-principal 180.625" --proc test180625 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_chpass_principal $server_handle "%s/a" password -- } $test] "AUTH" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test180625 } -- --test "chpass-principal 180.75" --proc test18075 {} { -- global test -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [create_principal_pol "$test/a" once-a-min]} { -- error_and_restart "$test: creating principal" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_chpass_principal $server_handle "%s/a" Foobar -- } $test] "AUTH_CHANGEPW" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } { test18075 } -- --test "chpass-principal 182" --proc test182 {} { -- global test -- -- if { ! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_chpass_principal $server_handle kadmin/history password -- } "PROTECT" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test182 -- --test "chpass-principal 183" --proc test183 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if { ! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_chpass_principal null "%s/a" password -- } $test] "BAD_SERVER_HANDLE" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test183 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.current/crte-policy.exp b/src/lib/kadm5/unit-test/api.current/crte-policy.exp -deleted file mode 100644 -index 7e1eda63f..000000000 ---- a/src/lib/kadm5/unit-test/api.current/crte-policy.exp -+++ /dev/null -@@ -1,927 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --# Description: (1) Fails for mask with undefined bit set. --# 01/24/94: pshuang: untried. --test "create-policy 1" --proc test1 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete policy \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- 0xF01000 -- } $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test1 -- --# Description: (2) Fails if caller connected with CHANGEPW_SERVICE. --test "create-policy 2" --proc test2 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy"; -- return -- } --} --if {$RPC} { test2 } -- --# Description: (3) Fails for mask without POLICY bit set. --# 01/24/94: pshuang: untried. --test "create-policy 3" --proc test3 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete policy \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- 0x000000 -- } $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test3 -- --# Description: (5) Fails for invalid policy name. --# 01/24/94: pshuang: untried. --test "create-policy 5" --proc test5 {} { -- global test -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/"] \ -- {KADM5_POLICY} -- } $test] "BAD_POLICY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test5 -- --# Description: (6) Fails for existing policy name. --test "create-policy 6" --proc test6 {} { -- global test --# set prms_id 777 --# setup_xfail {*-*-*} $prms_id -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_create_policy $server_handle [simple_policy test-pol] \ -- {KADM5_POLICY} -- } "DUP" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test6 -- --# Description: (7) Fails for null policy name. --# 01/24/94: pshuang: untried. --test "create-policy 7" --proc test7 {} { -- global test --# set prms_id 1977 --# setup_xfail {*-*-*} $prms_id -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_create_policy $server_handle [simple_policy null] \ -- {KADM5_POLICY} -- } "EINVAL" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test7 -- --# Description: (8) Fails for empty-string policy name. --test "create-policy 8" --proc test8 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_create_policy $server_handle [simple_policy ""] \ -- {KADM5_POLICY} -- } "BAD_POLICY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test8 -- --# Description: (9) Accepts 0 for pw_min_life. --test "create-policy 9" --proc test9 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY KADM5_PW_MIN_LIFE} -- } $test]]} { -- fail "$test: create failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 1\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test9 -- --# Description: (10) Accepts non-zero for pw_min_life. --test "create-policy 10" --proc test10 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 32 0 0 0 0 0 } \ -- {KADM5_POLICY KADM5_PW_MIN_LIFE} -- } $test]]} { -- fail "$test" -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 1\n" -- expect { -- -re "32\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test10 -- --# Description: (11) Accepts 0 for pw_max_life. --test "create-policy 11" --proc test11 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY KADM5_PW_MAX_LIFE} -- } $test]]} { -- fail "$test" -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 2\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test11 -- --# Description: (12) Accepts non-zero for pw_max_life. --test "create-policy 12" --proc test12 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 32 0 0 0 0 } \ -- {KADM5_POLICY KADM5_PW_MAX_LIFE} -- } $test]]} { -- fail "$test" -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 2\n" -- expect { -- -re "32\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test12 -- --# Description: (13) Rejects 0 for pw_min_length. --test "create-policy 13" --proc test13 {} { -- global test -- global prompt -- -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY KADM5_PW_MIN_LENGTH} -- } $test] "BAD_LENGTH" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test13 -- --# Description: (14) Accepts non-zero for pw_min_length. --test "create-policy 14" --proc test14 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 8 0 0 0 } \ -- {KADM5_POLICY KADM5_PW_MIN_LENGTH} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 3\n" -- expect { -- -re "8\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test14 -- --# Description: (15) Rejects 0 for pw_min_classes. --test "create-policy 15" --proc test15 {} { -- global test -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY KADM5_PW_MIN_CLASSES} -- } $test] "BAD_CLASS" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test15 -- --# Description: (16) Accepts 1 for pw_min_classes. --test "create-policy 16" --proc test16 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 0 1 0 0 } \ -- {KADM5_POLICY KADM5_PW_MIN_CLASSES} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 4\n" -- expect { -- -re "1\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test16 -- --# Description: (17) Accepts 4 for pw_min_classes. --test "create-policy 17" --proc test17 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 0 5 0 0} \ -- {KADM5_POLICY KADM5_PW_MIN_CLASSES} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 4\n" -- expect { -- -re "5\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test17 -- --# Description: (18) Rejects 5 for pw_min_classes. --test "create-policy 18" --proc test18 {} { -- global test -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 0 6 0 0} \ -- {KADM5_POLICY KADM5_PW_MIN_CLASSES} -- } $test] "BAD_CLASS" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test18 -- --# Description: (19) Rejects 0 for pw_history_num. --test "create-policy 19" --proc test19 {} { -- global test -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY KADM5_PW_HISTORY_NUM} -- } $test] "BAD_HISTORY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test19 -- --# Description: (20) Accepts 1 for pw_history_num. --test "create-policy 20" --proc test20 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 0 0 1 0} \ -- {KADM5_POLICY KADM5_PW_HISTORY_NUM} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retreuve policy" -- return -- } -- send "lindex \$policy 5\n" -- expect { -- -re "1\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test20 -- --# Description: (21) Accepts 10 for pw_history_num. --test "create-policy 21" --proc test21 {} { -- global test -- global prompt -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_policy $server_handle {"%s/a" 0 0 0 0 10 0} \ -- {KADM5_POLICY KADM5_PW_HISTORY_NUM} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 5\n" -- expect { -- -re "10\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test21 -- --# Description: (22) Fails for user with no access bits. --test "create-policy 22" --proc test22 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test22 -- --# Description: (23) Fails for user with "get" but not "add". --test "create-policy 23" --proc test23 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test23 -- --# Description: (24) Fails for user with "modify" but not "add". --# 01/24/94: pshuang: untried. --test "create-policy 24" --proc test24 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test24 -- --# Description: (25) Fails for user with "delete" but not "add". --# 01/24/94: pshuang: untried. --test "create-policy 25" --proc test25 {} { -- global test -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test25 -- --# Description: Succeeds for user with "add". --test "create-policy 26" --proc test26 {} { -- global test -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test26 -- --# Description: Succeeds for user with "get" and "add". --# 01/24/94: pshuang: untried. --test "create-policy 27" --proc test27 {} { -- global test -- -- if {! (( ! [policy_exists "$test/a"]) || -- [delete_policy "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/get-add admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_create_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test27 -- --# Description: (28) Rejects null policy argument. --# 01/24/94: pshuang: untried. --test "create-policy 28" --proc test28 {} { -- global test -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_create_policy $server_handle null {KADM5_POLICY} -- } "EINVAL" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test28 -- --test "create-policy 30" --proc test30 {} { -- global test -- one_line_fail_test [format { -- kadm5_create_policy null [simple_policy "%s/a"] \ -- {KADM5_POLICY} -- } $test] "BAD_SERVER_HANDLE" --} --test30 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.current/crte-principal.exp b/src/lib/kadm5/unit-test/api.current/crte-principal.exp -deleted file mode 100644 -index d6d6809ec..000000000 ---- a/src/lib/kadm5/unit-test/api.current/crte-principal.exp -+++ /dev/null -@@ -1,1336 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --#test "create-principal 1" --# --#proc test1 {} { --# global test --# begin_dump --# one_line_fail_test [format { --# kadm5_create_principal $server_handle \ --# [simple_principal "%s/a"] {KADM5_PRINCIPAL} "%s/a" --# } $test $test] "NOT_INIT" --# end_dump_compare "no-diffs" --#} --#test1 -- --# v2 create-principal 3 test, to avoid name conflict --test "create-principal 1" --proc test1 {} { -- global test --# set prms_id 777 --# setup_xfail {*-*-*} $prms_id -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} null -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test1 -- --test "create-principal 2" -- --proc test2 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_create_principal $server_handle null \ -- {KADM5_PRINCIPAL} testpass -- } "EINVAL" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test2 -- --test "create-principal 4" --proc test4 {} { -- global test -- -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} "" -- } $test] "_Q_TOOSHORT" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test4 -- --test "create-principal 5" --proc test5 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle \ -- [simple_principal "%s/a"] {0x100001} "%s/a" -- } $test $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test5 -- --test "create-principal 6" --proc test6 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_LAST_PWD_CHANGE} "%s/a" -- } $test $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test6 -- --test "create-principal 7" --proc test7 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_MOD_TIME} "%s/a" -- } $test $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test7 -- --test "create-principal 8" --proc test8 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_MOD_NAME} "%s/a" -- } $test $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test8 -- --test "create-principal 9" --proc test9 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_MKVNO} "%s/a" -- } $test $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test9 -- --test "create-principal 10" --proc test10 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_AUX_ATTRIBUTES} "%s/a" -- } $test $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test10 -- --test "create-principal 11" --proc test11 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_POLICY_CLR} "%s/a" -- } $test $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test11 -- --test "create-principal 12" --proc test12 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} testpass -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" -- --} --if {$RPC} { test12 } -- --test "create-principal 13" --proc test13 {} { -- global test -- begin_dump -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} testpass -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --if {$RPC} { test13 } -- --test "create-principal 14" --proc test14 {} { -- global test -- begin_dump -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} testpass -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --if {$RPC} { test14 } -- --test "create-principal 15" --proc test15 {} { -- global test -- begin_dump -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} testpass -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --if {$RPC} { test15 } -- --test "create-principal 16" --proc test16 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} testpass -- } $test] "AUTH_ADD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --if {$RPC} { test16 } -- --test "create-principal 17" --proc test17 {} { -- global test -- -- begin_dump -- if {! (( [principal_exists "$test/a"]) || [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} testpass -- } $test] "DUP" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test17 -- --test "create-principal 18" --proc test18 {} { -- global test -- -- begin_dump -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle \ -- [princ_w_pol "%s/a" test-pol] \ -- {KADM5_PRINCIPAL KADM5_POLICY} tP -- } $test] "_Q_TOOSHORT" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test18 -- --test "create-principal 19" --proc test19 {} { -- global test -- -- begin_dump -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle \ -- [princ_w_pol "%s/a" test-pol] \ -- {KADM5_PRINCIPAL KADM5_POLICY} testpassword -- } $test] "_Q_CLASS" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test19 -- --test "create-principal 20" --proc test20 {} { -- global test -- -- begin_dump -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_create_principal $server_handle \ -- [princ_w_pol "%s/a" test-pol] \ -- {KADM5_PRINCIPAL KADM5_POLICY} Abyssinia -- } $test] "_Q_DICT" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test20 -- --test "create-principal 21" --proc test21 {} { -- global test -- -- begin_dump -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_create_principal $server_handle \ -- [princ_w_pol "%s/a" non-existant-pol] \ -- {KADM5_PRINCIPAL KADM5_POLICY} NotinTheDictionary -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- end_dump_compare "no-diffs" --} --test21 -- --test "create-principal 23" --proc test23 {} { -- global test -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- one_line_succeed_test \ -- [format {kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK} $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test23 -- --test "create-principal 24" --proc test24 {} { -- global test -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/rename admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- one_line_succeed_test \ -- [format {kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK} $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test24 } -- -- --test "create-principal 28" --proc test28 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- -- if {! [cmd [format { -- kadm5_create_principal $server_handle \ -- [princ_w_pol "%s/a" test-pol] \ -- {KADM5_PRINCIPAL KADM5_POLICY} NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return -- } -- send "lindex \$principal 10\n" -- expect { -- -re "test-pol.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test28 -- --test "create-principal 29" --proc test29 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL KADM5_PRINC_EXPIRE_TIME} \ -- inTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return; -- } -- send "lindex \$principal 1\n" -- expect { -- -re "0.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test29 -- --test "create-principal 30" --proc test30 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL KADM5_PW_EXPIRATION} \ -- NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return; -- } -- send "lindex \$principal 3\n" -- expect { -- -re "0.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test30 -- --test "create-principal 31" --proc test31 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle \ -- [princ_w_pol "%s/a" test-pol-nopw] \ -- {KADM5_PRINCIPAL KADM5_POLICY \ -- KADM5_PW_EXPIRATION} NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return; -- } -- send "lindex \$principal 3\n" -- expect { -- -re "0.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test31 -- --test "create-principal 32" --proc test32 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle \ -- [princ_w_pol "%s/a" test-pol] \ -- {KADM5_PRINCIPAL KADM5_POLICY \ -- KADM5_PW_EXPIRATION} NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return; -- } -- if { ! [cmd {kadm5_get_policy $server_handle test-pol policy}]} { -- error_and_restart "$test: cannot retrieve policy" -- return -- } -- -- send "lindex \$principal 6\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set mod_date $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting mod_date" -- return -- } -- eof { -- error_and_restart "$test: eof getting mod_date" -- return -- } -- } -- -- send "lindex \$principal 3\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_expire $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_expire" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_expire" -- return -- } -- } -- -- send "lindex \$policy 2\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_max_life $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_max_life" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_max_life" -- return -- } -- } -- if { $pw_expire != 0 } { -- fail "$test: pw_expire $pw_expire should be 0" -- return -- } else { -- pass "$test" -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test32 -- --test "create-principal 33" --proc test33 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle \ -- {"%s/a" 0 0 1234 0 null 0 0 0 0 null 0} \ -- {KADM5_PRINCIPAL KADM5_PW_EXPIRATION} \ -- NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return; -- } -- send "lindex \$principal 3\n" -- expect { -- -re "1234.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test33 -- --test "create-principal 34" --proc test34 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle \ -- { "%s/a" 0 0 1234 0 null 0 0 0 0 test-pol-nopw 0} \ -- {KADM5_PRINCIPAL KADM5_POLICY \ -- KADM5_PW_EXPIRATION} NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return; -- } -- send "lindex \$principal 3\n" -- expect { -- -re "1234.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test34 -- --test "create-principal 35" --proc test35 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle \ -- {"%s/a" 0 0 1234 0 null 0 0 0 0 test-pol 0} \ -- {KADM5_PRINCIPAL KADM5_POLICY \ -- KADM5_PW_EXPIRATION} NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return; -- } -- send "lindex \$principal 3\n" -- expect { -- -re "1234.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test35 -- --test "create-principal 36" --proc test36 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle \ -- {"%s/a" 0 0 999999999 0 null 0 0 0 0 test-pol 0} \ -- {KADM5_PRINCIPAL KADM5_POLICY \ -- KADM5_PW_EXPIRATION} NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return; -- } -- if { ! [cmd {kadm5_get_policy $server_handle test-pol policy} ]} { -- error_and_restart "$test: cannot retrieve policy" -- return -- } -- -- send "lindex \$principal 6\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set mod_date $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting mod_date" -- return -- } -- eof { -- error_and_restart "$test: eof getting mod_date" -- return -- } -- } -- -- send "lindex \$principal 3\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_expire $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_expire" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_expire" -- return -- } -- } -- -- send "lindex \$policy 2\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_max_life $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_max_life" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_max_life" -- return -- } -- } -- if { $pw_expire != 999999999 } { -- fail "$test: pw_expire is wrong" -- return -- } else { -- pass "$test" -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test36 -- --test "create-principal 37" --proc test37 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return; -- } -- send "lindex \$principal 3\n" -- expect { -- -re "0.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test37 -- --test "create-principal 38" --proc test38 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle [princ_w_pol "%s/a" \ -- test-pol-nopw] {KADM5_PRINCIPAL KADM5_POLICY} \ -- NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return; -- } -- send "lindex \$principal 3\n" -- expect { -- -re "0.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test38 -- --test "create-principal 39" --proc test39 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle [princ_w_pol "%s/a" \ -- test-pol] {KADM5_PRINCIPAL KADM5_POLICY} \ -- NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if { ! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: cannot not retrieve principal" -- return -- } -- if { ! [cmd {kadm5_get_policy $server_handle test-pol policy}]} { -- error_and_restart "$test: cannot retrieve policy" -- return -- } -- send "lindex \$principal 6\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set mod_date $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting mod_date" -- return -- } -- eof { -- error_and_restart "$test: eof getting mod_date" -- return -- } -- } -- -- send "lindex \$principal 3\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_expire $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_expire" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_expire" -- return -- } -- } -- -- send "lindex \$policy 2\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_max_life $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_max_life" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_max_life" -- return -- } -- } -- if { [expr "$mod_date + $pw_max_life - $pw_expire"] > 5 } { -- fail "$test: pw_expire is wrong" -- return -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test39 -- --test "create-principal 40" --proc test40 {} { -- global test -- global prompt -- -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL KADM5_PW_EXPIRATION} \ -- NotinTheDictionary -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- fail "$test: can not retrieve principal" -- return; -- } -- send "lindex \$principal 4\n" -- expect { -- -re "0.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test40 -- --test "create-principal 43" --proc test43 {} { -- global test -- one_line_fail_test [format { -- kadm5_create_principal null \ -- [simple_principal "%s/a"] {KADM5_PRINCIPAL} "%s/a" -- } $test $test] "BAD_SERVER_HANDLE" --} --test43 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.current/destroy.exp b/src/lib/kadm5/unit-test/api.current/destroy.exp -deleted file mode 100644 -index a3e2bfc59..000000000 ---- a/src/lib/kadm5/unit-test/api.current/destroy.exp -+++ /dev/null -@@ -1,203 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "destroy 1" -- --proc test1 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test {kadm5_destroy $server_handle} -- end_dump_compare "no-diffs" --} --test1 -- --#test "destroy 2" --# --#proc test2 {} { --# global test --# begin_dump --# if {! [cmd { --# kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ --# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ --# server_handle --# }]} { --# perror "$test: unexpected failure on init" --# return --# } --# if {! [cmd {kadm5_destroy $server_handle}]} { --# error_and_restart "$test: couldn't close database" --# return --# } --# one_line_fail_test \ --# {kadm5_get_principal $server_handle admin principal} \ --# "NOT_INIT" --# end_dump_compare "no-diffs" --#} --#test2 -- --#test "destroy 3" --#proc test3 {} { --# global test --# --# begin_dump --# if {! (( ! [principal_exists "$test/a"]) || [delete_principal "$test/a"])} { --# error_and_restart "$test couldn't delete principal \"$test/a\"" --# return --# } --# if {! [cmd { --# kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ --# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ --# server_handle --# }]} { --# perror "$test: unexpected failure on init" --# return --# } --# if {! [cmd {kadm5_destroy $server_handle}]} { --# error_and_restart "$test: couldn't close database" --# return --# } --# one_line_fail_test [format { --# kadm5_create_principal $server_handle \ --# [simple_principal "%s/a"] {KADM5_PRINCIPAL} "%s/a" --# } $test $test] "NOT_INIT" --# end_dump_compare "no-diffs" --#} --#test3 -- --#test "destroy 4" --#proc test4 {} { --# global test prompt --# --# if {! (([principal_exists "$test/a"]) || [create_principal "$test/a"])} { --# error_and_restart "$test: couldn't create principal \"$test/a\"" --# return --# } --# begin_dump --# if {! ([cmd { --# kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ --# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ --# server_handle --# }] && --# [cmd [format { --# kadm5_get_principal $server_handle "%s/a" principal --# } $test]])} { --# error_and_restart "$test: error getting principal" --# return; --# } --# if {! [cmd {kadm5_destroy $server_handle}]} { --# error_and_restart "$test: couldn't close database" --# return --# } --# one_line_fail_test [format { --# kadm5_modify_principal $server_handle \ --# {"%s/a" 0 0 0 0 0 0 0 %d 0 0 0} {KADM5_KVNO} --# } $test "77"] "NOT_INIT" --# end_dump_compare "no-diffs" --#} --#test4 -- --#test "destroy 5" --# --#proc test5 {} { --# global test --# --# if {! ([principal_exists "$test/a"] || [create_principal "$test/a"])} { --# error_and_restart "$test: couldn't create principal \"$test/a\"" --# return --# } --# begin_dump --# if {! [cmd { --# kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ --# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ --# server_handle --# }]} { --# perror "$test: unexpected failure on init" --# return --# } --# if {! [cmd {kadm5_destroy $server_handle}]} { --# error_and_restart "$test: couldn't close database" --# return --# } --# one_line_fail_test [format { --# kadm5_delete_principal $server_handle "%s/a" --# } $test] "NOT_INIT" --# end_dump_compare "no-diffs" --#} --#test5 -- --#test "destroy 6" --# --#proc test6 {} { --# global test --# begin_dump --# one_line_fail_test {kadm5_destroy $server_handle} "NOT_INIT" --# end_dump_compare "no-diffs" --#} --#test6 -- -- --#test "destroy 7" --# --#proc test7 {} { --# global test --# begin_dump --# if {! [cmd { --# kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ --# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ --# server_handle --# }]} { --# perror "$test: unexpected failure in init" --# return --# } --# if {! [cmd {kadm5_destroy $server_handle}]} { --# error_and_restart "$test: couldn't close database" --# } --# one_line_fail_test {kadm5_destroy $server_handle} "NOT_INIT" --# end_dump_compare "no-diffs" --#} --#test7 -- --test "destroy 8" --proc test8 {} { -- global test -- begin_dump -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } -- one_line_succeed_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } -- end_dump_compare "no-diffs" --} --test8 -- --test "destroy 9" --proc test9 {} { -- global test -- one_line_fail_test {kadm5_destroy null} "BAD_SERVER_HANDLE" --} --test9 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.current/dlte-policy.exp b/src/lib/kadm5/unit-test/api.current/dlte-policy.exp -deleted file mode 100644 -index ad2863d0f..000000000 ---- a/src/lib/kadm5/unit-test/api.current/dlte-policy.exp -+++ /dev/null -@@ -1,208 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "delete-policy 2" --proc test2 {} { -- global test --# set prms_id 744 --# setup_xfail {*-*-*} $prms_id -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test \ -- {kadm5_delete_policy $server_handle ""} "BAD_POL" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test2 -- --test "delete-policy 5" --proc test5 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_delete_policy $server_handle "%s/a" -- } $test] "AUTH_DELETE" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if ${RPC} test5 -- --test "delete-policy 6" --proc test6 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_delete_policy $server_handle "%s/a" -- } $test] "AUTH_DELETE" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if ${RPC} test6 -- --test "delete-policy 7" --proc test7 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_delete_policy $server_handle "%s/a" -- } $test] "AUTH_DELETE" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test7 -- --test "delete-policy 10" --proc test10 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_delete_policy $server_handle "%s/a" -- } $test]]} { -- fail "$test" -- return -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- if { [policy_exists "$test/a"]} { -- fail "$test" -- return -- } --} --test10 -- --test "delete-policy 12" --proc test12 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle [princ_w_pol "%s/a" \ -- "%s/a"] {KADM5_PRINCIPAL KADM5_POLICY} \ -- NotinTheDictionary -- } $test $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_delete_policy $server_handle "%s/a" -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test12 -- --test "delete-policy 13" --proc test13 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- one_line_fail_test [format { -- kadm5_delete_policy null "%s/a" -- } $test] "BAD_SERVER_HANDLE" --} --test13 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.current/dlte-principal.exp b/src/lib/kadm5/unit-test/api.current/dlte-principal.exp -deleted file mode 100644 -index 660468534..000000000 ---- a/src/lib/kadm5/unit-test/api.current/dlte-principal.exp -+++ /dev/null -@@ -1,253 +0,0 @@ --load_lib lib.t -- --api_exit --api_start -- --#test "delete-principal 1" --#proc test1 {} { --# global test --# one_line_fail_test [format { --# kadm5_delete_principal $server_handle "%s/a" --# } $test] "NOT_INIT" --#} --#test1 -- --test "delete-principal 2" --proc test2 {} { -- global test -- -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test \ -- {kadm5_delete_principal $server_handle null} "EINVAL" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: unexpected failure in destroy" -- return -- } --} --test2 -- --test "delete-principal 5" --proc test5 {} { -- global test -- -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_delete_principal $server_handle "%s/a" -- } $test] "UNK_PRINC" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test5 -- --test "delete-principal 6" --proc test6 {} { -- global test -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal_pol "$test/a" test-pol])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_delete_principal $server_handle "%s/a" -- } $test] "AUTH_DELETE" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test6 } -- -- --test "delete-principal 7" --proc test7 {} { -- global test -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_delete_principal $server_handle "%s/a" -- } $test] "AUTH_DELETE" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test7 } -- -- --test "delete-principal 8" --proc test8 {} { -- global test -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_delete_principal $server_handle "%s/a" -- } $test] "AUTH_DELETE" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test8 } -- --test "delete-principal 9" --proc test9 {} { -- global test -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_delete_principal $server_handle "%s/a" -- } $test] "AUTH_DELETE" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test9 } -- --test "delete-principal 10" --proc test10 {} { -- global test -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_delete_principal $server_handle "%s/a" -- } $test] "AUTH_DELETE" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test10 } -- --test "delete-principal 11" --proc test11 {} { -- global test -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_delete_principal $server_handle "%s/a" -- } $test]]} { -- fail "$test: delete failed" -- return; -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- if { [principal_exists "$test/a"] } { -- fail "$test" -- return -- } --} --test11 -- --test "delete-principal 13" --proc test13 {} { -- global test -- one_line_fail_test [format { -- kadm5_delete_principal null "%s/a" -- } $test] "BAD_SERVER_HANDLE" --} --test13 -- --return "" -- -- -- -- -- -diff --git a/src/lib/kadm5/unit-test/api.current/get-policy.exp b/src/lib/kadm5/unit-test/api.current/get-policy.exp -deleted file mode 100644 -index c15ef0ca2..000000000 ---- a/src/lib/kadm5/unit-test/api.current/get-policy.exp -+++ /dev/null -@@ -1,199 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "get-policy 3" --proc test3 {} { -- global test --# set prms_id 744 --# setup_xfail {*-*-*} $prms_id -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test {kadm5_get_policy $server_handle "" p} "BAD_POLICY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test3 -- --test "get-policy 6" --proc test6 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \ -- "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } test6 -- --test "get-policy 7" --proc test7 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \ -- "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } test7 -- --test "get-policy 11" --proc test11 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/get-pol StupidAdmin $KADM5_ADMIN_SERVICE \ -- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test {kadm5_get_policy $server_handle test-pol p} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test11 -- --test "get-policy 12" --proc test12 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/get-pol StupidAdmin \ -- $KADM5_CHANGEPW_SERVICE null $KADM5_STRUCT_VERSION \ -- $KADM5_API_VERSION_3 server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test \ -- {kadm5_get_policy $server_handle test-pol-nopw p} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test12 -- --test "get-policy 15" --proc test15 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/pol StupidAdmin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test \ -- {kadm5_get_policy $server_handle test-pol-nopw p} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test15 -- --test "get-policy 16" --proc test16 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/pol StupidAdmin $KADM5_CHANGEPW_SERVICE \ -- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test \ -- {kadm5_get_policy $server_handle test-pol-nopw p} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test16 -- --test "get-policy 17" --proc test17 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test {kadm5_get_policy $server_handle test-pol p} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test17 -- --test "get-policy 18" --proc test18 {} { -- global test -- -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test {kadm5_get_policy $server_handle test-pol p} \ -- "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } test18 -- --test "get-policy 21" --proc test21 {} { -- global test -- -- one_line_fail_test {kadm5_get_policy null "pol1" p} "BAD_SERVER_HANDLE" --} --test21 -diff --git a/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp -deleted file mode 100644 -index 3ea1ba29b..000000000 ---- a/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp -+++ /dev/null -@@ -1,250 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "get-principal 100" --proc test100 {} { -- global test prompt -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd { -- kadm5_get_principal $server_handle testuser p \ -- {KADM5_PRINCIPAL_NORMAL_MASK} -- }]} { -- perror "$test: unexpected failure in get_principal" -- } -- send "lindex \$p 16\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" { set num_keys $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting num_keys" -- return -- } -- eof { -- error_and_restart "$test: eof getting num_keys" -- return -- } -- } -- send "lindex \$p 17\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" { set num_tl $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting num_tl" -- return -- } -- eof { -- error_and_restart "$test: eof getting num_tl" -- return -- } -- } -- send "lindex \$p 18\n" -- expect { -- -re "({.*})\n$prompt" {set key_data $expect_out(1,string) } -- -re "\n$prompt" { set key_data {} } -- timeout { -- error_and_restart "$test: timeout getting key_data" -- return -- } -- eof { -- error_and_restart "$test: eof getting key_data" -- return -- } -- } -- send "lindex \$p 19\n" -- expect { -- -re "({.*})\n$prompt" {set tl_data $expect_out(1,string) } -- -re "\n$prompt" { set tl_data {} } -- timeout { -- error_and_restart "$test: timeout getting tl_data" -- return -- } -- eof { -- error_and_restart "$test: eof getting tl_data" -- return -- } -- } -- -- set failed 0 -- if {$num_keys != 0} { -- fail "$test: num_keys $num_keys should be 0" -- set failed 1 -- } -- if {$num_tl != 0} { -- fail "$test: num_tl $num_tl should be 0" -- set failed 1 -- } -- if {$key_data != {}} { -- fail "$test: key_data $key_data should be {}" -- set failed 1 -- } -- if {$tl_data != "{}"} { -- fail "$test: tl_data $tl_data should be empty" -- set failed 1 -- } -- if {$failed == 0} { -- pass "$test" -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test100 -- --proc test101_102 {rpc} { -- global test prompt -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd { -- kadm5_get_principal $server_handle testuser p \ -- {KADM5_PRINCIPAL_NORMAL_MASK KADM5_KEY_DATA} -- }]} { -- perror "$test: unexpected failure in get_principal" -- } -- send "lindex \$p 16\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" { set num_keys $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting num_keys" -- return -- } -- eof { -- error_and_restart "$test: eof getting num_keys" -- return -- } -- } -- send "lindex \$p 18\n" -- expect { -- -re "({.*})\n$prompt" {set key_data $expect_out(1,string) } -- -re "\n$prompt" { set key_data {} } -- timeout { -- error_and_restart "$test: timeout getting key_data" -- return -- } -- eof { -- error_and_restart "$test: eof getting key_data" -- return -- } -- } -- -- set failed 0 -- if {$num_keys != 5} { -- fail "$test: num_keys $num_keys should be 5" -- set failed 1 -- } -- for {set i 0} {$i < $num_keys} {incr i} { -- set key "[lindex [lindex $key_data $i] 2]" -- if {($rpc && [string compare $key ""] != 0) || -- ((! $rpc) && [string compare $key ""] == 0)} { -- fail "$test: key_data $key is wrong" -- set failed 1 -- -- } -- } -- if {$failed == 0} { pass "$test" } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test "get-principal 101" --if {$RPC} {test101_102 $RPC} --test "get-principal 102" --if {! $RPC} {test101_102 $RPC} -- --test "get-principal 103" --proc test103 {} { -- global test prompt -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle \ -- "{%s/a} 0 0 0 0 {%s/a} 0 0 0 0 null 0 0 0 0 0 0 1 {} {{999 6 foobar}}" \ -- {KADM5_TL_DATA} -- } $test $test]]} { -- fail "$test: cannot set TL_DATA" -- return -- } -- -- if {! [cmd [format { -- kadm5_get_principal $server_handle {%s/a} p \ -- {KADM5_PRINCIPAL_NORMAL_MASK KADM5_TL_DATA} -- } $test]]} { -- perror "$test: unexpected failure in get_principal" -- } -- send "lindex \$p 17\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" { set num_tl $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting num_tl" -- return -- } -- eof { -- error_and_restart "$test: eof getting num_tl" -- return -- } -- } -- send "lindex \$p 19\n" -- expect { -- -re "({.*})\n$prompt" {set tl_data $expect_out(1,string) } -- -re "\n$prompt" { set tl_data {} } -- timeout { -- error_and_restart "$test: timeout getting tl_data" -- return -- } -- eof { -- error_and_restart "$test: eof getting tl_data" -- return -- } -- } -- -- if {$num_tl == 0} { -- fail "$test: num_tl $num_tl should not be 0" -- } elseif {$tl_data == "{{999 6 foobar}}"} { -- pass "$test" -- } else { -- fail "$test: tl_data $tl_data should be {{999 6 foobar}}" -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test103 -- --return "" -- -- -- -- -diff --git a/src/lib/kadm5/unit-test/api.current/get-principal.exp b/src/lib/kadm5/unit-test/api.current/get-principal.exp -deleted file mode 100644 -index a33fdfe8c..000000000 ---- a/src/lib/kadm5/unit-test/api.current/get-principal.exp -+++ /dev/null -@@ -1,346 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "get-principal 1" --proc test1 {} { -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test \ -- {kadm5_get_principal $server_handle null p KADM5_PRINCIPAL_NORMAL_MASK} "EINVAL" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test1 -- --test "get-principal 2" --proc test2 {} { -- global test -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK -- } $test] "UNK_PRINC" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test2 -- --test "get-principal 3" --proc test3 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK -- } $test] "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test3 } -- --test "get-principal 4" --proc test4 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK -- } $test] "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test4 } -- --test "get-principal 5" --proc test5 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK -- } $test] "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test5 } -- --test "get-principal 6" --proc test6 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK -- } $test] "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test6 } -- --test "get-principal 7" --proc test7 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK -- } $test] "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test7 } -- -- --test "get-principal 8" --proc test8 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_get_principal $server_handle "%s/a" p KADM5_PRINCIPAL_NORMAL_MASK -- } $test] "AUTH_GET" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test8 } -- -- --test "get-principal 9" --proc test9 {} { -- global test -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test \ -- {kadm5_get_principal $server_handle admin/none p KADM5_PRINCIPAL_NORMAL_MASK} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test9 -- --test "get-principal 10" --proc test10 {} { -- global test -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test \ -- {kadm5_get_principal $server_handle admin/none p KADM5_PRINCIPAL_NORMAL_MASK} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test10 -- --test "get-principal 11" --proc test11 {} { -- global test -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test {kadm5_get_principal $server_handle admin/get p KADM5_PRINCIPAL_NORMAL_MASK} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test11 -- --test "get-principal 12" --proc test12 {} { -- global test -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test {kadm5_get_principal $server_handle admin/get p KADM5_PRINCIPAL_NORMAL_MASK} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test12 -- --test "get-principal 13" --proc test13 {} { -- global test -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test {kadm5_get_principal $server_handle admin/add p KADM5_PRINCIPAL_NORMAL_MASK} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test13 -- --test "get-principal 14" --proc test14 {} { -- global test -- if {! [cmd { -- kadm5_init admin/get-mod admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test {kadm5_get_principal $server_handle admin/add p KADM5_PRINCIPAL_NORMAL_MASK} -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test14 -- --test "get-principal 15" --proc test15 {} { -- one_line_fail_test \ -- {kadm5_get_principal null "admin" p KADM5_PRINCIPAL_NORMAL_MASK} "BAD_SERVER_HANDLE" --} --test15 -- --return "" -- -- -- -- -diff --git a/src/lib/kadm5/unit-test/api.current/init-v2.exp b/src/lib/kadm5/unit-test/api.current/init-v2.exp -deleted file mode 100644 -index 47764c212..000000000 ---- a/src/lib/kadm5/unit-test/api.current/init-v2.exp -+++ /dev/null -@@ -1,506 +0,0 @@ --load_lib lib.t -- --api_exit --api_start -- --proc get_hostname { } { -- global hostname -- -- if {[info exists hostname]} { -- return 1 -- } -- -- catch "exec hostname >myname" exec_output -- if ![string match "" $exec_output] { -- send_log "$exec_output\n" -- verbose $exec_output -- send_error "ERROR: can't get hostname\n" -- return 0 -- } -- set file [open myname r] -- if { [ gets $file hostname ] == -1 } { -- send_error "ERROR: no output from hostname\n" -- return 0 -- } -- close $file -- catch "exec rm -f myname" exec_output -- -- set hostname [string tolower $hostname] -- verbose "hostname: $hostname" -- -- return 1 --} -- -- --test "init 101" --proc test101 {} { -- global test -- global hostname -- -- get_hostname -- tcl_cmd "set hostname $hostname" -- -- # XXX Fix to work with a remote TEST_SERVER. For now, make sure -- # it fails in that case. -- one_line_succeed_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_ADMIN_SERVER KADM5_CONFIG_KADMIND_PORT} [list $hostname 1751]] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_ADMIN_SERVER KADM5_CONFIG_KADMIND_PORT} [list $hostname 4]] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } "RPC_ERROR" --} --if {$RPC} test101 -- --test "init 102" --proc test102 {} { -- global test -- -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_ADMIN_SERVER} does.not.exist] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } "CANT_RESOLVE" --} --if {$RPC} test102 -- --test "init 103" --proc test103 {} { -- global test -- -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_DBNAME} /does-not-exist] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } "ENOENT" --} --#if {! $RPC} test103 --if {! $RPC} { -- send_user "UNTESTED: test103: test needs updating for DAL changes (see MIT RT ticket 3202)\n" -- untested "test103: test needs updating for DAL changes (see MIT RT ticket 3202)" --} -- -- --test "init 106" --proc test106 {} { -- global test prompt -- -- set prompting 0 -- send [string trim { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_MKEY_FROM_KBD} 1] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }] -- send "\n" -- expect { -- -re "\n\[^\n\]+:\[^\n\]*$" { set prompting 1} -- -re "\nOK .*$prompt$" { fail "$test: premature success" } -- -re "\nERROR .*$prompt$" { fail "$test: premature failure" } -- timeout { fail "$test: timeout" } -- eof { fail "$test: eof" } -- } -- if {$prompting} { -- one_line_succeed_test mrroot -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --if {! $RPC} test106 -- --test "init 107" --proc test107 {} { -- global test -- -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_STASH_FILE} /does-not-exist] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } "KDB_CANTREAD_STORED" --} --if {! $RPC} test107 -- --test "init 108" --proc test108 {} { -- global test -- -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_MKEY_NAME} does/not/exist] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } "KRB5_KDB_CANTREAD_STORED" --} --if {! $RPC} test108 -- --test "init 109-113" --proc test109 {} { -- global test prompt -- -- delete_principal "$test/a" -- -- # I'd like to specify flags explicitly and check them, as in the -- # following config_params, but tcl gets mighty confused if I do and -- # I have no idea why. --# [config_params {KADM5_CONFIG_MAX_LIFE KADM5_CONFIG_MAX_RLIFE KADM5_CONFIG_EXPIRATION KADM5_CONFIG_FLAGS KADM5_CONFIG_ENCTYPES} {10 20 30 KRB5_KDB_DISALLOW_TGT_BASED {}} ] -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_MAX_LIFE KADM5_CONFIG_MAX_RLIFE KADM5_CONFIG_EXPIRATION KADM5_CONFIG_ENCTYPES} {10 20 30 {}} ] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- fail "$test: cannot init with max_life" -- return -- } -- if {! [cmd [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} testpass -- } $test]]} { -- fail "$test: can not create principal" -- return; -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" p \ -- {KADM5_PRINCIPAL_NORMAL_MASK KADM5_KEY_DATA} -- } $test]]} { -- fail "$test: can not get principal" -- return; -- } -- send "puts \$p\n" -- expect { -- -re "$prompt" { } -- timeout { -- error_and_restart "$test: timeout getting prompt" -- return -- } -- eof { -- error_and_restart "$test: eof getting prompt" -- return -- } -- } -- send "lindex \$p 4\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set max_life $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting max_life" -- return -- } -- eof { -- error_and_restart "$test: eof getting max_life" -- return -- } -- } -- send "lindex \$p 12\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set max_rlife $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting max_rlife" -- return -- } -- eof { -- error_and_restart "$test: eof getting max_rlife" -- return -- } -- } -- send "lindex \$p 1\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set expiration $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting expiration" -- return -- } -- eof { -- error_and_restart "$test: eof getting expiration" -- return -- } -- } -- send "lindex \$p 7\n" -- expect { -- -re "(\[A-Z_\]*)\n$prompt" {set flags $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting flags" -- return -- } -- eof { -- error_and_restart "$test: eof getting flags" -- return -- } -- } -- # This sorta worries me. Since the test is setting ENCTYPES to -- # nothing, the principal has no keys. That means that nothing is -- # printed for the keys in the correct case; but it feels too -- # likely that nothing will be printed in the case of some problem. -- send "lindex \$p 18\n" -- expect { -- -re "({.*})\n$prompt" {set key_data $expect_out(1,string) } -- -re "\n$prompt" { set key_data {} } -- timeout { -- error_and_restart "$test: timeout getting flags" -- return -- } -- eof { -- error_and_restart "$test: eof getting flags" -- return -- } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } -- if {$max_life == 10} { -- pass "$test" -- } else { -- fail "$test: $max_life is not 10" -- } -- if {$max_rlife == 20} { -- pass "$test" -- } else { -- fail "$test: $max_rlife is not 20" -- } -- if {$expiration == 30} { -- pass "$test" -- } else { -- fail "$test: $expiration is not 30" -- } -- if {$flags == ""} { -- pass "$test" -- } else { -- fail "$test: flags $flags are wrong" -- } -- if {$key_data == {}} { -- pass "$test" -- } else { -- fail "$test: key_data $key_data is wrong" -- } --} --if {! $RPC} test109 -- --test "init 116" --proc test116 {} { -- global test -- -- delete_principal "$test/a" -- -- if {! [cmd {kadm5_init admin/get-add admin $KADM5_ADMIN_SERVICE \ -- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- get_add_handle}]} { -- error_and_restart "$test: couldn't init with admin/get-add" -- } -- -- if {! [cmd {kadm5_init admin/mod-delete admin $KADM5_ADMIN_SERVICE \ -- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- mod_delete_handle}]} { -- error_and_restart "$test: couldn't init with admin/get-add" -- } -- -- one_line_succeed_test { -- kadm5_get_principal $get_add_handle testuser p \ -- KADM5_PRINCIPAL_NORMAL_MASK -- } -- one_line_succeed_test [format { -- kadm5_create_principal $get_add_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} testpass -- } $test] -- one_line_fail_test { -- kadm5_modify_principal $get_add_handle [simple_principal testuser] \ -- {KADM5_PRINC_EXPIRE_TIME} -- } "AUTH_MODIFY" -- one_line_fail_test { -- kadm5_delete_principal $get_add_handle testuser -- } "AUTH_DELETE" -- -- one_line_fail_test { -- kadm5_get_principal $mod_delete_handle testuser p \ -- KADM5_PRINCIPAL_NORMAL_MASK -- } "AUTH_GET" -- one_line_fail_test [format { -- kadm5_create_principal $mod_delete_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} testpass -- } $test] "AUTH_ADD" -- one_line_succeed_test { -- kadm5_modify_principal $mod_delete_handle [simple_principal testuser] \ -- {KADM5_PRINC_EXPIRE_TIME} -- } -- one_line_succeed_test [format { -- kadm5_delete_principal $mod_delete_handle "%s/a" -- } $test] -- -- if {! [cmd {kadm5_destroy $get_add_handle}]} { -- error_and_restart "$test: couldn't close get_add_handle" -- } -- if {! [cmd {kadm5_destroy $mod_delete_handle}]} { -- error_and_restart "$test: couldn't close mod_delete_handle" -- } --} --if {$RPC} test116 -- --test "init 117" --proc test117 {} { -- global test env prompt -- -- if {[catch "exec grep max_life $env(KRB5_KDC_PROFILE)"] != 1} { -- warning \ -- "$test: max_life in $env(KRB5_KDC_PROFILE), cannot perform test" -- return -- } -- -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- fail "$test: unexpected failure in init" -- return -- } -- -- if {! [cmd [format { -- kadm5_create_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} "%s/a" -- } $test $test]]} { -- perror "$test: unexpected failure creating principal" -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_MAX_LIFE -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 4\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set max_life $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting max_life" -- return -- } -- eof { -- error_and_restart "$test: eof getting max_life" -- return -- } -- } -- -- if {$max_life == 86400} { -- pass "$test" -- } else { -- fail "$test: max_life $max_life should be 86400" -- } -- -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close server_handle" -- } --} --test117 -- --send "puts \$KADM5_ADMIN_SERVICE\n" --expect { -- -re "(\[a-zA-Z/@\]+)\n$prompt" { -- set KADM5_ADMIN_SERVICE $expect_out(1,string) -- } -- default { -- error_and_restart "$test: timeout/eof getting admin_service" -- return -- } --} -- --send "puts \$KADM5_CHANGEPW_SERVICE\n" --expect { -- -re "(\[a-zA-Z/@\]+)\n$prompt" { -- set KADM5_CHANGEPW_SERVICE $expect_out(1,string) -- } -- default { -- error_and_restart "$test: timeout/eof getting changepw_service" -- return -- } --} -- --test "init 150" --proc test150 {} { -- global test KADM5_ADMIN_SERVICE -- -- kdestroy -- kinit testuser notathena "-S $KADM5_ADMIN_SERVICE" -- one_line_succeed_test { -- kadm5_init_with_creds testuser null $KADM5_ADMIN_SERVICE \ -- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } -- kdestroy --} --if {$RPC} test150 -- --test "init 151" --proc test151 {} { -- global test KADM5_CHANGEPW_SERVICE -- -- kdestroy -- kinit testuser notathena "-S $KADM5_CHANGEPW_SERVICE" -- one_line_succeed_test { -- kadm5_init_with_creds testuser null $KADM5_CHANGEPW_SERVICE \ -- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } -- kdestroy --} --if {$RPC} test151 -- --test "init 152" --proc test152 {} { -- global test KADM5_ADMIN_SERVICE -- -- kdestroy -- one_line_fail_test { -- kadm5_init_with_creds testuser null $KADM5_ADMIN_SERVICE \ -- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } "KRB5_FCC_NOFILE" --} --if {$RPC} test152 -- --test "init 153" --proc test153 {} { -- global test KADM5_ADMIN_SERVICE -- -- kinit testuser notathena -- one_line_fail_test { -- kadm5_init_with_creds testuser null $KADM5_ADMIN_SERVICE \ -- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } "KRB5_CC_NOTFOUND" --} --if {$RPC} test153 -- --test "init 154" --proc test154 {} { -- global test env -- -- set orig $env(KRB5_KDC_PROFILE) -- set env(KRB5_KDC_PROFILE) /does-not-exist -- api_exit; api_start -- set env(KRB5_KDC_PROFILE) $orig -- -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } "ENOENT" -- -- api_exit; lib_start_api --} --if {0 && ! $RPC} test154 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.current/init.exp b/src/lib/kadm5/unit-test/api.current/init.exp -deleted file mode 100644 -index 8390b9cfa..000000000 ---- a/src/lib/kadm5/unit-test/api.current/init.exp -+++ /dev/null -@@ -1,699 +0,0 @@ --load_lib lib.t -- --# Assumptions: --# --# Principal "admin" exists, with "get", "add", "modify" and "delete" --# access bits and password "admin". --# The string "not-the-password" isn't the password of any user in the database. --# Database master password is "mrroot". -- --api_exit --api_start --test "init 1" -- --one_line_fail_test_nochk \ -- {kadm5_init admin admin $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_REALM} {""}] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 server_handle} -- --test "init 2" -- --one_line_fail_test_nochk \ -- {kadm5_init admin admin $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_REALM} {@}] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 server_handle} -- --test "init 2.5" -- --one_line_fail_test_nochk \ -- {kadm5_init admin admin $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_REALM} {BAD.REALM}] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 server_handle} -- --test "init 3" -- --proc test3 {} { -- global test -- if {! ([principal_exists "$test/a"] || [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- one_line_fail_test_nochk [format { -- kadm5_init admin admin "%s/a" null $KADM5_STRUCT_VERSION \ -- $KADM5_API_VERSION_3 server_handle -- } $test] --} --if {$RPC} { test3 } -- --test "init 4" -- --proc test4 {} { -- global test -- if {! ((! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- -- one_line_fail_test_nochk [format { -- kadm5_init admin admin "%s/a" null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } $test] --} --if {$RPC} { test4 } -- --test "init 5" -- --if {$RPC} { -- one_line_fail_test_nochk { -- kadm5_init admin admin admin null $KADM5_STRUCT_VERSION \ -- $KADM5_API_VERSION_3 server_handle -- } --} -- --test "init 6" -- --proc test6 {} { -- global test -- -- send "kadm5_init admin null \$KADM5_ADMIN_SERVICE null \$KADM5_STRUCT_VERSION \$KADM5_API_VERSION_3 server_handle\n" -- -- expect { -- -re "assword\[^\r\n\]*:" { } -- eof { -- fail "$test: eof instead of password prompt" -- api_exit -- api_start -- return -- } -- timeout { -- fail "$test: timeout instead of password prompt" -- return -- } -- } -- one_line_succeed_test "admin" -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --if { $RPC } { test6 } -- --test "init 8" -- --proc test8 {} { -- global test -- if {! ([principal_exists "$test/a"] || [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- one_line_fail_test_nochk [format { -- kadm5_init "%s/a" admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } $test] --} --if {$RPC} { test8 } -- --test "init 9" -- --if {$RPC} { -- global test -- one_line_fail_test_nochk { -- kadm5_init admin not-the-password $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } --} -- --test "init 10" -- --proc test10 {} { -- global test --# set prms_id 562 --# setup_xfail {*-*-*} $prms_id -- one_line_fail_test_nochk { -- kadm5_init null admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } --} --test10 -- --#test "init 11" --# --#proc test11 {} { --# global test --# set prms_id 563 --# setup_xfail {*-*-*} $prms_id --# one_line_fail_test_nochk { --# kadm5_init "" admin $KADM5_ADMIN_SERVICE null \ --# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ --# server_handle --# } --#} --#test11 -- --test "init 12" -- --proc test12 {} { -- global test -- one_line_fail_test_nochk [format { -- kadm5_init "%s/a" admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } $test] --} --if {$RPC} { test12 } -- --test "init 13" -- --proc test13 {} { -- global test -- one_line_fail_test_nochk [format { -- kadm5_init "%s/a@SECURE-TEST.OV.COM" admin \ -- $KADM5_ADMIN_SERVICE null $KADM5_STRUCT_VERSION \ -- $KADM5_API_VERSION_3 server_handle -- } $test] --} --if {$RPC} { test13 } -- --test "init 14" -- --proc test14 {} { -- global test -- one_line_fail_test_nochk [format { -- kadm5_init "%s/a@BAD.REALM" admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } $test] --} --if {$RPC} { test14 } -- --test "init 15" -- --if {$RPC} { -- one_line_fail_test_nochk { -- kadm5_init admin@BAD.REALM admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } --} -- --test "init 16" -- --proc test16 {} { -- global test -- one_line_succeed_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --test16 -- --test "init 17" -- --proc test17 {} { -- global test -- one_line_succeed_test { -- kadm5_init admin@SECURE-TEST.OV.COM admin \ -- $KADM5_ADMIN_SERVICE null $KADM5_STRUCT_VERSION \ -- $KADM5_API_VERSION_3 server_handle -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --test17 -- --test "init 18" -- --proc test18 {} { -- global test -- one_line_succeed_test { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --test18 -- --test "init 19" -- --proc test19 {} { -- global test -- one_line_succeed_test { -- kadm5_init admin@SECURE-TEST.OV.COM admin \ -- $KADM5_ADMIN_SERVICE \ -- [config_params {KADM5_CONFIG_REALM} {SECURE-TEST.OV.COM}] \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --test19 -- --test "init 20" -- --proc test20 {} { -- global test -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- error_and_restart "$test: couldn't init database" -- return -- } -- one_line_succeed_test \ -- {kadm5_get_principal $server_handle admin principal KADM5_PRINCIPAL_NORMAL_MASK} -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --test20 -- --#test "init 21" --# --#proc test21 {} { --# global test --# if {! [cmd { --# kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ --# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ --# server_handle --# }]} { --# error_and_restart "$test: couldn't init database" --# return --# } --# one_line_fail_test_nochk { --# kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ --# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ --# server_handle --# } --# if {! [cmd {kadm5_destroy $server_handle}]} { --# error_and_restart "$test: couldn't close database" --# } --#} --#test21 -- -- --# proc test22 {} { --# global test prompt --# set prompting 0 --# send [string trim { --# kadm5_init admin null null null $KADM5_STRUCT_VERSION \ --# $KADM5_API_VERSION_3 server_handle --# }] --# send "\n" --# expect { --# -re ":$" { set prompting 1} --# -re "\nOK .*$prompt$" { fail "$test: premature success" } --# -re "\nERROR .*$prompt$" { fail "$test: premature failure" } --# timeout { fail "$test: timeout" } --# eof { fail "$test: eof" } --# } --# if {$prompting} { --# one_line_succeed_test mrroot --# } --# if {! [cmd {kadm5_destroy $server_handle}]} { --# error_and_restart "$test: couldn't close database" --# } --# } --# if {! $RPC} { test22 } --# --# test "init 22.5" --# proc test225 {} { --# global test prompt --# set prompting 0 --# send [string trim { --# kadm5_init admin null null null $KADM5_STRUCT_VERSION \ --# $KADM5_API_VERSION_3 server_handle --# }] --# send "\n" --# expect { --# -re ":$" { set prompting 1} --# -re "\nOK .*$prompt$" { fail "$test: premature success" } --# -re "\nERROR .*$prompt$" { fail "$test: premature failure" } --# timeout { fail "$test: timeout" } --# eof { fail "$test: eof" } --# } --# if {$prompting} { --# one_line_succeed_test mrroot --# } --# if {! [cmd {kadm5_destroy $server_handle}]} { --# error_and_restart "$test: couldn't close database" --# } --# } --# if {! $RPC} { test225 } -- --test "init 23" -- --proc test23 {} { -- global test -- one_line_succeed_test { -- kadm5_init admin not-the-password $KADM5_ADMIN_SERVICE \ -- null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --if {! $RPC} { test23 } -- --test "init 24" -- --proc test24 {} { -- global test -- one_line_succeed_test { -- kadm5_init admin admin null null $KADM5_STRUCT_VERSION \ -- $KADM5_API_VERSION_3 server_handle -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --if {! $RPC} { test24 } -- --test "init 25" -- --proc test25 {} { -- global test -- one_line_succeed_test { -- kadm5_init admin admin foobar null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --if {! $RPC} { test25 } -- --test "init 26" -- --#proc test26 {} { --# global test --# --# api_exit --# api_start --# one_line_fail_test_nochk { --# kadm5_get_principal $server_handle admin principal --# } --#} --#test26 -- --#test "init 27" --# --#proc test27 {} { --# global test --# --# if {! ((! [principal_exists "$test/a"]) || [delete_principal "$test/a"])} { --# error_and_restart "$test: couldn't delete principal \"$test/a\"" --# return --# } --# begin_dump --# if {[cmd [format { --# kadm5_create_principal $server_handle [simple_principal \ --# "%s/a"] {KADM5_PRINCIPAL} "%s/a" --# } $test $test]]} { --# fail "$test: unexpected success in add" --# return --# } --# end_dump_compare "no-diffs" --#} --#test27 -- --#test "init 28" --# --#proc test28 {} { --# global test prompt --# --# if {! ([principal_exists "$test/a"] || [create_principal "$test/a"])} { --# error_and_restart "$test: couldn't create principal \"$test/a\"" --# return --# } --# begin_dump --# if {! ([cmd { --# kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ --# $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ --# server_handle --# }] && [cmd [format { --# kadm5_get_principal $server_handle "%s/a" principal --# } $test]])} { --# error_and_restart "$test: error getting principal" --# return; --# } --# send "lindex \$principal 8\n" --# expect { --# -re "\n(\[0-9\]+).*$prompt$" {set kvno $expect_out(1,string) } --# timeout { --# error_and_restart "$test: timeout getting principal kvno" --# return --# } --# eof { --# error_and_restart "$test: eof getting principal kvno" --# return --# } --# } --# api_exit --# api_start --# set new_kvno [expr "$kvno + 1"] --# if {[cmd [format { --# kadm5_modify_principal $server_handle \ --# {"%s/a" 0 0 0 0 0 0 0 %d 0 0 0} {KADM5_KVNO} --# } $test $new_kvno]]} { --# fail "$test: unexpected success in modify" --# return; --# } --# end_dump_compare "no-diffs" --#} --#test28 -- --#test "init 29" --# --#proc test29 {} { --# global test --# --# if {! ([principal_exists "$test/a"] || [create_principal "$test/a"])} { --# error_and_restart "$test: couldn't create principal \"$test/a\"" --# return --# } --# begin_dump --# if {[cmd [format { --# kadm5_delete_principal $server_handle "%s/a" --# } $test]]} { --# fail "$test: unexpected success in delete" --# return --# } --# end_dump_compare "no-diffs" --#} --#test29 -- --test "init 30" --proc test30 {} { -- global test -- if {[cmd { -- kadm5_init admin foobar $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- error_and_restart "$test: unexpected success" -- return -- } -- one_line_succeed_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --if ${RPC} { test30 } -- --test "init 31" --proc test31 {} { -- global test -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $bad_struct_version_mask $KADM5_API_VERSION_3 \ -- server_handle -- } "BAD_STRUCT_VERSION" --} --test31 -- --test "init 32" --proc test32 {} { -- global test -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $no_struct_version_mask $KADM5_API_VERSION_3 \ -- server_handle -- } "BAD_STRUCT_VERSION" --} --test32 -- --test "init 33" --proc test33 {} { -- global test -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $old_struct_version $KADM5_API_VERSION_3 \ -- server_handle -- } "OLD_STRUCT_VERSION" --} --test33 -- --test "init 34" --proc test34 {} { -- global test -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $new_struct_version $KADM5_API_VERSION_3 \ -- server_handle -- } "NEW_STRUCT_VERSION" --} --test34 -- --test "init 35" --proc test35 {} { -- global test -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $bad_api_version_mask \ -- server_handle -- } "BAD_API_VERSION" --} --test35 -- --test "init 36" --proc test36 {} { -- global test -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $no_api_version_mask \ -- server_handle -- } "BAD_API_VERSION" --} --test36 -- --test "init 37" --proc test37 {} { -- global test -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $old_api_version \ -- server_handle -- } "OLD_LIB_API_VERSION" --} --if { $RPC } test37 -- --test "init 38" --proc test38 {} { -- global test -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $old_api_version \ -- server_handle -- } "OLD_SERVER_API_VERSION" --} --if { ! $RPC } test38 -- --test "init 39" --proc test39 {} { -- global test -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $new_api_version \ -- server_handle -- } "NEW_LIB_API_VERSION" --} --if { $RPC } test39 -- --test "init 40" --proc test40 {} { -- global test -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $new_api_version \ -- server_handle -- } "NEW_SERVER_API_VERSION" --} --if { ! $RPC } test40 -- --test "init 41" --proc test41 {} { -- global test -- one_line_fail_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_API_VERSION_3 $KADM5_STRUCT_VERSION \ -- server_handle -- } "BAD_" --} --test41 -- --test "init 42" --proc test42 {} { -- global test -- one_line_succeed_test { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } -- if {! [cmd {kadm5_destroy $server_handle}]} { -- error_and_restart "$test: couldn't close database" -- } --} --test42 -- -- --proc test45_46 {service} { -- global test kadmin_local env -- -- spawn $kadmin_local -q "delprinc -force $service" -- expect { -- -re "Principal .* deleted." {} -- default { -- perror "kadmin.local delprinc failed\n"; -- } -- } -- expect eof -- wait -- -- one_line_fail_test [concat {kadm5_init admin admin } \ -- $service \ -- { null $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle}] "SECURE_PRINC_MISSING" -- -- # this leaves the keytab with an incorrect entry -- spawn $kadmin_local -q "ank -randkey $service" -- expect eof -- wait -- -- # restart the api so it gets a new ccache -- api_exit -- api_start --} -- --if {$RPC} { -- test "init 45" -- -- test45_46 kadmin/admin -- -- test "init 46" -- -- test45_46 kadmin/changepw --} -- --return "" -- -diff --git a/src/lib/kadm5/unit-test/api.current/mod-policy.exp b/src/lib/kadm5/unit-test/api.current/mod-policy.exp -deleted file mode 100644 -index 1bf00b524..000000000 ---- a/src/lib/kadm5/unit-test/api.current/mod-policy.exp -+++ /dev/null -@@ -1,711 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "modify-policy 2" --proc test2 {} { -- global test -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test] "AUTH_MODIFY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test2 } -- --test "modify-policy 8" --proc test8 {} { -- global test --# set prms_id 744 --# setup_xfail {*-*-*} $prms_id -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_modify_policy $server_handle [simple_policy ""] \ -- {KADM5_PW_MAX_LIFE} -- } "BAD_POLICY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test8 -- --test "modify-policy 9" --proc test9 {} { -- global test -- global prompt -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MIN_LIFE} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 1\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test9 -- --test "modify-policy 10" --proc test10 {} { -- global test -- global prompt -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 32 0 0 0 0 0 0 0 0} \ -- {KADM5_PW_MIN_LIFE} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 1\n" -- expect { -- -re "32\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test10 -- -- --test "modify-policy 11" --proc test11 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 2\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test11 -- --test "modify-policy 12" --proc test12 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 32 0 0 0 0 0 0 0} \ -- {KADM5_PW_MAX_LIFE} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 2\n" -- expect { -- -re "32\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test12 -- --test "modify-policy 13" --proc test13 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MIN_LENGTH} -- } $test] "BAD_LENGTH" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test13 -- --test "modify-policy 14" --proc test14 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 8 0 0 0 0 0 0} \ -- {KADM5_PW_MIN_LENGTH} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 3\n" -- expect { -- -re "8\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test14 -- --test "modify-policy 15" --proc test15 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MIN_CLASSES} -- } $test] "BAD_CLASS" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test15 -- --test "modify-policy 16" --proc test16 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 1 0 0 0 0 0} \ -- {KADM5_PW_MIN_CLASSES} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 4\n" -- expect { -- -re "1\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test16 -- --test "modify-policy 17" --proc test17 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a"])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 5 0 0 0 0 0} \ -- {KADM5_PW_MIN_CLASSES} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 4\n" -- expect { -- -re "5\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test17 -- --test "modify-policy 18" --proc test18 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 6 0 0 0 0 0} \ -- {KADM5_PW_MIN_CLASSES} -- } $test] "BAD_CLASS" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test18 -- --test "modify-policy 19" --proc test19 {} { -- global test -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_HISTORY_NUM} -- } $test] "BAD_HISTORY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test19 -- --test "modify-policy 20" --proc test20 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 0 1 0 0 0 0} \ -- {KADM5_PW_HISTORY_NUM} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 5\n" -- expect { -- -re "1\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test20 -- --test "modify-policy 21" --proc test21 {} { -- global test -- global prompt -- -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 0 10 0 0 0 0} \ -- {KADM5_PW_HISTORY_NUM} -- } $test]]} { -- fail $test -- return -- } -- if {! [cmd [format { -- kadm5_get_policy $server_handle "%s/a" policy -- } $test]]} { -- fail "$test: can not retrieve policy" -- return -- } -- send "lindex \$policy 5\n" -- expect { -- -re "10\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test21 -- --test "modify-policy 22" --proc test22 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test] "AUTH_MODIFY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test22 -- --test "modify-policy 23" --proc test23 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test] "AUTH_MODIFY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} test23 -- --test "modify-policy 26" --proc test26 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_modify_policy $server_handle [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test26 -- --test "modify-policy 30" --proc test30 {} { -- global test -- -- one_line_fail_test [format { -- kadm5_modify_policy null [simple_policy "%s/a"] \ -- {KADM5_PW_MAX_LIFE} -- } $test] "BAD_SERVER_HANDLE" --} --test30 -- --test "modify-policy 31" --proc test31 {} { -- global test -- if {! (( [policy_exists "$test/a"]) || -- [create_policy "$test/a" ])} { -- error_and_restart "$test: couldn't create policy \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 0 0 0 2 0 0} \ -- {KADM5_PW_MAX_FAILURE} -- } $test] -- one_line_succeed_test [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 1 0 0 0 90 0} \ -- {KADM5_PW_FAILURE_COUNT_INTERVAL} -- } $test] -- one_line_succeed_test [format { -- kadm5_modify_policy $server_handle {"%s/a" 0 0 0 1 0 0 0 0 180} \ -- {KADM5_PW_LOCKOUT_DURATION} -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test31 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.current/mod-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/mod-principal-v2.exp -deleted file mode 100644 -index 4abbeb52d..000000000 ---- a/src/lib/kadm5/unit-test/api.current/mod-principal-v2.exp -+++ /dev/null -@@ -1,115 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "modify-principal 100-105" --proc test100_104 {} { -- global test -- global prompt -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- -- set origtest "$test" -- -- test "modify-principal 100" -- one_line_succeed_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_MAX_RLIFE} -- } $origtest] -- -- test "modify-principal 101" -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_LAST_SUCCESS} -- } $origtest] "BAD_MASK" -- -- test "modify-principal 102" -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_LAST_FAILED} -- } $origtest] "BAD_MASK" -- --# This is now permitted to reset lockout count --# test "modify-principal 103" --# one_line_fail_test [format { --# kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ --# {KADM5_FAIL_AUTH_COUNT} --# } $origtest] "BAD_MASK" -- -- test "modify-principal 103.5" -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_KEY_DATA} -- } $origtest] "BAD_MASK" -- -- test "modify-principal 105" -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle \ -- "{%s/a} 0 0 0 0 {%s/a} 0 0 0 0 null 0 0 0 0 0 0 1 {} {{1 1 x}}" \ -- {KADM5_TL_DATA} -- } $origtest $origtest] "BAD_TL_TYPE" -- -- test "modify-principal 100,104" -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle \ -- "{%s/a} 0 0 0 0 {%s/a} 0 0 0 0 null 0 88 0 0 0 0 1 {} {{990 6 foobar}}" \ -- {KADM5_MAX_RLIFE KADM5_TL_DATA} -- } $origtest $origtest]]} { -- fail "$test: cannot set MAX_RLIFE or TL_DATA" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal {KADM5_PRINCIPAL_NORMAL_MASK KADM5_TL_DATA} -- } $origtest]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 12\n" -- expect { -- -re "(\[0-9\]+)\n$prompt$" {set rlife $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting rlife" -- return -- } -- eof { -- error_and_restart "$test: eof getting rlife" -- return -- } -- } -- send "lindex \$principal 19\n" -- expect { -- -re "\(\{.*\}\)\n$prompt$" {set tl $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting tl_data" -- return -- } -- eof { -- error_and_restart "$test: eof getting tl_data" -- return -- } -- } -- if {($rlife == 88) && ($tl == "{{990 6 foobar}}")} { -- pass "$test" -- } else { -- fail "$test: $rlife should be 88, $tl should be {{990 6 foobar}}" -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test100_104 -diff --git a/src/lib/kadm5/unit-test/api.current/mod-principal.exp b/src/lib/kadm5/unit-test/api.current/mod-principal.exp -deleted file mode 100644 -index ac9f96845..000000000 ---- a/src/lib/kadm5/unit-test/api.current/mod-principal.exp -+++ /dev/null -@@ -1,1606 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --#test "modify-principal 1" --#proc test1 {} { --# global test --# one_line_fail_test [format { --# kadm5_modify_principal $server_handle [simple_principal \ --# "%s/a"] {KADM5_PW_EXPIRATION} --# } $test] "NOT_INIT" --#} --#test1 -- --test "modify-principal 2" --proc test2 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINC_EXPIRE_TIME} -- } $test] "AUTH_MODIFY" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test2 } -- --test "modify-principal 4" --proc test4 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINCIPAL} -- } $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test4 -- -- --test "modify-principal 5" --proc test5 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_LAST_PWD_CHANGE} -- } $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test5 -- --test "modify-principal 6" --proc test6 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_MOD_TIME} -- } $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test6 -- --test "modify-principal 7" --proc test7 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_MOD_NAME} -- } $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test7 -- --test "modify-principal 8" --proc test8 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_MKVNO} -- } $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test8 -- --test "modify-principal 9" --proc test9 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_AUX_ATTRIBUTES} -- } $test] "BAD_MASK" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test9 -- --test "modify-principal 10" --proc test10 {} { -- global test -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINC_EXPIRE_TIME} -- } $test] "UNK_PRINC" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test10 -- --test "modify-principal 11" --proc test11 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/none admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINC_EXPIRE_TIME} -- } $test] "AUTH_MOD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } { test11 } -- --test "modify-principal 12" --proc test12 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/get admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINC_EXPIRE_TIME} -- } $test] "AUTH_MOD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } { test12 } -- --test "modify-principal 13" --proc test13 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/add admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINC_EXPIRE_TIME} -- } $test] "AUTH_MOD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } { test13 } -- --test "modify-principal 14" --proc test14 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/delete admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINC_EXPIRE_TIME} -- } $test] "AUTH_MOD" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } { test14 } -- --test "modify-principal 15" --proc test15 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINC_EXPIRE_TIME} -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test15 -- --test "modify-principal 17" --proc test17 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_modify_principal $server_handle [princ_w_pol "%s/a" \ -- no-policy] {KADM5_POLICY} -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test17 -- --test "modify-principal 21.5" --proc test21.5 {} { -- global test -- global prompt -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if { !( [create_principal_pol "$test/a" "test-pol"])} { -- error_and_restart "$test: could not create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd {kadm5_get_policy $server_handle test-pol old_p1}]} { -- perror "$test: unexpected failure on get policy" -- return -- } -- if {! [cmd [format { -- kadm5_modify_principal $server_handle [princ_w_pol "%s/a" \ -- test-pol] {KADM5_POLICY} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$old_p1 6\n" -- expect { -- -re "(\[0-9\]+)\n$prompt$" {set old_p1_ref $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting principal kvno (second time)" -- return -- } -- eof { -- error_and_restart "$test: eof getting principal kvno (second time)" -- return -- } -- } -- -- if { ! [cmd {kadm5_get_policy $server_handle test-pol new_p1}]} { -- perror "$test: unexpected failure on get policy" -- return -- } -- -- send "lindex \$new_p1 6\n" -- expect { -- -re "(\[0-9\]+)\n$prompt$" {set new_p1_ref $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting principal kvno (second time)" -- return -- } -- eof { -- error_and_restart "$test: eof getting principal kvno (second time)" -- return -- } -- } -- -- if {$old_p1_ref != $new_p1_ref} { -- fail "$test: policy reference count changed ($old_p1_ref to $new_p1_ref)" -- return -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test21.5 -- --test "modify-principal 22" --proc test22 {} { -- global test -- global prompt -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PW_EXPIRATION} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 3\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test22 -- --test "modify-principal 23" --proc test23 {} { -- global test -- global prompt -- if {! (( [principal_exists "$test/a"]) || -- [create_principal_pol "$test/a" test-pol-nopw])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PW_EXPIRATION} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 3\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test23 -- --test "modify-principal 24" --proc test24 {} { -- global test -- global prompt -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal_pol "$test/a" "test-pol" ])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- error_and_restart "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PW_EXPIRATION} -- } $test]]} { -- fail "$test: could not modify principal" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- if { ! [cmd [format { -- kadm5_get_policy $server_handle %s policy -- } test-pol]]} { -- error_and_restart "$test: cannot retrieve policy" -- return -- } -- send "lindex \$principal 2\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_mod_date $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting mod_date" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_mod_date" -- return -- } -- } -- -- send "lindex \$principal 3\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_expire $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_expire" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_expire" -- return -- } -- } -- -- send "lindex \$policy 2\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_max_life $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_max_life" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_max_life" -- return -- } -- } -- if { $pw_expire != 0 } { -- fail "$test: pw_expire $pw_expire should be 0" -- return -- } else { -- pass "$test" -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test24 -- --test "modify-principal 25" --proc test25 {} { -- global test -- global prompt -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle \ -- {"%s/a" 0 0 1234 0 0 0 0 0 0 0 0} {KADM5_PW_EXPIRATION} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 3\n" -- expect { -- -re "1234\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test25 -- --test "modify-principal 26" --proc test26 {} { -- global test -- global prompt -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal_pol "$test/a" "test-pol-nopw" ])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle \ -- {"%s/a" 0 0 1234 0 0 0 0 0 0 0 0} {KADM5_PW_EXPIRATION} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 3\n" -- expect { -- -re "1234\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test26 -- --test "modify-principal 27" --proc test27 {} { -- global test -- global prompt -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal_pol "$test/a" "test-pol" ])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle \ -- {"%s/a" 0 0 1234 0 0 0 0 0 0 0 0} {KADM5_PW_EXPIRATION} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 3\n" -- expect { -- -re "1234\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test27 -- --test "modify-principal 28" --proc test28 {} { -- global test -- global prompt --# set prms_id 1358 --# setup_xfail {*-*-*} $prms_id -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal_pol "$test/a" "test-pol" ])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle \ -- {"%s/a" 0 0 999999999 0 0 0 0 0 0 0 0} {KADM5_PW_EXPIRATION} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- if { ! [cmd {kadm5_get_policy $server_handle test-pol policy}]} { -- error_and_restart "$test: cannot retrieve policy" -- return -- } -- send "lindex \$principal 2\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_mod_date $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_mod_date" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_mod_date" -- return -- } -- } -- -- send "lindex \$principal 3\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_expire $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_expire" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_expire" -- return -- } -- } -- send "lindex \$policy 2\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_max_life $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_max_life" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_max_life" -- return -- } -- } -- if { $pw_expire != 999999999 } { -- fail "$test: pw_expire $pw_expire should be 999999999" -- return -- } -- pass "$test" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test28 -- --test "modify-principal 29" --proc test29 {} { -- global test -- global prompt -- -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if { ! ([create_principal_pol "$test/a" test-pol])} { -- perror "$test: unexpected failure in creating principal" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_POLICY_CLR} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 3\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test29 -- --test "modify-principal 30" --proc test30 {} { -- global test -- global prompt -- -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! ([create_principal_pol "$test/a" test-pol])} { -- perror "$test: unexpected failure in creating principal" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle [princ_w_pol "%s/a" \ -- test-pol-nopw] {KADM5_POLICY} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 3\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test30 -- --test "modify-principal 31" --proc test31 {} { -- global test -- global prompt -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! ([create_principal "$test/a"])} { -- perror "$test: unexpected failure in creating principal" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle [princ_w_pol "%s/a" \ -- test-pol] {KADM5_POLICY} -- } $test]]} { -- fail "modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- if { ! [cmd {kadm5_get_policy $server_handle test-pol policy}]} { -- error_and_restart "$test: cannot retrieve policy" -- return -- } -- send "lindex \$principal 2\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_mod_date $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_mod_date" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_mod_date" -- return -- } -- } -- -- send "lindex \$principal 3\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_expire $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_expire" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_expire" -- return -- } -- } -- -- send "lindex \$policy 2\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" {set pw_max_life $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting pw_max_life" -- return -- } -- eof { -- error_and_restart "$test: eof getting pw_max_life" -- return -- } -- } -- if { [expr "$pw_mod_date + $pw_max_life"] != $pw_expire } { -- fail "$test: pw_expire is wrong" -- return -- } -- -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test31 -- --test "modify-principal 32" --proc test32 {} { -- global test -- global prompt -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! ([create_principal "$test/a"])} { -- perror "$test: unexpected failure in creating principal" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_principal $server_handle \ -- {"%s/a" 1234 0 0 0 0 0 0 0 0 0 0} \ -- {KADM5_PRINC_EXPIRE_TIME} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 1\n" -- expect { -- -re "1234\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test32 -- --test "modify-principal 33" --proc test33 {} { -- global test -- global prompt -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! ([create_principal "$test/a"])} { -- perror "$test: unexpected failure in creating principal" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_principal $server_handle \ -- {"%s/a" 0 0 0 0 0 0 KRB5_KDB_DISALLOW_ALL_TIX 0 0 0 0} \ -- {KADM5_ATTRIBUTES} -- } $test]]} { -- fail "$test: modified fail" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 7\n" -- expect { -- -re "KRB5_KDB_DISALLOW_ALL_TIX.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test33 -- --test "modify-principal 33.25" --proc test3325 {} { -- global test -- global prompt -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! ([create_principal "$test/a"])} { -- perror "$test: unexpected failure in creating principal" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_principal $server_handle \ -- {"%s/a" 0 0 0 0 0 0 KRB5_KDB_REQUIRES_PWCHANGE 0 0 0 0} \ -- {KADM5_ATTRIBUTES} -- } $test]]} { -- fail "$test: modified fail" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 7\n" -- expect { -- -re "KRB5_KDB_REQUIRES_PWCHANGE.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test3325 -- --test "modify-principal 33.5" --proc test335 {} { -- global test -- global prompt -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! ([create_principal "$test/a"])} { -- perror "$test: unexpected failure in creating principal" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_principal $server_handle \ -- {"%s/a" 0 0 0 0 0 0 KRB5_KDB_DISALLOW_TGT_BASED 0 0 0 0} \ -- {KADM5_ATTRIBUTES} -- } $test]]} { -- fail "$test: modified fail" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 7\n" -- expect { -- -re "KRB5_KDB_DISALLOW_TGT_BASED.*$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test335 -- -- --test "modify-principal 34" --proc test34 {} { -- global test -- global prompt -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! ([create_principal "$test/a"])} { -- perror "$test: unexpected failure in creating principal" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle \ -- {"%s/a" 0 0 0 3456 0 0 0 0 0 0 0} {KADM5_MAX_LIFE} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 4\n" -- expect { -- -re "3456\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test34 -- --test "modify-principal 35" --proc test35 {} { -- global prompt -- global test -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! ([create_principal "$test/a"])} { -- perror "$test: unexpected failure in creating principal" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd [format { -- kadm5_modify_principal $server_handle \ -- {"%s/a" 0 0 0 0 0 0 0 7 0 0 0} {KADM5_KVNO} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 8\n" -- expect { -- -re "7\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test35 -- --test "modify-principal 36" --proc test36 {} { -- global test -- global prompt -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if { !( [create_principal_pol "$test/a" "test-pol"])} { -- error_and_restart "$test: could not create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if { ! [cmd {kadm5_get_policy $server_handle test-pol pol}]} { -- perror "$test: unexpected failure on get policy" -- return -- } -- if {! [cmd [format { -- kadm5_modify_principal $server_handle [princ_w_pol "%s/a" \ -- test-pol] {KADM5_POLICY} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 10\n" -- expect { -- -re "test-pol\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- send "lindex \$pol 6\n" -- expect { -- -re "(\[0-9\]+)\n$prompt$" {set oldref $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting principal kvno (second time)" -- return -- } -- eof { -- error_and_restart "$test: eof getting principal kvno (second time)" -- return -- } -- } -- if { ! [cmd {kadm5_get_policy $server_handle test-pol pol2}]} { -- perror "$test: unexpected failure on get policy" -- return -- } -- send "lindex \$pol2 6\n" -- expect { -- -re "(\[0-9\]+)\n$prompt$" {set newref $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting principal kvno (second time)" -- return -- } -- eof { -- error_and_restart "$test: eof getting principal kvno (second time)" -- return -- } -- } -- if { $oldref != $newref } { -- fail "$test: policy reference count is wrong" -- return; -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test36 -- --test "modify-principal 37" --proc test37 {} { -- global test -- global prompt -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if { !( [create_principal "$test/a"])} { -- error_and_restart "$test: could not create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_POLICY_CLR} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test37 -- --test "modify-principal 38" --proc test38 {} { -- global test -- global prompt -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! ([create_principal "$test/a"])} { -- perror "$test: unexpected failure in creating principal" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_PRINC_EXPIRE_TIME} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 1\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test38 -- --test "modify-principal 39" --proc test39 {} { -- global test -- global prompt -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! ([create_principal "$test/a"])} { -- perror "$test: unexpected failure in creating principal" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_principal $server_handle [simple_principal "%s/a"] \ -- {KADM5_MAX_LIFE} -- } $test]]} { -- fail "$test: modify failed" -- return -- } -- if {! [cmd [format { -- kadm5_get_principal $server_handle "%s/a" principal KADM5_PRINCIPAL_NORMAL_MASK -- } $test]]} { -- error_and_restart "$test: could not retrieve principal" -- return -- } -- send "lindex \$principal 4\n" -- expect { -- -re "0\n$prompt$" { pass "$test" } -- timeout { fail "$test" } -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test39 -- --test "modify-principal 40" --proc test40 {} { -- global test -- global prompt -- -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test { -- kadm5_modify_principal $server_handle null \ -- {KADM5_PRINC_EXPIRE_TIME} -- } "EINVAL" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test40 -- --test "modify-principal 43" --proc test43 {} { -- global test -- one_line_fail_test [format { -- kadm5_modify_principal null [simple_principal \ -- "%s/a"] {KADM5_PW_EXPIRATION} -- } $test] "BAD_SERVER_HANDLE" --} --test43 -- --test "modify-principal 44" --proc test44 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- # setting fail auth count to a non-zero value must fail -- one_line_fail_test [format { -- kadm5_modify_principal $server_handle \ -- {"%s/a" 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1234 0 0 {} {}} {KADM5_FAIL_AUTH_COUNT} -- } $test] "BAD_SERVER_PARAMS" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test44 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp -deleted file mode 100644 -index 2925c1c43..000000000 ---- a/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp -+++ /dev/null -@@ -1,61 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "randkey-principal 100" --proc test100 {} { -- global test prompt -- -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [create_principal "$test/a"]} { -- error_and_restart "$test: creating principal" -- return -- } -- -- # I'd like to specify a long list of keysalt tuples and make sure that -- # randkey does the right thing, but we can only use those enctypes that -- # krbtgt has a key for: 3DES and AES, according to the prototype kdc.conf. -- if {! [cmd [format { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_randkey_principal $server_handle "%s/a" keys num_keys -- } $test]]} { -- perror "$test: unexpected failure in randkey_principal" -- } -- send "puts \$num_keys\n" -- expect { -- -re "(\[0-9\]+)\n$prompt" { set num_keys $expect_out(1,string) } -- timeout { -- error_and_restart "$test: timeout getting num_keys" -- return -- } -- eof { -- error_and_restart "$test: eof getting num_keys" -- return -- } -- } -- -- # XXX Perhaps I should actually check the key type returned. -- if {$num_keys == 5} { -- pass "$test" -- } else { -- fail "$test: $num_keys keys, should be 5" -- } -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test100 -- --return "" -diff --git a/src/lib/kadm5/unit-test/api.current/randkey-principal.exp b/src/lib/kadm5/unit-test/api.current/randkey-principal.exp -deleted file mode 100644 -index 1484901fa..000000000 ---- a/src/lib/kadm5/unit-test/api.current/randkey-principal.exp -+++ /dev/null -@@ -1,297 +0,0 @@ --load_lib lib.t --api_exit --api_start -- --test "randkey-principal 1" --proc test1 {} { -- global test -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [create_principal_pol "$test/a" once-a-min]} { -- error_and_restart "$test: creating principal" -- return -- } -- -- if {! [cmd [format { -- kadm5_init "%s/a" "%s/a" $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } $test $test]]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_randkey_principal $server_handle "%s/a" keys num_keys -- } $test] "PASS_TOOSOON" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test1 } -- --test "randkey-principal 3" --proc test3 {} { -- global test -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [create_principal_pol "$test/a" once-a-min]} { -- error_and_restart "$test: creating principal" -- return -- } -- -- if {! [cmd [format { -- kadm5_init "%s/a" "%s/a" $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } $test $test]]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_randkey_principal $server_handle "%s/a" keys num_keys -- } $test] "PASS_TOOSOON" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if ${RPC} { test3 } -- --test "randkey-principal 13" --proc test13 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- if {! [cmd [format { -- kadm5_modify_principal $server_handle [princ_w_pol "%s/a" \ -- once-a-min] KADM5_POLICY -- } $test]]} { -- perror "$test: failed modify" -- return -- } -- one_line_succeed_test [format { -- kadm5_randkey_principal $server_handle "%s/a" keys num_keys -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test13 -- --test "randkey-principal 15" --proc test15 {} { -- global test -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [create_principal_pol "$test/a" once-a-min]} { -- error_and_restart "$test: creating principal" -- return -- } -- -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_randkey_principal $server_handle "%s/a" keys num_keys -- } $test] "AUTH_CHANGEPW" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if { $RPC } { test15 } -- --test "randkey-principal 28" --proc test28 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_randkey_principal $server_handle "%s/a" keys num_keys -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test28 -- --test "randkey-principal 28.25" --proc test2825 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin admin $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_randkey_principal $server_handle "%s/a" keys num_keys -- } $test] "AUTH" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --if {$RPC} { test2825 } -- --test "randkey-principal 28.5" --proc test285 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [cmd { -- kadm5_init admin/modify admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_randkey_principal $server_handle "%s/a" keys num_keys -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test285 -- --test "randkey-principal 30" --proc test30 {} { -- global test -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't delete principal \"$test/a\"" -- return -- } -- if {! [create_principal "$test/a"]} { -- error_and_restart "$test: creating principal" -- return -- } -- if {! [cmd [format { -- kadm5_init "%s/a" "%s/a" $KADM5_CHANGEPW_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } $test $test]]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_randkey_principal $server_handle "%s/a" keys num_keys -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test30 -- --test "randkey-principal 31" --proc test31 {} { -- global test -- if {! (( ! [principal_exists "$test/a"]) || -- [delete_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if {! [create_principal "$test/a"]} { -- error_and_restart "$test: creating principal" -- return -- } -- -- if {! [cmd [format { -- kadm5_init "%s/a" "%s/a" $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- } $test $test]]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_succeed_test [format { -- kadm5_randkey_principal $server_handle "%s/a" keys num_keys -- } $test] -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} --test31 -- --test "randkey-principal 33" --proc test33 {} { -- global test -- if {! (( [principal_exists "$test/a"]) || -- [create_principal "$test/a"])} { -- error_and_restart "$test: couldn't create principal \"$test/a\"" -- return -- } -- if { ! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- server_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- one_line_fail_test [format { -- kadm5_randkey_principal null "%s/a" keys num_keys -- } $test] "BAD_SERVER_HANDLE" -- if { ! [cmd {kadm5_destroy $server_handle}]} { -- perror "$test: unexpected failure in destroy" -- return -- } --} -- --test33 -- --return "" -diff --git a/src/lib/kadm5/unit-test/config/unix.exp b/src/lib/kadm5/unit-test/config/unix.exp -deleted file mode 100644 -index d7706ec53..000000000 ---- a/src/lib/kadm5/unit-test/config/unix.exp -+++ /dev/null -@@ -1,222 +0,0 @@ --source runenv.exp -- --set prompt "% " --set stty_init {-onlcr -opost intr \^C kill \^U} --set kadmin_local $KADMIN_LOCAL -- --# Backward compatibility until we're using expect 5 everywhere --if {[info exists exp_version_4]} { -- global wait_error_index wait_errno_index wait_status_index -- set wait_error_index 0 -- set wait_errno_index 1 -- set wait_status_index 1 --} else { -- set wait_error_index 2 -- set wait_errno_index 3 -- set wait_status_index 3 --} -- --if { [string length $VALGRIND] } { -- rename spawn valgrind_aux_spawn -- proc spawn { args } { -- global VALGRIND -- upvar 1 spawn_id spawn_id -- set newargs {} -- set inflags 1 -- set eatnext 0 -- foreach arg $args { -- if { $arg == "-ignore" \ -- || $arg == "-open" \ -- || $arg == "-leaveopen" } { -- lappend newargs $arg -- set eatnext 1 -- continue -- } -- if [string match "-*" $arg] { -- lappend newargs $arg -- continue -- } -- if { $eatnext } { -- set eatnext 0 -- lappend newargs $arg -- continue -- } -- if { $inflags } { -- set inflags 0 -- # Only run valgrind for local programs, not -- # system ones. --#&&![string match "/bin/sh" $arg] sh is used to start kadmind! -- if [string match "/" [string index $arg 0]]&&![string match "/bin/ls" $arg]&&![regexp {/kshd$} $arg] { -- set newargs [concat $newargs $VALGRIND] -- } -- } -- lappend newargs $arg -- } -- set pid [eval valgrind_aux_spawn $newargs] -- return $pid -- } --} -- --# Hack around Solaris 9 kernel race condition that causes last output --# from a pty to get dropped. --if { $PRIOCNTL_HACK } { -- catch {exec priocntl -s -c FX -m 30 -p 30 -i pid [getpid]} -- rename spawn oldspawn -- proc spawn { args } { -- upvar 1 spawn_id spawn_id -- set newargs {} -- set inflags 1 -- set eatnext 0 -- foreach arg $args { -- if { $arg == "-ignore" \ -- || $arg == "-open" \ -- || $arg == "-leaveopen" } { -- lappend newargs $arg -- set eatnext 1 -- continue -- } -- if [string match "-*" $arg] { -- lappend newargs $arg -- continue -- } -- if { $eatnext } { -- set eatnext 0 -- lappend newargs $arg -- continue -- } -- if { $inflags } { -- set inflags 0 -- set newargs [concat $newargs {priocntl -e -c FX -p 0}] -- } -- lappend newargs $arg -- } -- set pid [eval oldspawn $newargs] -- return $pid -- } --} -- --# Variables for keeping track of api process state --set api_pid "0" -- --proc api_exit {} { -- global spawn_id -- global api_pid -- --# puts stdout "Starting api_exit (spawn_id $spawn_id)." -- catch {close} errMsg -- catch {wait} errMsg --# puts stdout "Finishing api_exit for $api_pid." -- set api_pid "0" --} -- --proc api_isrunning {pid} { -- global api_pid -- --# puts stdout "testing $pid, api_pid is $api_pid" -- if {$pid == $api_pid} { -- return 1; -- } else { -- return 0; -- } --} -- --proc api_version {} { --} -- --proc api_start {} { -- global API -- global env -- global spawn_id -- global prompt -- global api_pid -- -- set pid [spawn $API] -- expect { -- -re "$prompt$" {} -- eof { perror "EOF starting API" } -- timeout { perror "Timeout starting API" } -- } -- if {! [info exists env(TCLUTIL)]} { -- perror "TCLUTIL environment variable isn't set" -- } -- # tcl 8.4 for some reason screws up autodetection of output -- # EOL translation. Work around it for now. -- send "if { \[info commands fconfigure\] ne \"\" } { fconfigure stdout -translation lf }\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF starting API" } -- timeout { perror "Timeout starting API" } -- } -- send "source $env(TCLUTIL)\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF starting API" } -- timeout { perror "Timeout starting API" } -- } -- send "set current_struct_version \[expr \$KADM5_STRUCT_VERSION &~ \$KADM5_STRUCT_VERSION_MASK\]\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF setting API variables"} -- timeout { perror "timeout setting API variables"} -- } -- send "set current_api_version \[expr \$KADM5_API_VERSION_3 &~ \$KADM5_API_VERSION_MASK\]\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF setting API variables"} -- timeout { perror "timeout setting API variables"} -- } -- send "set bad_struct_version_mask \[expr 0x65432100 | \$current_struct_version\]\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF setting API variables"} -- timeout { perror "timeout setting API variables"} -- } -- send "set bad_api_version_mask \[expr 0x65432100 | \$current_api_version\]\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF setting API variables"} -- timeout { perror "timeout setting API variables"} -- } -- send "set no_api_version_mask \$current_api_version\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF setting API variables"} -- timeout { perror "timeout setting API variables"} -- } -- send "set no_struct_version_mask \$current_struct_version\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF setting API variables"} -- timeout { perror "timeout setting API variables"} -- } -- send "set old_api_version \[expr \$KADM5_API_VERSION_MASK | 0x00\]\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF setting API variables"} -- timeout { perror "timeout setting API variables"} -- } -- send "set old_struct_version \[expr \$KADM5_STRUCT_VERSION_MASK | 0x00\]\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF setting API variables"} -- timeout { perror "timeout setting API variables"} -- } -- send "set new_api_version \[expr \$KADM5_API_VERSION_MASK | 0xca\]\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF setting API variables"} -- timeout { perror "timeout setting API variables"} -- } -- send "set new_struct_version \[expr \$KADM5_STRUCT_VERSION_MASK | 0xca\]\n" -- expect { -- -re "$prompt$" {} -- eof { perror "EOF setting API variables"} -- timeout { perror "timeout setting API variables"} -- } -- -- set api_pid $pid --# puts stdout "Finishing api_start (spawn_id $spawn_id, pid $api_pid)." -- return $pid --} --api_start -- -diff --git a/src/lib/kadm5/unit-test/deps b/src/lib/kadm5/unit-test/deps -deleted file mode 100644 -index cf54f475b..000000000 ---- a/src/lib/kadm5/unit-test/deps -+++ /dev/null -@@ -1,86 +0,0 @@ --# --# Generated makefile dependencies follow. --# --$(OUTPRE)init-test.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \ -- $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \ -- $(BUILDTOP)/include/kadm5/chpass_util_strings.h $(BUILDTOP)/include/kadm5/kadm_err.h \ -- $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ -- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ -- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ -- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ -- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ -- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \ -- $(top_srcdir)/include/krb5.h init-test.c --$(OUTPRE)destroy-test.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \ -- $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \ -- $(BUILDTOP)/include/kadm5/admin_internal.h $(BUILDTOP)/include/kadm5/chpass_util_strings.h \ -- $(BUILDTOP)/include/kadm5/client_internal.h $(BUILDTOP)/include/kadm5/kadm_err.h \ -- $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ -- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ -- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ -- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ -- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ -- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \ -- $(top_srcdir)/include/krb5.h destroy-test.c --$(OUTPRE)handle-test.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ -- $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssrpc/types.h \ -- $(BUILDTOP)/include/kadm5/admin.h $(BUILDTOP)/include/kadm5/admin_internal.h \ -- $(BUILDTOP)/include/kadm5/chpass_util_strings.h $(BUILDTOP)/include/kadm5/kadm_err.h \ -- $(BUILDTOP)/include/kadm5/server_internal.h $(BUILDTOP)/include/krb5/krb5.h \ -- $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ -- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ -- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ -- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ -- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ -- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \ -- $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/plugin.h \ -- handle-test.c --$(OUTPRE)iter-test.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \ -- $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \ -- $(BUILDTOP)/include/kadm5/chpass_util_strings.h $(BUILDTOP)/include/kadm5/kadm_err.h \ -- $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ -- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ -- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ -- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ -- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ -- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \ -- $(top_srcdir)/include/krb5.h iter-test.c --$(OUTPRE)setkey-test.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ -- $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssrpc/types.h \ -- $(BUILDTOP)/include/kadm5/admin.h $(BUILDTOP)/include/kadm5/chpass_util_strings.h \ -- $(BUILDTOP)/include/kadm5/kadm_err.h $(BUILDTOP)/include/krb5/krb5.h \ -- $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ -- $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ -- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ -- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ -- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ -- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ -- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/k5-buf.h \ -- $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ -- $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ -- $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ -- $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \ -- $(top_srcdir)/include/kdb.h $(top_srcdir)/include/krb5.h \ -- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \ -- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ -- setkey-test.c --$(OUTPRE)randkey-test.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \ -- $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \ -- $(BUILDTOP)/include/kadm5/chpass_util_strings.h $(BUILDTOP)/include/kadm5/kadm_err.h \ -- $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ -- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ -- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ -- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ -- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ -- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \ -- $(top_srcdir)/include/krb5.h randkey-test.c --$(OUTPRE)lock-test.$(OBJEXT): $(BUILDTOP)/include/gssapi/gssapi.h \ -- $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \ -- $(BUILDTOP)/include/kadm5/chpass_util_strings.h $(BUILDTOP)/include/kadm5/kadm_err.h \ -- $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ -- $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ -- $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ -- $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ -- $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ -- $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/kdb.h \ -- $(top_srcdir)/include/krb5.h lock-test.c -diff --git a/src/lib/kadm5/unit-test/destroy-test.c b/src/lib/kadm5/unit-test/destroy-test.c -deleted file mode 100644 -index 738cfeb86..000000000 ---- a/src/lib/kadm5/unit-test/destroy-test.c -+++ /dev/null -@@ -1,48 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include -- --#define TEST_NUM 25 -- --int main() --{ -- kadm5_ret_t ret; -- char *cp; -- int x; -- void *server_handle; -- kadm5_server_handle_t handle; -- krb5_context context; -- -- ret = kadm5_init_krb5_context(&context); -- if (ret != 0) { -- com_err("test", ret, "context init"); -- exit(2); -- } -- for(x = 0; x < TEST_NUM; x++) { -- ret = kadm5_init(context, "admin", "admin", KADM5_ADMIN_SERVICE, 0, -- KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL, -- &server_handle); -- if(ret != KADM5_OK) { -- com_err("test", ret, "init"); -- exit(2); -- } -- handle = (kadm5_server_handle_t) server_handle; -- cp = strdup(strchr(handle->cache_name, ':') + 1); -- kadm5_destroy(server_handle); -- if(access(cp, F_OK) == 0) { -- puts("ticket cache not destroyed"); -- exit(2); -- } -- free(cp); -- } -- krb5_free_context(context); -- exit(0); --} -diff --git a/src/lib/kadm5/unit-test/diff-files/destroy-1 b/src/lib/kadm5/unit-test/diff-files/destroy-1 -deleted file mode 100644 -index 593d67320..000000000 ---- a/src/lib/kadm5/unit-test/diff-files/destroy-1 -+++ /dev/null -@@ -1,2 +0,0 @@ --##! nochanges -- -diff --git a/src/lib/kadm5/unit-test/diff-files/no-diffs b/src/lib/kadm5/unit-test/diff-files/no-diffs -deleted file mode 100644 -index 593d67320..000000000 ---- a/src/lib/kadm5/unit-test/diff-files/no-diffs -+++ /dev/null -@@ -1,2 +0,0 @@ --##! nochanges -- -diff --git a/src/lib/kadm5/unit-test/handle-test.c b/src/lib/kadm5/unit-test/handle-test.c -deleted file mode 100644 -index 29bd2c9a1..000000000 ---- a/src/lib/kadm5/unit-test/handle-test.c -+++ /dev/null -@@ -1,140 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --#include --#include --#include --#include --#include --#include --#include --#include --#ifdef CLIENT_TEST --#include --#else --#include --#include --#endif -- --int main(int argc, char *argv[]) --{ -- kadm5_ret_t ret; -- void *server_handle; -- kadm5_server_handle_t handle; -- kadm5_server_handle_rec orig_handle; -- kadm5_policy_ent_rec pol; -- kadm5_principal_ent_t princ; -- kadm5_principal_ent_rec kprinc; -- krb5_keyblock *key; -- krb5_principal tprinc; -- krb5_context context; -- -- -- kadm5_init_krb5_context(&context); -- -- ret = kadm5_init(context, "admin/none", "admin", KADM5_ADMIN_SERVICE, NULL, -- KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL, -- &server_handle); -- if(ret != KADM5_OK) { -- com_err("test", ret, "init"); -- exit(2); -- } -- handle = (kadm5_server_handle_t) server_handle; -- orig_handle = *handle; -- handle->magic_number = KADM5_STRUCT_VERSION; -- krb5_parse_name(context, "testuser", &tprinc); -- ret = kadm5_get_principal(server_handle, tprinc, &kprinc, -- KADM5_PRINCIPAL_NORMAL_MASK); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "get-principal", -- error_message(ret)); -- exit(1); -- } -- -- ret = kadm5_get_policy(server_handle, "pol1", &pol); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "get-policy", -- error_message(ret)); -- exit(1); -- } -- -- princ = &kprinc; -- ret = kadm5_create_principal(server_handle, princ, KADM5_PRINCIPAL, "pass"); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "create-principal", -- error_message(ret)); -- exit(1); -- } -- -- ret = kadm5_create_policy(server_handle, &pol, KADM5_POLICY); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "create-policy", -- error_message(ret)); -- exit(1); -- } -- -- ret = kadm5_modify_principal(server_handle, princ, KADM5_PW_EXPIRATION); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "modify-principal", -- error_message(ret)); -- exit(1); -- } -- -- ret = kadm5_modify_policy(server_handle, &pol, KADM5_PW_MAX_LIFE); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "modify-policy", -- error_message(ret)); -- exit(1); -- } -- -- ret = kadm5_delete_principal(server_handle, tprinc); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "delete-principal", -- error_message(ret)); -- exit(1); -- } -- -- ret = kadm5_delete_policy(server_handle, "pol1"); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "delete-policy", -- error_message(ret)); -- exit(1); -- } -- -- ret = kadm5_chpass_principal(server_handle, tprinc, "FooBar"); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "chpass", -- error_message(ret)); -- exit(1); -- } -- ret = kadm5_randkey_principal(server_handle, tprinc, &key, NULL); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "randkey", -- error_message(ret)); -- exit(1); -- } -- -- ret = kadm5_rename_principal(server_handle, tprinc, tprinc); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "rename", -- error_message(ret)); -- exit(1); -- } -- -- ret = kadm5_destroy(server_handle); -- if(ret != KADM5_BAD_SERVER_HANDLE) { -- fprintf(stderr, "%s -- returned -- %s\n", "destroy", -- error_message(ret)); -- exit(1); -- } -- -- *handle = orig_handle; -- ret = kadm5_destroy(server_handle); -- if (ret != KADM5_OK) { -- fprintf(stderr, "valid %s -- returned -- %s\n", "destroy", -- error_message(ret)); -- exit(1); -- } -- -- krb5_free_principal(context, tprinc); -- krb5_free_context(context); -- exit(0); --} -diff --git a/src/lib/kadm5/unit-test/init-test.c b/src/lib/kadm5/unit-test/init-test.c -deleted file mode 100644 -index 9f06621e8..000000000 ---- a/src/lib/kadm5/unit-test/init-test.c -+++ /dev/null -@@ -1,39 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --#include --#include --#include --#include --#include --#include -- --int main() --{ -- kadm5_ret_t ret; -- void *server_handle; -- kadm5_config_params params; -- krb5_context context; -- -- memset(¶ms, 0, sizeof(params)); -- params.mask |= KADM5_CONFIG_NO_AUTH; -- ret = kadm5_init_krb5_context(&context); -- if (ret != 0) { -- com_err("init-test", ret, "while initializing krb5 context"); -- exit(1); -- } -- ret = kadm5_init(context, "admin", "admin", NULL, ¶ms, -- KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL, -- &server_handle); -- if (!ret) -- (void)kadm5_destroy(server_handle); -- krb5_free_context(context); -- if (ret == KADM5_RPC_ERROR) { -- exit(0); -- } -- else if (ret != 0) { -- com_err("init-test", ret, "while initializing without auth"); -- exit(1); -- } else { -- fprintf(stderr, "Unexpected success while initializing without auth!\n"); -- exit(1); -- } --} -diff --git a/src/lib/kadm5/unit-test/iter-test.c b/src/lib/kadm5/unit-test/iter-test.c -deleted file mode 100644 -index cd85ebe4d..000000000 ---- a/src/lib/kadm5/unit-test/iter-test.c -+++ /dev/null -@@ -1,51 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --#include --#include --#include -- --int main(int argc, char **argv) --{ -- kadm5_ret_t ret; -- void *server_handle; -- char **names; -- int count, princ, i; -- krb5_context context; -- -- if (argc != 3) { -- fprintf(stderr, "Usage: %s [-princ|-pol] exp\n", argv[0]); -- exit(1); -- } -- princ = (strcmp(argv[1], "-princ") == 0); -- -- ret = kadm5_init_krb5_context(&context); -- if (ret != KADM5_OK) { -- com_err("iter-test", ret, "while initializing context"); -- exit(1); -- } -- ret = kadm5_init("admin", "admin", KADM5_ADMIN_SERVICE, 0, -- KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL, -- &server_handle); -- if (ret != KADM5_OK) { -- com_err("iter-test", ret, "while initializing"); -- exit(1); -- } -- -- if (princ) -- ret = kadm5_get_principals(server_handle, argv[2], &names, &count); -- else -- ret = kadm5_get_policies(server_handle, argv[2], &names, &count); -- -- if (ret != KADM5_OK) { -- com_err("iter-test", ret, "while retrieving list"); -- exit(1); -- } -- -- for (i = 0; i < count; i++) -- printf("%d: %s\n", i, names[i]); -- -- kadm5_free_name_list(server_handle, names, count); -- -- (void) kadm5_destroy(server_handle); -- -- return 0; --} -diff --git a/src/lib/kadm5/unit-test/lib/lib.t b/src/lib/kadm5/unit-test/lib/lib.t -deleted file mode 100644 -index 3444775cf..000000000 ---- a/src/lib/kadm5/unit-test/lib/lib.t -+++ /dev/null -@@ -1,306 +0,0 @@ --global timeout --set timeout 60 -- --set lib_pid 0 -- --# --# The functions in this library used to be responsible for bazillions --# of wasted api_starts. Now, they all just use their own library --# handle so they are not interrupted when the main tests call init or --# destroy. They have to keep track of when the api exists and --# restarts, though, since the lib_handle needs to be re-opened in that --# case. --# --proc lib_start_api {} { -- global spawn_id lib_pid test -- -- if {! [api_isrunning $lib_pid]} { -- api_exit -- set lib_pid [api_start] -- if {! [cmd { -- kadm5_init admin admin $KADM5_ADMIN_SERVICE null \ -- $KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \ -- lib_handle -- }]} { -- perror "$test: unexpected failure in init" -- return -- } -- verbose "+++ restarted api ($lib_pid) for lib" -- } else { -- verbose "+++ api $lib_pid already running for lib" -- } --} -- --proc cmd {command} { -- global prompt -- global spawn_id -- global test -- -- send "[string trim $command]\n" -- expect { -- -re "OK .*$prompt$" { return 1 } -- -re "ERROR .*$prompt$" { return 0 } -- "wrong # args" { perror "$test: wrong number args"; return 0 } -- timeout { fail "$test: timeout"; return 0 } -- eof { fail "$test: eof"; api_exit; lib_start_api; return 0 } -- } --} -- --proc tcl_cmd {command} { -- global prompt spawn_id test -- -- send "[string trim $command]\n" -- expect { -- -re "$prompt$" { return 1} -- "wrong # args" { perror "$test: wrong number args"; return 0 } -- timeout { error_and_restart "timeout" } -- eof { api_exit; lib_start_api; return 0 } -- } --} -- --proc one_line_succeed_test {command} { -- global prompt -- global spawn_id -- global test -- -- send "[string trim $command]\n" -- expect { -- -re "OK .*$prompt$" { pass "$test"; return 1 } -- -re "ERROR .*$prompt$" { -- fail "$test: $expect_out(buffer)"; return 0 -- } -- "wrong # args" { perror "$test: wrong number args"; return 0 } -- timeout { fail "$test: timeout"; return 0 } -- eof { fail "$test: eof"; api_exit; lib_start_api; return 0 } -- } --} -- --proc one_line_fail_test {command code} { -- global prompt -- global spawn_id -- global test -- -- send "[string trim $command]\n" -- expect { -- -re "ERROR .*$code.*$prompt$" { pass "$test"; return 1 } -- -re "ERROR .*$prompt$" { fail "$test: bad failure"; return 0 } -- -re "OK .*$prompt$" { fail "$test: bad success"; return 0 } -- "wrong # args" { perror "$test: wrong number args"; return 0 } -- timeout { fail "$test: timeout"; return 0 } -- eof { fail "$test: eof"; api_exit; lib_start_api; return 0 } -- } --} -- --proc one_line_fail_test_nochk {command} { -- global prompt -- global spawn_id -- global test -- -- send "[string trim $command]\n" -- expect { -- -re "ERROR .*$prompt$" { pass "$test:"; return 1 } -- -re "OK .*$prompt$" { fail "$test: bad success"; return 0 } -- "wrong # args" { perror "$test: wrong number args"; return 0 } -- timeout { fail "$test: timeout"; return 0 } -- eof { fail "$test: eof"; api_exit; lib_start_api; return 0 } -- } --} -- --proc resync {} { -- global prompt spawn_id test -- -- expect { -- -re "$prompt$" {} -- "wrong # args" { perror "$test: wrong number args"; return 0 } -- eof { api_exit; lib_start_api } -- } --} -- --proc create_principal {name} { -- lib_start_api -- -- set ret [cmd [format { -- kadm5_create_principal $lib_handle [simple_principal \ -- "%s"] {KADM5_PRINCIPAL} "%s" -- } $name $name]] -- -- return $ret --} -- --proc create_policy {name} { -- lib_start_api -- -- set ret [cmd [format { -- kadm5_create_policy $lib_handle [simple_policy "%s"] \ -- {KADM5_POLICY} -- } $name $name]] -- -- return $ret --} -- --proc create_principal_pol {name policy} { -- lib_start_api -- -- set ret [cmd [format { -- kadm5_create_principal $lib_handle [princ_w_pol "%s" \ -- "%s"] {KADM5_PRINCIPAL KADM5_POLICY} "%s" -- } $name $policy $name]] -- -- return $ret --} -- --proc delete_principal {name} { -- lib_start_api -- -- set ret [cmd [format { -- kadm5_delete_principal $lib_handle "%s" -- } $name]] -- -- return $ret --} -- --proc delete_policy {name} { -- lib_start_api -- -- set ret [cmd [format {kadm5_delete_policy $lib_handle "%s"} $name]] -- -- return $ret --} -- --proc principal_exists {name} { --# puts stdout "Starting principal_exists." -- -- lib_start_api -- -- set ret [cmd [format { -- kadm5_get_principal $lib_handle "%s" principal \ -- KADM5_PRINCIPAL_NORMAL_MASK -- } $name]] -- --# puts stdout "Finishing principal_exists." -- -- return $ret --} -- --proc policy_exists {name} { -- lib_start_api -- --# puts stdout "Starting policy_exists." -- -- set ret [cmd [format { -- kadm5_get_policy $lib_handle "%s" policy -- } $name]] -- --# puts stdout "Finishing policy_exists." -- -- return $ret --} -- --proc error_and_restart {error} { -- api_exit -- api_start -- perror $error --} -- --proc test {name} { -- global test verbose -- -- set test $name -- if {$verbose >= 1} { -- puts stdout "At $test" -- } --} -- --proc begin_dump {} { -- global TOP -- global RPC -- -- if { ! $RPC } { --# exec $env(SIMPLE_DUMP) > /tmp/dump.before -- } --} -- --proc end_dump_compare {name} { -- global file -- global TOP -- global RPC -- -- if { ! $RPC } { --# set file $TOP/admin/lib/unit-test/diff-files/$name --# exec $env(SIMPLE_DUMP) > /tmp/dump.after --# exec $env(COMPARE_DUMP) /tmp/dump.before /tmp/dump.after $file -- } --} -- --proc kinit { princ pass {opts ""} } { -- global env; -- global KINIT -- -- eval spawn $KINIT -5 $opts $princ -- expect { -- -re {Password for .*: $} -- {send "$pass\n"} -- timeout {puts "Timeout waiting for prompt" ; close } -- } -- -- # this necessary so close(1) in the child will not sleep waiting for -- # the parent, which is us, to read pending data. -- -- expect { -- "when initializing cache" { perror "kinit failed: $expect_out(buffer)" } -- eof {} -- } -- wait --} -- --proc kdestroy {} { -- global KDESTROY -- global errorCode errorInfo -- global env -- -- if {[info exists errorCode]} { -- set saveErrorCode $errorCode -- } -- if {[info exists errorInfo]} { -- set saveErrorInfo $errorInfo -- } -- catch "exec $KDESTROY -5 2>/dev/null" -- if {[info exists saveErrorCode]} { -- set errorCode $saveErrorCode -- } elseif {[info exists errorCode]} { -- unset errorCode -- } -- if {[info exists saveErrorInfo]} { -- set errorInfo $saveErrorInfo -- } elseif {[info exists errorInfo]} { -- unset errorInfo -- } --} -- --proc create_principal_with_keysalts {name keysalts} { -- global kadmin_local -- -- spawn $kadmin_local -e "$keysalts" -- expect { -- "kadmin.local:" {} -- default { perror "waiting for kadmin.local prompt"; return 1} -- } -- send "ank -pw \"$name\" \"$name\"\n" -- expect { -- -re "Principal \"$name.*\" created." {} -- "kadmin.local:" { -- perror "expecting principal created message"; -- return 1 -- } -- default { perror "waiting for principal created message"; return 1 } -- } -- expect { -- "kadmin.local:" {} -- default { perror "waiting for kadmin.local prompt"; return 1 } -- } -- close -- wait -- return 0 --} -- -- -diff --git a/src/lib/kadm5/unit-test/lock-test.c b/src/lib/kadm5/unit-test/lock-test.c -deleted file mode 100644 -index 59f9d2609..000000000 ---- a/src/lib/kadm5/unit-test/lock-test.c -+++ /dev/null -@@ -1,105 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --#include --#include --#include --#include --#include -- --char *whoami; -- --static void usage() --{ -- fprintf(stderr, -- "Usage: %s {shared|exclusive|permanent|release|" -- "get name|wait} ...\n", whoami); -- exit(1); --} -- --int main(int argc, char **argv) --{ -- krb5_error_code ret; -- osa_policy_ent_t entry; -- krb5_context context; -- kadm5_config_params params; -- krb5_error_code kret; -- -- whoami = argv[0]; -- -- kret = kadm5_init_krb5_context(&context); -- if (kret) { -- com_err(whoami, kret, "while initializing krb5"); -- exit(1); -- } -- -- params.mask = 0; -- ret = kadm5_get_config_params(context, 1, ¶ms, ¶ms); -- if (ret) { -- com_err(whoami, ret, "while retrieving configuration parameters"); -- exit(1); -- } -- if (! (params.mask & KADM5_CONFIG_ADBNAME)) { -- com_err(whoami, KADM5_BAD_SERVER_PARAMS, -- "while retrieving configuration parameters"); -- exit(1); -- } -- -- ret = krb5_db_open( context, NULL, KRB5_KDB_OPEN_RW); -- if (ret) { -- com_err(whoami, ret, "while opening database"); -- exit(1); -- } -- -- argc--; argv++; -- while (argc) { -- if (strcmp(*argv, "shared") == 0) { -- ret = krb5_db_lock(context, KRB5_DB_LOCKMODE_SHARED); -- if (ret) -- com_err(whoami, ret, "while getting shared lock"); -- else -- printf("shared\n"); -- } else if (strcmp(*argv, "exclusive") == 0) { -- ret = krb5_db_lock(context, KRB5_DB_LOCKMODE_EXCLUSIVE ); -- if (ret) -- com_err(whoami, ret, "while getting exclusive lock"); -- else -- printf("exclusive\n"); -- } else if (strcmp(*argv, "permanent") == 0) { -- ret = krb5_db_lock(context, KRB5_DB_LOCKMODE_EXCLUSIVE ); -- if (ret) -- com_err(whoami, ret, "while getting permanent lock"); -- else -- printf("permanent\n"); -- } else if (strcmp(*argv, "release") == 0) { -- ret = krb5_db_unlock(context); -- if (ret) -- com_err(whoami, ret, "while releasing lock"); -- else -- printf("released\n"); -- } else if (strcmp(*argv, "get") == 0) { -- argc--; argv++; -- if (!argc) usage(); -- if ((ret = krb5_db_get_policy(context, *argv, &entry))) { -- com_err(whoami, ret, "while getting policy"); -- } else { -- printf("retrieved\n"); -- krb5_db_free_policy(context, entry); -- } -- } else if (strcmp(*argv, "wait") == 0) { -- getchar(); -- } else { -- fprintf(stderr, "%s: Invalid argument \"%s\"\n", -- whoami, *argv); -- usage(); -- } -- -- argc--; argv++; -- } -- -- ret = krb5_db_fini(context); -- if (ret) { -- com_err(whoami, ret, "while closing database"); -- exit(1); -- } -- -- return 0; --} -diff --git a/src/lib/kadm5/unit-test/randkey-test.c b/src/lib/kadm5/unit-test/randkey-test.c -deleted file mode 100644 -index dbef88ac8..000000000 ---- a/src/lib/kadm5/unit-test/randkey-test.c -+++ /dev/null -@@ -1,42 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --#include --#include --#include --#include --#include --#include --#include -- --#define TEST_NUM 1000 -- --int main() --{ -- kadm5_ret_t ret; -- krb5_keyblock *keys[TEST_NUM]; -- krb5_principal tprinc; -- krb5_keyblock *newkey; -- krb5_context context; -- void *server_handle; -- -- int x, i; -- -- kadm5_init_krb5_context(&context); -- -- krb5_parse_name(context, "testuser", &tprinc); -- ret = kadm5_init(context, "admin", "admin", KADM5_ADMIN_SERVICE, NULL, -- KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL, -- &server_handle); -- if(ret != KADM5_OK) { -- com_err("test", ret, "init"); -- exit(2); -- } -- for(x = 0; x < TEST_NUM; x++) { -- kadm5_randkey_principal(server_handle, tprinc, &keys[x], NULL); -- for(i = 0; i < x; i++) { -- if (!memcmp(newkey->contents, keys[i]->contents, newkey->length)) -- puts("match found"); -- } -- } -- kadm5_destroy(server_handle); -- exit(0); --} -diff --git a/src/lib/kadm5/unit-test/setkey-test.c b/src/lib/kadm5/unit-test/setkey-test.c -deleted file mode 100644 -index 8e7df96e9..000000000 ---- a/src/lib/kadm5/unit-test/setkey-test.c -+++ /dev/null -@@ -1,246 +0,0 @@ --/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ --#include --#include -- --#if HAVE_SRAND48 --#define RAND() lrand48() --#define SRAND(a) srand48(a) --#define RAND_TYPE long --#elif HAVE_SRAND --#define RAND() rand() --#define SRAND(a) srand(a) --#define RAND_TYPE int --#elif HAVE_SRANDOM --#define RAND() random() --#define SRAND(a) srandom(a) --#define RAND_TYPE long --#else /* no random */ --need a random number generator --#endif /* no random */ -- --krb5_keyblock test1[] = { -- {0, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0, 0}, -- {-1}, --}; --krb5_keyblock test2[] = { -- {0, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0, 0}, -- {-1}, --}; --krb5_keyblock test3[] = { -- {0, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0, 0}, -- {-1}, --}; -- --krb5_keyblock *tests[] = { -- test1, test2, test3, NULL --}; -- --krb5_data tgtname = { -- 0, -- KRB5_TGS_NAME_SIZE, -- KRB5_TGS_NAME --}; -- --krb5_enctype ktypes[] = { 0, 0 }; -- --extern krb5_kt_ops krb5_ktf_writable_ops; -- --int --main(int argc, char **argv) --{ -- krb5_context context; -- krb5_keytab kt; -- krb5_keytab_entry ktent; -- krb5_encrypt_block eblock; -- krb5_creds my_creds; -- krb5_get_init_creds_opt *opt; -- kadm5_principal_ent_rec princ_ent; -- krb5_principal princ, server; -- char pw[16]; -- char *whoami, *principal, *authprinc, *authpwd; -- krb5_data pwdata; -- void *handle; -- int ret, test, encnum; -- unsigned int i; -- -- whoami = argv[0]; -- -- if (argc < 2 || argc > 4) { -- fprintf(stderr, "Usage: %s principal [authuser] [authpwd]\n", whoami); -- exit(1); -- } -- principal = argv[1]; -- authprinc = (argc > 2) ? argv[2] : argv[0]; -- authpwd = (argc > 3) ? argv[3] : NULL; -- -- /* -- * Setup. Initialize data structures, open keytab, open connection -- * to kadm5 server. -- */ -- -- memset(&context, 0, sizeof(context)); -- kadm5_init_krb5_context(&context); -- -- ret = krb5_parse_name(context, principal, &princ); -- if (ret) { -- com_err(whoami, ret, "while parsing principal name %s", principal); -- exit(1); -- } -- -- if((ret = krb5_build_principal_ext(context, &server, -- krb5_princ_realm(kcontext, princ)->length, -- krb5_princ_realm(kcontext, princ)->data, -- tgtname.length, tgtname.data, -- krb5_princ_realm(kcontext, princ)->length, -- krb5_princ_realm(kcontext, princ)->data, -- 0))) { -- com_err(whoami, ret, "while building server name"); -- exit(1); -- } -- -- ret = krb5_kt_default(context, &kt); -- if (ret) { -- com_err(whoami, ret, "while opening keytab"); -- exit(1); -- } -- -- ret = kadm5_init(context, authprinc, authpwd, KADM5_ADMIN_SERVICE, NULL, -- KADM5_STRUCT_VERSION, KADM5_API_VERSION_4, NULL, -- &handle); -- if (ret) { -- com_err(whoami, ret, "while initializing connection"); -- exit(1); -- } -- -- /* these pw's don't need to be secure, just different every time */ -- SRAND((RAND_TYPE)time((void *) NULL)); -- pwdata.data = pw; -- pwdata.length = sizeof(pw); -- -- /* -- * For each test: -- * -- * For each enctype in the test, construct a random password/key. -- * Assign all keys to principal with kadm5_setkey_principal. Add -- * each key to the keytab, and acquire an initial ticket with the -- * keytab (XXX can I specify the kvno explicitly?). If -- * krb5_get_init_creds_keytab succeeds, then the keys were set -- * successfully. -- */ -- for (test = 0; tests[test] != NULL; test++) { -- krb5_keyblock *testp = tests[test]; -- kadm5_key_data *extracted; -- int n_extracted, match; -- printf("+ Test %d:\n", test); -- -- for (encnum = 0; testp[encnum].magic != -1; encnum++) { -- for (i = 0; i < sizeof(pw); i++) -- pw[i] = (RAND() % 26) + '0'; /* XXX */ -- -- krb5_use_enctype(context, &eblock, testp[encnum].enctype); -- ret = krb5_string_to_key(context, &eblock, &testp[encnum], -- &pwdata, NULL); -- if (ret) { -- com_err(whoami, ret, "while converting string to key"); -- exit(1); -- } -- } -- -- /* now, encnum == # of keyblocks in testp */ -- ret = kadm5_setkey_principal(handle, princ, testp, encnum); -- if (ret) { -- com_err(whoami, ret, "while setting keys"); -- exit(1); -- } -- -- ret = kadm5_get_principal(handle, princ, &princ_ent, KADM5_KVNO); -- if (ret) { -- com_err(whoami, ret, "while retrieving principal"); -- exit(1); -- } -- -- ret = kadm5_get_principal_keys(handle, princ, 0, &extracted, -- &n_extracted); -- if (ret) { -- com_err(whoami, ret, "while extracting keys"); -- exit(1); -- } -- -- for (encnum = 0; testp[encnum].magic != -1; encnum++) { -- printf("+ enctype %d\n", testp[encnum].enctype); -- -- for (match = 0; match < n_extracted; match++) { -- if (extracted[match].key.enctype == testp[encnum].enctype) -- break; -- } -- if (match >= n_extracted) { -- com_err(whoami, KRB5_WRONG_ETYPE, "while matching enctypes"); -- exit(1); -- } -- if (extracted[match].key.length != testp[encnum].length || -- memcmp(extracted[match].key.contents, testp[encnum].contents, -- testp[encnum].length) != 0) { -- com_err(whoami, KRB5_KDB_NO_MATCHING_KEY, "verifying keys"); -- exit(1); -- } -- -- memset(&ktent, 0, sizeof(ktent)); -- ktent.principal = princ; -- ktent.key = testp[encnum]; -- ktent.vno = princ_ent.kvno; -- -- ret = krb5_kt_add_entry(context, kt, &ktent); -- if (ret) { -- com_err(whoami, ret, "while adding keytab entry"); -- exit(1); -- } -- -- memset(&my_creds, 0, sizeof(my_creds)); -- my_creds.client = princ; -- my_creds.server = server; -- -- ktypes[0] = testp[encnum].enctype; -- ret = krb5_get_init_creds_opt_alloc(context, &opt); -- if (ret) { -- com_err(whoami, ret, "while allocating gic opts"); -- exit(1); -- } -- krb5_get_init_creds_opt_set_etype_list(opt, ktypes, 1); -- ret = krb5_get_init_creds_keytab(context, &my_creds, princ, -- kt, 0, NULL /* in_tkt_service */, -- opt); -- krb5_get_init_creds_opt_free(context, opt); -- if (ret) { -- com_err(whoami, ret, "while acquiring initial ticket"); -- exit(1); -- } -- krb5_free_cred_contents(context, &my_creds); -- -- /* since I can't specify enctype explicitly ... */ -- ret = krb5_kt_remove_entry(context, kt, &ktent); -- if (ret) { -- com_err(whoami, ret, "while removing keytab entry"); -- exit(1); -- } -- } -- -- (void)kadm5_free_kadm5_key_data(context, n_extracted, extracted); -- } -- -- ret = krb5_kt_close(context, kt); -- if (ret) { -- com_err(whoami, ret, "while closing keytab"); -- exit(1); -- } -- -- ret = kadm5_destroy(handle); -- if (ret) { -- com_err(whoami, ret, "while closing kadmin connection"); -- exit(1); -- } -- -- krb5_free_principal(context, princ); -- krb5_free_principal(context, server); -- krb5_free_context(context); -- return 0; --} -diff --git a/src/lib/kadm5/unit-test/site.exp b/src/lib/kadm5/unit-test/site.exp -deleted file mode 100644 -index 7fe397463..000000000 ---- a/src/lib/kadm5/unit-test/site.exp -+++ /dev/null -@@ -1,2 +0,0 @@ --set tool kadm5_srv_tcl --set prompt "% " --- -2.31.1 - diff --git a/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch b/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch deleted file mode 100644 index 3c90b97..0000000 --- a/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch +++ /dev/null @@ -1,150 +0,0 @@ -From c99ecf1bb49e2fbd0bf30a7b357cf06407b9588a Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Sat, 15 May 2021 18:04:58 -0400 -Subject: [PATCH] Remove deprecated OpenSSL calls from softpkcs11 - -Rewrite add_pubkey_info() in terms of the EVP_PKEY interface. In this -process, fix its unchecked allocations and fail fast for non-RSA keys. - -(cherry picked from commit d6bf42279675100e3e4fe7c6e08eef74d49624cb) -(cherry picked from commit 5072bfdfaddae762680d0f9d97afa6dbf8274760) ---- - src/configure.ac | 1 + - src/tests/softpkcs11/main.c | 106 ++++++++++++++++++++++++------------ - 2 files changed, 72 insertions(+), 35 deletions(-) - -diff --git a/src/configure.ac b/src/configure.ac -index 3e1052db7..eb6307468 100644 ---- a/src/configure.ac -+++ b/src/configure.ac -@@ -1114,6 +1114,7 @@ int i = 1; - ])], k5_cv_openssl_version_okay=yes, k5_cv_openssl_version_okay=no)]) - old_LIBS="$LIBS" - AC_CHECK_LIB(crypto, PKCS7_get_signer_info) -+ AC_CHECK_FUNCS(EVP_PKEY_get_bn_param) - LIBS="$old_LIBS" - fi - if test "$k5_cv_openssl_version_okay" = yes && (test "$enable_pkinit" = yes || test "$enable_pkinit" = try); then -diff --git a/src/tests/softpkcs11/main.c b/src/tests/softpkcs11/main.c -index caa537b68..86b4ef711 100644 ---- a/src/tests/softpkcs11/main.c -+++ b/src/tests/softpkcs11/main.c -@@ -413,47 +413,83 @@ add_object_attribute(struct st_object *o, - return CKR_OK; - } - -+#ifdef HAVE_EVP_PKEY_GET_BN_PARAM -+ -+/* Declare owner pointers since EVP_PKEY_get_bn_param() gives us copies. */ -+#define DECLARE_BIGNUM(name) BIGNUM *name = NULL -+#define RELEASE_BIGNUM(bn) BN_clear_free(bn) - static CK_RV --add_pubkey_info(struct st_object *o, CK_KEY_TYPE key_type, EVP_PKEY *key) -+get_bignums(EVP_PKEY *key, BIGNUM **n, BIGNUM **e) - { -- switch (key_type) { -- case CKK_RSA: { -- CK_BYTE *modulus = NULL; -- size_t modulus_len = 0; -- CK_ULONG modulus_bits = 0; -- CK_BYTE *exponent = NULL; -- size_t exponent_len = 0; -- const RSA *rsa; -- const BIGNUM *n, *e; -+ if (EVP_PKEY_get_bn_param(key, "n", n) == 0 || -+ EVP_PKEY_get_bn_param(key, "e", e) == 0) -+ return CKR_DEVICE_ERROR; - -- rsa = EVP_PKEY_get0_RSA(key); -- RSA_get0_key(rsa, &n, &e, NULL); -- modulus_bits = BN_num_bits(n); -- -- modulus_len = BN_num_bytes(n); -- modulus = malloc(modulus_len); -- BN_bn2bin(n, modulus); -- -- exponent_len = BN_num_bytes(e); -- exponent = malloc(exponent_len); -- BN_bn2bin(e, exponent); -- -- add_object_attribute(o, 0, CKA_MODULUS, modulus, modulus_len); -- add_object_attribute(o, 0, CKA_MODULUS_BITS, -- &modulus_bits, sizeof(modulus_bits)); -- add_object_attribute(o, 0, CKA_PUBLIC_EXPONENT, -- exponent, exponent_len); -- -- free(modulus); -- free(exponent); -- } -- default: -- /* XXX */ -- break; -- } - return CKR_OK; - } - -+#else -+ -+/* Declare const pointers since the old API gives us aliases. */ -+#define DECLARE_BIGNUM(name) const BIGNUM *name -+#define RELEASE_BIGNUM(bn) -+static CK_RV -+get_bignums(EVP_PKEY *key, const BIGNUM **n, const BIGNUM **e) -+{ -+ const RSA *rsa; -+ -+ rsa = EVP_PKEY_get0_RSA(key); -+ RSA_get0_key(rsa, n, e, NULL); -+ -+ return CKR_OK; -+} -+ -+#endif -+ -+static CK_RV -+add_pubkey_info(struct st_object *o, CK_KEY_TYPE key_type, EVP_PKEY *key) -+{ -+ CK_BYTE *modulus = NULL, *exponent = 0; -+ size_t modulus_len = 0, exponent_len = 0; -+ CK_ULONG modulus_bits = 0; -+ CK_RV ret; -+ DECLARE_BIGNUM(n); -+ DECLARE_BIGNUM(e); -+ -+ if (key_type != CKK_RSA) -+ abort(); -+ -+ ret = get_bignums(key, &n, &e); -+ if (ret != CKR_OK) -+ goto done; -+ -+ modulus_bits = BN_num_bits(n); -+ modulus_len = BN_num_bytes(n); -+ exponent_len = BN_num_bytes(e); -+ -+ modulus = malloc(modulus_len); -+ exponent = malloc(exponent_len); -+ if (modulus == NULL || exponent == NULL) { -+ ret = CKR_DEVICE_MEMORY; -+ goto done; -+ } -+ -+ BN_bn2bin(n, modulus); -+ BN_bn2bin(e, exponent); -+ -+ add_object_attribute(o, 0, CKA_MODULUS, modulus, modulus_len); -+ add_object_attribute(o, 0, CKA_MODULUS_BITS, &modulus_bits, -+ sizeof(modulus_bits)); -+ add_object_attribute(o, 0, CKA_PUBLIC_EXPONENT, exponent, exponent_len); -+ -+ ret = CKR_OK; -+done: -+ free(modulus); -+ free(exponent); -+ RELEASE_BIGNUM(n); -+ RELEASE_BIGNUM(e); -+ return ret; -+} - - static int - pem_callback(char *buf, int num, int w, void *key) diff --git a/Support-host-based-GSS-initiator-names.patch b/Support-host-based-GSS-initiator-names.patch deleted file mode 100644 index cd7450c..0000000 --- a/Support-host-based-GSS-initiator-names.patch +++ /dev/null @@ -1,578 +0,0 @@ -From 818a777822658d44ce647fe975011a5ea25e8250 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Fri, 15 Jan 2021 13:51:34 -0500 -Subject: [PATCH] Support host-based GSS initiator names - -When checking if we can get initial credentials in the GSS krb5 mech, -use krb5_kt_have_match() to support fallback iteration. When scanning -the ccache or getting initial credentials, rewrite cred->name->princ -to the canonical client name. When a name check is necessary (such as -when the caller specifies both a name and ccache), use a new internal -API k5_sname_compare() to support fallback iteration. Add fallback -iteration to krb5_cc_cache_match() to allow host-based names to be -canonicalized against the cache collection. - -Create and store the matching principal for acceptor names in -acquire_accept_cred() so that it isn't affected by changes in -cred->name->princ during acquire_init_cred(). - -ticket: 8978 (new) -(cherry picked from commit c374ab40dd059a5938ffc0440d87457ac5da3a46) ---- - src/include/k5-int.h | 9 +++ - src/include/k5-trace.h | 3 + - src/lib/gssapi/krb5/accept_sec_context.c | 15 +--- - src/lib/gssapi/krb5/acquire_cred.c | 89 ++++++++++++++---------- - src/lib/gssapi/krb5/gssapiP_krb5.h | 1 + - src/lib/gssapi/krb5/rel_cred.c | 1 + - src/lib/krb5/ccache/cccursor.c | 57 +++++++++++---- - src/lib/krb5/libkrb5.exports | 1 + - src/lib/krb5/os/sn2princ.c | 23 +++++- - src/lib/krb5_32.def | 1 + - src/tests/gssapi/t_client_keytab.py | 44 ++++++++++++ - src/tests/gssapi/t_credstore.py | 32 +++++++++ - 12 files changed, 214 insertions(+), 62 deletions(-) - -diff --git a/src/include/k5-int.h b/src/include/k5-int.h -index efb523689..46f2ce2d3 100644 ---- a/src/include/k5-int.h -+++ b/src/include/k5-int.h -@@ -2411,4 +2411,13 @@ void k5_change_error_message_code(krb5_context ctx, krb5_error_code oldcode, - #define k5_prependmsg krb5_prepend_error_message - #define k5_wrapmsg krb5_wrap_error_message - -+/* -+ * Like krb5_principal_compare(), but with canonicalization of sname if -+ * fallback is enabled. This function should be avoided if multiple matches -+ * are required, since repeated canonicalization is inefficient. -+ */ -+krb5_boolean -+k5_sname_compare(krb5_context context, krb5_const_principal sname, -+ krb5_const_principal princ); -+ - #endif /* _KRB5_INT_H */ -diff --git a/src/include/k5-trace.h b/src/include/k5-trace.h -index b3e039dc8..79b5a7a85 100644 ---- a/src/include/k5-trace.h -+++ b/src/include/k5-trace.h -@@ -105,6 +105,9 @@ void krb5int_trace(krb5_context context, const char *fmt, ...); - - #endif /* DISABLE_TRACING */ - -+#define TRACE_CC_CACHE_MATCH(c, princ, ret) \ -+ TRACE(c, "Matching {princ} in collection with result: {kerr}", \ -+ princ, ret) - #define TRACE_CC_DESTROY(c, cache) \ - TRACE(c, "Destroying ccache {ccache}", cache) - #define TRACE_CC_GEN_NEW(c, cache) \ -diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c -index fcf2c2152..a1d7e0d96 100644 ---- a/src/lib/gssapi/krb5/accept_sec_context.c -+++ b/src/lib/gssapi/krb5/accept_sec_context.c -@@ -683,7 +683,6 @@ kg_accept_krb5(minor_status, context_handle, - krb5_flags ap_req_options = 0; - krb5_enctype negotiated_etype; - krb5_authdata_context ad_context = NULL; -- krb5_principal accprinc = NULL; - krb5_ap_req *request = NULL; - - code = krb5int_accessor (&kaccess, KRB5INT_ACCESS_VERSION); -@@ -849,17 +848,9 @@ kg_accept_krb5(minor_status, context_handle, - } - } - -- if (!cred->default_identity) { -- if ((code = kg_acceptor_princ(context, cred->name, &accprinc))) { -- major_status = GSS_S_FAILURE; -- goto fail; -- } -- } -- -- code = krb5_rd_req_decoded(context, &auth_context, request, accprinc, -- cred->keytab, &ap_req_options, NULL); -- -- krb5_free_principal(context, accprinc); -+ code = krb5_rd_req_decoded(context, &auth_context, request, -+ cred->acceptor_mprinc, cred->keytab, -+ &ap_req_options, NULL); - if (code) { - major_status = GSS_S_FAILURE; - goto fail; -diff --git a/src/lib/gssapi/krb5/acquire_cred.c b/src/lib/gssapi/krb5/acquire_cred.c -index 632ee7def..e226a0269 100644 ---- a/src/lib/gssapi/krb5/acquire_cred.c -+++ b/src/lib/gssapi/krb5/acquire_cred.c -@@ -123,11 +123,11 @@ gss_krb5int_register_acceptor_identity(OM_uint32 *minor_status, - /* Try to verify that keytab contains at least one entry for name. Return 0 if - * it does, KRB5_KT_NOTFOUND if it doesn't, or another error as appropriate. */ - static krb5_error_code --check_keytab(krb5_context context, krb5_keytab kt, krb5_gss_name_t name) -+check_keytab(krb5_context context, krb5_keytab kt, krb5_gss_name_t name, -+ krb5_principal mprinc) - { - krb5_error_code code; - krb5_keytab_entry ent; -- krb5_principal accprinc = NULL; - char *princname; - - if (name->service == NULL) { -@@ -141,21 +141,15 @@ check_keytab(krb5_context context, krb5_keytab kt, krb5_gss_name_t name) - if (kt->ops->start_seq_get == NULL) - return 0; - -- /* Get the partial principal for the acceptor name. */ -- code = kg_acceptor_princ(context, name, &accprinc); -- if (code) -- return code; -- -- /* Scan the keytab for host-based entries matching accprinc. */ -- code = k5_kt_have_match(context, kt, accprinc); -+ /* Scan the keytab for host-based entries matching mprinc. */ -+ code = k5_kt_have_match(context, kt, mprinc); - if (code == KRB5_KT_NOTFOUND) { -- if (krb5_unparse_name(context, accprinc, &princname) == 0) { -+ if (krb5_unparse_name(context, mprinc, &princname) == 0) { - k5_setmsg(context, code, _("No key table entry found matching %s"), - princname); - free(princname); - } - } -- krb5_free_principal(context, accprinc); - return code; - } - -@@ -202,8 +196,14 @@ acquire_accept_cred(krb5_context context, OM_uint32 *minor_status, - } - - if (cred->name != NULL) { -+ code = kg_acceptor_princ(context, cred->name, &cred->acceptor_mprinc); -+ if (code) { -+ major = GSS_S_FAILURE; -+ goto cleanup; -+ } -+ - /* Make sure we have keys matching the desired name in the keytab. */ -- code = check_keytab(context, kt, cred->name); -+ code = check_keytab(context, kt, cred->name, cred->acceptor_mprinc); - if (code) { - if (code == KRB5_KT_NOTFOUND) { - k5_change_error_message_code(context, code, KG_KEYTAB_NOMATCH); -@@ -324,7 +324,6 @@ static krb5_boolean - can_get_initial_creds(krb5_context context, krb5_gss_cred_id_rec *cred) - { - krb5_error_code code; -- krb5_keytab_entry entry; - - if (cred->password != NULL) - return TRUE; -@@ -336,20 +335,21 @@ can_get_initial_creds(krb5_context context, krb5_gss_cred_id_rec *cred) - if (cred->name == NULL) - return !krb5_kt_have_content(context, cred->client_keytab); - -- /* Check if we have a keytab key for the client principal. */ -- code = krb5_kt_get_entry(context, cred->client_keytab, cred->name->princ, -- 0, 0, &entry); -- if (code) { -- krb5_clear_error_message(context); -- return FALSE; -- } -- krb5_free_keytab_entry_contents(context, &entry); -- return TRUE; -+ /* -+ * Check if we have a keytab key for the client principal. This is a bit -+ * more permissive than we really want because krb5_kt_have_match() -+ * supports wildcarding and obeys ignore_acceptor_hostname, but that should -+ * generally be harmless. -+ */ -+ code = k5_kt_have_match(context, cred->client_keytab, cred->name->princ); -+ return code == 0; - } - --/* Scan cred->ccache for name, expiry time, impersonator, refresh time. */ -+/* Scan cred->ccache for name, expiry time, impersonator, refresh time. If -+ * check_name is true, verify the cache name against the credential name. */ - static krb5_error_code --scan_ccache(krb5_context context, krb5_gss_cred_id_rec *cred) -+scan_ccache(krb5_context context, krb5_gss_cred_id_rec *cred, -+ krb5_boolean check_name) - { - krb5_error_code code; - krb5_ccache ccache = cred->ccache; -@@ -365,23 +365,31 @@ scan_ccache(krb5_context context, krb5_gss_cred_id_rec *cred) - if (code) - return code; - -- /* Credentials cache principal must match the initiator name. */ - code = krb5_cc_get_principal(context, ccache, &ccache_princ); - if (code != 0) - goto cleanup; -- if (cred->name != NULL && -- !krb5_principal_compare(context, ccache_princ, cred->name->princ)) { -- code = KG_CCACHE_NOMATCH; -- goto cleanup; -- } - -- /* Save the ccache principal as the credential name if not already set. */ -- if (!cred->name) { -+ if (cred->name == NULL) { -+ /* Save the ccache principal as the credential name. */ - code = kg_init_name(context, ccache_princ, NULL, NULL, NULL, - KG_INIT_NAME_NO_COPY, &cred->name); - if (code) - goto cleanup; - ccache_princ = NULL; -+ } else { -+ /* Check against the desired name if needed. */ -+ if (check_name) { -+ if (!k5_sname_compare(context, cred->name->princ, ccache_princ)) { -+ code = KG_CCACHE_NOMATCH; -+ goto cleanup; -+ } -+ } -+ -+ /* Replace the credential name principal with the canonical client -+ * principal, retaining acceptor_mprinc if set. */ -+ krb5_free_principal(context, cred->name->princ); -+ cred->name->princ = ccache_princ; -+ ccache_princ = NULL; - } - - assert(cred->name->princ != NULL); -@@ -447,7 +455,7 @@ get_cache_for_name(krb5_context context, krb5_gss_cred_id_rec *cred) - assert(cred->name != NULL && cred->ccache == NULL); - #ifdef USE_LEASH - code = get_ccache_leash(context, cred->name->princ, &cred->ccache); -- return code ? code : scan_ccache(context, cred); -+ return code ? code : scan_ccache(context, cred, TRUE); - #else - /* Check first whether we can acquire tickets, to avoid overwriting the - * extended error message from krb5_cc_cache_match. */ -@@ -456,7 +464,7 @@ get_cache_for_name(krb5_context context, krb5_gss_cred_id_rec *cred) - /* Look for an existing cache for the client principal. */ - code = krb5_cc_cache_match(context, cred->name->princ, &cred->ccache); - if (code == 0) -- return scan_ccache(context, cred); -+ return scan_ccache(context, cred, FALSE); - if (code != KRB5_CC_NOTFOUND || !can_get) - return code; - krb5_clear_error_message(context); -@@ -633,6 +641,13 @@ get_initial_cred(krb5_context context, const struct verify_params *verify, - kg_cred_set_initial_refresh(context, cred, &creds.times); - cred->have_tgt = TRUE; - cred->expire = creds.times.endtime; -+ -+ /* Steal the canonical client principal name from creds and save it in the -+ * credential name, retaining acceptor_mprinc if set. */ -+ krb5_free_principal(context, cred->name->princ); -+ cred->name->princ = creds.client; -+ creds.client = NULL; -+ - krb5_free_cred_contents(context, &creds); - cleanup: - krb5_get_init_creds_opt_free(context, opt); -@@ -721,7 +736,7 @@ acquire_init_cred(krb5_context context, OM_uint32 *minor_status, - - if (cred->ccache != NULL) { - /* The caller specified a ccache; check what's in it. */ -- code = scan_ccache(context, cred); -+ code = scan_ccache(context, cred, TRUE); - if (code == KRB5_FCC_NOFILE) { - /* See if we can get initial creds. If the caller didn't specify - * a name, pick one from the client keytab. */ -@@ -984,7 +999,7 @@ kg_cred_resolve(OM_uint32 *minor_status, krb5_context context, - } - } - if (cred->ccache != NULL) { -- code = scan_ccache(context, cred); -+ code = scan_ccache(context, cred, FALSE); - if (code) - goto kerr; - } -@@ -996,7 +1011,7 @@ kg_cred_resolve(OM_uint32 *minor_status, krb5_context context, - code = krb5int_cc_default(context, &cred->ccache); - if (code) - goto kerr; -- code = scan_ccache(context, cred); -+ code = scan_ccache(context, cred, FALSE); - if (code == KRB5_FCC_NOFILE) { - /* Default ccache doesn't exist; fall through to client keytab. */ - krb5_cc_close(context, cred->ccache); -diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h -index 3bacdcd35..fd7abbd77 100644 ---- a/src/lib/gssapi/krb5/gssapiP_krb5.h -+++ b/src/lib/gssapi/krb5/gssapiP_krb5.h -@@ -175,6 +175,7 @@ typedef struct _krb5_gss_cred_id_rec { - /* name/type of credential */ - gss_cred_usage_t usage; - krb5_gss_name_t name; -+ krb5_principal acceptor_mprinc; - krb5_principal impersonator; - unsigned int default_identity : 1; - unsigned int iakerb_mech : 1; -diff --git a/src/lib/gssapi/krb5/rel_cred.c b/src/lib/gssapi/krb5/rel_cred.c -index a9515daf7..0da6c1b95 100644 ---- a/src/lib/gssapi/krb5/rel_cred.c -+++ b/src/lib/gssapi/krb5/rel_cred.c -@@ -72,6 +72,7 @@ krb5_gss_release_cred(minor_status, cred_handle) - if (cred->name) - kg_release_name(context, &cred->name); - -+ krb5_free_principal(context, cred->acceptor_mprinc); - krb5_free_principal(context, cred->impersonator); - - if (cred->req_enctypes) -diff --git a/src/lib/krb5/ccache/cccursor.c b/src/lib/krb5/ccache/cccursor.c -index 8f5872116..760216d05 100644 ---- a/src/lib/krb5/ccache/cccursor.c -+++ b/src/lib/krb5/ccache/cccursor.c -@@ -30,6 +30,7 @@ - - #include "cc-int.h" - #include "../krb/int-proto.h" -+#include "../os/os-proto.h" - - #include - -@@ -141,18 +142,18 @@ krb5_cccol_cursor_free(krb5_context context, - return 0; - } - --krb5_error_code KRB5_CALLCONV --krb5_cc_cache_match(krb5_context context, krb5_principal client, -- krb5_ccache *cache_out) -+static krb5_error_code -+match_caches(krb5_context context, krb5_const_principal client, -+ krb5_ccache *cache_out) - { - krb5_error_code ret; - krb5_cccol_cursor cursor; - krb5_ccache cache = NULL; - krb5_principal princ; -- char *name; - krb5_boolean eq; - - *cache_out = NULL; -+ - ret = krb5_cccol_cursor_new(context, &cursor); - if (ret) - return ret; -@@ -169,20 +170,52 @@ krb5_cc_cache_match(krb5_context context, krb5_principal client, - krb5_cc_close(context, cache); - } - krb5_cccol_cursor_free(context, &cursor); -+ - if (ret) - return ret; -- if (cache == NULL) { -- ret = krb5_unparse_name(context, client, &name); -- if (ret == 0) { -- k5_setmsg(context, KRB5_CC_NOTFOUND, -+ if (cache == NULL) -+ return KRB5_CC_NOTFOUND; -+ -+ *cache_out = cache; -+ return 0; -+} -+ -+krb5_error_code KRB5_CALLCONV -+krb5_cc_cache_match(krb5_context context, krb5_principal client, -+ krb5_ccache *cache_out) -+{ -+ krb5_error_code ret; -+ struct canonprinc iter = { client, .subst_defrealm = TRUE }; -+ krb5_const_principal canonprinc = NULL; -+ krb5_ccache cache = NULL; -+ char *name; -+ -+ *cache_out = NULL; -+ -+ while ((ret = k5_canonprinc(context, &iter, &canonprinc)) == 0 && -+ canonprinc != NULL) { -+ ret = match_caches(context, canonprinc, &cache); -+ if (ret != KRB5_CC_NOTFOUND) -+ break; -+ } -+ free_canonprinc(&iter); -+ -+ if (ret == 0 && canonprinc == NULL) { -+ ret = KRB5_CC_NOTFOUND; -+ if (krb5_unparse_name(context, client, &name) == 0) { -+ k5_setmsg(context, ret, - _("Can't find client principal %s in cache collection"), - name); - krb5_free_unparsed_name(context, name); - } -- ret = KRB5_CC_NOTFOUND; -- } else -- *cache_out = cache; -- return ret; -+ } -+ -+ TRACE_CC_CACHE_MATCH(context, client, ret); -+ if (ret) -+ return ret; -+ -+ *cache_out = cache; -+ return 0; - } - - /* Store the error state for code from context into errsave, but only if code -diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports -index adbfa332b..df6e2ffbe 100644 ---- a/src/lib/krb5/libkrb5.exports -+++ b/src/lib/krb5/libkrb5.exports -@@ -181,6 +181,7 @@ k5_size_authdata_context - k5_size_context - k5_size_keyblock - k5_size_principal -+k5_sname_compare - k5_unmarshal_cred - k5_unmarshal_princ - k5_unwrap_cammac_svc -diff --git a/src/lib/krb5/os/sn2princ.c b/src/lib/krb5/os/sn2princ.c -index 8b7214189..c99b7da17 100644 ---- a/src/lib/krb5/os/sn2princ.c -+++ b/src/lib/krb5/os/sn2princ.c -@@ -277,7 +277,8 @@ k5_canonprinc(krb5_context context, struct canonprinc *iter, - - /* If we're not doing fallback, the input principal is canonical. */ - if (context->dns_canonicalize_hostname != CANONHOST_FALLBACK || -- iter->princ->type != KRB5_NT_SRV_HST || iter->princ->length != 2) { -+ iter->princ->type != KRB5_NT_SRV_HST || iter->princ->length != 2 || -+ iter->princ->data[1].length == 0) { - *princ_out = (step == 1) ? iter->princ : NULL; - return 0; - } -@@ -288,6 +289,26 @@ k5_canonprinc(krb5_context context, struct canonprinc *iter, - return canonicalize_princ(context, iter, step == 2, princ_out); - } - -+krb5_boolean -+k5_sname_compare(krb5_context context, krb5_const_principal sname, -+ krb5_const_principal princ) -+{ -+ krb5_error_code ret; -+ struct canonprinc iter = { sname, .subst_defrealm = TRUE }; -+ krb5_const_principal canonprinc = NULL; -+ krb5_boolean match = FALSE; -+ -+ while ((ret = k5_canonprinc(context, &iter, &canonprinc)) == 0 && -+ canonprinc != NULL) { -+ if (krb5_principal_compare(context, canonprinc, princ)) { -+ match = TRUE; -+ break; -+ } -+ } -+ free_canonprinc(&iter); -+ return match; -+} -+ - krb5_error_code KRB5_CALLCONV - krb5_sname_to_principal(krb5_context context, const char *hostname, - const char *sname, krb5_int32 type, -diff --git a/src/lib/krb5_32.def b/src/lib/krb5_32.def -index 60b8dd311..cf690dbe4 100644 ---- a/src/lib/krb5_32.def -+++ b/src/lib/krb5_32.def -@@ -507,3 +507,4 @@ EXPORTS - ; new in 1.20 - krb5_marshal_credentials @472 - krb5_unmarshal_credentials @473 -+ k5_sname_compare @474 ; PRIVATE GSSAPI -diff --git a/src/tests/gssapi/t_client_keytab.py b/src/tests/gssapi/t_client_keytab.py -index 7847b3ecd..9a61d53b8 100755 ---- a/src/tests/gssapi/t_client_keytab.py -+++ b/src/tests/gssapi/t_client_keytab.py -@@ -141,5 +141,49 @@ msgs = ('Getting initial credentials for user/admin@KRBTEST.COM', - '/Matching credential not found') - realm.run(['./t_ccselect', phost], expected_code=1, - expected_msg='Ticket expired', expected_trace=msgs) -+realm.run([kdestroy, '-A']) -+ -+# Test 19: host-based initiator name -+mark('host-based initiator name') -+hsvc = 'h:svc@' + hostname -+svcprinc = 'svc/%s@%s' % (hostname, realm.realm) -+realm.addprinc(svcprinc) -+realm.extract_keytab(svcprinc, realm.client_keytab) -+# On the first run we match against the keytab while getting tickets, -+# substituting the default realm. -+msgs = ('/Can\'t find client principal svc/%s@ in' % hostname, -+ 'Getting initial credentials for svc/%s@' % hostname, -+ 'Found entries for %s in keytab' % svcprinc, -+ 'Retrieving %s from FILE:%s' % (svcprinc, realm.client_keytab), -+ 'Storing %s -> %s in' % (svcprinc, realm.krbtgt_princ), -+ 'Retrieving %s -> %s from' % (svcprinc, realm.krbtgt_princ), -+ 'authenticator for %s -> %s' % (svcprinc, realm.host_princ)) -+realm.run(['./t_ccselect', phost, hsvc], expected_trace=msgs) -+# On the second run we match against the collection. -+msgs = ('Matching svc/%s@ in collection with result: 0' % hostname, -+ 'Getting credentials %s -> %s' % (svcprinc, realm.host_princ), -+ 'authenticator for %s -> %s' % (svcprinc, realm.host_princ)) -+realm.run(['./t_ccselect', phost, hsvc], expected_trace=msgs) -+realm.run([kdestroy, '-A']) -+ -+# Test 20: host-based initiator name with fallback -+mark('host-based fallback initiator name') -+canonname = canonicalize_hostname(hostname) -+if canonname != hostname: -+ hfsvc = 'h:fsvc@' + hostname -+ canonprinc = 'fsvc/%s@%s' % (canonname, realm.realm) -+ realm.addprinc(canonprinc) -+ realm.extract_keytab(canonprinc, realm.client_keytab) -+ msgs = ('/Can\'t find client principal fsvc/%s@ in' % hostname, -+ 'Found entries for %s in keytab' % canonprinc, -+ 'authenticator for %s -> %s' % (canonprinc, realm.host_princ)) -+ realm.run(['./t_ccselect', phost, hfsvc], expected_trace=msgs) -+ msgs = ('Matching fsvc/%s@ in collection with result: 0' % hostname, -+ 'Getting credentials %s -> %s' % (canonprinc, realm.host_princ)) -+ realm.run(['./t_ccselect', phost, hfsvc], expected_trace=msgs) -+ realm.run([kdestroy, '-A']) -+else: -+ skipped('GSS initiator name fallback test', -+ '%s does not canonicalize to a different name' % hostname) - - success('Client keytab tests') -diff --git a/src/tests/gssapi/t_credstore.py b/src/tests/gssapi/t_credstore.py -index c11975bf5..9be57bb82 100644 ---- a/src/tests/gssapi/t_credstore.py -+++ b/src/tests/gssapi/t_credstore.py -@@ -15,6 +15,38 @@ msgs = ('Storing %s -> %s in %s' % (service_cs, realm.krbtgt_princ, - realm.run(['./t_credstore', '-s', 'p:' + service_cs, 'ccache', storagecache, - 'keytab', servicekeytab], expected_trace=msgs) - -+mark('matching') -+scc = 'FILE:' + os.path.join(realm.testdir, 'service_cache') -+realm.kinit(realm.host_princ, flags=['-k', '-c', scc]) -+realm.run(['./t_credstore', '-i', 'p:' + realm.host_princ, 'ccache', scc]) -+realm.run(['./t_credstore', '-i', 'h:host', 'ccache', scc]) -+realm.run(['./t_credstore', '-i', 'h:host@' + hostname, 'ccache', scc]) -+realm.run(['./t_credstore', '-i', 'p:wrong', 'ccache', scc], -+ expected_code=1, expected_msg='does not match desired name') -+realm.run(['./t_credstore', '-i', 'h:host@-nomatch-', 'ccache', scc], -+ expected_code=1, expected_msg='does not match desired name') -+realm.run(['./t_credstore', '-i', 'h:svc', 'ccache', scc], -+ expected_code=1, expected_msg='does not match desired name') -+ -+mark('matching (fallback)') -+canonname = canonicalize_hostname(hostname) -+if canonname != hostname: -+ canonprinc = 'host/%s@%s' % (canonname, realm.realm) -+ realm.addprinc(canonprinc) -+ realm.extract_keytab(canonprinc, realm.keytab) -+ realm.kinit(canonprinc, flags=['-k', '-c', scc]) -+ realm.run(['./t_credstore', '-i', 'h:host', 'ccache', scc]) -+ realm.run(['./t_credstore', '-i', 'h:host@' + hostname, 'ccache', scc]) -+ realm.run(['./t_credstore', '-i', 'h:host@' + canonname, 'ccache', scc]) -+ realm.run(['./t_credstore', '-i', 'p:' + canonprinc, 'ccache', scc]) -+ realm.run(['./t_credstore', '-i', 'p:' + realm.host_princ, 'ccache', scc], -+ expected_code=1, expected_msg='does not match desired name') -+ realm.run(['./t_credstore', '-i', 'h:host@-nomatch-', 'ccache', scc], -+ expected_code=1, expected_msg='does not match desired name') -+else: -+ skipped('fallback matching test', -+ '%s does not canonicalize to a different name' % hostname) -+ - mark('rcache') - # t_credstore -r should produce a replay error normally, but not with - # rcache set to "none:". diff --git a/Try-harder-to-avoid-password-change-replay-errors.patch b/Try-harder-to-avoid-password-change-replay-errors.patch deleted file mode 100644 index 875ed9c..0000000 --- a/Try-harder-to-avoid-password-change-replay-errors.patch +++ /dev/null @@ -1,91 +0,0 @@ -From 1f706852ee759160e763c355a3053ad5e045fa06 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Fri, 4 Mar 2022 00:45:00 -0500 -Subject: [PATCH] Try harder to avoid password change replay errors - -Commit d7b3018d338fc9c989c3fa17505870f23c3759a8 (ticket 7905) changed -change_set_password() to prefer TCP. However, because UDP_LAST falls -back to UDP after one second, we can still get a replay error due to a -dropped packet, before the TCP layer has a chance to retry. - -Instead, try k5_sendto() with NO_UDP, and only fall back to UDP after -TCP fails completely without reaching a server. In sendto_kdc.c, -implement an ONLY_UDP transport strategy to allow the UDP fallback. - -ticket: 9037 ---- - src/lib/krb5/os/changepw.c | 9 ++++++++- - src/lib/krb5/os/os-proto.h | 1 + - src/lib/krb5/os/sendto_kdc.c | 12 ++++++++---- - 3 files changed, 17 insertions(+), 5 deletions(-) - -diff --git a/src/lib/krb5/os/changepw.c b/src/lib/krb5/os/changepw.c -index 9f968da7f..c59232586 100644 ---- a/src/lib/krb5/os/changepw.c -+++ b/src/lib/krb5/os/changepw.c -@@ -255,9 +255,16 @@ change_set_password(krb5_context context, - callback_info.pfn_cleanup = kpasswd_sendto_msg_cleanup; - krb5_free_data_contents(callback_ctx.context, &chpw_rep); - -+ /* UDP retransmits may be seen as replays. Only try UDP after other -+ * transports fail completely. */ - code = k5_sendto(callback_ctx.context, NULL, &creds->server->realm, -- &sl, UDP_LAST, &callback_info, &chpw_rep, -+ &sl, NO_UDP, &callback_info, &chpw_rep, - ss2sa(&remote_addr), &addrlen, NULL, NULL, NULL); -+ if (code == KRB5_KDC_UNREACH) { -+ code = k5_sendto(callback_ctx.context, NULL, &creds->server->realm, -+ &sl, ONLY_UDP, &callback_info, &chpw_rep, -+ ss2sa(&remote_addr), &addrlen, NULL, NULL, NULL); -+ } - if (code) - goto cleanup; - -diff --git a/src/lib/krb5/os/os-proto.h b/src/lib/krb5/os/os-proto.h -index a985f2aec..91d2791ce 100644 ---- a/src/lib/krb5/os/os-proto.h -+++ b/src/lib/krb5/os/os-proto.h -@@ -49,6 +49,7 @@ typedef enum { - UDP_FIRST = 0, - UDP_LAST, - NO_UDP, -+ ONLY_UDP - } k5_transport_strategy; - - /* A single server hostname or address. */ -diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c -index 0eedec175..c7f5d861a 100644 ---- a/src/lib/krb5/os/sendto_kdc.c -+++ b/src/lib/krb5/os/sendto_kdc.c -@@ -802,11 +802,14 @@ resolve_server(krb5_context context, const krb5_data *realm, - int err, result; - char portbuf[PORT_LENGTH]; - -- /* Skip UDP entries if we don't want UDP. */ -+ /* Skip entries excluded by the strategy. */ - if (strategy == NO_UDP && entry->transport == UDP) - return 0; -+ if (strategy == ONLY_UDP && entry->transport != UDP && -+ entry->transport != TCP_OR_UDP) -+ return 0; - -- transport = (strategy == UDP_FIRST) ? UDP : TCP; -+ transport = (strategy == UDP_FIRST || strategy == ONLY_UDP) ? UDP : TCP; - if (entry->hostname == NULL) { - /* Added by a module, so transport is either TCP or UDP. */ - ai.ai_socktype = socktype_for_transport(entry->transport); -@@ -850,8 +853,9 @@ resolve_server(krb5_context context, const krb5_data *realm, - } - - /* For TCP_OR_UDP entries, add each address again with the non-preferred -- * transport, unless we are avoiding UDP. Flag these as deferred. */ -- if (retval == 0 && entry->transport == TCP_OR_UDP && strategy != NO_UDP) { -+ * transport, if there is one. Flag these as deferred. */ -+ if (retval == 0 && entry->transport == TCP_OR_UDP && -+ (strategy == UDP_FIRST || strategy == UDP_LAST)) { - transport = (strategy == UDP_FIRST) ? TCP : UDP; - for (a = addrs; a != 0 && retval == 0; a = a->ai_next) { - a->ai_socktype = socktype_for_transport(transport); --- -2.35.1 - diff --git a/Use-KCM_OP_RETRIEVE-in-KCM-client.patch b/Use-KCM_OP_RETRIEVE-in-KCM-client.patch deleted file mode 100644 index 2af5676..0000000 --- a/Use-KCM_OP_RETRIEVE-in-KCM-client.patch +++ /dev/null @@ -1,235 +0,0 @@ -From 336f744403baa5dfaffcc5bd226fdd8f14a0200b Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Fri, 26 Mar 2021 23:38:54 -0400 -Subject: [PATCH] Use KCM_OP_RETRIEVE in KCM client - -In kcm_retrieve(), try KCM_OP_RETRIEVE. Fall back to iteration if the -server doesn't implement it, or if we can an answer incompatible with -KRB5_TC_SUPPORTED_KTYPES. - -In kcmserver.py, implement partial decoding for creds and cred tags so -that we can do a basic principal name match. - -ticket: 8997 (new) -(cherry picked from commit 795ebba8c039be172ab93cd41105c73ffdba0fdb) ---- - src/include/kcm.h | 2 +- - src/lib/krb5/ccache/cc_kcm.c | 52 +++++++++++++++++++++++++++++++++--- - src/tests/kcmserver.py | 44 +++++++++++++++++++++++++++--- - src/tests/t_ccache.py | 11 +++++--- - 4 files changed, 99 insertions(+), 10 deletions(-) - -diff --git a/src/include/kcm.h b/src/include/kcm.h -index 9b66f1cbd..85c20d345 100644 ---- a/src/include/kcm.h -+++ b/src/include/kcm.h -@@ -87,7 +87,7 @@ typedef enum kcm_opcode { - KCM_OP_INITIALIZE, /* (name, princ) -> () */ - KCM_OP_DESTROY, /* (name) -> () */ - KCM_OP_STORE, /* (name, cred) -> () */ -- KCM_OP_RETRIEVE, -+ KCM_OP_RETRIEVE, /* (name, flags, credtag) -> (cred) */ - KCM_OP_GET_PRINCIPAL, /* (name) -> (princ) */ - KCM_OP_GET_CRED_UUID_LIST, /* (name) -> (uuid, ...) */ - KCM_OP_GET_CRED_BY_UUID, /* (name, uuid) -> (cred) */ -diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c -index 46705f1da..23fcf13ea 100644 ---- a/src/lib/krb5/ccache/cc_kcm.c -+++ b/src/lib/krb5/ccache/cc_kcm.c -@@ -826,9 +826,55 @@ static krb5_error_code KRB5_CALLCONV - kcm_retrieve(krb5_context context, krb5_ccache cache, krb5_flags flags, - krb5_creds *mcred, krb5_creds *cred_out) - { -- /* There is a KCM opcode for retrieving creds, but Heimdal's client doesn't -- * use it. It causes the KCM daemon to actually make a TGS request. */ -- return k5_cc_retrieve_cred_default(context, cache, flags, mcred, cred_out); -+ krb5_error_code ret; -+ struct kcmreq req = EMPTY_KCMREQ; -+ krb5_creds cred; -+ krb5_enctype *enctypes = NULL; -+ -+ memset(&cred, 0, sizeof(cred)); -+ -+ /* Include KCM_GC_CACHED in flags to prevent Heimdal's sssd from making a -+ * TGS request itself. */ -+ kcmreq_init(&req, KCM_OP_RETRIEVE, cache); -+ k5_buf_add_uint32_be(&req.reqbuf, map_tcflags(flags) | KCM_GC_CACHED); -+ k5_marshal_mcred(&req.reqbuf, mcred); -+ ret = cache_call(context, cache, &req); -+ -+ /* Fall back to iteration if the server does not support retrieval. */ -+ if (ret == KRB5_FCC_INTERNAL || ret == KRB5_CC_IO) { -+ ret = k5_cc_retrieve_cred_default(context, cache, flags, mcred, -+ cred_out); -+ goto cleanup; -+ } -+ if (ret) -+ goto cleanup; -+ -+ ret = k5_unmarshal_cred(req.reply.ptr, req.reply.len, 4, &cred); -+ if (ret) -+ goto cleanup; -+ -+ /* In rare cases we might retrieve a credential with a session key this -+ * context can't support, in which case we must retry using iteration. */ -+ if (flags & KRB5_TC_SUPPORTED_KTYPES) { -+ ret = krb5_get_tgs_ktypes(context, cred.server, &enctypes); -+ if (ret) -+ goto cleanup; -+ if (!k5_etypes_contains(enctypes, cred.keyblock.enctype)) { -+ ret = k5_cc_retrieve_cred_default(context, cache, flags, mcred, -+ cred_out); -+ goto cleanup; -+ } -+ } -+ -+ *cred_out = cred; -+ memset(&cred, 0, sizeof(cred)); -+ -+cleanup: -+ kcmreq_free(&req); -+ krb5_free_cred_contents(context, &cred); -+ free(enctypes); -+ /* Heimdal's KCM returns KRB5_CC_END if no cred is found. */ -+ return (ret == KRB5_CC_END) ? KRB5_CC_NOTFOUND : map_invalid(ret); - } - - static krb5_error_code KRB5_CALLCONV -diff --git a/src/tests/kcmserver.py b/src/tests/kcmserver.py -index 8c5e66ff1..25e6f2bbe 100644 ---- a/src/tests/kcmserver.py -+++ b/src/tests/kcmserver.py -@@ -40,6 +40,7 @@ class KCMOpcodes(object): - INITIALIZE = 4 - DESTROY = 5 - STORE = 6 -+ RETRIEVE = 7 - GET_PRINCIPAL = 8 - GET_CRED_UUID_LIST = 9 - GET_CRED_BY_UUID = 10 -@@ -54,6 +55,7 @@ class KCMOpcodes(object): - - - class KRB5Errors(object): -+ KRB5_CC_NOTFOUND = -1765328243 - KRB5_CC_END = -1765328242 - KRB5_CC_NOSUPP = -1765328137 - KRB5_FCC_NOFILE = -1765328189 -@@ -86,11 +88,29 @@ def get_cache(name): - return cache - - -+def unpack_data(argbytes): -+ dlen, = struct.unpack('>L', argbytes[:4]) -+ return argbytes[4:dlen+4], argbytes[dlen+4:] -+ -+ - def unmarshal_name(argbytes): - offset = argbytes.find(b'\0') - return argbytes[0:offset], argbytes[offset+1:] - - -+def unmarshal_princ(argbytes): -+ # Ignore the type at argbytes[0:4]. -+ ncomps, = struct.unpack('>L', argbytes[4:8]) -+ realm, rest = unpack_data(argbytes[8:]) -+ comps = [] -+ for i in range(ncomps): -+ comp, rest = unpack_data(rest) -+ comps.append(comp) -+ # Asssume no quoting is needed. -+ princ = b'/'.join(comps) + b'@' + realm -+ return princ, rest -+ -+ - def op_gen_new(argbytes): - # Does not actually check for uniqueness. - global next_unique -@@ -126,6 +146,22 @@ def op_store(argbytes): - return 0, b'' - - -+def op_retrieve(argbytes): -+ name, rest = unmarshal_name(argbytes) -+ # Ignore the flags at rest[0:4] and the header at rest[4:8]. -+ # Assume there are client and server creds in the tag and match -+ # only against them. -+ cprinc, rest = unmarshal_princ(rest[8:]) -+ sprinc, rest = unmarshal_princ(rest) -+ cache = get_cache(name) -+ for cred in (cache.creds[u] for u in cache.cred_uuids): -+ cred_cprinc, rest = unmarshal_princ(cred) -+ cred_sprinc, rest = unmarshal_princ(rest) -+ if cred_cprinc == cprinc and cred_sprinc == sprinc: -+ return 0, cred -+ return KRB5Errors.KRB5_CC_NOTFOUND, b'' -+ -+ - def op_get_principal(argbytes): - name, rest = unmarshal_name(argbytes) - cache = get_cache(name) -@@ -199,6 +235,7 @@ ophandlers = { - KCMOpcodes.INITIALIZE : op_initialize, - KCMOpcodes.DESTROY : op_destroy, - KCMOpcodes.STORE : op_store, -+ KCMOpcodes.RETRIEVE : op_retrieve, - KCMOpcodes.GET_PRINCIPAL : op_get_principal, - KCMOpcodes.GET_CRED_UUID_LIST : op_get_cred_uuid_list, - KCMOpcodes.GET_CRED_BY_UUID : op_get_cred_by_uuid, -@@ -243,10 +280,11 @@ def service_request(s): - return True - - parser = optparse.OptionParser() --parser.add_option('-c', '--credlist', action='store_true', dest='credlist', -- default=False, help='Support KCM_OP_GET_CRED_LIST') -+parser.add_option('-f', '--fallback', action='store_true', dest='fallback', -+ default=False, help='Do not support RETRIEVE/GET_CRED_LIST') - (options, args) = parser.parse_args() --if not options.credlist: -+if options.fallback: -+ del ophandlers[KCMOpcodes.RETRIEVE] - del ophandlers[KCMOpcodes.GET_CRED_LIST] - - server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) -diff --git a/src/tests/t_ccache.py b/src/tests/t_ccache.py -index 90040fb7b..6ea9fb969 100755 ---- a/src/tests/t_ccache.py -+++ b/src/tests/t_ccache.py -@@ -25,7 +25,7 @@ from k5test import * - kcm_socket_path = os.path.join(os.getcwd(), 'testdir', 'kcm') - conf = {'libdefaults': {'kcm_socket': kcm_socket_path, - 'kcm_mach_service': '-'}} --realm = K5Realm(create_host=False, krb5_conf=conf) -+realm = K5Realm(krb5_conf=conf) - - keyctl = which('keyctl') - out = realm.run([klist, '-c', 'KEYRING:process:abcd'], expected_code=1) -@@ -71,6 +71,11 @@ def collection_test(realm, ccname): - realm.kinit('alice', password('alice')) - realm.run([klist], expected_msg='Default principal: alice@') - realm.run([klist, '-A', '-s']) -+ realm.run([kvno, realm.host_princ], expected_msg = 'kvno = 1') -+ realm.run([kvno, realm.host_princ], expected_msg = 'kvno = 1') -+ out = realm.run([klist]) -+ if out.count(realm.host_princ) != 1: -+ fail('Wrong number of service tickets in cache') - realm.run([kdestroy]) - output = realm.run([klist], expected_code=1) - if 'No credentials cache' not in output and 'not found' not in output: -@@ -126,14 +131,14 @@ def collection_test(realm, ccname): - - collection_test(realm, 'DIR:' + os.path.join(realm.testdir, 'cc')) - --# Test KCM without and with GET_CRED_LIST support. -+# Test KCM with and without RETRIEVE and GET_CRED_LIST support. - kcmserver_path = os.path.join(srctop, 'tests', 'kcmserver.py') - kcmd = realm.start_server([sys.executable, kcmserver_path, kcm_socket_path], - 'starting...') - collection_test(realm, 'KCM:') - stop_daemon(kcmd) - os.remove(kcm_socket_path) --realm.start_server([sys.executable, kcmserver_path, '-c', kcm_socket_path], -+realm.start_server([sys.executable, kcmserver_path, '-f', kcm_socket_path], - 'starting...') - collection_test(realm, 'KCM:') - diff --git a/Use-OpenSSL-s-KBKDF-and-KRB5KDF-for-deriving-long-te.patch b/Use-OpenSSL-s-KBKDF-and-KRB5KDF-for-deriving-long-te.patch deleted file mode 100644 index 927b506..0000000 --- a/Use-OpenSSL-s-KBKDF-and-KRB5KDF-for-deriving-long-te.patch +++ /dev/null @@ -1,482 +0,0 @@ -From 21e3b9a4463f1d1aeb71de8a27c298f1307d186b Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Fri, 4 Oct 2019 14:49:29 -0400 -Subject: [PATCH] Use OpenSSL's KBKDF and KRB5KDF for deriving long-term keys - -If supported, use OpenSSL-provided KBKDF (aes-sha2 and camellia) and -KRB5KDF (3des and aes-sha1). We already use OpenSSL's PBKDF2 where -appropriate. OpenSSL added support for these KDFs in 3.0. - -(cherry picked from commit ef8d11f6fb1232201c9efd2ae2ed567023fb85d2) -[rharwood@redhat.com: 3des removal] ---- - src/lib/crypto/krb/derive.c | 409 ++++++++++++++++++++++++++++-------- - 1 file changed, 324 insertions(+), 85 deletions(-) - -diff --git a/src/lib/crypto/krb/derive.c b/src/lib/crypto/krb/derive.c -index 6707a7308..8e474b38e 100644 ---- a/src/lib/crypto/krb/derive.c -+++ b/src/lib/crypto/krb/derive.c -@@ -27,6 +27,12 @@ - - #include "crypto_int.h" - -+#ifdef HAVE_EVP_KDF_FETCH -+#include -+#include -+#include -+#endif -+ - static krb5_key - find_cached_dkey(struct derived_key *list, const krb5_data *constant) - { -@@ -77,55 +83,251 @@ cleanup: - return ENOMEM; - } - -+#ifdef HAVE_EVP_KDF_FETCH - static krb5_error_code --derive_random_rfc3961(const struct krb5_enc_provider *enc, -- krb5_key inkey, krb5_data *outrnd, -- const krb5_data *in_constant) -+openssl_kbdkf_counter_hmac(const struct krb5_hash_provider *hash, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *label, const krb5_data *context) - { -- size_t blocksize, keybytes, n; - krb5_error_code ret; -- krb5_data block = empty_data(); -+ EVP_KDF *kdf = NULL; -+ EVP_KDF_CTX *kctx = NULL; -+ OSSL_PARAM params[6]; -+ size_t i = 0; -+ char *digest; - -- blocksize = enc->block_size; -- keybytes = enc->keybytes; -+ /* On NULL hash, preserve default behavior for pbkdf2_string_to_key(). */ -+ if (hash == NULL || !strcmp(hash->hash_name, "SHA1")) { -+ digest = "SHA1"; -+ } else if (!strcmp(hash->hash_name, "SHA-256")) { -+ digest = "SHA256"; -+ } else if (!strcmp(hash->hash_name, "SHA-384")) { -+ digest = "SHA384"; -+ } else { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } - -- if (blocksize == 1) -- return KRB5_BAD_ENCTYPE; -- if (inkey->keyblock.length != enc->keylength || outrnd->length != keybytes) -+ kdf = EVP_KDF_fetch(NULL, "KBKDF", NULL); -+ if (!kdf) { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } -+ -+ kctx = EVP_KDF_CTX_new(kdf); -+ if (!kctx) { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } -+ -+ params[i++] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, -+ digest, 0); -+ params[i++] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC, -+ "HMAC", 0); -+ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, -+ inkey->keyblock.contents, -+ inkey->keyblock.length); -+ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, -+ context->data, -+ context->length); -+ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT, -+ label->data, -+ label->length); -+ params[i] = OSSL_PARAM_construct_end(); -+ if (EVP_KDF_derive(kctx, (unsigned char *)outrnd->data, outrnd->length, -+ params) <= 0) { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } -+ -+ ret = 0; -+done: -+ if (ret) -+ zap(outrnd->data, outrnd->length); -+ EVP_KDF_free(kdf); -+ EVP_KDF_CTX_free(kctx); -+ return ret; -+} -+ -+static krb5_error_code -+openssl_kbkdf_feedback_cmac(const struct krb5_enc_provider *enc, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *in_constant) -+{ -+ krb5_error_code ret; -+ EVP_KDF *kdf = NULL; -+ EVP_KDF_CTX *kctx = NULL; -+ OSSL_PARAM params[7]; -+ size_t i = 0; -+ char *cipher; -+ static unsigned char zeroes[16]; -+ -+ memset(zeroes, 0, sizeof(zeroes)); -+ -+ if (!memcmp(enc, &krb5int_enc_camellia128, sizeof(*enc))) { -+ cipher = "CAMELLIA-128-CBC"; -+ } else if (!memcmp(enc, &krb5int_enc_camellia256, sizeof(*enc))) { -+ cipher = "CAMELLIA-256-CBC"; -+ } else { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } -+ -+ kdf = EVP_KDF_fetch(NULL, "KBKDF", NULL); -+ if (!kdf) { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } -+ -+ kctx = EVP_KDF_CTX_new(kdf); -+ if (!kctx) { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } -+ -+ params[i++] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE, -+ "FEEDBACK", 0); -+ params[i++] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC, -+ "CMAC", 0); -+ params[i++] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CIPHER, -+ cipher, 0); -+ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, -+ inkey->keyblock.contents, -+ inkey->keyblock.length); -+ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT, -+ in_constant->data, -+ in_constant->length); -+ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, -+ zeroes, sizeof(zeroes)); -+ params[i] = OSSL_PARAM_construct_end(); -+ if (EVP_KDF_derive(kctx, (unsigned char *)outrnd->data, outrnd->length, -+ params) <= 0) { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } -+ -+ ret = 0; -+done: -+ if (ret) -+ zap(outrnd->data, outrnd->length); -+ EVP_KDF_free(kdf); -+ EVP_KDF_CTX_free(kctx); -+ return ret; -+} -+ -+static krb5_error_code -+openssl_krb5kdf(const struct krb5_enc_provider *enc, krb5_key inkey, -+ krb5_data *outrnd, const krb5_data *in_constant) -+{ -+ krb5_error_code ret; -+ EVP_KDF *kdf = NULL; -+ EVP_KDF_CTX *kctx = NULL; -+ OSSL_PARAM params[4]; -+ size_t i = 0; -+ char *cipher; -+ -+ if (inkey->keyblock.length != enc->keylength || -+ outrnd->length != enc->keybytes) { -+ return KRB5_CRYPTO_INTERNAL; -+ } -+ -+ if (!memcmp(enc, &krb5int_enc_aes128, sizeof(*enc))) { -+ cipher = "AES-128-CBC"; -+ } else if (!memcmp(enc, &krb5int_enc_aes256, sizeof(*enc))) { -+ cipher = "AES-256-CBC"; -+ } else { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } -+ -+ kdf = EVP_KDF_fetch(NULL, "KRB5KDF", NULL); -+ if (kdf == NULL) { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } -+ -+ kctx = EVP_KDF_CTX_new(kdf); -+ if (kctx == NULL) { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } -+ -+ params[i++] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CIPHER, -+ cipher, 0); -+ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, -+ inkey->keyblock.contents, -+ inkey->keyblock.length); -+ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_CONSTANT, -+ in_constant->data, -+ in_constant->length); -+ params[i] = OSSL_PARAM_construct_end(); -+ if (EVP_KDF_derive(kctx, (unsigned char *)outrnd->data, outrnd->length, -+ params) <= 0) { -+ ret = KRB5_CRYPTO_INTERNAL; -+ goto done; -+ } -+ -+ ret = 0; -+done: -+ if (ret) -+ zap(outrnd->data, outrnd->length); -+ EVP_KDF_free(kdf); -+ EVP_KDF_CTX_free(kctx); -+ return ret; -+} -+ -+#else /* HAVE_EVP_KDF_FETCH */ -+ -+/* -+ * NIST SP800-108 KDF in counter mode (section 5.1). -+ * Parameters: -+ * - HMAC (with hash as the hash provider) is the PRF. -+ * - A block counter of four bytes is used. -+ * - Four bytes are used to encode the output length in the PRF input. -+ * -+ * There are no uses requiring more than a single PRF invocation. -+ */ -+static krb5_error_code -+builtin_sp800_108_counter_hmac(const struct krb5_hash_provider *hash, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *label, -+ const krb5_data *context) -+{ -+ krb5_crypto_iov iov[5]; -+ krb5_error_code ret; -+ krb5_data prf; -+ unsigned char ibuf[4], lbuf[4]; -+ -+ if (hash == NULL || outrnd->length > hash->hashsize) - return KRB5_CRYPTO_INTERNAL; - - /* Allocate encryption data buffer. */ -- ret = alloc_data(&block, blocksize); -+ ret = alloc_data(&prf, hash->hashsize); - if (ret) - return ret; - -- /* Initialize the input block. */ -- if (in_constant->length == blocksize) { -- memcpy(block.data, in_constant->data, blocksize); -- } else { -- krb5int_nfold(in_constant->length * 8, -- (unsigned char *) in_constant->data, -- blocksize * 8, (unsigned char *) block.data); -- } -+ /* [i]2: four-byte big-endian binary string giving the block counter (1) */ -+ iov[0].flags = KRB5_CRYPTO_TYPE_DATA; -+ iov[0].data = make_data(ibuf, sizeof(ibuf)); -+ store_32_be(1, ibuf); -+ /* Label */ -+ iov[1].flags = KRB5_CRYPTO_TYPE_DATA; -+ iov[1].data = *label; -+ /* 0x00: separator byte */ -+ iov[2].flags = KRB5_CRYPTO_TYPE_DATA; -+ iov[2].data = make_data("", 1); -+ /* Context */ -+ iov[3].flags = KRB5_CRYPTO_TYPE_DATA; -+ iov[3].data = *context; -+ /* [L]2: four-byte big-endian binary string giving the output length */ -+ iov[4].flags = KRB5_CRYPTO_TYPE_DATA; -+ iov[4].data = make_data(lbuf, sizeof(lbuf)); -+ store_32_be(outrnd->length * 8, lbuf); - -- /* Loop encrypting the blocks until enough key bytes are generated. */ -- n = 0; -- while (n < keybytes) { -- ret = encrypt_block(enc, inkey, &block); -- if (ret) -- goto cleanup; -- -- if ((keybytes - n) <= blocksize) { -- memcpy(outrnd->data + n, block.data, (keybytes - n)); -- break; -- } -- -- memcpy(outrnd->data + n, block.data, blocksize); -- n += blocksize; -- } -- --cleanup: -- zapfree(block.data, blocksize); -+ ret = krb5int_hmac(hash, inkey, iov, 5, &prf); -+ if (!ret) -+ memcpy(outrnd->data, prf.data, outrnd->length); -+ zapfree(prf.data, prf.length); - return ret; - } - -@@ -139,9 +341,9 @@ cleanup: - * - Four bytes are used to encode the output length in the PRF input. - */ - static krb5_error_code --derive_random_sp800_108_feedback_cmac(const struct krb5_enc_provider *enc, -- krb5_key inkey, krb5_data *outrnd, -- const krb5_data *in_constant) -+builtin_sp800_108_feedback_cmac(const struct krb5_enc_provider *enc, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *in_constant) - { - size_t blocksize, keybytes, n; - krb5_crypto_iov iov[6]; -@@ -204,56 +406,94 @@ cleanup: - return ret; - } - --/* -- * NIST SP800-108 KDF in counter mode (section 5.1). -- * Parameters: -- * - HMAC (with hash as the hash provider) is the PRF. -- * - A block counter of four bytes is used. -- * - Four bytes are used to encode the output length in the PRF input. -- * -- * There are no uses requiring more than a single PRF invocation. -- */ -+static krb5_error_code -+builtin_derive_random_rfc3961(const struct krb5_enc_provider *enc, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *in_constant) -+{ -+ size_t blocksize, keybytes, n; -+ krb5_error_code ret; -+ krb5_data block = empty_data(); -+ -+ blocksize = enc->block_size; -+ keybytes = enc->keybytes; -+ -+ if (blocksize == 1) -+ return KRB5_BAD_ENCTYPE; -+ if (inkey->keyblock.length != enc->keylength || outrnd->length != keybytes) -+ return KRB5_CRYPTO_INTERNAL; -+ -+ /* Allocate encryption data buffer. */ -+ ret = alloc_data(&block, blocksize); -+ if (ret) -+ return ret; -+ -+ /* Initialize the input block. */ -+ if (in_constant->length == blocksize) { -+ memcpy(block.data, in_constant->data, blocksize); -+ } else { -+ krb5int_nfold(in_constant->length * 8, -+ (unsigned char *) in_constant->data, -+ blocksize * 8, (unsigned char *) block.data); -+ } -+ -+ /* Loop encrypting the blocks until enough key bytes are generated. */ -+ n = 0; -+ while (n < keybytes) { -+ ret = encrypt_block(enc, inkey, &block); -+ if (ret) -+ goto cleanup; -+ -+ if ((keybytes - n) <= blocksize) { -+ memcpy(outrnd->data + n, block.data, (keybytes - n)); -+ break; -+ } -+ -+ memcpy(outrnd->data + n, block.data, blocksize); -+ n += blocksize; -+ } -+ -+cleanup: -+ zapfree(block.data, blocksize); -+ return ret; -+} -+#endif /* HAVE_EVP_KDF_FETCH */ -+ - krb5_error_code - k5_sp800_108_counter_hmac(const struct krb5_hash_provider *hash, - krb5_key inkey, krb5_data *outrnd, - const krb5_data *label, const krb5_data *context) - { -- krb5_crypto_iov iov[5]; -- krb5_error_code ret; -- krb5_data prf; -- unsigned char ibuf[4], lbuf[4]; -+#ifdef HAVE_EVP_KDF_FETCH -+ return openssl_kbdkf_counter_hmac(hash, inkey, outrnd, label, context); -+#else -+ return builtin_sp800_108_counter_hmac(hash, inkey, outrnd, label, -+ context); -+#endif -+} - -- if (hash == NULL || outrnd->length > hash->hashsize) -- return KRB5_CRYPTO_INTERNAL; -+static krb5_error_code -+sp800_108_feedback_cmac(const struct krb5_enc_provider *enc, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *in_constant) -+{ -+#ifdef HAVE_EVP_KDF_FETCH -+ return openssl_kbkdf_feedback_cmac(enc, inkey, outrnd, in_constant); -+#else -+ return builtin_sp800_108_feedback_cmac(enc, inkey, outrnd, in_constant); -+#endif -+} - -- /* Allocate encryption data buffer. */ -- ret = alloc_data(&prf, hash->hashsize); -- if (ret) -- return ret; -- -- /* [i]2: four-byte big-endian binary string giving the block counter (1) */ -- iov[0].flags = KRB5_CRYPTO_TYPE_DATA; -- iov[0].data = make_data(ibuf, sizeof(ibuf)); -- store_32_be(1, ibuf); -- /* Label */ -- iov[1].flags = KRB5_CRYPTO_TYPE_DATA; -- iov[1].data = *label; -- /* 0x00: separator byte */ -- iov[2].flags = KRB5_CRYPTO_TYPE_DATA; -- iov[2].data = make_data("", 1); -- /* Context */ -- iov[3].flags = KRB5_CRYPTO_TYPE_DATA; -- iov[3].data = *context; -- /* [L]2: four-byte big-endian binary string giving the output length */ -- iov[4].flags = KRB5_CRYPTO_TYPE_DATA; -- iov[4].data = make_data(lbuf, sizeof(lbuf)); -- store_32_be(outrnd->length * 8, lbuf); -- -- ret = krb5int_hmac(hash, inkey, iov, 5, &prf); -- if (!ret) -- memcpy(outrnd->data, prf.data, outrnd->length); -- zapfree(prf.data, prf.length); -- return ret; -+static krb5_error_code -+derive_random_rfc3961(const struct krb5_enc_provider *enc, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *in_constant) -+{ -+#ifdef HAVE_EVP_KDF_FETCH -+ return openssl_krb5kdf(enc, inkey, outrnd, in_constant); -+#else -+ return builtin_derive_random_rfc3961(enc, inkey, outrnd, in_constant); -+#endif - } - - krb5_error_code -@@ -268,8 +508,7 @@ krb5int_derive_random(const struct krb5_enc_provider *enc, - case DERIVE_RFC3961: - return derive_random_rfc3961(enc, inkey, outrnd, in_constant); - case DERIVE_SP800_108_CMAC: -- return derive_random_sp800_108_feedback_cmac(enc, inkey, outrnd, -- in_constant); -+ return sp800_108_feedback_cmac(enc, inkey, outrnd, in_constant); - case DERIVE_SP800_108_HMAC: - return k5_sp800_108_counter_hmac(hash, inkey, outrnd, in_constant, - &empty); diff --git a/Use-OpenSSL-s-SSKDF-in-PKINIT-when-available.patch b/Use-OpenSSL-s-SSKDF-in-PKINIT-when-available.patch deleted file mode 100644 index 0a9cde1..0000000 --- a/Use-OpenSSL-s-SSKDF-in-PKINIT-when-available.patch +++ /dev/null @@ -1,408 +0,0 @@ -From 8bbb492f2be1418e1e4bb2cf197414810dac9589 Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Fri, 20 Sep 2019 17:20:59 -0400 -Subject: [PATCH] Use OpenSSL's SSKDF in PKINIT when available - -Starting in 3.0, OpenSSL implements SSKDF, which is the basis of our -id-pkinit-kdf (RFC 8636). Factor out common setup code around -other_info. Adjust code to comply to existing style. - -(cherry picked from commit 4376a22e41fb639be31daf81275a332d3f930996) ---- - .../preauth/pkinit/pkinit_crypto_openssl.c | 294 +++++++++++------- - 1 file changed, 181 insertions(+), 113 deletions(-) - -diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -index e1153344e..350c2118a 100644 ---- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -@@ -38,6 +38,12 @@ - #include - #include - -+#ifdef HAVE_EVP_KDF_FETCH -+#include -+#include -+#include -+#endif -+ - static krb5_error_code pkinit_init_pkinit_oids(pkinit_plg_crypto_context ); - static void pkinit_fini_pkinit_oids(pkinit_plg_crypto_context ); - -@@ -2294,15 +2300,16 @@ cleanup: - } - - --/** -+/* - * Given an algorithm_identifier, this function returns the hash length - * and EVP function associated with that algorithm. -+ * -+ * RFC 8636 defines a SHA384 variant, but we don't use it. - */ - static krb5_error_code --pkinit_alg_values(krb5_context context, -- const krb5_data *alg_id, -- size_t *hash_bytes, -- const EVP_MD *(**func)(void)) -+pkinit_alg_values(krb5_context context, const krb5_data *alg_id, -+ size_t *hash_bytes, const EVP_MD *(**func)(void), -+ char **hash_name) - { - *hash_bytes = 0; - *func = NULL; -@@ -2311,18 +2318,21 @@ pkinit_alg_values(krb5_context context, - krb5_pkinit_sha1_oid_len))) { - *hash_bytes = 20; - *func = &EVP_sha1; -+ *hash_name = strdup("SHA1"); - return 0; - } else if ((alg_id->length == krb5_pkinit_sha256_oid_len) && - (0 == memcmp(alg_id->data, krb5_pkinit_sha256_oid, - krb5_pkinit_sha256_oid_len))) { - *hash_bytes = 32; - *func = &EVP_sha256; -+ *hash_name = strdup("SHA256"); - return 0; - } else if ((alg_id->length == krb5_pkinit_sha512_oid_len) && - (0 == memcmp(alg_id->data, krb5_pkinit_sha512_oid, - krb5_pkinit_sha512_oid_len))) { - *hash_bytes = 64; - *func = &EVP_sha512; -+ *hash_name = strdup("SHA512"); - return 0; - } else { - krb5_set_error_message(context, KRB5_ERR_BAD_S2K_PARAMS, -@@ -2331,11 +2341,60 @@ pkinit_alg_values(krb5_context context, - } - } /* pkinit_alg_values() */ - -+#ifdef HAVE_EVP_KDF_FETCH -+static krb5_error_code -+openssl_sskdf(krb5_context context, size_t hash_bytes, krb5_data *key, -+ krb5_data *info, char *out, size_t out_len, char *digest) -+{ -+ krb5_error_code ret; -+ EVP_KDF *kdf = NULL; -+ EVP_KDF_CTX *kctx = NULL; -+ OSSL_PARAM params[4]; -+ size_t i = 0; - --/* pkinit_alg_agility_kdf() -- -- * This function generates a key using the KDF described in -- * draft_ietf_krb_wg_pkinit_alg_agility-04.txt. The algorithm is -- * described as follows: -+ if (digest == NULL) { -+ ret = oerr(context, ENOMEM, -+ _("Failed to allocate space for digest algorithm name")); -+ goto done; -+ } -+ -+ kdf = EVP_KDF_fetch(NULL, "SSKDF", NULL); -+ if (kdf == NULL) { -+ ret = oerr(context, KRB5_CRYPTO_INTERNAL, _("Failed to fetch SSKDF")); -+ goto done; -+ } -+ -+ kctx = EVP_KDF_CTX_new(kdf); -+ if (!kctx) { -+ ret = oerr(context, KRB5_CRYPTO_INTERNAL, -+ _("Failed to instantiate SSKDF")); -+ goto done; -+ } -+ -+ params[i++] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, -+ digest, 0); -+ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY, -+ key->data, key->length); -+ params[i++] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO, -+ info->data, info->length); -+ params[i] = OSSL_PARAM_construct_end(); -+ if (EVP_KDF_derive(kctx, (unsigned char *)out, out_len, params) <= 0) { -+ ret = oerr(context, KRB5_CRYPTO_INTERNAL, -+ _("Failed to derive key using SSKDF")); -+ goto done; -+ } -+ -+ ret = 0; -+done: -+ EVP_KDF_free(kdf); -+ EVP_KDF_CTX_free(kctx); -+ return ret; -+} -+#else -+/* -+ * Generate a key using the KDF described in RFC 8636, also known as SSKDF -+ * (single-step kdf). Our caller precomputes `reps`, but otherwise the -+ * algorithm is as follows: - * - * 1. reps = keydatalen (K) / hash length (H) - * -@@ -2349,95 +2408,16 @@ pkinit_alg_values(krb5_context context, - * - * 4. Set key = Hash1 || Hash2 || ... so that length of key is K bytes. - */ --krb5_error_code --pkinit_alg_agility_kdf(krb5_context context, -- krb5_data *secret, -- krb5_data *alg_oid, -- krb5_const_principal party_u_info, -- krb5_const_principal party_v_info, -- krb5_enctype enctype, -- krb5_data *as_req, -- krb5_data *pk_as_rep, -- krb5_keyblock *key_block) -+static krb5_error_code -+builtin_sskdf(krb5_context context, unsigned int reps, size_t hash_len, -+ const EVP_MD *(*EVP_func)(void), krb5_data *secret, -+ krb5_data *other_info, char *out, size_t out_len) - { -- krb5_error_code retval = 0; -+ krb5_error_code ret = 0; - -- unsigned int reps = 0; -- uint32_t counter = 1; /* Does this type work on Windows? */ -+ uint32_t counter = 1; - size_t offset = 0; -- size_t hash_len = 0; -- size_t rand_len = 0; -- size_t key_len = 0; -- krb5_data random_data; -- krb5_sp80056a_other_info other_info_fields; -- krb5_pkinit_supp_pub_info supp_pub_info_fields; -- krb5_data *other_info = NULL; -- krb5_data *supp_pub_info = NULL; -- krb5_algorithm_identifier alg_id; - EVP_MD_CTX *ctx = NULL; -- const EVP_MD *(*EVP_func)(void); -- -- /* initialize random_data here to make clean-up safe */ -- random_data.length = 0; -- random_data.data = NULL; -- -- /* allocate and initialize the key block */ -- key_block->magic = 0; -- key_block->enctype = enctype; -- if (0 != (retval = krb5_c_keylengths(context, enctype, &rand_len, -- &key_len))) -- goto cleanup; -- -- random_data.length = rand_len; -- key_block->length = key_len; -- -- if (NULL == (key_block->contents = malloc(key_block->length))) { -- retval = ENOMEM; -- goto cleanup; -- } -- -- memset (key_block->contents, 0, key_block->length); -- -- /* If this is anonymous pkinit, use the anonymous principle for party_u_info */ -- if (party_u_info && krb5_principal_compare_any_realm(context, party_u_info, -- krb5_anonymous_principal())) -- party_u_info = (krb5_principal)krb5_anonymous_principal(); -- -- if (0 != (retval = pkinit_alg_values(context, alg_oid, &hash_len, &EVP_func))) -- goto cleanup; -- -- /* 1. reps = keydatalen (K) / hash length (H) */ -- reps = key_block->length/hash_len; -- -- /* ... and round up, if necessary */ -- if (key_block->length > (reps * hash_len)) -- reps++; -- -- /* Allocate enough space in the random data buffer to hash directly into -- * it, even if the last hash will make it bigger than the key length. */ -- if (NULL == (random_data.data = malloc(reps * hash_len))) { -- retval = ENOMEM; -- goto cleanup; -- } -- -- /* Encode the ASN.1 octet string for "SuppPubInfo" */ -- supp_pub_info_fields.enctype = enctype; -- supp_pub_info_fields.as_req = *as_req; -- supp_pub_info_fields.pk_as_rep = *pk_as_rep; -- if (0 != ((retval = encode_krb5_pkinit_supp_pub_info(&supp_pub_info_fields, -- &supp_pub_info)))) -- goto cleanup; -- -- /* Now encode the ASN.1 octet string for "OtherInfo" */ -- memset(&alg_id, 0, sizeof alg_id); -- alg_id.algorithm = *alg_oid; /*alias*/ -- -- other_info_fields.algorithm_identifier = alg_id; -- other_info_fields.party_u_info = (krb5_principal) party_u_info; -- other_info_fields.party_v_info = (krb5_principal) party_v_info; -- other_info_fields.supp_pub_info = *supp_pub_info; -- if (0 != (retval = encode_krb5_sp80056a_other_info(&other_info_fields, &other_info))) -- goto cleanup; - - /* 2. Initialize a 32-bit, big-endian bit string counter as 1. - * 3. For i = 1 to reps by 1, do the following: -@@ -2450,7 +2430,7 @@ pkinit_alg_agility_kdf(krb5_context context, - - ctx = EVP_MD_CTX_new(); - if (ctx == NULL) { -- retval = KRB5_CRYPTO_INTERNAL; -+ ret = KRB5_CRYPTO_INTERNAL; - goto cleanup; - } - -@@ -2458,7 +2438,7 @@ pkinit_alg_agility_kdf(krb5_context context, - if (!EVP_DigestInit(ctx, EVP_func())) { - krb5_set_error_message(context, KRB5_CRYPTO_INTERNAL, - "Call to OpenSSL EVP_DigestInit() returned an error."); -- retval = KRB5_CRYPTO_INTERNAL; -+ ret = KRB5_CRYPTO_INTERNAL; - goto cleanup; - } - -@@ -2467,15 +2447,16 @@ pkinit_alg_agility_kdf(krb5_context context, - !EVP_DigestUpdate(ctx, other_info->data, other_info->length)) { - krb5_set_error_message(context, KRB5_CRYPTO_INTERNAL, - "Call to OpenSSL EVP_DigestUpdate() returned an error."); -- retval = KRB5_CRYPTO_INTERNAL; -+ ret = KRB5_CRYPTO_INTERNAL; - goto cleanup; - } - -- /* 4. Set key = Hash1 || Hash2 || ... so that length of key is K bytes. */ -- if (!EVP_DigestFinal(ctx, (uint8_t *)random_data.data + offset, &s)) { -+ /* 4. Set key = Hash1 || Hash2 || ... so that length of key is K -+ * bytes. */ -+ if (!EVP_DigestFinal(ctx, (unsigned char *)out + offset, &s)) { - krb5_set_error_message(context, KRB5_CRYPTO_INTERNAL, - "Call to OpenSSL EVP_DigestUpdate() returned an error."); -- retval = KRB5_CRYPTO_INTERNAL; -+ ret = KRB5_CRYPTO_INTERNAL; - goto cleanup; - } - offset += s; -@@ -2484,26 +2465,113 @@ pkinit_alg_agility_kdf(krb5_context context, - EVP_MD_CTX_free(ctx); - ctx = NULL; - } -- -- retval = krb5_c_random_to_key(context, enctype, &random_data, -- key_block); -- - cleanup: - EVP_MD_CTX_free(ctx); -+ return ret; -+} /* builtin_sskdf() */ -+#endif /* HAVE_EVP_KDF_FETCH */ - -- /* If this has been an error, free the allocated key_block, if any */ -- if (retval) { -- krb5_free_keyblock_contents(context, key_block); -+/* id-pkinit-kdf family, as specified by RFC 8636. */ -+krb5_error_code -+pkinit_alg_agility_kdf(krb5_context context, krb5_data *secret, -+ krb5_data *alg_oid, krb5_const_principal party_u_info, -+ krb5_const_principal party_v_info, -+ krb5_enctype enctype, krb5_data *as_req, -+ krb5_data *pk_as_rep, krb5_keyblock *key_block) -+{ -+ krb5_error_code ret; -+ size_t hash_len = 0, rand_len = 0, key_len = 0; -+ const EVP_MD *(*EVP_func)(void); -+ krb5_sp80056a_other_info other_info_fields; -+ krb5_pkinit_supp_pub_info supp_pub_info_fields; -+ krb5_data *other_info = NULL, *supp_pub_info = NULL; -+ krb5_data random_data = empty_data(); -+ krb5_algorithm_identifier alg_id; -+ unsigned int reps; -+ char *hash_name = NULL; -+ -+ /* Allocate and initialize the key block. */ -+ key_block->magic = 0; -+ key_block->enctype = enctype; -+ -+ /* Use separate variables to avoid alignment restriction problems. */ -+ ret = krb5_c_keylengths(context, enctype, &rand_len, &key_len); -+ if (ret) -+ goto cleanup; -+ random_data.length = rand_len; -+ key_block->length = key_len; -+ -+ key_block->contents = k5calloc(key_block->length, 1, &ret); -+ if (key_block->contents == NULL) -+ goto cleanup; -+ -+ /* If this is anonymous pkinit, use the anonymous principle for -+ * party_u_info. */ -+ if (party_u_info && -+ krb5_principal_compare_any_realm(context, party_u_info, -+ krb5_anonymous_principal())) { -+ party_u_info = (krb5_principal)krb5_anonymous_principal(); - } - -- /* free other allocated resources, either way */ -- if (random_data.data) -- free(random_data.data); -+ ret = pkinit_alg_values(context, alg_oid, &hash_len, &EVP_func, -+ &hash_name); -+ if (ret) -+ goto cleanup; -+ -+ /* 1. reps = keydatalen (K) / hash length (H) */ -+ reps = key_block->length / hash_len; -+ -+ /* ... and round up, if necessary. */ -+ if (key_block->length > (reps * hash_len)) -+ reps++; -+ -+ /* Allocate enough space in the random data buffer to hash directly into -+ * it, even if the last hash will make it bigger than the key length. */ -+ random_data.data = k5alloc(reps * hash_len, &ret); -+ if (random_data.data == NULL) -+ goto cleanup; -+ -+ /* Encode the ASN.1 octet string for "SuppPubInfo". */ -+ supp_pub_info_fields.enctype = enctype; -+ supp_pub_info_fields.as_req = *as_req; -+ supp_pub_info_fields.pk_as_rep = *pk_as_rep; -+ ret = encode_krb5_pkinit_supp_pub_info(&supp_pub_info_fields, -+ &supp_pub_info); -+ if (ret) -+ goto cleanup; -+ -+ /* Now encode the ASN.1 octet string for "OtherInfo". */ -+ memset(&alg_id, 0, sizeof(alg_id)); -+ alg_id.algorithm = *alg_oid; -+ other_info_fields.algorithm_identifier = alg_id; -+ other_info_fields.party_u_info = (krb5_principal)party_u_info; -+ other_info_fields.party_v_info = (krb5_principal)party_v_info; -+ other_info_fields.supp_pub_info = *supp_pub_info; -+ ret = encode_krb5_sp80056a_other_info(&other_info_fields, &other_info); -+ if (ret) -+ goto cleanup; -+ -+#ifdef HAVE_EVP_KDF_FETCH -+ ret = openssl_sskdf(context, hash_len, secret, other_info, -+ random_data.data, key_block->length, hash_name); -+#else -+ ret = builtin_sskdf(context, reps, hash_len, EVP_func, secret, -+ other_info, random_data.data, key_block->length); -+#endif -+ if (ret) -+ goto cleanup; -+ -+ ret = krb5_c_random_to_key(context, enctype, &random_data, key_block); -+cleanup: -+ if (ret) -+ krb5_free_keyblock_contents(context, key_block); -+ -+ free(hash_name); -+ zapfree(random_data.data, random_data.length); - krb5_free_data(context, other_info); - krb5_free_data(context, supp_pub_info); -- -- return retval; --} /*pkinit_alg_agility_kdf() */ -+ return ret; -+} - - /* Call DH_compute_key() and ensure that we left-pad short results instead of - * leaving junk bytes at the end of the buffer. */ diff --git a/Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch b/Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch deleted file mode 100644 index ace4da9..0000000 --- a/Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch +++ /dev/null @@ -1,113 +0,0 @@ -From 538be893707e2306e89f5e5ca92c0db0ee305e3e Mon Sep 17 00:00:00 2001 -From: Julien Rische -Date: Fri, 11 Mar 2022 11:33:56 +0100 -Subject: [PATCH] Use SHA-256 instead of SHA-1 for PKINIT CMS digest - -Various organizations including NIST have been strongly recommending to -stop using SHA-1 for digital signatures for some years already. CMS -digest is used to generate such signatures, hence it should be upgraded -to use SHA-256. ---- - .../preauth/pkinit/pkinit_crypto_openssl.c | 27 ++++++++++--------- - 1 file changed, 14 insertions(+), 13 deletions(-) - -diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -index 42e5c581d..2a6ef4aaa 100644 ---- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -@@ -1240,7 +1240,7 @@ cms_signeddata_create(krb5_context context, - /* will not fill-out EVP_PKEY because it's on the smartcard */ - - /* Set digest algs */ -- p7si->digest_alg->algorithm = OBJ_nid2obj(NID_sha1); -+ p7si->digest_alg->algorithm = OBJ_nid2obj(NID_sha256); - - if (p7si->digest_alg->parameter != NULL) - ASN1_TYPE_free(p7si->digest_alg->parameter); -@@ -1251,17 +1251,17 @@ cms_signeddata_create(krb5_context context, - /* Set sig algs */ - if (p7si->digest_enc_alg->parameter != NULL) - ASN1_TYPE_free(p7si->digest_enc_alg->parameter); -- p7si->digest_enc_alg->algorithm = OBJ_nid2obj(NID_sha1WithRSAEncryption); -+ p7si->digest_enc_alg->algorithm = OBJ_nid2obj(NID_sha256WithRSAEncryption); - if (!(p7si->digest_enc_alg->parameter = ASN1_TYPE_new())) - goto cleanup; - p7si->digest_enc_alg->parameter->type = V_ASN1_NULL; - - /* add signed attributes */ -- /* compute sha1 digest over the EncapsulatedContentInfo */ -+ /* compute sha256 digest over the EncapsulatedContentInfo */ - ctx = EVP_MD_CTX_new(); - if (ctx == NULL) - goto cleanup; -- EVP_DigestInit_ex(ctx, EVP_sha1(), NULL); -+ EVP_DigestInit_ex(ctx, EVP_sha256(), NULL); - EVP_DigestUpdate(ctx, data, data_len); - md_tmp = EVP_MD_CTX_md(ctx); - EVP_DigestFinal_ex(ctx, md_data, &md_len); -@@ -1289,9 +1289,10 @@ cms_signeddata_create(krb5_context context, - goto cleanup2; - - #ifndef WITHOUT_PKCS11 -- /* Some tokens can only do RSAEncryption without sha1 hash */ -- /* to compute sha1WithRSAEncryption, encode the algorithm ID for the hash -- * function and the hash value into an ASN.1 value of type DigestInfo -+ /* Some tokens can only do RSAEncryption without sha256 hash */ -+ /* to compute sha256WithRSAEncryption, encode the algorithm ID for the -+ * hash function and the hash value into an ASN.1 value of type -+ * DigestInfo - * DigestInfo::=SEQUENCE { - * digestAlgorithm AlgorithmIdentifier, - * digest OCTET STRING } -@@ -1310,7 +1311,7 @@ cms_signeddata_create(krb5_context context, - alg = X509_ALGOR_new(); - if (alg == NULL) - goto cleanup2; -- X509_ALGOR_set0(alg, OBJ_nid2obj(NID_sha1), V_ASN1_NULL, NULL); -+ X509_ALGOR_set0(alg, OBJ_nid2obj(NID_sha256), V_ASN1_NULL, NULL); - alg_len = i2d_X509_ALGOR(alg, NULL); - - digest = ASN1_OCTET_STRING_new(); -@@ -1339,7 +1340,7 @@ cms_signeddata_create(krb5_context context, - #endif - { - pkiDebug("mech = %s\n", -- id_cryptoctx->pkcs11_method == 1 ? "CKM_SHA1_RSA_PKCS" : "FS"); -+ id_cryptoctx->pkcs11_method == 1 ? "CKM_SHA256_RSA_PKCS" : "FS"); - retval = pkinit_sign_data(context, id_cryptoctx, abuf, alen, - &sig, &sig_len); - } -@@ -4189,7 +4190,7 @@ create_signature(unsigned char **sig, unsigned int *sig_len, - ctx = EVP_MD_CTX_new(); - if (ctx == NULL) - return ENOMEM; -- EVP_SignInit(ctx, EVP_sha1()); -+ EVP_SignInit(ctx, EVP_sha256()); - EVP_SignUpdate(ctx, data, data_len); - *sig_len = EVP_PKEY_size(pkey); - if ((*sig = malloc(*sig_len)) == NULL) -@@ -4663,10 +4664,10 @@ pkinit_get_certs_pkcs11(krb5_context context, - - #ifndef PKINIT_USE_MECH_LIST - /* -- * We'd like to use CKM_SHA1_RSA_PKCS for signing if it's available, but -+ * We'd like to use CKM_SHA256_RSA_PKCS for signing if it's available, but - * many cards seems to be confused about whether they are capable of - * this or not. The safe thing seems to be to ignore the mechanism list, -- * always use CKM_RSA_PKCS and calculate the sha1 digest ourselves. -+ * always use CKM_RSA_PKCS and calculate the sha256 digest ourselves. - */ - - id_cryptoctx->mech = CKM_RSA_PKCS; -@@ -4694,7 +4695,7 @@ pkinit_get_certs_pkcs11(krb5_context context, - if (mechp[i] == CKM_RSA_PKCS) { - /* This seems backwards... */ - id_cryptoctx->mech = -- (info.flags & CKF_SIGN) ? CKM_SHA1_RSA_PKCS : CKM_RSA_PKCS; -+ (info.flags & CKF_SIGN) ? CKM_SHA256_RSA_PKCS : CKM_RSA_PKCS; - } - } - free(mechp); --- -2.35.1 - diff --git a/Use-asan-in-one-of-the-CI-builds.patch b/Use-asan-in-one-of-the-CI-builds.patch deleted file mode 100644 index 4964d2f..0000000 --- a/Use-asan-in-one-of-the-CI-builds.patch +++ /dev/null @@ -1,22 +0,0 @@ -From 37e1fe755c6e976253a7f40ec7a9e740e4329789 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Mon, 21 Jun 2021 19:15:26 -0400 -Subject: [PATCH] Use asan in one of the CI builds - -(cherry picked from commit 7368354bcd0b58480a88b1fb81e63bd6aae7edf2) ---- - .github/workflows/build.yml | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml -index 8d1042b7b..06a35b7b9 100644 ---- a/.github/workflows/build.yml -+++ b/.github/workflows/build.yml -@@ -17,6 +17,7 @@ jobs: - os: ubuntu-18.04 - compiler: clang - makevars: CPPFLAGS=-Werror -+ configureopts: --enable-asan - - name: linux-clang-openssl - os: ubuntu-18.04 - compiler: clang diff --git a/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch b/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch deleted file mode 100644 index 4a9f664..0000000 --- a/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch +++ /dev/null @@ -1,752 +0,0 @@ -From 86d606e33439fd0511c5154be7f32b0df2c72e54 Mon Sep 17 00:00:00 2001 -From: Robbie Harwood -Date: Fri, 15 Nov 2019 20:05:16 +0000 -Subject: [PATCH] [downstream] Use backported version of OpenSSL-3 KDF - interface - -Last-updated: krb5-1.17 ---- - src/configure.ac | 4 + - src/lib/crypto/krb/derive.c | 356 +++++++++++++----- - .../preauth/pkinit/pkinit_crypto_openssl.c | 257 ++++++++----- - 3 files changed, 428 insertions(+), 189 deletions(-) - -diff --git a/src/configure.ac b/src/configure.ac -index 3e1052db7..ea708491b 100644 ---- a/src/configure.ac -+++ b/src/configure.ac -@@ -282,6 +282,10 @@ AC_SUBST(CRYPTO_IMPL) - AC_SUBST(CRYPTO_IMPL_CFLAGS) - AC_SUBST(CRYPTO_IMPL_LIBS) - -+AC_CHECK_FUNCS(EVP_KDF_CTX_new_id EVP_KDF_ctrl EVP_KDF_derive, -+ AC_DEFINE(OSSL_KDFS, 1, [Define if using OpenSSL KDFs]), -+ AC_MSG_ERROR([backported OpenSSL KDFs not found])) -+ - AC_ARG_WITH([prng-alg], - AC_HELP_STRING([--with-prng-alg=ALG], [use specified PRNG algorithm. @<:@fortuna@:>@]), - [PRNG_ALG=$withval -diff --git a/src/lib/crypto/krb/derive.c b/src/lib/crypto/krb/derive.c -index 6707a7308..915a173dd 100644 ---- a/src/lib/crypto/krb/derive.c -+++ b/src/lib/crypto/krb/derive.c -@@ -27,6 +27,13 @@ - - #include "crypto_int.h" - -+#ifdef OSSL_KDFS -+#include -+#include -+#else -+#error "Refusing to build without OpenSSL KDFs!" -+#endif -+ - static krb5_key - find_cached_dkey(struct derived_key *list, const krb5_data *constant) - { -@@ -77,55 +84,193 @@ cleanup: - return ENOMEM; - } - -+#ifdef OSSL_KDFS - static krb5_error_code --derive_random_rfc3961(const struct krb5_enc_provider *enc, -- krb5_key inkey, krb5_data *outrnd, -- const krb5_data *in_constant) -+openssl_kbdkf_counter_hmac(const struct krb5_hash_provider *hash, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *label, const krb5_data *context) - { -- size_t blocksize, keybytes, n; -+ krb5_error_code ret = KRB5_CRYPTO_INTERNAL; -+ EVP_KDF_CTX *ctx = NULL; -+ const EVP_MD *digest; -+ -+ if (!strcmp(hash->hash_name, "SHA1")) -+ digest = EVP_sha1(); -+ else if (!strcmp(hash->hash_name, "SHA-256")) -+ digest = EVP_sha256(); -+ else if (!strcmp(hash->hash_name, "SHA-384")) -+ digest = EVP_sha384(); -+ else -+ goto done; -+ -+ ctx = EVP_KDF_CTX_new_id(EVP_KDF_KB); -+ if (!ctx) -+ goto done; -+ -+ if (EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_MD, digest) != 1 || -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KB_MAC_TYPE, -+ EVP_KDF_KB_MAC_TYPE_HMAC) != 1 || -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KEY, inkey->keyblock.contents, -+ inkey->keyblock.length) != 1 || -+ (context->length > 0 && -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KB_INFO, context->data, -+ context->length) != 1) || -+ (label->length > 0 && -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SALT, label->data, -+ label->length) != 1) || -+ EVP_KDF_derive(ctx, (unsigned char *)outrnd->data, -+ outrnd->length) != 1) -+ goto done; -+ -+ ret = 0; -+done: -+ if (ret) -+ zap(outrnd->data, outrnd->length); -+ EVP_KDF_CTX_free(ctx); -+ return ret; -+} -+ -+static krb5_error_code -+openssl_kbkdf_feedback_cmac(const struct krb5_enc_provider *enc, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *in_constant) -+{ -+ krb5_error_code ret = KRB5_CRYPTO_INTERNAL; -+ EVP_KDF_CTX *ctx = NULL; -+ const EVP_CIPHER *cipher; -+ static unsigned char zeroes[16]; -+ -+ memset(zeroes, 0, sizeof(zeroes)); -+ -+ if (enc->keylength == 16) -+ cipher = EVP_camellia_128_cbc(); -+ else if (enc->keylength == 32) -+ cipher = EVP_camellia_256_cbc(); -+ else -+ goto done; -+ -+ ctx = EVP_KDF_CTX_new_id(EVP_KDF_KB); -+ if (!ctx) -+ goto done; -+ -+ if (EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KB_MODE, -+ EVP_KDF_KB_MODE_FEEDBACK) != 1 || -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KB_MAC_TYPE, -+ EVP_KDF_KB_MAC_TYPE_CMAC) != 1 || -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_CIPHER, cipher) != 1 || -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KEY, inkey->keyblock.contents, -+ inkey->keyblock.length) != 1 || -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SALT, in_constant->data, -+ in_constant->length) != 1 || -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KB_SEED, zeroes, -+ sizeof(zeroes)) != 1 || -+ EVP_KDF_derive(ctx, (unsigned char *)outrnd->data, -+ outrnd->length) != 1) -+ goto done; -+ -+ ret = 0; -+done: -+ if (ret) -+ zap(outrnd->data, outrnd->length); -+ EVP_KDF_CTX_free(ctx); -+ return ret; -+} -+ -+static krb5_error_code -+openssl_krb5kdf(const struct krb5_enc_provider *enc, krb5_key inkey, -+ krb5_data *outrnd, const krb5_data *in_constant) -+{ -+ krb5_error_code ret = KRB5_CRYPTO_INTERNAL; -+ EVP_KDF_CTX *ctx = NULL; -+ const EVP_CIPHER *cipher; -+ -+ if (inkey->keyblock.length != enc->keylength || -+ outrnd->length != enc->keybytes) { -+ return KRB5_CRYPTO_INTERNAL; -+ } -+ -+ if (enc->encrypt == krb5int_aes_encrypt && enc->keylength == 16) -+ cipher = EVP_aes_128_cbc(); -+ else if (enc->encrypt == krb5int_aes_encrypt && enc->keylength == 32) -+ cipher = EVP_aes_256_cbc(); -+ else if (enc->keylength == 24) -+ cipher = EVP_des_ede3_cbc(); -+ else -+ goto done; -+ -+ ctx = EVP_KDF_CTX_new_id(EVP_KDF_KRB5KDF); -+ if (ctx == NULL) -+ goto done; -+ -+ if (EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_CIPHER, cipher) != 1 || -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KEY, inkey->keyblock.contents, -+ inkey->keyblock.length) != 1 || -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KRB5KDF_CONSTANT, -+ in_constant->data, in_constant->length) != 1 || -+ EVP_KDF_derive(ctx, (unsigned char *)outrnd->data, -+ outrnd->length) != 1) -+ goto done; -+ -+ ret = 0; -+done: -+ if (ret) -+ zap(outrnd->data, outrnd->length); -+ EVP_KDF_CTX_free(ctx); -+ return ret; -+} -+ -+#else /* OSSL_KDFS */ -+ -+/* -+ * NIST SP800-108 KDF in counter mode (section 5.1). -+ * Parameters: -+ * - HMAC (with hash as the hash provider) is the PRF. -+ * - A block counter of four bytes is used. -+ * - Four bytes are used to encode the output length in the PRF input. -+ * -+ * There are no uses requiring more than a single PRF invocation. -+ */ -+static krb5_error_code -+builtin_sp800_108_counter_hmac(const struct krb5_hash_provider *hash, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *label, -+ const krb5_data *context) -+{ -+ krb5_crypto_iov iov[5]; - krb5_error_code ret; -- krb5_data block = empty_data(); -+ krb5_data prf; -+ unsigned char ibuf[4], lbuf[4]; - -- blocksize = enc->block_size; -- keybytes = enc->keybytes; -- -- if (blocksize == 1) -- return KRB5_BAD_ENCTYPE; -- if (inkey->keyblock.length != enc->keylength || outrnd->length != keybytes) -+ if (hash == NULL || outrnd->length > hash->hashsize) - return KRB5_CRYPTO_INTERNAL; - - /* Allocate encryption data buffer. */ -- ret = alloc_data(&block, blocksize); -+ ret = alloc_data(&prf, hash->hashsize); - if (ret) - return ret; - -- /* Initialize the input block. */ -- if (in_constant->length == blocksize) { -- memcpy(block.data, in_constant->data, blocksize); -- } else { -- krb5int_nfold(in_constant->length * 8, -- (unsigned char *) in_constant->data, -- blocksize * 8, (unsigned char *) block.data); -- } -+ /* [i]2: four-byte big-endian binary string giving the block counter (1) */ -+ iov[0].flags = KRB5_CRYPTO_TYPE_DATA; -+ iov[0].data = make_data(ibuf, sizeof(ibuf)); -+ store_32_be(1, ibuf); -+ /* Label */ -+ iov[1].flags = KRB5_CRYPTO_TYPE_DATA; -+ iov[1].data = *label; -+ /* 0x00: separator byte */ -+ iov[2].flags = KRB5_CRYPTO_TYPE_DATA; -+ iov[2].data = make_data("", 1); -+ /* Context */ -+ iov[3].flags = KRB5_CRYPTO_TYPE_DATA; -+ iov[3].data = *context; -+ /* [L]2: four-byte big-endian binary string giving the output length */ -+ iov[4].flags = KRB5_CRYPTO_TYPE_DATA; -+ iov[4].data = make_data(lbuf, sizeof(lbuf)); -+ store_32_be(outrnd->length * 8, lbuf); - -- /* Loop encrypting the blocks until enough key bytes are generated. */ -- n = 0; -- while (n < keybytes) { -- ret = encrypt_block(enc, inkey, &block); -- if (ret) -- goto cleanup; -- -- if ((keybytes - n) <= blocksize) { -- memcpy(outrnd->data + n, block.data, (keybytes - n)); -- break; -- } -- -- memcpy(outrnd->data + n, block.data, blocksize); -- n += blocksize; -- } -- --cleanup: -- zapfree(block.data, blocksize); -+ ret = krb5int_hmac(hash, inkey, iov, 5, &prf); -+ if (!ret) -+ memcpy(outrnd->data, prf.data, outrnd->length); -+ zapfree(prf.data, prf.length); - return ret; - } - -@@ -139,9 +284,9 @@ cleanup: - * - Four bytes are used to encode the output length in the PRF input. - */ - static krb5_error_code --derive_random_sp800_108_feedback_cmac(const struct krb5_enc_provider *enc, -- krb5_key inkey, krb5_data *outrnd, -- const krb5_data *in_constant) -+builtin_sp800_108_feedback_cmac(const struct krb5_enc_provider *enc, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *in_constant) - { - size_t blocksize, keybytes, n; - krb5_crypto_iov iov[6]; -@@ -204,56 +349,94 @@ cleanup: - return ret; - } - --/* -- * NIST SP800-108 KDF in counter mode (section 5.1). -- * Parameters: -- * - HMAC (with hash as the hash provider) is the PRF. -- * - A block counter of four bytes is used. -- * - Four bytes are used to encode the output length in the PRF input. -- * -- * There are no uses requiring more than a single PRF invocation. -- */ -+static krb5_error_code -+builtin_derive_random_rfc3961(const struct krb5_enc_provider *enc, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *in_constant) -+{ -+ size_t blocksize, keybytes, n; -+ krb5_error_code ret; -+ krb5_data block = empty_data(); -+ -+ blocksize = enc->block_size; -+ keybytes = enc->keybytes; -+ -+ if (blocksize == 1) -+ return KRB5_BAD_ENCTYPE; -+ if (inkey->keyblock.length != enc->keylength || outrnd->length != keybytes) -+ return KRB5_CRYPTO_INTERNAL; -+ -+ /* Allocate encryption data buffer. */ -+ ret = alloc_data(&block, blocksize); -+ if (ret) -+ return ret; -+ -+ /* Initialize the input block. */ -+ if (in_constant->length == blocksize) { -+ memcpy(block.data, in_constant->data, blocksize); -+ } else { -+ krb5int_nfold(in_constant->length * 8, -+ (unsigned char *) in_constant->data, -+ blocksize * 8, (unsigned char *) block.data); -+ } -+ -+ /* Loop encrypting the blocks until enough key bytes are generated. */ -+ n = 0; -+ while (n < keybytes) { -+ ret = encrypt_block(enc, inkey, &block); -+ if (ret) -+ goto cleanup; -+ -+ if ((keybytes - n) <= blocksize) { -+ memcpy(outrnd->data + n, block.data, (keybytes - n)); -+ break; -+ } -+ -+ memcpy(outrnd->data + n, block.data, blocksize); -+ n += blocksize; -+ } -+ -+cleanup: -+ zapfree(block.data, blocksize); -+ return ret; -+} -+#endif /* OSSL_KDFS */ -+ - krb5_error_code - k5_sp800_108_counter_hmac(const struct krb5_hash_provider *hash, - krb5_key inkey, krb5_data *outrnd, - const krb5_data *label, const krb5_data *context) - { -- krb5_crypto_iov iov[5]; -- krb5_error_code ret; -- krb5_data prf; -- unsigned char ibuf[4], lbuf[4]; -+#ifdef OSSL_KDFS -+ return openssl_kbdkf_counter_hmac(hash, inkey, outrnd, label, context); -+#else -+ return builtin_sp800_108_counter_hmac(hash, inkey, outrnd, label, -+ context); -+#endif -+} - -- if (hash == NULL || outrnd->length > hash->hashsize) -- return KRB5_CRYPTO_INTERNAL; -+static krb5_error_code -+k5_sp800_108_feedback_cmac(const struct krb5_enc_provider *enc, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *in_constant) -+{ -+#ifdef OSSL_KDFS -+ return openssl_kbkdf_feedback_cmac(enc, inkey, outrnd, in_constant); -+#else -+ return builtin_sp800_108_feedback_cmac(enc, inkey, outrnd, in_constant); -+#endif -+} - -- /* Allocate encryption data buffer. */ -- ret = alloc_data(&prf, hash->hashsize); -- if (ret) -- return ret; -- -- /* [i]2: four-byte big-endian binary string giving the block counter (1) */ -- iov[0].flags = KRB5_CRYPTO_TYPE_DATA; -- iov[0].data = make_data(ibuf, sizeof(ibuf)); -- store_32_be(1, ibuf); -- /* Label */ -- iov[1].flags = KRB5_CRYPTO_TYPE_DATA; -- iov[1].data = *label; -- /* 0x00: separator byte */ -- iov[2].flags = KRB5_CRYPTO_TYPE_DATA; -- iov[2].data = make_data("", 1); -- /* Context */ -- iov[3].flags = KRB5_CRYPTO_TYPE_DATA; -- iov[3].data = *context; -- /* [L]2: four-byte big-endian binary string giving the output length */ -- iov[4].flags = KRB5_CRYPTO_TYPE_DATA; -- iov[4].data = make_data(lbuf, sizeof(lbuf)); -- store_32_be(outrnd->length * 8, lbuf); -- -- ret = krb5int_hmac(hash, inkey, iov, 5, &prf); -- if (!ret) -- memcpy(outrnd->data, prf.data, outrnd->length); -- zapfree(prf.data, prf.length); -- return ret; -+static krb5_error_code -+k5_derive_random_rfc3961(const struct krb5_enc_provider *enc, -+ krb5_key inkey, krb5_data *outrnd, -+ const krb5_data *in_constant) -+{ -+#ifdef OSSL_KDFS -+ return openssl_krb5kdf(enc, inkey, outrnd, in_constant); -+#else -+ return builtin_derive_random_rfc3961(enc, inkey, outrnd, in_constant); -+#endif - } - - krb5_error_code -@@ -266,10 +449,9 @@ krb5int_derive_random(const struct krb5_enc_provider *enc, - - switch (alg) { - case DERIVE_RFC3961: -- return derive_random_rfc3961(enc, inkey, outrnd, in_constant); -+ return k5_derive_random_rfc3961(enc, inkey, outrnd, in_constant); - case DERIVE_SP800_108_CMAC: -- return derive_random_sp800_108_feedback_cmac(enc, inkey, outrnd, -- in_constant); -+ return k5_sp800_108_feedback_cmac(enc, inkey, outrnd, in_constant); - case DERIVE_SP800_108_HMAC: - return k5_sp800_108_counter_hmac(hash, inkey, outrnd, in_constant, - &empty); -diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -index e1153344e..911e74fd9 100644 ---- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -@@ -38,6 +38,13 @@ - #include - #include - -+#ifdef OSSL_KDFS -+#include -+#include -+#else -+#error "Refusing to build without OpenSSL KDFs!" -+#endif -+ - static krb5_error_code pkinit_init_pkinit_oids(pkinit_plg_crypto_context ); - static void pkinit_fini_pkinit_oids(pkinit_plg_crypto_context ); - -@@ -2331,11 +2338,51 @@ pkinit_alg_values(krb5_context context, - } - } /* pkinit_alg_values() */ - -+#ifdef OSSL_KDFS -+static krb5_error_code -+openssl_sskdf(krb5_context context, size_t hash_bytes, krb5_data *key, -+ krb5_data *info, char *out, size_t out_len) -+{ -+ krb5_error_code ret = KRB5_CRYPTO_INTERNAL; -+ EVP_KDF_CTX *ctx = NULL; -+ const EVP_MD *digest; - --/* pkinit_alg_agility_kdf() -- -- * This function generates a key using the KDF described in -- * draft_ietf_krb_wg_pkinit_alg_agility-04.txt. The algorithm is -- * described as follows: -+ /* RFC 8636 defines a SHA384 variant, but we don't use it. */ -+ if (hash_bytes == 20) { -+ digest = EVP_sha1(); -+ } else if (hash_bytes == 32) { -+ digest = EVP_sha256(); -+ } else if (hash_bytes == 64) { -+ digest = EVP_sha512(); -+ } else { -+ krb5_set_error_message(context, ret, "Bad hash type for SSKDF"); -+ goto done; -+ } -+ -+ ctx = EVP_KDF_CTX_new_id(EVP_KDF_SS); -+ if (!ctx) { -+ oerr(context, ret, _("Failed to instantiate SSKDF")); -+ goto done; -+ } -+ -+ if (EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_MD, digest) != 1 || -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KEY, key->data, -+ key->length) != 1 || -+ EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSKDF_INFO, info->data, -+ info->length) != 1 || -+ EVP_KDF_derive(ctx, (unsigned char *)out, out_len) != 1) -+ goto done; -+ -+ ret = 0; -+done: -+ EVP_KDF_CTX_free(ctx); -+ return ret; -+} -+#else -+/* -+ * Generate a key using the KDF described in RFC 8636, also known as SSKDF -+ * (single-step kdf). Our caller precomputes `reps`, but otherwise the -+ * algorithm is as follows: - * - * 1. reps = keydatalen (K) / hash length (H) - * -@@ -2349,95 +2396,16 @@ pkinit_alg_values(krb5_context context, - * - * 4. Set key = Hash1 || Hash2 || ... so that length of key is K bytes. - */ --krb5_error_code --pkinit_alg_agility_kdf(krb5_context context, -- krb5_data *secret, -- krb5_data *alg_oid, -- krb5_const_principal party_u_info, -- krb5_const_principal party_v_info, -- krb5_enctype enctype, -- krb5_data *as_req, -- krb5_data *pk_as_rep, -- krb5_keyblock *key_block) -+static krb5_error_code -+builtin_sskdf(krb5_context context, unsigned int reps, size_t hash_len, -+ const EVP_MD *(*EVP_func)(void), krb5_data *secret, -+ krb5_data *other_info, char *out, size_t out_len) - { - krb5_error_code retval = 0; - -- unsigned int reps = 0; -- uint32_t counter = 1; /* Does this type work on Windows? */ -+ uint32_t counter = 1; - size_t offset = 0; -- size_t hash_len = 0; -- size_t rand_len = 0; -- size_t key_len = 0; -- krb5_data random_data; -- krb5_sp80056a_other_info other_info_fields; -- krb5_pkinit_supp_pub_info supp_pub_info_fields; -- krb5_data *other_info = NULL; -- krb5_data *supp_pub_info = NULL; -- krb5_algorithm_identifier alg_id; - EVP_MD_CTX *ctx = NULL; -- const EVP_MD *(*EVP_func)(void); -- -- /* initialize random_data here to make clean-up safe */ -- random_data.length = 0; -- random_data.data = NULL; -- -- /* allocate and initialize the key block */ -- key_block->magic = 0; -- key_block->enctype = enctype; -- if (0 != (retval = krb5_c_keylengths(context, enctype, &rand_len, -- &key_len))) -- goto cleanup; -- -- random_data.length = rand_len; -- key_block->length = key_len; -- -- if (NULL == (key_block->contents = malloc(key_block->length))) { -- retval = ENOMEM; -- goto cleanup; -- } -- -- memset (key_block->contents, 0, key_block->length); -- -- /* If this is anonymous pkinit, use the anonymous principle for party_u_info */ -- if (party_u_info && krb5_principal_compare_any_realm(context, party_u_info, -- krb5_anonymous_principal())) -- party_u_info = (krb5_principal)krb5_anonymous_principal(); -- -- if (0 != (retval = pkinit_alg_values(context, alg_oid, &hash_len, &EVP_func))) -- goto cleanup; -- -- /* 1. reps = keydatalen (K) / hash length (H) */ -- reps = key_block->length/hash_len; -- -- /* ... and round up, if necessary */ -- if (key_block->length > (reps * hash_len)) -- reps++; -- -- /* Allocate enough space in the random data buffer to hash directly into -- * it, even if the last hash will make it bigger than the key length. */ -- if (NULL == (random_data.data = malloc(reps * hash_len))) { -- retval = ENOMEM; -- goto cleanup; -- } -- -- /* Encode the ASN.1 octet string for "SuppPubInfo" */ -- supp_pub_info_fields.enctype = enctype; -- supp_pub_info_fields.as_req = *as_req; -- supp_pub_info_fields.pk_as_rep = *pk_as_rep; -- if (0 != ((retval = encode_krb5_pkinit_supp_pub_info(&supp_pub_info_fields, -- &supp_pub_info)))) -- goto cleanup; -- -- /* Now encode the ASN.1 octet string for "OtherInfo" */ -- memset(&alg_id, 0, sizeof alg_id); -- alg_id.algorithm = *alg_oid; /*alias*/ -- -- other_info_fields.algorithm_identifier = alg_id; -- other_info_fields.party_u_info = (krb5_principal) party_u_info; -- other_info_fields.party_v_info = (krb5_principal) party_v_info; -- other_info_fields.supp_pub_info = *supp_pub_info; -- if (0 != (retval = encode_krb5_sp80056a_other_info(&other_info_fields, &other_info))) -- goto cleanup; - - /* 2. Initialize a 32-bit, big-endian bit string counter as 1. - * 3. For i = 1 to reps by 1, do the following: -@@ -2471,8 +2439,9 @@ pkinit_alg_agility_kdf(krb5_context context, - goto cleanup; - } - -- /* 4. Set key = Hash1 || Hash2 || ... so that length of key is K bytes. */ -- if (!EVP_DigestFinal(ctx, (uint8_t *)random_data.data + offset, &s)) { -+ /* 4. Set key = Hash1 || Hash2 || ... so that length of key is K -+ * bytes. */ -+ if (!EVP_DigestFinal(ctx, (unsigned char *)out + offset, &s)) { - krb5_set_error_message(context, KRB5_CRYPTO_INTERNAL, - "Call to OpenSSL EVP_DigestUpdate() returned an error."); - retval = KRB5_CRYPTO_INTERNAL; -@@ -2484,26 +2453,110 @@ pkinit_alg_agility_kdf(krb5_context context, - EVP_MD_CTX_free(ctx); - ctx = NULL; - } -- -- retval = krb5_c_random_to_key(context, enctype, &random_data, -- key_block); -- - cleanup: - EVP_MD_CTX_free(ctx); -+ return retval; -+} /* builtin_sskdf() */ -+#endif /* OSSL_KDFS */ - -- /* If this has been an error, free the allocated key_block, if any */ -- if (retval) { -- krb5_free_keyblock_contents(context, key_block); -+/* id-pkinit-kdf family, as specified by RFC 8636. */ -+krb5_error_code -+pkinit_alg_agility_kdf(krb5_context context, krb5_data *secret, -+ krb5_data *alg_oid, krb5_const_principal party_u_info, -+ krb5_const_principal party_v_info, -+ krb5_enctype enctype, krb5_data *as_req, -+ krb5_data *pk_as_rep, krb5_keyblock *key_block) -+{ -+ krb5_error_code retval; -+ size_t hash_len = 0, rand_len = 0, key_len = 0; -+ const EVP_MD *(*EVP_func)(void); -+ krb5_sp80056a_other_info other_info_fields; -+ krb5_pkinit_supp_pub_info supp_pub_info_fields; -+ krb5_data *other_info = NULL, *supp_pub_info = NULL; -+ krb5_data random_data = empty_data(); -+ krb5_algorithm_identifier alg_id; -+ unsigned int reps; -+ -+ /* Allocate and initialize the key block. */ -+ key_block->magic = 0; -+ key_block->enctype = enctype; -+ -+ /* Use separate variables to avoid alignment restriction problems. */ -+ retval = krb5_c_keylengths(context, enctype, &rand_len, &key_len); -+ if (retval) -+ goto cleanup; -+ random_data.length = rand_len; -+ key_block->length = key_len; -+ -+ key_block->contents = k5calloc(key_block->length, 1, &retval); -+ if (key_block->contents == NULL) -+ goto cleanup; -+ -+ /* If this is anonymous pkinit, use the anonymous principle for -+ * party_u_info. */ -+ if (party_u_info && -+ krb5_principal_compare_any_realm(context, party_u_info, -+ krb5_anonymous_principal())) { -+ party_u_info = (krb5_principal)krb5_anonymous_principal(); - } - -- /* free other allocated resources, either way */ -- if (random_data.data) -- free(random_data.data); -+ retval = pkinit_alg_values(context, alg_oid, &hash_len, &EVP_func); -+ if (retval) -+ goto cleanup; -+ -+ /* 1. reps = keydatalen (K) / hash length (H) */ -+ reps = key_block->length / hash_len; -+ -+ /* ... and round up, if necessary. */ -+ if (key_block->length > (reps * hash_len)) -+ reps++; -+ -+ /* Allocate enough space in the random data buffer to hash directly into -+ * it, even if the last hash will make it bigger than the key length. */ -+ random_data.data = k5alloc(reps * hash_len, &retval); -+ if (random_data.data == NULL) -+ goto cleanup; -+ -+ /* Encode the ASN.1 octet string for "SuppPubInfo". */ -+ supp_pub_info_fields.enctype = enctype; -+ supp_pub_info_fields.as_req = *as_req; -+ supp_pub_info_fields.pk_as_rep = *pk_as_rep; -+ retval = encode_krb5_pkinit_supp_pub_info(&supp_pub_info_fields, -+ &supp_pub_info); -+ if (retval) -+ goto cleanup; -+ -+ /* Now encode the ASN.1 octet string for "OtherInfo". */ -+ memset(&alg_id, 0, sizeof(alg_id)); -+ alg_id.algorithm = *alg_oid; -+ other_info_fields.algorithm_identifier = alg_id; -+ other_info_fields.party_u_info = (krb5_principal)party_u_info; -+ other_info_fields.party_v_info = (krb5_principal)party_v_info; -+ other_info_fields.supp_pub_info = *supp_pub_info; -+ retval = encode_krb5_sp80056a_other_info(&other_info_fields, &other_info); -+ if (retval) -+ goto cleanup; -+ -+#ifdef OSSL_KDFS -+ retval = openssl_sskdf(context, hash_len, secret, other_info, -+ random_data.data, key_block->length); -+#else -+ retval = builtin_sskdf(context, reps, hash_len, EVP_func, secret, -+ other_info, random_data.data, key_block->length); -+#endif -+ if (retval) -+ goto cleanup; -+ -+ retval = krb5_c_random_to_key(context, enctype, &random_data, key_block); -+cleanup: -+ if (retval) -+ krb5_free_keyblock_contents(context, key_block); -+ -+ zapfree(random_data.data, random_data.length); - krb5_free_data(context, other_info); - krb5_free_data(context, supp_pub_info); -- - return retval; --} /*pkinit_alg_agility_kdf() */ -+} - - /* Call DH_compute_key() and ensure that we left-pad short results instead of - * leaving junk bytes at the end of the buffer. */ diff --git a/krb5-krad-larger-attrs.patch b/krb5-krad-larger-attrs.patch deleted file mode 100644 index 32111ec..0000000 --- a/krb5-krad-larger-attrs.patch +++ /dev/null @@ -1,69 +0,0 @@ -From f35077bfc570205092eca2a9d44e50ce265622f4 Mon Sep 17 00:00:00 2001 -From: Sumit Bose -Date: Mon, 8 Nov 2021 17:48:50 +0100 -Subject: [PATCH] Support larger RADIUS attributes in libkrad - -In kr_attrset_decode(), explicitly treat the length byte as unsigned. -Otherwise attributes longer than 125 characters will be rejected with -EBADMSG. - -Add a 253-character-long NAS-Identifier attribute to the tests to make -sure that attributes with the maximal number of characters are working -as expected. - -[ghudson@mit.edu: used uint8_t cast per current practices; edited -commit message] - -ticket: 9036 (new) ---- - src/lib/krad/attrset.c | 2 +- - src/lib/krad/t_packet.c | 13 +++++++++++++ - 2 files changed, 14 insertions(+), 1 deletion(-) - -diff --git a/src/lib/krad/attrset.c b/src/lib/krad/attrset.c -index 03c613716..f309f1581 100644 ---- a/src/lib/krad/attrset.c -+++ b/src/lib/krad/attrset.c -@@ -217,7 +217,7 @@ kr_attrset_decode(krb5_context ctx, const krb5_data *in, const char *secret, - - for (i = 0; i + 2 < in->length; ) { - type = in->data[i++]; -- tmp = make_data(&in->data[i + 1], in->data[i] - 2); -+ tmp = make_data(&in->data[i + 1], (uint8_t)in->data[i] - 2); - i += tmp.length + 1; - - retval = (in->length < i) ? EBADMSG : 0; -diff --git a/src/lib/krad/t_packet.c b/src/lib/krad/t_packet.c -index 0a92e9cc2..c22489144 100644 ---- a/src/lib/krad/t_packet.c -+++ b/src/lib/krad/t_packet.c -@@ -57,6 +57,14 @@ make_packet(krb5_context ctx, const krb5_data *username, - krb5_error_code retval; - const krb5_data *data; - int i = 0; -+ krb5_data nas_id; -+ -+ nas_id = string2data("12345678901234567890123456789012345678901234567890" -+ "12345678901234567890123456789012345678901234567890" -+ "12345678901234567890123456789012345678901234567890" -+ "12345678901234567890123456789012345678901234567890" -+ "12345678901234567890123456789012345678901234567890" -+ "123"); - - retval = krad_attrset_new(ctx, &set); - if (retval != 0) -@@ -71,6 +79,11 @@ make_packet(krb5_context ctx, const krb5_data *username, - if (retval != 0) - goto out; - -+ retval = krad_attrset_add(set, krad_attr_name2num("NAS-Identifier"), -+ &nas_id); -+ if (retval != 0) -+ goto out; -+ - retval = krad_packet_new_request(ctx, "foo", - krad_code_name2num("Access-Request"), - set, iterator, &i, &tmp); --- -2.35.1 - diff --git a/krb5-krad-remote.patch b/krb5-krad-remote.patch deleted file mode 100644 index 42452ff..0000000 --- a/krb5-krad-remote.patch +++ /dev/null @@ -1,209 +0,0 @@ -From ce160f8826bae223876a6527a731c36b6912db15 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Tue, 9 Nov 2021 13:00:43 -0500 -Subject: [PATCH 1/2] Avoid use after free during libkrad cleanup - -libkrad client requests contain a list of references to remotes, with -no back-references or reference counts. To prevent accesses to -dangling references during cleanup, cancel all requests on all remotes -before freeing any remotes. - -Remove the code for aging out unused servers. This code was fairly -safe as all requests referencing a remote should have completed or -timed out during an hour of disuse, but in the current design we have -no way to guarantee or check that. The set of addresses we send -RADIUS requests to will generally be small, so aging out servers is -unnecessary. - -ticket: 9035 (new) ---- - src/lib/krad/client.c | 42 ++++++++++++++--------------------------- - src/lib/krad/internal.h | 4 ++++ - src/lib/krad/remote.c | 11 ++++++++--- - 3 files changed, 26 insertions(+), 31 deletions(-) - -diff --git a/src/lib/krad/client.c b/src/lib/krad/client.c -index 6365dd1c6..810940afc 100644 ---- a/src/lib/krad/client.c -+++ b/src/lib/krad/client.c -@@ -64,7 +64,6 @@ struct request_st { - - struct server_st { - krad_remote *serv; -- time_t last; - K5_LIST_ENTRY(server_st) list; - }; - -@@ -81,15 +80,10 @@ get_server(krad_client *rc, const struct addrinfo *ai, const char *secret, - krad_remote **out) - { - krb5_error_code retval; -- time_t currtime; - server *srv; - -- if (time(&currtime) == (time_t)-1) -- return errno; -- - K5_LIST_FOREACH(srv, &rc->servers, list) { - if (kr_remote_equals(srv->serv, ai, secret)) { -- srv->last = currtime; - *out = srv->serv; - return 0; - } -@@ -98,7 +92,6 @@ get_server(krad_client *rc, const struct addrinfo *ai, const char *secret, - srv = calloc(1, sizeof(server)); - if (srv == NULL) - return ENOMEM; -- srv->last = currtime; - - retval = kr_remote_new(rc->kctx, rc->vctx, ai, secret, &srv->serv); - if (retval != 0) { -@@ -173,28 +166,12 @@ request_new(krad_client *rc, krad_code code, const krad_attrset *attrs, - return 0; - } - --/* Close remotes that haven't been used in a while. */ --static void --age(struct server_head *head, time_t currtime) --{ -- server *srv, *tmp; -- -- K5_LIST_FOREACH_SAFE(srv, head, list, tmp) { -- if (currtime == (time_t)-1 || currtime - srv->last > 60 * 60) { -- K5_LIST_REMOVE(srv, list); -- kr_remote_free(srv->serv); -- free(srv); -- } -- } --} -- - /* Handle a response from a server (or related errors). */ - static void - on_response(krb5_error_code retval, const krad_packet *reqp, - const krad_packet *rspp, void *data) - { - request *req = data; -- time_t currtime; - size_t i; - - /* Do nothing if we are already completed. */ -@@ -221,10 +198,6 @@ on_response(krb5_error_code retval, const krad_packet *reqp, - for (i = 0; req->remotes[i].remote != NULL; i++) - kr_remote_cancel(req->remotes[i].remote, req->remotes[i].packet); - -- /* Age out servers that haven't been used in a while. */ -- if (time(&currtime) != (time_t)-1) -- age(&req->rc->servers, currtime); -- - request_free(req); - } - -@@ -247,10 +220,23 @@ krad_client_new(krb5_context kctx, verto_ctx *vctx, krad_client **out) - void - krad_client_free(krad_client *rc) - { -+ server *srv; -+ - if (rc == NULL) - return; - -- age(&rc->servers, -1); -+ /* Cancel all requests before freeing any remotes, since each request's -+ * callback data may contain references to multiple remotes. */ -+ K5_LIST_FOREACH(srv, &rc->servers, list) -+ kr_remote_cancel_all(srv->serv); -+ -+ while (!K5_LIST_EMPTY(&rc->servers)) { -+ srv = K5_LIST_FIRST(&rc->servers); -+ K5_LIST_REMOVE(srv, list); -+ kr_remote_free(srv->serv); -+ free(srv); -+ } -+ - free(rc); - } - -diff --git a/src/lib/krad/internal.h b/src/lib/krad/internal.h -index 0143d155a..7619563fc 100644 ---- a/src/lib/krad/internal.h -+++ b/src/lib/krad/internal.h -@@ -109,6 +109,10 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs, - void - kr_remote_cancel(krad_remote *rr, const krad_packet *pkt); - -+/* Cancel all requests awaiting responses. */ -+void -+kr_remote_cancel_all(krad_remote *rr); -+ - /* Determine if this remote object refers to the remote resource identified - * by the addrinfo struct and the secret. */ - krb5_boolean -diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c -index 7e491e994..06ae751bc 100644 ---- a/src/lib/krad/remote.c -+++ b/src/lib/krad/remote.c -@@ -421,15 +421,20 @@ error: - return retval; - } - -+void -+kr_remote_cancel_all(krad_remote *rr) -+{ -+ while (!K5_TAILQ_EMPTY(&rr->list)) -+ request_finish(K5_TAILQ_FIRST(&rr->list), ECANCELED, NULL); -+} -+ - void - kr_remote_free(krad_remote *rr) - { - if (rr == NULL) - return; - -- while (!K5_TAILQ_EMPTY(&rr->list)) -- request_finish(K5_TAILQ_FIRST(&rr->list), ECANCELED, NULL); -- -+ kr_remote_cancel_all(rr); - free(rr->secret); - if (rr->info != NULL) - free(rr->info->ai_addr); --- -2.35.1 - - -From e0084425df784952e76b3bcc8ae9d08300234733 Mon Sep 17 00:00:00 2001 -From: Sumit Bose -Date: Mon, 8 Nov 2021 17:47:17 +0100 -Subject: [PATCH 2/2] More python3 fixes for t_daemon.py - -[ghudson@mit.edu: use a list comprehension instead of map()] ---- - src/lib/krad/t_daemon.py | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/src/lib/krad/t_daemon.py b/src/lib/krad/t_daemon.py -index 7668cd7f8..4a3de079c 100755 ---- a/src/lib/krad/t_daemon.py -+++ b/src/lib/krad/t_daemon.py -@@ -50,7 +50,7 @@ class TestServer(server.Server): - - for key in pkt.keys(): - if key == "User-Password": -- passwd = map(pkt.PwDecrypt, pkt[key]) -+ passwd = [pkt.PwDecrypt(x) for x in pkt[key]] - - reply = self.CreateReplyPacket(pkt) - if passwd == ['accept']: -@@ -61,8 +61,8 @@ class TestServer(server.Server): - - srv = TestServer(addresses=["localhost"], - hosts={"127.0.0.1": -- server.RemoteHost("127.0.0.1", "foo", "localhost")}, -- dict=dictionary.Dictionary(StringIO.StringIO(DICTIONARY))) -+ server.RemoteHost("127.0.0.1", b"foo", "localhost")}, -+ dict=dictionary.Dictionary(StringIO(DICTIONARY))) - - # Write a sentinel character to let the parent process know we're listening. - sys.stdout.write("~") --- -2.35.1 - diff --git a/krb5.spec b/krb5.spec index c6039dc..b14c9c9 100644 --- a/krb5.spec +++ b/krb5.spec @@ -34,7 +34,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 13 +%global baserelease 0.1 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -46,9 +46,9 @@ %endif %global krb5_version_major 1 -%global krb5_version_minor 19 +%global krb5_version_minor 20 # For a release without a patch number set to %%nil -%global krb5_version_patch 2 +%global krb5_version_patch 1 %global krb5_version_major_minor %{krb5_version_major}.%{krb5_version_minor} %global krb5_version %{krb5_version_major_minor} @@ -68,59 +68,29 @@ Release: %{krb5_release}%{?dist} Source0: https://web.mit.edu/kerberos/dist/krb5/%{krb5_version_major_minor}/krb5-%{krb5_version}%{?krb5_pre_release}.tar.gz Source1: https://web.mit.edu/kerberos/dist/krb5/%{krb5_version_major_minor}/krb5-%{krb5_version}%{?krb5_pre_release}.tar.gz.asc -# Numbering is a relic of old init systems etc. It's easiest to just leave. Source2: kprop.service -Source4: kadmin.service -Source5: krb5kdc.service -Source6: krb5.conf -Source10: kdc.conf -Source11: kadm5.acl -Source19: krb5kdc.sysconfig -Source20: kadmin.sysconfig -Source21: kprop.sysconfig -Source29: ksu.pamd -Source33: krb5kdc.logrotate -Source34: kadmind.logrotate -Source39: krb5-krb5kdc.conf +Source3: kadmin.service +Source4: krb5kdc.service +Source5: krb5.conf +Source6: kdc.conf +Source7: kadm5.acl +Source8: krb5kdc.sysconfig +Source9: kadmin.sysconfig +Source10: kprop.sysconfig +Source11: ksu.pamd +Source12: krb5kdc.logrotate +Source13: kadmind.logrotate +Source14: krb5-krb5kdc.conf -Patch0: downstream-ksu-pam-integration.patch -Patch1: downstream-SELinux-integration.patch -Patch4: downstream-fix-debuginfo-with-y.tab.c.patch -Patch5: downstream-Remove-3des-support.patch -Patch7: downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch -Patch8: Add-APIs-for-marshalling-credentials.patch -Patch9: Add-hostname-canonicalization-helper-to-k5test.py.patch -Patch10: Support-host-based-GSS-initiator-names.patch -Patch11: Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch -Patch12: Fix-KCM-flag-transmission-for-remove_cred.patch -Patch13: Make-KCM-iteration-fallback-work-with-sssd-kcm.patch -Patch14: Use-KCM_OP_RETRIEVE-in-KCM-client.patch -Patch15: Fix-KCM-retrieval-support-for-sssd.patch -Patch17: Move-some-dejagnu-kadmin-tests-to-Python-tests.patch -Patch18: Fix-some-principal-realm-canonicalization-cases.patch -Patch19: Allow-kinit-with-keytab-to-defer-canonicalization.patch -Patch20: Fix-kadmin-k-with-fallback-or-referral-realm.patch -Patch21: Fix-softpkcs11-build-issues-with-openssl-3.0.patch -Patch22: Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch -Patch23: Fix-k5tls-module-for-OpenSSL-3.patch -Patch24: Fix-leaks-on-error-in-kadm5-init-functions.patch -Patch25: Clean-up-context-after-failed-open-in-libkdb5.patch -Patch26: Use-asan-in-one-of-the-CI-builds.patch -Patch29: Clean-up-gssapi_krb5-ccache-name-functions.patch -Patch30: Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch -Patch32: Add-buildsystem-detection-of-the-OpenSSL-3-KDF-inter.patch -Patch33: Use-OpenSSL-s-SSKDF-in-PKINIT-when-available.patch -Patch34: Use-OpenSSL-s-KBKDF-and-KRB5KDF-for-deriving-long-te.patch -Patch35: Handle-OpenSSL-3-s-providers.patch -Patch36: Remove-TCL-based-libkadm5-API-tests.patch -Patch37: Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch -Patch38: krb5-krad-remote.patch -Patch39: krb5-krad-larger-attrs.patch -Patch40: Try-harder-to-avoid-password-change-replay-errors.patch -Patch41: Add-configure-variable-for-default-PKCS-11-module.patch -Patch42: downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch -Patch43: Read-GSS-configuration-files-with-mtime-0.patch -Patch44: Fix-integer-overflows-in-PAC-parsing.patch +Patch1: 0001-downstream-ksu-pam-integration.patch +Patch2: 0002-downstream-SELinux-integration.patch +Patch3: 0003-downstream-fix-debuginfo-with-y.tab.c.patch +Patch4: 0004-downstream-Remove-3des-support.patch +Patch5: 0005-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch +Patch6: 0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch +Patch7: 0007-Add-configure-variable-for-default-PKCS-11-module.patch +Patch8: 0008-Set-reasonable-supportedCMSTypes-in-PKINIT.patch +Patch9: 0009-Simplify-plugin-loading-code.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -153,8 +123,14 @@ BuildRequires: procps-ng BuildRequires: resolv_wrapper %endif +%if 0%{?fedora} > 35 # Need KDFs. This is the "real" version BuildRequires: openssl-devel => 1:3.0.0 +%else +# Need KDFs. This is the backported version +BuildRequires: openssl-devel >= 1:1.1.1d-4 +BuildRequires: openssl-devel < 1:3.0.0 +%endif %description Kerberos V5 is a trusted-third-party network authentication system, @@ -180,7 +156,12 @@ to install this package. %package libs Summary: The non-admin shared libraries used by Kerberos 5 +%if 0%{?fedora} > 35 Requires: openssl-libs >= 1:3.0.0 +%else +Requires: openssl-libs >= 1:1.1.1d-4 +Requires: openssl-libs < 1:3.0.0 +%endif Requires: coreutils, gawk, sed Requires: keyutils-libs >= 1.5.8 Requires: /etc/crypto-policies/back-ends/krb5.config @@ -296,6 +277,13 @@ PORT=`expr 7777 + $LONG_BIT - 48` sed -i -e s,7777,`expr "$PORT" + 0`,g $cfg sed -i -e s,7778,`expr "$PORT" + 1`,g $cfg +# Fix kadmind port hard-coded in tests +PORT=`expr 61000 + $LONG_BIT - 48` +sed -i -e \ + "s,params.kadmind_port = 61001;,params.kadmind_port = $((PORT + 1));," \ + src/lib/kadm5/t_kadm5.c + + %build # Go ahead and supply tcl info, because configure doesn't know how to find it. source %{_libdir}/tclConfig.sh @@ -379,15 +367,15 @@ popd # Sample KDC config files (bundled kdc.conf and kadm5.acl). mkdir -p $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc -install -pm 600 %{SOURCE10} $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/ -install -pm 600 %{SOURCE11} $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/ +install -pm 600 %{SOURCE6} $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/ +install -pm 600 %{SOURCE7} $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/ # Where per-user keytabs live by default. mkdir -p $RPM_BUILD_ROOT%{_var}/kerberos/krb5/user # Default configuration file for everything. mkdir -p $RPM_BUILD_ROOT/etc -install -pm 644 %{SOURCE6} $RPM_BUILD_ROOT/etc/krb5.conf +install -pm 644 %{SOURCE5} $RPM_BUILD_ROOT/etc/krb5.conf # Default include on this directory mkdir -p $RPM_BUILD_ROOT/etc/krb5.conf.d @@ -407,16 +395,16 @@ mkdir -m 755 -p $RPM_BUILD_ROOT/etc/gss/mech.d export DEFCCNAME="%{configured_default_ccache_name}" awk '{print} /^# default_realm/{print " default_ccache_name =", ENVIRON["DEFCCNAME"]}' \ - %{SOURCE6} > $RPM_BUILD_ROOT/etc/krb5.conf -touch -r %{SOURCE6} $RPM_BUILD_ROOT/etc/krb5.conf + %{SOURCE5} > $RPM_BUILD_ROOT/etc/krb5.conf +touch -r %{SOURCE5} $RPM_BUILD_ROOT/etc/krb5.conf grep default_ccache_name $RPM_BUILD_ROOT/etc/krb5.conf %endif # Server init scripts (krb5kdc,kadmind,kpropd) and their sysconfig files. mkdir -p $RPM_BUILD_ROOT%{_unitdir} for unit in \ - %{SOURCE5}\ - %{SOURCE4} \ + %{SOURCE4}\ + %{SOURCE3} \ %{SOURCE2} ; do # In the past, the init script was supposed to be named after the service # that the started daemon provided. Changing their names is an @@ -424,11 +412,11 @@ for unit in \ install -pm 644 ${unit} $RPM_BUILD_ROOT%{_unitdir} done mkdir -p $RPM_BUILD_ROOT/%{_tmpfilesdir} -install -pm 644 %{SOURCE39} $RPM_BUILD_ROOT/%{_tmpfilesdir}/ +install -pm 644 %{SOURCE14} $RPM_BUILD_ROOT/%{_tmpfilesdir}/ mkdir -p $RPM_BUILD_ROOT/%{_localstatedir}/run/krb5kdc mkdir -p $RPM_BUILD_ROOT/etc/sysconfig -for sysconfig in %{SOURCE19} %{SOURCE20} %{SOURCE21} ; do +for sysconfig in %{SOURCE8} %{SOURCE9} %{SOURCE10} ; do install -pm 644 ${sysconfig} \ $RPM_BUILD_ROOT/etc/sysconfig/`basename ${sysconfig} .sysconfig` done @@ -436,15 +424,15 @@ done # logrotate configuration files mkdir -p $RPM_BUILD_ROOT/etc/logrotate.d/ for logrotate in \ - %{SOURCE33} \ - %{SOURCE34} ; do + %{SOURCE12} \ + %{SOURCE13} ; do install -pm 644 ${logrotate} \ $RPM_BUILD_ROOT/etc/logrotate.d/`basename ${logrotate} .logrotate` done # PAM configuration files. mkdir -p $RPM_BUILD_ROOT/etc/pam.d/ -for pam in %{SOURCE29} ; do +for pam in %{SOURCE11} ; do install -pm 644 ${pam} \ $RPM_BUILD_ROOT/etc/pam.d/`basename ${pam} .pamd` done @@ -676,6 +664,13 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Tue Nov 22 2022 Julien Rische - 1.20.1-0.1 +- New upstream version (1.20.1) +- Resolves: rhbz#2124463 +- Restore "supportedCMSTypes" attribute in PKINIT preauth requests +- Set SHA-512 or SHA-256 with RSA as preferred CMS signature algorithms +- Resolves: rhbz#2114766 + * Wed Nov 09 2022 Julien Rische - 1.19.2-13 - Fix integer overflows in PAC parsing (CVE-2022-42898) - Resolves: rhbz#2143011 diff --git a/sources b/sources index 16c7a8d..9bc9770 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (krb5-1.19.2.tar.gz) = b90d6ed0e1e8a87eb5cb2c36d88b823a6a6caabf85e5d419adb8a930f7eea09a5f8491464e7e454cca7ba88be09d19415962fe0036ad2e31fc584f9fc0bbd470 -SHA512 (krb5-1.19.2.tar.gz.asc) = 87c4d096dbb6821401125b8f8a315ce1aac029744ba9670a4f8a2a680e6dd5798e1c6d5d2b68b17fd9a4b3b9c6ff111cd1dcac42f934d48fb20381b3765e0f64 +SHA512 (krb5-1.20.1.tar.gz) = 6f57479f13f107cd84f30de5c758eb6b9fc59171329c13e5da6073b806755f8d163eb7bd84767ea861ad6458ea0c9eeb00ee044d3bcad01ef136e9888564b6a2 +SHA512 (krb5-1.20.1.tar.gz.asc) = 1d3312bd67581e07adfdadf2c5fe394179631d8add8bd075efefe982a0de22369004e60a14422d426382c8c591e4181b9897088afe9d4e86f0b5a97e5954c67a From 603ad7099ee5bad5c587d8f0260395eae1c6d5fa Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Wed, 23 Nov 2022 19:25:05 +0100 Subject: [PATCH 070/103] Update error checking for OpenSSL CMS_verify Resolves: rhbz#2119704 Signed-off-by: Julien Rische --- ...rror-checking-for-OpenSSL-CMS_verify.patch | 48 +++++++++++++++++++ ...-SHA-1-digest-disallowed-error-for-P.patch | 28 +++++++++++ krb5.spec | 8 +++- 3 files changed, 82 insertions(+), 2 deletions(-) create mode 100644 0010-Update-error-checking-for-OpenSSL-CMS_verify.patch create mode 100644 0011-downstream-Catch-SHA-1-digest-disallowed-error-for-P.patch diff --git a/0010-Update-error-checking-for-OpenSSL-CMS_verify.patch b/0010-Update-error-checking-for-OpenSSL-CMS_verify.patch new file mode 100644 index 0000000..0fbd529 --- /dev/null +++ b/0010-Update-error-checking-for-OpenSSL-CMS_verify.patch @@ -0,0 +1,48 @@ +From 963314f4f449e136195232bdada3109af65d0881 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Thu, 28 Jul 2022 15:20:12 +0200 +Subject: [PATCH] Update error checking for OpenSSL CMS_verify + +The code for CMS data verification was initially written for OpenSSL's +PKCS7_verify() function. It now uses CMS_verify(), but error handling +is still done using PKCS7_verify() error identifiers. Update the +recognized error codes so that the KDC generates +KDC_ERR_DIGEST_IN_SIGNED_DATA_NOT_ACCEPTED errors when appropriate. +Use ERR_peek_last_error() to observe the error generated closest to +the API surface. + +[ghudson@mit.edu: edited commit message] + +ticket: 9069 (new) +tags: pullup +target_version: 1.20-next +--- + src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index 1c2aa02827..16edf15cb2 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -2102,12 +2102,15 @@ cms_signeddata_verify(krb5_context context, + goto cleanup; + out = BIO_new(BIO_s_mem()); + if (CMS_verify(cms, NULL, store, NULL, out, flags) == 0) { +- unsigned long err = ERR_peek_error(); ++ unsigned long err = ERR_peek_last_error(); + switch(ERR_GET_REASON(err)) { +- case PKCS7_R_DIGEST_FAILURE: ++ case RSA_R_DIGEST_NOT_ALLOWED: ++ case CMS_R_UNKNOWN_DIGEST_ALGORITHM: ++ case CMS_R_NO_MATCHING_DIGEST: ++ case CMS_R_NO_MATCHING_SIGNATURE: + retval = KRB5KDC_ERR_DIGEST_IN_SIGNED_DATA_NOT_ACCEPTED; + break; +- case PKCS7_R_SIGNATURE_FAILURE: ++ case CMS_R_VERIFICATION_FAILURE: + default: + retval = KRB5KDC_ERR_INVALID_SIG; + } +-- +2.38.1 + diff --git a/0011-downstream-Catch-SHA-1-digest-disallowed-error-for-P.patch b/0011-downstream-Catch-SHA-1-digest-disallowed-error-for-P.patch new file mode 100644 index 0000000..373cd1a --- /dev/null +++ b/0011-downstream-Catch-SHA-1-digest-disallowed-error-for-P.patch @@ -0,0 +1,28 @@ +From c7d2d7c090bc000acd67b358150b9487f606ff20 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Fri, 19 Aug 2022 10:34:52 +0200 +Subject: [PATCH] [downstream] Catch SHA-1 digest disallowed error for + PKINIT + +An OpenSSL patch causes EVP_R_INVALID_DIGEST error to be raised if +CMS_verify is called to verify a SHA-1 signature. If this error is +caught, it will now return KDC_ERR_DIGEST_IN_SIGNED_DATA_NOT_ACCEPTED. +--- + src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index 16edf15cb2..bfa3fe8e91 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -2104,6 +2104,7 @@ cms_signeddata_verify(krb5_context context, + if (CMS_verify(cms, NULL, store, NULL, out, flags) == 0) { + unsigned long err = ERR_peek_last_error(); + switch(ERR_GET_REASON(err)) { ++ case EVP_R_INVALID_DIGEST: + case RSA_R_DIGEST_NOT_ALLOWED: + case CMS_R_UNKNOWN_DIGEST_ALGORITHM: + case CMS_R_NO_MATCHING_DIGEST: +-- +2.38.1 + diff --git a/krb5.spec b/krb5.spec index b14c9c9..5d8587e 100644 --- a/krb5.spec +++ b/krb5.spec @@ -34,7 +34,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 0.1 +%global baserelease 0.2 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -91,6 +91,8 @@ Patch6: 0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch Patch7: 0007-Add-configure-variable-for-default-PKCS-11-module.patch Patch8: 0008-Set-reasonable-supportedCMSTypes-in-PKINIT.patch Patch9: 0009-Simplify-plugin-loading-code.patch +Patch10: 0010-Update-error-checking-for-OpenSSL-CMS_verify.patch +Patch11: 0011-downstream-Catch-SHA-1-digest-disallowed-error-for-P.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -664,12 +666,14 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog -* Tue Nov 22 2022 Julien Rische - 1.20.1-0.1 +* Wed Nov 23 2022 Julien Rische - 1.20.1-0.2 - New upstream version (1.20.1) - Resolves: rhbz#2124463 - Restore "supportedCMSTypes" attribute in PKINIT preauth requests - Set SHA-512 or SHA-256 with RSA as preferred CMS signature algorithms - Resolves: rhbz#2114766 +- Update error checking for OpenSSL CMS_verify +- Resolves: rhbz#2119704 * Wed Nov 09 2022 Julien Rische - 1.19.2-13 - Fix integer overflows in PAC parsing (CVE-2022-42898) From 3668746b8fd3a4b5a42eb16cd70bbe308dbc8934 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Wed, 23 Nov 2022 19:31:12 +0100 Subject: [PATCH 071/103] Remove invalid password expiry warning Resolves: rhbz#2129113 Signed-off-by: Julien Rische --- 0012-Add-and-use-ts_interval-helper.patch | 239 ++++++++++++++++++++++ krb5.spec | 7 +- 2 files changed, 244 insertions(+), 2 deletions(-) create mode 100644 0012-Add-and-use-ts_interval-helper.patch diff --git a/0012-Add-and-use-ts_interval-helper.patch b/0012-Add-and-use-ts_interval-helper.patch new file mode 100644 index 0000000..5f9647e --- /dev/null +++ b/0012-Add-and-use-ts_interval-helper.patch @@ -0,0 +1,239 @@ +From 07ec260c65ec036d44362868df0f796a53495f27 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Mon, 19 Sep 2022 15:18:50 -0400 +Subject: [PATCH] Add and use ts_interval() helper + +ts_delta() returns a signed result, which cannot hold an interval +larger than 2^31-1 seconds. Intervals like this have been seen when +admins set password expiration dates more than 68 years in the future. + +Add a second helper ts_interval() which returns a signed result, and +has the arguments reversed so that the start time is first. Use it in +warn_pw_expiry() to handle the password expiration case, in the GSS +krb5 mech where we return an unsigned context or credential lifetime +to the caller, and in the KEYRING ccache type where we compute an +unsigned keyring timeout. + +ticket: 9071 (new) +--- + src/include/k5-int.h | 9 +++++++++ + src/lib/gssapi/krb5/accept_sec_context.c | 10 ++++++---- + src/lib/gssapi/krb5/acquire_cred.c | 3 +-- + src/lib/gssapi/krb5/context_time.c | 2 +- + src/lib/gssapi/krb5/init_sec_context.c | 4 ++-- + src/lib/gssapi/krb5/inq_context.c | 2 +- + src/lib/gssapi/krb5/inq_cred.c | 2 +- + src/lib/gssapi/krb5/s4u_gss_glue.c | 2 +- + src/lib/krb5/ccache/cc_keyring.c | 4 ++-- + src/lib/krb5/krb/get_in_tkt.c | 15 +++++++-------- + 10 files changed, 31 insertions(+), 22 deletions(-) + +diff --git a/src/include/k5-int.h b/src/include/k5-int.h +index c3aecba7d4..768110e5ef 100644 +--- a/src/include/k5-int.h ++++ b/src/include/k5-int.h +@@ -2325,6 +2325,15 @@ ts_delta(krb5_timestamp a, krb5_timestamp b) + return (krb5_deltat)((uint32_t)a - (uint32_t)b); + } + ++/* Return (end - start) as an unsigned 32-bit value, or 0 if start > end. */ ++static inline uint32_t ++ts_interval(krb5_timestamp start, krb5_timestamp end) ++{ ++ if ((uint32_t)start > (uint32_t)end) ++ return 0; ++ return (uint32_t)end - (uint32_t)start; ++} ++ + /* Increment a timestamp by a signed 32-bit interval, without relying on + * undefined behavior. */ + static inline krb5_timestamp +diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c +index 1bc807172b..7de2c9fd77 100644 +--- a/src/lib/gssapi/krb5/accept_sec_context.c ++++ b/src/lib/gssapi/krb5/accept_sec_context.c +@@ -353,8 +353,8 @@ kg_accept_dce(minor_status, context_handle, verifier_cred_handle, + *mech_type = ctx->mech_used; + + if (time_rec) { +- *time_rec = ts_delta(ctx->krb_times.endtime, now) + +- ctx->k5_context->clockskew; ++ *time_rec = ts_interval(now - ctx->k5_context->clockskew, ++ ctx->krb_times.endtime); + } + + /* Never return GSS_C_DELEG_FLAG since we don't support DCE credential +@@ -1151,8 +1151,10 @@ kg_accept_krb5(minor_status, context_handle, + + /* Add the maximum allowable clock skew as a grace period for context + * expiration, just as we do for the ticket. */ +- if (time_rec) +- *time_rec = ts_delta(ctx->krb_times.endtime, now) + context->clockskew; ++ if (time_rec) { ++ *time_rec = ts_interval(now - context->clockskew, ++ ctx->krb_times.endtime); ++ } + + if (ret_flags) + *ret_flags = ctx->gss_flags; +diff --git a/src/lib/gssapi/krb5/acquire_cred.c b/src/lib/gssapi/krb5/acquire_cred.c +index e226a02692..006eba114d 100644 +--- a/src/lib/gssapi/krb5/acquire_cred.c ++++ b/src/lib/gssapi/krb5/acquire_cred.c +@@ -879,8 +879,7 @@ acquire_cred_context(krb5_context context, OM_uint32 *minor_status, + GSS_C_NO_NAME); + if (GSS_ERROR(ret)) + goto error_out; +- *time_rec = ts_after(cred->expire, now) ? +- ts_delta(cred->expire, now) : 0; ++ *time_rec = ts_interval(now, cred->expire); + k5_mutex_unlock(&cred->lock); + } + } +diff --git a/src/lib/gssapi/krb5/context_time.c b/src/lib/gssapi/krb5/context_time.c +index 1fdb5a16f2..5469d8154c 100644 +--- a/src/lib/gssapi/krb5/context_time.c ++++ b/src/lib/gssapi/krb5/context_time.c +@@ -51,7 +51,7 @@ krb5_gss_context_time(minor_status, context_handle, time_rec) + return(GSS_S_FAILURE); + } + +- lifetime = ts_delta(ctx->krb_times.endtime, now); ++ lifetime = ts_interval(now, ctx->krb_times.endtime); + if (!ctx->initiate) + lifetime += ctx->k5_context->clockskew; + if (lifetime <= 0) { +diff --git a/src/lib/gssapi/krb5/init_sec_context.c b/src/lib/gssapi/krb5/init_sec_context.c +index ea87cf6432..f0f094ccb7 100644 +--- a/src/lib/gssapi/krb5/init_sec_context.c ++++ b/src/lib/gssapi/krb5/init_sec_context.c +@@ -664,7 +664,7 @@ kg_new_connection( + if (time_rec) { + if ((code = krb5_timeofday(context, &now))) + goto cleanup; +- *time_rec = ts_delta(ctx->krb_times.endtime, now); ++ *time_rec = ts_interval(now, ctx->krb_times.endtime); + } + + /* set the other returns */ +@@ -878,7 +878,7 @@ mutual_auth( + if (time_rec) { + if ((code = krb5_timeofday(context, &now))) + goto fail; +- *time_rec = ts_delta(ctx->krb_times.endtime, now); ++ *time_rec = ts_interval(now, ctx->krb_times.endtime); + } + + if (ret_flags) +diff --git a/src/lib/gssapi/krb5/inq_context.c b/src/lib/gssapi/krb5/inq_context.c +index cac024da1f..51c484fdfe 100644 +--- a/src/lib/gssapi/krb5/inq_context.c ++++ b/src/lib/gssapi/krb5/inq_context.c +@@ -120,7 +120,7 @@ krb5_gss_inquire_context(minor_status, context_handle, initiator_name, + + /* Add the maximum allowable clock skew as a grace period for context + * expiration, just as we do for the ticket during authentication. */ +- lifetime = ts_delta(ctx->krb_times.endtime, now); ++ lifetime = ts_interval(now, ctx->krb_times.endtime); + if (!ctx->initiate) + lifetime += context->clockskew; + if (lifetime < 0) +diff --git a/src/lib/gssapi/krb5/inq_cred.c b/src/lib/gssapi/krb5/inq_cred.c +index bb63b726c8..0e675959a3 100644 +--- a/src/lib/gssapi/krb5/inq_cred.c ++++ b/src/lib/gssapi/krb5/inq_cred.c +@@ -131,7 +131,7 @@ krb5_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret, + } + + if (cred->expire != 0) { +- lifetime = ts_delta(cred->expire, now); ++ lifetime = ts_interval(now, cred->expire); + if (lifetime < 0) + lifetime = 0; + } +diff --git a/src/lib/gssapi/krb5/s4u_gss_glue.c b/src/lib/gssapi/krb5/s4u_gss_glue.c +index 7dcfe4e1eb..fa7f980af7 100644 +--- a/src/lib/gssapi/krb5/s4u_gss_glue.c ++++ b/src/lib/gssapi/krb5/s4u_gss_glue.c +@@ -279,7 +279,7 @@ kg_compose_deleg_cred(OM_uint32 *minor_status, + if (code != 0) + goto cleanup; + +- *time_rec = ts_delta(cred->expire, now); ++ *time_rec = ts_interval(now, cred->expire); + } + + major_status = GSS_S_COMPLETE; +diff --git a/src/lib/krb5/ccache/cc_keyring.c b/src/lib/krb5/ccache/cc_keyring.c +index ebef37d607..1dadeef64f 100644 +--- a/src/lib/krb5/ccache/cc_keyring.c ++++ b/src/lib/krb5/ccache/cc_keyring.c +@@ -762,7 +762,7 @@ update_keyring_expiration(krb5_context context, krb5_ccache id) + + /* Setting the timeout to zero would reset the timeout, so we set it to one + * second instead if creds are already expired. */ +- timeout = ts_after(endtime, now) ? ts_delta(endtime, now) : 1; ++ timeout = ts_after(endtime, now) ? ts_interval(now, endtime) : 1; + (void)keyctl_set_timeout(data->cache_id, timeout); + } + +@@ -1343,7 +1343,7 @@ krcc_store(krb5_context context, krb5_ccache id, krb5_creds *creds) + + if (ts_after(creds->times.endtime, now)) { + (void)keyctl_set_timeout(cred_key, +- ts_delta(creds->times.endtime, now)); ++ ts_interval(now, creds->times.endtime)); + } + + update_keyring_expiration(context, id); +diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c +index 8b5ab595e9..1b420a3ac2 100644 +--- a/src/lib/krb5/krb/get_in_tkt.c ++++ b/src/lib/krb5/krb/get_in_tkt.c +@@ -1522,7 +1522,7 @@ warn_pw_expiry(krb5_context context, krb5_get_init_creds_opt *options, + void *expire_data; + krb5_timestamp pw_exp, acct_exp, now; + krb5_boolean is_last_req; +- krb5_deltat delta; ++ uint32_t interval; + char ts[256], banner[1024]; + + if (as_reply == NULL || as_reply->enc_part2 == NULL) +@@ -1553,8 +1553,8 @@ warn_pw_expiry(krb5_context context, krb5_get_init_creds_opt *options, + ret = krb5_timeofday(context, &now); + if (ret != 0) + return; +- if (!is_last_req && +- (ts_after(now, pw_exp) || ts_delta(pw_exp, now) > 7 * 24 * 60 * 60)) ++ interval = ts_interval(now, pw_exp); ++ if (!is_last_req && (!interval || interval > 7 * 24 * 60 * 60)) + return; + + if (!prompter) +@@ -1564,19 +1564,18 @@ warn_pw_expiry(krb5_context context, krb5_get_init_creds_opt *options, + if (ret != 0) + return; + +- delta = ts_delta(pw_exp, now); +- if (delta < 3600) { ++ if (interval < 3600) { + snprintf(banner, sizeof(banner), + _("Warning: Your password will expire in less than one hour " + "on %s"), ts); +- } else if (delta < 86400 * 2) { ++ } else if (interval < 86400 * 2) { + snprintf(banner, sizeof(banner), + _("Warning: Your password will expire in %d hour%s on %s"), +- delta / 3600, delta < 7200 ? "" : "s", ts); ++ interval / 3600, interval < 7200 ? "" : "s", ts); + } else { + snprintf(banner, sizeof(banner), + _("Warning: Your password will expire in %d days on %s"), +- delta / 86400, ts); ++ interval / 86400, ts); + } + + /* PROMPTER_INVOCATION */ +-- +2.38.1 + diff --git a/krb5.spec b/krb5.spec index 5d8587e..113a81c 100644 --- a/krb5.spec +++ b/krb5.spec @@ -34,7 +34,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 0.2 +%global baserelease 1 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -93,6 +93,7 @@ Patch8: 0008-Set-reasonable-supportedCMSTypes-in-PKINIT.patch Patch9: 0009-Simplify-plugin-loading-code.patch Patch10: 0010-Update-error-checking-for-OpenSSL-CMS_verify.patch Patch11: 0011-downstream-Catch-SHA-1-digest-disallowed-error-for-P.patch +Patch12: 0012-Add-and-use-ts_interval-helper.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -666,7 +667,7 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog -* Wed Nov 23 2022 Julien Rische - 1.20.1-0.2 +* Wed Nov 23 2022 Julien Rische - 1.20.1-1 - New upstream version (1.20.1) - Resolves: rhbz#2124463 - Restore "supportedCMSTypes" attribute in PKINIT preauth requests @@ -674,6 +675,8 @@ exit 0 - Resolves: rhbz#2114766 - Update error checking for OpenSSL CMS_verify - Resolves: rhbz#2119704 +- Remove invalid password expiry warning +- Resolves: rhbz#2129113 * Wed Nov 09 2022 Julien Rische - 1.19.2-13 - Fix integer overflows in PAC parsing (CVE-2022-42898) From 95288a2fb92899c39c8ea11f395bebc2cb1bb766 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Tue, 29 Nov 2022 16:41:27 +0100 Subject: [PATCH 072/103] Use TMT for gating tests Signed-off-by: Julien Rische --- .fmf/version | 1 + gating.yaml | 8 ++ krb5-tests | 14 ++ krb5.spec | 135 ++++++++++++------ plans/tests.fmf | 9 ++ .../Makefile | 0 .../PURPOSE | 0 tests/inplace-upgrade-sanity/TC#0378369.fmf | 21 +++ tests/inplace-upgrade-sanity/TC#0552039.fmf | 17 +++ tests/inplace-upgrade-sanity/TC#0608992.fmf | 14 ++ .../kdc.conf | 0 .../krb5.conf | 0 tests/inplace-upgrade-sanity/main.fmf | 19 +++ .../runtest.sh | 13 +- tests/tests.yml | 16 --- tests/upstream/main.fmf | 7 + tests/upstream/test.sh | 2 + 17 files changed, 210 insertions(+), 66 deletions(-) create mode 100644 .fmf/version create mode 100644 gating.yaml create mode 100644 krb5-tests create mode 100644 plans/tests.fmf rename tests/{inplace-upgrade-sanity-test => inplace-upgrade-sanity}/Makefile (100%) rename tests/{inplace-upgrade-sanity-test => inplace-upgrade-sanity}/PURPOSE (100%) create mode 100644 tests/inplace-upgrade-sanity/TC#0378369.fmf create mode 100644 tests/inplace-upgrade-sanity/TC#0552039.fmf create mode 100644 tests/inplace-upgrade-sanity/TC#0608992.fmf rename tests/{inplace-upgrade-sanity-test => inplace-upgrade-sanity}/kdc.conf (100%) rename tests/{inplace-upgrade-sanity-test => inplace-upgrade-sanity}/krb5.conf (100%) create mode 100644 tests/inplace-upgrade-sanity/main.fmf rename tests/{inplace-upgrade-sanity-test => inplace-upgrade-sanity}/runtest.sh (97%) delete mode 100644 tests/tests.yml create mode 100644 tests/upstream/main.fmf create mode 100755 tests/upstream/test.sh diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/gating.yaml b/gating.yaml new file mode 100644 index 0000000..af37a4c --- /dev/null +++ b/gating.yaml @@ -0,0 +1,8 @@ +--- !Policy +product_versions: +- fedora-* +decision_contexts: +- bodhi_update_push_stable +subject_type: koji_build +rules: +- !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tests.functional} diff --git a/krb5-tests b/krb5-tests new file mode 100644 index 0000000..cbbb302 --- /dev/null +++ b/krb5-tests @@ -0,0 +1,14 @@ +#!/bin/sh +set -e + +export RPM_PACKAGE_NAME={{ name }} +export RPM_PACKAGE_VERSION={{ version }} +export RPM_PACKAGE_RELEASE={{ release }} +export RPM_ARCH={{ arch }} + +testdir="$(mktemp -d)" +trap "rm -rf ${testdir}" EXIT + +cp -rp /usr/share/{{ name }}-tests "${testdir}/" +make -C "${testdir}/{{ name }}-tests" $(rpm --eval '%{_smp_mflags}') +keyctl session - make -C "${testdir}/{{ name }}-tests" check diff --git a/krb5.spec b/krb5.spec index 113a81c..cc8bc17 100644 --- a/krb5.spec +++ b/krb5.spec @@ -1,27 +1,3 @@ -%bcond_without check -%if %{without check} -%global skipcheck 1 -%endif - -# COPR doesn't work right with the tests. I suspect keyring issues, -# but can't actually debug, so... -%if 0%{?copr_username:1} -%global skipcheck 1 -%endif - -# There are 0 test machines for this architecture, very few builders, and -# they're not very well provisioned / maintained. I can't support it. -# Patches welcome, but there's nothing I can do - it fails more than half the -# for "infrastructure issues" that I can't hope to debug. -%ifarch s390x -%global skipcheck 1 -%endif - -# RHEL runs upstream's test suite in a separate pass after build. -%if 0%{?rhel} -%global skipcheck 1 -%endif - # Set this so that find-lang.sh will recognize the .po files. %global gettext_domain mit-krb5 # Guess where the -libs subpackage's docs are going to go. @@ -81,6 +57,7 @@ Source11: ksu.pamd Source12: krb5kdc.logrotate Source13: kadmind.logrotate Source14: krb5-krb5kdc.conf +Source15: %{name}-tests Patch1: 0001-downstream-ksu-pam-integration.patch Patch2: 0002-downstream-SELinux-integration.patch @@ -115,17 +92,6 @@ BuildRequires: perl-interpreter # For autosetup BuildRequires: git -%if 0%{?skipcheck} -%else -BuildRequires: dejagnu -BuildRequires: net-tools, rpcbind -BuildRequires: hostname -BuildRequires: iproute -BuildRequires: python3-pyrad -BuildRequires: procps-ng -BuildRequires: resolv_wrapper -%endif - %if 0%{?fedora} > 35 # Need KDFs. This is the "real" version BuildRequires: openssl-devel => 1:3.0.0 @@ -135,6 +101,10 @@ BuildRequires: openssl-devel >= 1:1.1.1d-4 BuildRequires: openssl-devel < 1:3.0.0 %endif +# Enable compilation of optional tests +BuildRequires: resolv_wrapper +BuildRequires: libcmocka-devel + %description Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's security by eliminating the insecure @@ -244,6 +214,53 @@ Kerberos is a network authentication system. The libkadm5 package contains only the libkadm5clnt and libkadm5serv shared objects. This interface is not considered stable. +%package tests +Summary: Test sources for krb5 build + +# Build dependencies +Requires: coreutils, gawk, sed +Requires: gcc-c++ +Requires: gettext +Requires: libcom_err-devel +Requires: libselinux-devel +Requires: libss-devel +Requires: libverto-devel +Requires: lmdb-devel +Requires: openldap-devel +Requires: pam-devel +Requires: redhat-rpm-config +%if 0%{?fedora} > 35 +Requires: openssl-devel => 1:3.0.0 +%else +Requires: openssl-devel >= 1:1.1.1d-4 +Requires: openssl-devel < 1:3.0.0 +%endif + +# Test dependencies +Requires: dejagnu +Requires: hostname +Requires: iproute +Requires: keyutils, keyutils-libs-devel >= 1.5.8 +Requires: libcmocka-devel +Requires: libverto-module-base +Requires: logrotate +Requires: net-tools, rpcbind +Requires: perl-interpreter +Requires: procps-ng +Requires: python3-kdcproxy +Requires: python3-pyrad +Requires: resolv_wrapper +Requires: /etc/crypto-policies/back-ends/krb5.config +Requires: /usr/share/dict/words +#Requires: openldap-servers, openldap-clients + +# sssd_krb5_locator_plugin.so conflicts with t_discover_uri.py +Conflicts: sssd-client + +%description tests +FOR TESTING PURPOSE ONLY +Test sources for krb5 build, with pre-defined compilation parameters + %prep %autosetup -S git_am -n %{name}-%{version}%{?dashpre} ln NOTICE LICENSE @@ -354,17 +371,6 @@ sphinx-build -a -b man -t pathsubs doc build-man sphinx-build -a -b html -t pathsubs doc build-html rm -fr build-html/_sources -%if 0%{?skipcheck} -%else -%check -pushd src - -# The build system may give us a revoked session keyring, so run affected -# tests with a new one. -keyctl session - make check OFFLINE=yes TMPDIR=%{_tmppath} -popd -%endif - %install [ "$RPM_BUILD_ROOT" != '/' ] && rm -rf -- "$RPM_BUILD_ROOT" @@ -481,6 +487,39 @@ rm -- "$RPM_BUILD_ROOT/%{_docdir}/krb5-libs/examples/services.append" # This is only needed for tests rm -- "$RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/preauth/test.so" +# Generate tests launching script +sed -e 's/{{ name }}/%{name}/' \ + -e 's/{{ version }}/%{krb5_version}/' \ + -e 's/{{ release }}/%{krb5_release}/' \ + -e 's/{{ arch }}/%{_arch}/' \ + -i %{SOURCE15} +mkdir -p $RPM_BUILD_ROOT%{_libexecdir} +install -pm 755 %{SOURCE15} $RPM_BUILD_ROOT%{_libexecdir}/ + +# Copy source files from build folder to system data folder +install -pdm 755 $RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests +pushd src +cp -p --parents -t "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/" \ + $(find . -type f -exec file -i "{}" + \ + | sed -ne 's|^\./\([^:]\+\): \+text/.\+$|\1|p') +popd + +# Copy binary test files +install -pm 644 src/tests/pkinit-certs/*.p12 \ + "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/tests/pkinit-certs/" +install -pm 644 src/tests/au_dict.json \ + "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/tests/" + +# Unset executable bit if no shebang in script +for f in $(find "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/" -type f -executable) +do + head -n1 "$f" | grep -Eq '^#!' || chmod a-x "$f" +done + +# Remove broken shebang Perl scripts +rm -- "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/config/wconfig.pl" +rm -- "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/kadmin/kdbkeys/do-test.pl" + %find_lang %{gettext_domain} %ldconfig_scriptlets libs @@ -666,6 +705,10 @@ exit 0 %{_libdir}/libkadm5clnt_mit.so.* %{_libdir}/libkadm5srv_mit.so.* +%files tests +%{_libexecdir}/%{name}-tests +%{_datarootdir}/%{name}-tests/ + %changelog * Wed Nov 23 2022 Julien Rische - 1.20.1-1 - New upstream version (1.20.1) diff --git a/plans/tests.fmf b/plans/tests.fmf new file mode 100644 index 0000000..9d368f3 --- /dev/null +++ b/plans/tests.fmf @@ -0,0 +1,9 @@ +summary: Tests +discover: + how: fmf +prepare: +- how: shell + script: + - dnf remove -y sssd-client +execute: + how: tmt diff --git a/tests/inplace-upgrade-sanity-test/Makefile b/tests/inplace-upgrade-sanity/Makefile similarity index 100% rename from tests/inplace-upgrade-sanity-test/Makefile rename to tests/inplace-upgrade-sanity/Makefile diff --git a/tests/inplace-upgrade-sanity-test/PURPOSE b/tests/inplace-upgrade-sanity/PURPOSE similarity index 100% rename from tests/inplace-upgrade-sanity-test/PURPOSE rename to tests/inplace-upgrade-sanity/PURPOSE diff --git a/tests/inplace-upgrade-sanity/TC#0378369.fmf b/tests/inplace-upgrade-sanity/TC#0378369.fmf new file mode 100644 index 0000000..8d54d68 --- /dev/null +++ b/tests/inplace-upgrade-sanity/TC#0378369.fmf @@ -0,0 +1,21 @@ +tag: + - CI-Tier-1 + - CI-Tier-1-krb5 + - Fedora 31 + - Fedora 32 + - FedoraReady + - IDM-CI-gating + - NoRHEL4 + - NoRHEL5 + - TIPpass + - TIPpass_Security + - Tier1 + - Tier1security + - rhel_upgrade +tier: '1' +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0378369 +extra-summary: /CoreOS/krb5/Sanity/inplace-upgrade-sanity-test diff --git a/tests/inplace-upgrade-sanity/TC#0552039.fmf b/tests/inplace-upgrade-sanity/TC#0552039.fmf new file mode 100644 index 0000000..7f2731d --- /dev/null +++ b/tests/inplace-upgrade-sanity/TC#0552039.fmf @@ -0,0 +1,17 @@ +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1394908 +tag: + - NoRHEL4 + - NoRHEL5 + - TIPpass + - TIPpass_Security + - Tier2 +tier: '2' +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +environment: + TEST_ENTROPY_SOURCE: yes +extra-nitrate: TC#0552039 +extra-summary: 'BZ#1394908: Enable faster getrandom-based entropy system' diff --git a/tests/inplace-upgrade-sanity/TC#0608992.fmf b/tests/inplace-upgrade-sanity/TC#0608992.fmf new file mode 100644 index 0000000..440308f --- /dev/null +++ b/tests/inplace-upgrade-sanity/TC#0608992.fmf @@ -0,0 +1,14 @@ +tag: + - Fedora 31 + - Fedora 32 + - FedoraReady + - NoRHEL4 + - NoRHEL5 + - rhel_upgrade +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +manual: true +extra-nitrate: TC#0608992 +extra-summary: /CoreOS/krb5/Sanity/inplace-upgrade-sanity-test-manual diff --git a/tests/inplace-upgrade-sanity-test/kdc.conf b/tests/inplace-upgrade-sanity/kdc.conf similarity index 100% rename from tests/inplace-upgrade-sanity-test/kdc.conf rename to tests/inplace-upgrade-sanity/kdc.conf diff --git a/tests/inplace-upgrade-sanity-test/krb5.conf b/tests/inplace-upgrade-sanity/krb5.conf similarity index 100% rename from tests/inplace-upgrade-sanity-test/krb5.conf rename to tests/inplace-upgrade-sanity/krb5.conf diff --git a/tests/inplace-upgrade-sanity/main.fmf b/tests/inplace-upgrade-sanity/main.fmf new file mode 100644 index 0000000..40e0a0e --- /dev/null +++ b/tests/inplace-upgrade-sanity/main.fmf @@ -0,0 +1,19 @@ +summary: Verifies basic scenarios which should work after inplace upgrade. +enabled: true +contact: Filip Dvorak +component: +- krb5 +test: ./runtest.sh +path: /tests/inplace-upgrade-sanity +framework: beakerlib +require: +- expect +- krb5-server +- krb5-workstation +- openssh-clients +- openssh-server +- rng-tools +- setools-console +duration: 20m +extra-summary: /CoreOS/krb5/Sanity/inplace-upgrade-sanity-test +extra-task: /CoreOS/krb5/Sanity/inplace-upgrade-sanity-test diff --git a/tests/inplace-upgrade-sanity-test/runtest.sh b/tests/inplace-upgrade-sanity/runtest.sh similarity index 97% rename from tests/inplace-upgrade-sanity-test/runtest.sh rename to tests/inplace-upgrade-sanity/runtest.sh index 7454540..c6e3d45 100755 --- a/tests/inplace-upgrade-sanity-test/runtest.sh +++ b/tests/inplace-upgrade-sanity/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="krb5" @@ -89,11 +88,17 @@ rlJournalStart if rlIsRHEL 6; then rlRun "sed -i \"s/EXAMPLE.COM/$krb5REALM1/\" $krb5conf" rlRun "sed -i \"s/kerberos.example.com/$krb5HostName/\" $krb5conf" - rlRun "sed -i \"s/example.com/$krb5DomainName/\" $krb5conf" + if [ "$krb5DomainName" ]; then + rlRun "sed -i \"s/example.com/$krb5DomainName/\" $krb5conf" + fi else rlRun "sed -i \"s/\[libdefaults\]/[libdefaults]\n default_realm = $krb5REALM1/\" $krb5conf" rlRun "sed -i \"s/\[realms\]/[realms]\n $krb5REALM1 = {\n kdc = $krb5HostName\n admin_server = $krb5HostName\n }/\" $krb5conf" - rlRun "sed -i \"s/\[domain_realm\]/[domain_realm]\n .$krb5DomainName = $krb5REALM1\n $krb5DomainName = $krb5REALM1/\" $krb5conf" + if [ "$krb5DomainName" ]; then + rlRun "sed -i \"s/\[domain_realm\]/[domain_realm]\n .$krb5DomainName = $krb5REALM1\n $krb5DomainName = $krb5REALM1/\" $krb5conf" + else + rlRun "sed -i \"s/\[domain_realm\]/[domain_realm]\n $krb5HostName = $krb5REALM1/\" $krb5conf" + fi fi rlRun "sed -i s/EXAMPLE.COM/$krb5REALM1/ $krb5kdcconf" # Configure the kadmin ACL @@ -368,4 +373,4 @@ _EOF rlRun "rm -r $TmpDir" rlPhaseEnd rlJournalPrintText -rlJournalEnd \ No newline at end of file +rlJournalEnd diff --git a/tests/tests.yml b/tests/tests.yml deleted file mode 100644 index 6ebc417..0000000 --- a/tests/tests.yml +++ /dev/null @@ -1,16 +0,0 @@ ---- -# This first play always runs on the local staging system -- hosts: localhost - roles: - - role: standard-test-beakerlib - tags: - - classic - tests: - - inplace-upgrade-sanity-test - required_packages: - - expect # Required for inplace-upgrade-sanity-test - - krb5-server # Required for inplace-upgrade-sanity-test - - krb5-workstation # Required for inplace-upgrade-sanity-test - - openssh-clients # Required for inplace-upgrade-sanity-test - - openssh-server # Required for inplace-upgrade-sanity-test - - rng-tools # Required for inplace-upgrade-sanity-test diff --git a/tests/upstream/main.fmf b/tests/upstream/main.fmf new file mode 100644 index 0000000..66718fa --- /dev/null +++ b/tests/upstream/main.fmf @@ -0,0 +1,7 @@ +summary: Run upstream tests +test: ./test.sh +enabled: true +path: /tests/upstream +require: +- krb5-tests +duration: 20m diff --git a/tests/upstream/test.sh b/tests/upstream/test.sh new file mode 100755 index 0000000..9c5abc5 --- /dev/null +++ b/tests/upstream/test.sh @@ -0,0 +1,2 @@ +#!/bin/sh -eux +/usr/libexec/krb5-tests From a206938c15db2bd32c66c63695cfb2caa34df0f7 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Thu, 1 Dec 2022 17:57:01 +0200 Subject: [PATCH 073/103] Bump KDB version to 9.0 Signed-off-by: Alexander Bokovoy --- krb5.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/krb5.spec b/krb5.spec index cc8bc17..45bfdc2 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 1 +%global baserelease 2 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -33,7 +33,7 @@ %endif # Should be in form 5.0, 6.1, etc. -%global kdbversion 8.0 +%global kdbversion 9.0 Summary: The Kerberos network authentication system Name: krb5 @@ -710,6 +710,9 @@ exit 0 %{_datarootdir}/%{name}-tests/ %changelog +* Thu Dec 1 2022 Alexander Bokovoy - 1.20.1-2 +- Bump KDB ABI version provide to 9.0 + * Wed Nov 23 2022 Julien Rische - 1.20.1-1 - New upstream version (1.20.1) - Resolves: rhbz#2124463 From f003c0755c1c27d658f974faa72ed3e7b6375686 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Tue, 6 Dec 2022 11:51:10 +0100 Subject: [PATCH 074/103] Enable TMT integration with Fedora CI Signed-off-by: Julien Rische --- ci.fmf | 1 + krb5.spec | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) create mode 100644 ci.fmf diff --git a/ci.fmf b/ci.fmf new file mode 100644 index 0000000..c5aa0e0 --- /dev/null +++ b/ci.fmf @@ -0,0 +1 @@ +resultsdb-testcase: separate diff --git a/krb5.spec b/krb5.spec index 45bfdc2..082fb42 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 2 +%global baserelease 3 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -710,6 +710,9 @@ exit 0 %{_datarootdir}/%{name}-tests/ %changelog +* Tue Dec 06 2022 Julien Rische - 1.20.1-3 +- Enable TMT integration with Fedora CI + * Thu Dec 1 2022 Alexander Bokovoy - 1.20.1-2 - Bump KDB ABI version provide to 9.0 From ba968605e78ef538c23aa391202de8a286ca55b8 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Wed, 7 Dec 2022 19:18:54 -0500 Subject: [PATCH 075/103] Fix openssl dependencies for RHEL/ELN --- krb5.spec | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/krb5.spec b/krb5.spec index 082fb42..b197f0b 100644 --- a/krb5.spec +++ b/krb5.spec @@ -92,9 +92,9 @@ BuildRequires: perl-interpreter # For autosetup BuildRequires: git -%if 0%{?fedora} > 35 +%if 0%{?fedora} > 35 || 0%{?rhel} >= 9 # Need KDFs. This is the "real" version -BuildRequires: openssl-devel => 1:3.0.0 +BuildRequires: openssl-devel >= 1:3.0.0 %else # Need KDFs. This is the backported version BuildRequires: openssl-devel >= 1:1.1.1d-4 @@ -129,7 +129,7 @@ to install this package. %package libs Summary: The non-admin shared libraries used by Kerberos 5 -%if 0%{?fedora} > 35 +%if 0%{?fedora} > 35 || 0%{?rhel} >= 9 Requires: openssl-libs >= 1:3.0.0 %else Requires: openssl-libs >= 1:1.1.1d-4 @@ -229,8 +229,8 @@ Requires: lmdb-devel Requires: openldap-devel Requires: pam-devel Requires: redhat-rpm-config -%if 0%{?fedora} > 35 -Requires: openssl-devel => 1:3.0.0 +%if 0%{?fedora} > 35 || 0%{?rhel} >= 9 +Requires: openssl-devel >= 1:3.0.0 %else Requires: openssl-devel >= 1:1.1.1d-4 Requires: openssl-devel < 1:3.0.0 From f29ff7186e1bc6902997e779103474351b2290ba Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Tue, 20 Dec 2022 16:25:16 +0100 Subject: [PATCH 076/103] Make tests compatible with sssd_krb5_locator_plugin.so --- ...tests-compatible-with-sssd_krb5_loca.patch | 41 +++++++++++++++++++ krb5.spec | 9 ++-- plans/tests.fmf | 4 -- 3 files changed, 46 insertions(+), 8 deletions(-) create mode 100644 0013-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch diff --git a/0013-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch b/0013-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch new file mode 100644 index 0000000..5840faa --- /dev/null +++ b/0013-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch @@ -0,0 +1,41 @@ +From 9a536113196d8b32e3143964a655356ac8af1347 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Wed, 7 Dec 2022 13:22:42 +0100 +Subject: [PATCH] [downstream] Make tests compatible with + sssd_krb5_locator_plugin.so + +The sssd_krb5_locator_plugin.so plugin provided by sssd-client conflicts +with the upstream test t_discover_uri.py. The test has to be modified in +order to avoid false positive. +--- + src/lib/krb5/os/t_discover_uri.py | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/src/lib/krb5/os/t_discover_uri.py b/src/lib/krb5/os/t_discover_uri.py +index 87bac17929..26bc95a8dc 100644 +--- a/src/lib/krb5/os/t_discover_uri.py ++++ b/src/lib/krb5/os/t_discover_uri.py +@@ -1,3 +1,4 @@ ++from os.path import exists + from k5test import * + + entries = ('URI _kerberos.TEST krb5srv::kkdcp:https://kdc1 1 1\n', +@@ -37,8 +38,14 @@ realm.env['RESOLV_WRAPPER_HOSTS'] = hosts_filename + out = realm.run(['./t_locate_kdc', 'TEST'], env=realm.env) + l = out.splitlines() + ++if (exists('/usr/lib/krb5/plugins/libkrb5/sssd_krb5_locator_plugin.so') ++ or exists('/usr/lib64/krb5/plugins/libkrb5/sssd_krb5_locator_plugin.so')): ++ line_range = range(6, 14) ++else: ++ line_range = range(4, 12) ++ + j = 0 +-for i in range(4, 12): ++for i in line_range: + if l[i].strip() != expected[j]: + fail('URI answers do not match') + j += 1 +-- +2.38.1 + diff --git a/krb5.spec b/krb5.spec index b197f0b..44696f6 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 3 +%global baserelease 4 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -71,6 +71,7 @@ Patch9: 0009-Simplify-plugin-loading-code.patch Patch10: 0010-Update-error-checking-for-OpenSSL-CMS_verify.patch Patch11: 0011-downstream-Catch-SHA-1-digest-disallowed-error-for-P.patch Patch12: 0012-Add-and-use-ts_interval-helper.patch +Patch13: 0013-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -254,9 +255,6 @@ Requires: /etc/crypto-policies/back-ends/krb5.config Requires: /usr/share/dict/words #Requires: openldap-servers, openldap-clients -# sssd_krb5_locator_plugin.so conflicts with t_discover_uri.py -Conflicts: sssd-client - %description tests FOR TESTING PURPOSE ONLY Test sources for krb5 build, with pre-defined compilation parameters @@ -710,6 +708,9 @@ exit 0 %{_datarootdir}/%{name}-tests/ %changelog +* Tue Dec 20 2022 Julien Rische - 1.20.1-4 +- Make tests compatible with sssd_krb5_locator_plugin.so + * Tue Dec 06 2022 Julien Rische - 1.20.1-3 - Enable TMT integration with Fedora CI diff --git a/plans/tests.fmf b/plans/tests.fmf index 9d368f3..970ae2e 100644 --- a/plans/tests.fmf +++ b/plans/tests.fmf @@ -1,9 +1,5 @@ summary: Tests discover: how: fmf -prepare: -- how: shell - script: - - dnf remove -y sssd-client execute: how: tmt From f0b4f85e9e3715cf90d634cd4cd21452fda2620a Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Thu, 5 Jan 2023 20:18:20 +0100 Subject: [PATCH 077/103] Include missing OpenSSL FIPS header Signed-off-by: Julien Rische --- ...-Include-missing-OpenSSL-FIPS-header.patch | 120 ++++++++++++++++++ krb5.spec | 4 +- 2 files changed, 123 insertions(+), 1 deletion(-) create mode 100644 0014-downstream-Include-missing-OpenSSL-FIPS-header.patch diff --git a/0014-downstream-Include-missing-OpenSSL-FIPS-header.patch b/0014-downstream-Include-missing-OpenSSL-FIPS-header.patch new file mode 100644 index 0000000..24ba48a --- /dev/null +++ b/0014-downstream-Include-missing-OpenSSL-FIPS-header.patch @@ -0,0 +1,120 @@ +From d57a804136c5ebf473ce053a9517edd71a56389f Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Thu, 5 Jan 2023 20:06:47 +0100 +Subject: [PATCH] [downstream] Include missing OpenSSL FIPS header + +The inclusion of openssl/fips.h, which provides the declaration of +FIPS_mode(), was removed from openssl/crypto.h. As a consequence, this +header file has to be included explicitly in krb5 code. +--- + src/lib/crypto/krb/prng.c | 4 +++- + src/lib/crypto/openssl/enc_provider/camellia.c | 1 + + src/lib/crypto/openssl/enc_provider/rc4.c | 4 ++++ + src/lib/crypto/openssl/hmac.c | 1 + + src/lib/krad/internal.h | 4 ++++ + src/plugins/preauth/spake/spake_client.c | 4 ++++ + src/plugins/preauth/spake/spake_kdc.c | 4 ++++ + 7 files changed, 21 insertions(+), 1 deletion(-) + +diff --git a/src/lib/crypto/krb/prng.c b/src/lib/crypto/krb/prng.c +index 9e80a03d21..ae37c77518 100644 +--- a/src/lib/crypto/krb/prng.c ++++ b/src/lib/crypto/krb/prng.c +@@ -28,7 +28,9 @@ + + #include + +-#if OPENSSL_VERSION_NUMBER < 0x30000000L ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++#include ++#else + #include + #endif + +diff --git a/src/lib/crypto/openssl/enc_provider/camellia.c b/src/lib/crypto/openssl/enc_provider/camellia.c +index d9f327add6..3dd3b0624f 100644 +--- a/src/lib/crypto/openssl/enc_provider/camellia.c ++++ b/src/lib/crypto/openssl/enc_provider/camellia.c +@@ -32,6 +32,7 @@ + #include + #if OPENSSL_VERSION_NUMBER >= 0x30000000L + #include ++#include + #else + #include + #endif +diff --git a/src/lib/crypto/openssl/enc_provider/rc4.c b/src/lib/crypto/openssl/enc_provider/rc4.c +index ce63cb5f1b..6a83f10d27 100644 +--- a/src/lib/crypto/openssl/enc_provider/rc4.c ++++ b/src/lib/crypto/openssl/enc_provider/rc4.c +@@ -38,6 +38,10 @@ + + #include + ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++#include ++#endif ++ + /* + * The loopback field is a pointer to the structure. If the application copies + * the state (not a valid operation, but one which happens to works with some +diff --git a/src/lib/crypto/openssl/hmac.c b/src/lib/crypto/openssl/hmac.c +index f21e268f7f..25a419d73a 100644 +--- a/src/lib/crypto/openssl/hmac.c ++++ b/src/lib/crypto/openssl/hmac.c +@@ -59,6 +59,7 @@ + #if OPENSSL_VERSION_NUMBER >= 0x30000000L + #include + #include ++#include + #else + #include + #endif +diff --git a/src/lib/krad/internal.h b/src/lib/krad/internal.h +index e123763954..a17b6f39b1 100644 +--- a/src/lib/krad/internal.h ++++ b/src/lib/krad/internal.h +@@ -41,6 +41,10 @@ + + #include + ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++#include ++#endif ++ + #ifndef UCHAR_MAX + #define UCHAR_MAX 255 + #endif +diff --git a/src/plugins/preauth/spake/spake_client.c b/src/plugins/preauth/spake/spake_client.c +index a3ce22b70f..13c699071f 100644 +--- a/src/plugins/preauth/spake/spake_client.c ++++ b/src/plugins/preauth/spake/spake_client.c +@@ -40,6 +40,10 @@ + + #include + ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++#include ++#endif ++ + typedef struct reqstate_st { + krb5_pa_spake *msg; /* set in prep_questions, used in process */ + krb5_keyblock *initial_key; +diff --git a/src/plugins/preauth/spake/spake_kdc.c b/src/plugins/preauth/spake/spake_kdc.c +index 232e78bc05..3394f8a58e 100644 +--- a/src/plugins/preauth/spake/spake_kdc.c ++++ b/src/plugins/preauth/spake/spake_kdc.c +@@ -43,6 +43,10 @@ + + #include + ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++#include ++#endif ++ + /* + * The SPAKE kdcpreauth module uses a secure cookie containing the following + * concatenated fields (all integer fields are big-endian): +-- +2.38.1 + diff --git a/krb5.spec b/krb5.spec index 44696f6..3593e7d 100644 --- a/krb5.spec +++ b/krb5.spec @@ -72,6 +72,7 @@ Patch10: 0010-Update-error-checking-for-OpenSSL-CMS_verify.patch Patch11: 0011-downstream-Catch-SHA-1-digest-disallowed-error-for-P.patch Patch12: 0012-Add-and-use-ts_interval-helper.patch Patch13: 0013-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch +Patch14: 0014-downstream-Include-missing-OpenSSL-FIPS-header.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -708,7 +709,8 @@ exit 0 %{_datarootdir}/%{name}-tests/ %changelog -* Tue Dec 20 2022 Julien Rische - 1.20.1-4 +* Thu Jan 05 2023 Julien Rische - 1.20.1-4 +- Include missing OpenSSL FIPS header - Make tests compatible with sssd_krb5_locator_plugin.so * Tue Dec 06 2022 Julien Rische - 1.20.1-3 From 4eee9bbb506af4f436832fb9b2778716d10849d0 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Mon, 9 Jan 2023 22:46:10 +0100 Subject: [PATCH 078/103] Strip debugging data from ksu executable file Signed-off-by: Julien Rische --- ...am-Do-not-set-root-as-ksu-file-owner.patch | 31 +++++++++++++++++++ krb5.spec | 6 +++- 2 files changed, 36 insertions(+), 1 deletion(-) create mode 100644 0015-downstream-Do-not-set-root-as-ksu-file-owner.patch diff --git a/0015-downstream-Do-not-set-root-as-ksu-file-owner.patch b/0015-downstream-Do-not-set-root-as-ksu-file-owner.patch new file mode 100644 index 0000000..5c53868 --- /dev/null +++ b/0015-downstream-Do-not-set-root-as-ksu-file-owner.patch @@ -0,0 +1,31 @@ +From 59d3ecdab7210e87ec475f4ae0d64888d5416b29 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Mon, 9 Jan 2023 22:39:52 +0100 +Subject: [PATCH] [downstream] Do not set root as ksu file owner + +Upstream Makefile uses the install command to set root as owner of the +ksu executable file. However, this is no longer supported on latest +versions of the Mock build environment. + +In case of ksu, the owner, group, and mode are already set using %attr() +in the specfile. +--- + src/config/pre.in | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/config/pre.in b/src/config/pre.in +index 7eaa2f351c..e9ae71471e 100644 +--- a/src/config/pre.in ++++ b/src/config/pre.in +@@ -185,7 +185,7 @@ INSTALL_PROGRAM=@INSTALL_PROGRAM@ $(INSTALL_STRIP) + INSTALL_SCRIPT=@INSTALL_PROGRAM@ + INSTALL_DATA=@INSTALL_DATA@ + INSTALL_SHLIB=@INSTALL_SHLIB@ +-INSTALL_SETUID=$(INSTALL) $(INSTALL_STRIP) -m 4755 -o root ++INSTALL_SETUID=$(INSTALL) + ## This is needed because autoconf will sometimes define @exec_prefix@ to be + ## ${prefix}. + prefix=@prefix@ +-- +2.38.1 + diff --git a/krb5.spec b/krb5.spec index 3593e7d..0f6e58d 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 4 +%global baserelease 5 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -73,6 +73,7 @@ Patch11: 0011-downstream-Catch-SHA-1-digest-disallowed-error-for-P.patch Patch12: 0012-Add-and-use-ts_interval-helper.patch Patch13: 0013-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch Patch14: 0014-downstream-Include-missing-OpenSSL-FIPS-header.patch +Patch15: 0015-downstream-Do-not-set-root-as-ksu-file-owner.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -709,6 +710,9 @@ exit 0 %{_datarootdir}/%{name}-tests/ %changelog +* Mon Jan 09 2023 Julien Rische - 1.20.1-5 +- Strip debugging data from ksu executable file + * Thu Jan 05 2023 Julien Rische - 1.20.1-4 - Include missing OpenSSL FIPS header - Make tests compatible with sssd_krb5_locator_plugin.so From 4a4fd39d5e74d2f06b6ab51d336433058baa8017 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Wed, 18 Jan 2023 16:01:02 +0100 Subject: [PATCH 079/103] Add AES SHA-2 HMAC family as default KDC etypes Resolves: rhbz#2114771 Signed-off-by: Julien Rische --- kdc.conf | 6 ++++-- krb5.spec | 7 ++++++- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/kdc.conf b/kdc.conf index 5d1571d..c504e58 100644 --- a/kdc.conf +++ b/kdc.conf @@ -5,10 +5,12 @@ [realms] EXAMPLE.COM = { - #master_key_type = aes256-cts + master_key_type = aes256-cts-hmac-sha384-192 acl_file = /var/kerberos/krb5kdc/kadm5.acl dict_file = /usr/share/dict/words default_principal_flags = +preauth admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab - supported_enctypes = aes256-cts:normal aes128-cts:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal + supported_enctypes = aes256-cts-hmac-sha384-192:normal aes128-cts-hmac-sha256-128:normal aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal camellia256-cts-cmac:normal camellia128-cts-cmac:normal arcfour-hmac-md5:normal + # Supported encryption types for FIPS mode: + #supported_enctypes = aes256-cts-hmac-sha384-192:normal aes128-cts-hmac-sha256-128:normal } diff --git a/krb5.spec b/krb5.spec index 0f6e58d..96d61b3 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 5 +%global baserelease 6 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -710,6 +710,11 @@ exit 0 %{_datarootdir}/%{name}-tests/ %changelog +* Wed Jan 18 2023 Julien Rische - 1.20.1-6 +- Set aes256-cts-hmac-sha384-192 as EXAMLE.COM master key in kdc.conf +- Add AES SHA-2 HMAC family as EXAMPLE.COM supported etypes in kdc.conf +- Resolves: rhbz#2114771 + * Mon Jan 09 2023 Julien Rische - 1.20.1-5 - Strip debugging data from ksu executable file From dca288bae2ddcaf521b06ebc20a39993a4c17c91 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 19 Jan 2023 15:08:24 +0000 Subject: [PATCH 080/103] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- krb5.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/krb5.spec b/krb5.spec index 96d61b3..eff2a84 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 6 +%global baserelease 7 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -710,6 +710,9 @@ exit 0 %{_datarootdir}/%{name}-tests/ %changelog +* Thu Jan 19 2023 Fedora Release Engineering - 1.20.1-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Wed Jan 18 2023 Julien Rische - 1.20.1-6 - Set aes256-cts-hmac-sha384-192 as EXAMLE.COM master key in kdc.conf - Add AES SHA-2 HMAC family as EXAMPLE.COM supported etypes in kdc.conf From ec957f57110521e222ea30d3916fd521b2ded7ce Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Mon, 30 Jan 2023 11:51:31 +0100 Subject: [PATCH 081/103] Do not block KRB5KDF and MD4/5 in FIPS mode Bypass OpenSSL's restrictions to use KRB5KDF in FIPS mode in case at least one of AES SHA-1 HMAC encryption types are used. Use OpenSSL 3.0 library context to access MD4 and MD5 lazily from legacy provider if RADIUS is being used or RC4 encryption type is enabled, without affecting global context. Such exceptions should not be allowed by the default FIPS crypto policy. Signed-off-by: Julien Rische --- ...low-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch | 165 ++++++++++++++++++ krb5.spec | 7 +- 2 files changed, 171 insertions(+), 1 deletion(-) create mode 100644 0016-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch diff --git a/0016-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch b/0016-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch new file mode 100644 index 0000000..227650e --- /dev/null +++ b/0016-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch @@ -0,0 +1,165 @@ +From d8f67df42efd68142aa904040f9e8cc0f9138c10 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Thu, 19 Jan 2023 19:22:27 +0100 +Subject: [PATCH] [downstream] Allow KRB5KDF, MD5, and MD4 in FIPS mode + +OpenSSL's restrictions to use KRB5KDF, MD5, and MD4 in FIPS mode are +bypassed in case AES SHA-1 HMAC or RC4 encryption types are allowed by +the crypto policy. +--- + .../crypto/openssl/hash_provider/hash_evp.c | 97 +++++++++++++++++-- + src/lib/crypto/openssl/kdf.c | 2 +- + 2 files changed, 89 insertions(+), 10 deletions(-) + +diff --git a/src/lib/crypto/openssl/hash_provider/hash_evp.c b/src/lib/crypto/openssl/hash_provider/hash_evp.c +index 11659908bb..eb2e693e9f 100644 +--- a/src/lib/crypto/openssl/hash_provider/hash_evp.c ++++ b/src/lib/crypto/openssl/hash_provider/hash_evp.c +@@ -44,6 +44,49 @@ + #define EVP_MD_CTX_free EVP_MD_CTX_destroy + #endif + ++#include ++#include ++#include ++ ++typedef struct ossl_lib_md_context { ++ OSSL_LIB_CTX *libctx; ++ OSSL_PROVIDER *default_provider; ++ OSSL_PROVIDER *legacy_provider; ++} ossl_md_context_t; ++ ++static thread_local ossl_md_context_t *ossl_md_ctx = NULL; ++ ++static krb5_error_code ++init_ossl_md_ctx(ossl_md_context_t *ctx, const char *algo) ++{ ++ ctx->libctx = OSSL_LIB_CTX_new(); ++ if (!ctx->libctx) ++ return KRB5_CRYPTO_INTERNAL; ++ ++ /* Load both legacy and default provider as both may be needed. */ ++ ctx->default_provider = OSSL_PROVIDER_load(ctx->libctx, "default"); ++ ctx->legacy_provider = OSSL_PROVIDER_load(ctx->libctx, "legacy"); ++ ++ if (!(ctx->default_provider && ctx->legacy_provider)) ++ return KRB5_CRYPTO_INTERNAL; ++ ++ return 0; ++} ++ ++static void ++deinit_ossl_ctx(ossl_md_context_t *ctx) ++{ ++ if (ctx->legacy_provider) ++ OSSL_PROVIDER_unload(ctx->legacy_provider); ++ ++ if (ctx->default_provider) ++ OSSL_PROVIDER_unload(ctx->default_provider); ++ ++ if (ctx->libctx) ++ OSSL_LIB_CTX_free(ctx->libctx); ++} ++ ++ + static krb5_error_code + hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data, + krb5_data *output) +@@ -60,11 +103,6 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data, + if (ctx == NULL) + return ENOMEM; + +- if (type == EVP_md4() || type == EVP_md5()) { +- /* See comments below in hash_md4() and hash_md5(). */ +- EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW); +- } +- + ok = EVP_DigestInit_ex(ctx, type, NULL); + for (i = 0; i < num_data; i++) { + if (!SIGN_IOV(&data[i])) +@@ -77,6 +115,43 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data, + return ok ? 0 : KRB5_CRYPTO_INTERNAL; + } + ++static krb5_error_code ++hash_legacy_evp(const char *algo, const krb5_crypto_iov *data, size_t num_data, ++ krb5_data *output) ++{ ++ krb5_error_code err; ++ EVP_MD *md = NULL; ++ ++ if (!ossl_md_ctx) { ++ ossl_md_ctx = malloc(sizeof(ossl_md_context_t)); ++ if (!ossl_md_ctx) { ++ err = ENOMEM; ++ goto end; ++ } ++ ++ err = init_ossl_md_ctx(ossl_md_ctx, algo); ++ if (err) { ++ deinit_ossl_ctx(ossl_md_ctx); ++ free(ossl_md_ctx); ++ ossl_md_ctx = NULL; ++ goto end; ++ } ++ } ++ ++ md = EVP_MD_fetch(ossl_md_ctx->libctx, algo, NULL); ++ if (!md) { ++ err = KRB5_CRYPTO_INTERNAL; ++ goto end; ++ } ++ ++ err = hash_evp(md, data, num_data, output); ++ ++end: ++ if (md) ++ EVP_MD_free(md); ++ ++ return err; ++} + #endif + + #ifdef K5_OPENSSL_MD4 +@@ -88,7 +163,8 @@ hash_md4(const krb5_crypto_iov *data, size_t num_data, krb5_data *output) + * by IPA. These keys are only used along a (separately) secured channel + * for legacy reasons when performing trusts to Active Directory. + */ +- return hash_evp(EVP_md4(), data, num_data, output); ++ return FIPS_mode() ? hash_legacy_evp("MD4", data, num_data, output) ++ : hash_evp(EVP_md4(), data, num_data, output); + } + + const struct krb5_hash_provider krb5int_hash_md4 = { +@@ -100,9 +176,12 @@ const struct krb5_hash_provider krb5int_hash_md4 = { + static krb5_error_code + hash_md5(const krb5_crypto_iov *data, size_t num_data, krb5_data *output) + { +- /* MD5 is needed in FIPS mode for communication with RADIUS servers. This +- * is gated in libkrad by libdefaults->radius_md5_fips_override. */ +- return hash_evp(EVP_md5(), data, num_data, output); ++ /* ++ * MD5 is needed in FIPS mode for communication with RADIUS servers. This ++ * is gated in libkrad by libdefaults->radius_md5_fips_override. ++ */ ++ return FIPS_mode() ? hash_legacy_evp("MD5", data, num_data, output) ++ : hash_evp(EVP_md5(), data, num_data, output); + } + + const struct krb5_hash_provider krb5int_hash_md5 = { +diff --git a/src/lib/crypto/openssl/kdf.c b/src/lib/crypto/openssl/kdf.c +index 5a43c3d9eb..8528ddc4a9 100644 +--- a/src/lib/crypto/openssl/kdf.c ++++ b/src/lib/crypto/openssl/kdf.c +@@ -198,7 +198,7 @@ k5_derive_random_rfc3961(const struct krb5_enc_provider *enc, krb5_key key, + goto done; + } + +- kdf = EVP_KDF_fetch(NULL, "KRB5KDF", NULL); ++ kdf = EVP_KDF_fetch(NULL, "KRB5KDF", "-fips"); + if (kdf == NULL) { + ret = KRB5_CRYPTO_INTERNAL; + goto done; +-- +2.39.1 + diff --git a/krb5.spec b/krb5.spec index eff2a84..3592f20 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 7 +%global baserelease 8 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -74,6 +74,7 @@ Patch12: 0012-Add-and-use-ts_interval-helper.patch Patch13: 0013-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch Patch14: 0014-downstream-Include-missing-OpenSSL-FIPS-header.patch Patch15: 0015-downstream-Do-not-set-root-as-ksu-file-owner.patch +Patch16: 0016-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -710,6 +711,10 @@ exit 0 %{_datarootdir}/%{name}-tests/ %changelog +* Mon Jan 30 2023 Julien Rische - 1.20.1-8 +- Bypass FIPS restrictions to use KRB5KDF in case AES SHA-1 HMAC is enabled +- Lazily load MD4/5 from OpenSSL if using RADIUS or RC4 enctype in FIPS mode + * Thu Jan 19 2023 Fedora Release Engineering - 1.20.1-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From 7058594eabc7495d1ec82717da6e752720418304 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Tue, 31 Jan 2023 17:56:02 +0100 Subject: [PATCH 082/103] Add support for MS-PAC extended KDC signature (CVE-2022-37967) Resolves: rhbz#2166001 Signed-off-by: Julien Rische --- 0017-Add-PAC-full-checksums.patch | 672 ++++++++++++++++++++++++++++++ krb5.spec | 7 +- 2 files changed, 678 insertions(+), 1 deletion(-) create mode 100644 0017-Add-PAC-full-checksums.patch diff --git a/0017-Add-PAC-full-checksums.patch b/0017-Add-PAC-full-checksums.patch new file mode 100644 index 0000000..f0a20f6 --- /dev/null +++ b/0017-Add-PAC-full-checksums.patch @@ -0,0 +1,672 @@ +From 5801da1ddc3b0984ad6997bb7a692eac85ff7dd3 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Thu, 22 Dec 2022 03:05:23 -0500 +Subject: [PATCH] Add PAC full checksums + +A paper by Tom Tervoort noted that computing the PAC privsvr checksum +over only the server checksum is vulnerable to collision attacks +(CVE-2022-37967). In response, Microsoft has added a second KDC +checksum over the full contents of the PAC. Generate and verify full +KDC checksums in PACs for service tickets. Update the t_pac.c ticket +test case to use a ticket issued by a recent version of Active +Directory (provided by Stefan Metzmacher). + +ticket: 9084 (new) +--- + doc/appdev/refs/macros/index.rst | 1 + + src/include/krb5/krb5.hin | 1 + + src/lib/krb5/krb/pac.c | 92 +++++++++-------- + src/lib/krb5/krb/pac_sign.c | 146 +++++++++++++++----------- + src/lib/krb5/krb/t_pac.c | 171 ++++++++++++++++++------------- + src/tests/t_authdata.py | 4 +- + 6 files changed, 240 insertions(+), 175 deletions(-) + +diff --git a/doc/appdev/refs/macros/index.rst b/doc/appdev/refs/macros/index.rst +index 5f34dea5e8..3eeee25593 100644 +--- a/doc/appdev/refs/macros/index.rst ++++ b/doc/appdev/refs/macros/index.rst +@@ -247,6 +247,7 @@ Public + KRB5_PAC_SERVER_CHECKSUM.rst + KRB5_PAC_TICKET_CHECKSUM.rst + KRB5_PAC_UPN_DNS_INFO.rst ++ KRB5_PAC_FULL_CHECKSUM.rst + KRB5_PADATA_AFS3_SALT.rst + KRB5_PADATA_AP_REQ.rst + KRB5_PADATA_AS_CHECKSUM.rst +diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin +index fb9f2a366c..2ba4010514 100644 +--- a/src/include/krb5/krb5.hin ++++ b/src/include/krb5/krb5.hin +@@ -8164,6 +8164,7 @@ krb5_verify_authdata_kdc_issued(krb5_context context, + #define KRB5_PAC_TICKET_CHECKSUM 16 /**< Ticket checksum */ + #define KRB5_PAC_ATTRIBUTES_INFO 17 /**< PAC attributes */ + #define KRB5_PAC_REQUESTOR 18 /**< PAC requestor SID */ ++#define KRB5_PAC_FULL_CHECKSUM 19 /**< KDC full checksum */ + + struct krb5_pac_data; + /** PAC data structure to convey authorization information */ +diff --git a/src/lib/krb5/krb/pac.c b/src/lib/krb5/krb/pac.c +index f6c4373de0..954482e0c7 100644 +--- a/src/lib/krb5/krb/pac.c ++++ b/src/lib/krb5/krb/pac.c +@@ -490,7 +490,8 @@ zero_signature(krb5_context context, const krb5_pac pac, krb5_ui_4 type, + size_t i; + + assert(type == KRB5_PAC_SERVER_CHECKSUM || +- type == KRB5_PAC_PRIVSVR_CHECKSUM); ++ type == KRB5_PAC_PRIVSVR_CHECKSUM || ++ type == KRB5_PAC_FULL_CHECKSUM); + assert(data->length >= pac->data.length); + + for (i = 0; i < pac->pac->cBuffers; i++) { +@@ -557,17 +558,17 @@ verify_checksum(krb5_context context, const krb5_pac pac, uint32_t buffer_type, + } + + static krb5_error_code +-verify_server_checksum(krb5_context context, const krb5_pac pac, +- const krb5_keyblock *server) ++verify_pac_checksums(krb5_context context, const krb5_pac pac, ++ krb5_boolean expect_full_checksum, ++ const krb5_keyblock *server, const krb5_keyblock *privsvr) + { + krb5_error_code ret; +- krb5_data copy; /* PAC with zeroed checksums */ ++ krb5_data copy, server_checksum; + ++ /* Make a copy of the PAC with zeroed out server and privsvr checksums. */ + ret = krb5int_copy_data_contents(context, &pac->data, ©); + if (ret) + return ret; +- +- /* Zero out both checksum buffers */ + ret = zero_signature(context, pac, KRB5_PAC_SERVER_CHECKSUM, ©); + if (ret) + goto cleanup; +@@ -575,32 +576,46 @@ verify_server_checksum(krb5_context context, const krb5_pac pac, + if (ret) + goto cleanup; + +- ret = verify_checksum(context, pac, KRB5_PAC_SERVER_CHECKSUM, server, +- KRB5_KEYUSAGE_APP_DATA_CKSUM, ©); ++ if (server != NULL) { ++ /* Verify the server checksum over the PAC copy. */ ++ ret = verify_checksum(context, pac, KRB5_PAC_SERVER_CHECKSUM, server, ++ KRB5_KEYUSAGE_APP_DATA_CKSUM, ©); ++ } + +-cleanup: +- free(copy.data); +- return ret; +-} ++ if (privsvr != NULL && expect_full_checksum) { ++ /* Zero the full checksum buffer in the copy and verify the full ++ * checksum over the copy with all three checksums zeroed. */ ++ ret = zero_signature(context, pac, KRB5_PAC_FULL_CHECKSUM, ©); ++ if (ret) ++ goto cleanup; ++ ret = verify_checksum(context, pac, KRB5_PAC_FULL_CHECKSUM, privsvr, ++ KRB5_KEYUSAGE_APP_DATA_CKSUM, ©); ++ if (ret) ++ goto cleanup; ++ } + +-static krb5_error_code +-verify_kdc_checksum(krb5_context context, const krb5_pac pac, +- const krb5_keyblock *privsvr) +-{ +- krb5_error_code ret; +- krb5_data server_checksum; ++ if (privsvr != NULL) { ++ /* Verify the privsvr checksum over the server checksum. */ ++ ret = k5_pac_locate_buffer(context, pac, KRB5_PAC_SERVER_CHECKSUM, ++ &server_checksum); ++ if (ret) ++ return ret; ++ if (server_checksum.length < PAC_SIGNATURE_DATA_LENGTH) ++ return KRB5_BAD_MSIZE; ++ server_checksum.data += PAC_SIGNATURE_DATA_LENGTH; ++ server_checksum.length -= PAC_SIGNATURE_DATA_LENGTH; + +- ret = k5_pac_locate_buffer(context, pac, KRB5_PAC_SERVER_CHECKSUM, +- &server_checksum); +- if (ret) +- return ret; +- if (server_checksum.length < PAC_SIGNATURE_DATA_LENGTH) +- return KRB5_BAD_MSIZE; +- server_checksum.data += PAC_SIGNATURE_DATA_LENGTH; +- server_checksum.length -= PAC_SIGNATURE_DATA_LENGTH; ++ ret = verify_checksum(context, pac, KRB5_PAC_PRIVSVR_CHECKSUM, privsvr, ++ KRB5_KEYUSAGE_APP_DATA_CKSUM, &server_checksum); ++ if (ret) ++ goto cleanup; ++ } ++ ++ pac->verified = TRUE; + +- return verify_checksum(context, pac, KRB5_PAC_PRIVSVR_CHECKSUM, privsvr, +- KRB5_KEYUSAGE_APP_DATA_CKSUM, &server_checksum); ++cleanup: ++ free(copy.data); ++ return ret; + } + + /* Per MS-PAC 2.8.3, tickets encrypted to TGS and password change principals +@@ -628,6 +643,7 @@ krb5_kdc_verify_ticket(krb5_context context, const krb5_enc_tkt_part *enc_tkt, + krb5_authdata **authdata, *orig, **ifrel = NULL, **recoded_ifrel = NULL; + uint8_t z = 0; + krb5_authdata zpac = { KV5M_AUTHDATA, KRB5_AUTHDATA_WIN2K_PAC, 1, &z }; ++ krb5_boolean is_service_tkt; + size_t i, j; + + *pac_out = NULL; +@@ -669,7 +685,8 @@ krb5_kdc_verify_ticket(krb5_context context, const krb5_enc_tkt_part *enc_tkt, + if (ret) + goto cleanup; + +- if (privsvr != NULL && k5_pac_should_have_ticket_signature(server_princ)) { ++ is_service_tkt = k5_pac_should_have_ticket_signature(server_princ); ++ if (privsvr != NULL && is_service_tkt) { + /* To check the PAC ticket signatures, re-encode the ticket with the + * PAC contents replaced by a single zero. */ + orig = ifrel[j]; +@@ -693,8 +710,9 @@ krb5_kdc_verify_ticket(krb5_context context, const krb5_enc_tkt_part *enc_tkt, + goto cleanup; + } + +- ret = krb5_pac_verify_ext(context, pac, enc_tkt->times.authtime, NULL, +- server, privsvr, FALSE); ++ ret = verify_pac_checksums(context, pac, is_service_tkt, server, privsvr); ++ if (ret) ++ goto cleanup; + + *pac_out = pac; + pac = NULL; +@@ -730,14 +748,8 @@ krb5_pac_verify_ext(krb5_context context, + { + krb5_error_code ret; + +- if (server != NULL) { +- ret = verify_server_checksum(context, pac, server); +- if (ret != 0) +- return ret; +- } +- +- if (privsvr != NULL) { +- ret = verify_kdc_checksum(context, pac, privsvr); ++ if (server != NULL || privsvr != NULL) { ++ ret = verify_pac_checksums(context, pac, FALSE, server, privsvr); + if (ret != 0) + return ret; + } +@@ -749,8 +761,6 @@ krb5_pac_verify_ext(krb5_context context, + return ret; + } + +- pac->verified = TRUE; +- + return 0; + } + +diff --git a/src/lib/krb5/krb/pac_sign.c b/src/lib/krb5/krb/pac_sign.c +index 0f9581abbb..8ea61ac17b 100644 +--- a/src/lib/krb5/krb/pac_sign.c ++++ b/src/lib/krb5/krb/pac_sign.c +@@ -187,26 +187,41 @@ k5_pac_encode_header(krb5_context context, krb5_pac pac) + return 0; + } + +-krb5_error_code KRB5_CALLCONV +-krb5_pac_sign(krb5_context context, krb5_pac pac, krb5_timestamp authtime, +- krb5_const_principal principal, const krb5_keyblock *server_key, +- const krb5_keyblock *privsvr_key, krb5_data *data) ++/* Find the buffer of type buftype in pac and write within it a checksum of ++ * type cksumtype over data. Set *cksum_out to the checksum. */ ++static krb5_error_code ++compute_pac_checksum(krb5_context context, krb5_pac pac, uint32_t buftype, ++ const krb5_keyblock *key, krb5_cksumtype cksumtype, ++ const krb5_data *data, krb5_data *cksum_out) + { +- return krb5_pac_sign_ext(context, pac, authtime, principal, server_key, +- privsvr_key, FALSE, data); ++ krb5_error_code ret; ++ krb5_data buf; ++ krb5_crypto_iov iov[2]; ++ ++ ret = k5_pac_locate_buffer(context, pac, buftype, &buf); ++ if (ret) ++ return ret; ++ ++ assert(buf.length > PAC_SIGNATURE_DATA_LENGTH); ++ *cksum_out = make_data(buf.data + PAC_SIGNATURE_DATA_LENGTH, ++ buf.length - PAC_SIGNATURE_DATA_LENGTH); ++ iov[0].flags = KRB5_CRYPTO_TYPE_DATA; ++ iov[0].data = *data; ++ iov[1].flags = KRB5_CRYPTO_TYPE_CHECKSUM; ++ iov[1].data = *cksum_out; ++ return krb5_c_make_checksum_iov(context, cksumtype, key, ++ KRB5_KEYUSAGE_APP_DATA_CKSUM, iov, 2); + } + +-krb5_error_code KRB5_CALLCONV +-krb5_pac_sign_ext(krb5_context context, krb5_pac pac, krb5_timestamp authtime, +- krb5_const_principal principal, +- const krb5_keyblock *server_key, +- const krb5_keyblock *privsvr_key, krb5_boolean with_realm, +- krb5_data *data) ++static krb5_error_code ++sign_pac(krb5_context context, krb5_pac pac, krb5_timestamp authtime, ++ krb5_const_principal principal, const krb5_keyblock *server_key, ++ const krb5_keyblock *privsvr_key, krb5_boolean with_realm, ++ krb5_boolean is_service_tkt, krb5_data *data) + { + krb5_error_code ret; +- krb5_data server_cksum, privsvr_cksum; ++ krb5_data full_cksum, server_cksum, privsvr_cksum; + krb5_cksumtype server_cksumtype, privsvr_cksumtype; +- krb5_crypto_iov iov[2]; + + data->length = 0; + data->data = NULL; +@@ -214,67 +229,53 @@ krb5_pac_sign_ext(krb5_context context, krb5_pac pac, krb5_timestamp authtime, + if (principal != NULL) { + ret = k5_insert_client_info(context, pac, authtime, principal, + with_realm); +- if (ret != 0) ++ if (ret) + return ret; + } + +- /* Create zeroed buffers for both checksums */ ++ /* Create zeroed buffers for all checksums. */ + ret = k5_insert_checksum(context, pac, KRB5_PAC_SERVER_CHECKSUM, + server_key, &server_cksumtype); +- if (ret != 0) ++ if (ret) + return ret; +- + ret = k5_insert_checksum(context, pac, KRB5_PAC_PRIVSVR_CHECKSUM, + privsvr_key, &privsvr_cksumtype); +- if (ret != 0) ++ if (ret) + return ret; ++ if (is_service_tkt) { ++ ret = k5_insert_checksum(context, pac, KRB5_PAC_FULL_CHECKSUM, ++ privsvr_key, &privsvr_cksumtype); ++ if (ret) ++ return ret; ++ } + +- /* Now, encode the PAC header so that the checksums will include it */ ++ /* Encode the PAC header so that the checksums will include it. */ + ret = k5_pac_encode_header(context, pac); +- if (ret != 0) +- return ret; +- +- /* Generate the server checksum over the entire PAC */ +- ret = k5_pac_locate_buffer(context, pac, KRB5_PAC_SERVER_CHECKSUM, +- &server_cksum); +- if (ret != 0) ++ if (ret) + return ret; + +- assert(server_cksum.length > PAC_SIGNATURE_DATA_LENGTH); +- +- iov[0].flags = KRB5_CRYPTO_TYPE_DATA; +- iov[0].data = pac->data; +- +- iov[1].flags = KRB5_CRYPTO_TYPE_CHECKSUM; +- iov[1].data.data = server_cksum.data + PAC_SIGNATURE_DATA_LENGTH; +- iov[1].data.length = server_cksum.length - PAC_SIGNATURE_DATA_LENGTH; ++ if (is_service_tkt) { ++ /* Generate a full KDC checksum over the whole PAC. */ ++ ret = compute_pac_checksum(context, pac, KRB5_PAC_FULL_CHECKSUM, ++ privsvr_key, privsvr_cksumtype, ++ &pac->data, &full_cksum); ++ if (ret) ++ return ret; ++ } + +- ret = krb5_c_make_checksum_iov(context, server_cksumtype, +- server_key, KRB5_KEYUSAGE_APP_DATA_CKSUM, +- iov, sizeof(iov)/sizeof(iov[0])); +- if (ret != 0) ++ /* Generate the server checksum over the whole PAC, including the full KDC ++ * checksum if we added one. */ ++ ret = compute_pac_checksum(context, pac, KRB5_PAC_SERVER_CHECKSUM, ++ server_key, server_cksumtype, &pac->data, ++ &server_cksum); ++ if (ret) + return ret; + +- /* Generate the privsvr checksum over the server checksum buffer */ +- ret = k5_pac_locate_buffer(context, pac, KRB5_PAC_PRIVSVR_CHECKSUM, ++ /* Generate the privsvr checksum over the server checksum buffer. */ ++ ret = compute_pac_checksum(context, pac, KRB5_PAC_PRIVSVR_CHECKSUM, ++ privsvr_key, privsvr_cksumtype, &server_cksum, + &privsvr_cksum); +- if (ret != 0) +- return ret; +- +- assert(privsvr_cksum.length > PAC_SIGNATURE_DATA_LENGTH); +- +- iov[0].flags = KRB5_CRYPTO_TYPE_DATA; +- iov[0].data.data = server_cksum.data + PAC_SIGNATURE_DATA_LENGTH; +- iov[0].data.length = server_cksum.length - PAC_SIGNATURE_DATA_LENGTH; +- +- iov[1].flags = KRB5_CRYPTO_TYPE_CHECKSUM; +- iov[1].data.data = privsvr_cksum.data + PAC_SIGNATURE_DATA_LENGTH; +- iov[1].data.length = privsvr_cksum.length - PAC_SIGNATURE_DATA_LENGTH; +- +- ret = krb5_c_make_checksum_iov(context, privsvr_cksumtype, +- privsvr_key, KRB5_KEYUSAGE_APP_DATA_CKSUM, +- iov, sizeof(iov)/sizeof(iov[0])); +- if (ret != 0) ++ if (ret) + return ret; + + data->data = k5memdup(pac->data.data, pac->data.length, &ret); +@@ -288,6 +289,26 @@ krb5_pac_sign_ext(krb5_context context, krb5_pac pac, krb5_timestamp authtime, + return 0; + } + ++krb5_error_code KRB5_CALLCONV ++krb5_pac_sign(krb5_context context, krb5_pac pac, krb5_timestamp authtime, ++ krb5_const_principal principal, const krb5_keyblock *server_key, ++ const krb5_keyblock *privsvr_key, krb5_data *data) ++{ ++ return sign_pac(context, pac, authtime, principal, server_key, ++ privsvr_key, FALSE, FALSE, data); ++} ++ ++krb5_error_code KRB5_CALLCONV ++krb5_pac_sign_ext(krb5_context context, krb5_pac pac, krb5_timestamp authtime, ++ krb5_const_principal principal, ++ const krb5_keyblock *server_key, ++ const krb5_keyblock *privsvr_key, krb5_boolean with_realm, ++ krb5_data *data) ++{ ++ return sign_pac(context, pac, authtime, principal, server_key, privsvr_key, ++ with_realm, FALSE, data); ++} ++ + /* Add a signature over der_enc_tkt in privsvr to pac. der_enc_tkt should be + * encoded with a dummy PAC authdata element containing a single zero byte. */ + static krb5_error_code +@@ -359,6 +380,7 @@ krb5_kdc_sign_ticket(krb5_context context, krb5_enc_tkt_part *enc_tkt, + krb5_error_code ret; + krb5_data *der_enc_tkt = NULL, pac_data = empty_data(); + krb5_authdata **list, *pac_ad; ++ krb5_boolean is_service_tkt; + size_t count; + + /* Reallocate space for another authdata element in enc_tkt. */ +@@ -377,7 +399,8 @@ krb5_kdc_sign_ticket(krb5_context context, krb5_enc_tkt_part *enc_tkt, + memmove(list + 1, list, (count + 1) * sizeof(*list)); + list[0] = pac_ad; + +- if (k5_pac_should_have_ticket_signature(server_princ)) { ++ is_service_tkt = k5_pac_should_have_ticket_signature(server_princ); ++ if (is_service_tkt) { + ret = encode_krb5_enc_tkt_part(enc_tkt, &der_enc_tkt); + if (ret) + goto cleanup; +@@ -388,9 +411,8 @@ krb5_kdc_sign_ticket(krb5_context context, krb5_enc_tkt_part *enc_tkt, + goto cleanup; + } + +- ret = krb5_pac_sign_ext(context, pac, enc_tkt->times.authtime, +- client_princ, server, privsvr, with_realm, +- &pac_data); ++ ret = sign_pac(context, pac, enc_tkt->times.authtime, client_princ, server, ++ privsvr, with_realm, is_service_tkt, &pac_data); + if (ret) + goto cleanup; + +diff --git a/src/lib/krb5/krb/t_pac.c b/src/lib/krb5/krb/t_pac.c +index 173bde7bab..81f1642ab0 100644 +--- a/src/lib/krb5/krb/t_pac.c ++++ b/src/lib/krb5/krb/t_pac.c +@@ -607,78 +607,102 @@ check_pac(krb5_context context, int index, const unsigned char *pdata, + + static const krb5_keyblock ticket_sig_krbtgt_key = { + 0, ENCTYPE_AES256_CTS_HMAC_SHA1_96, +- 32, U("\x7a\x58\x98\xd2\xaf\xa6\xaf\xc0\x6a\xce\x06\x04\x4b\xc2\x70\x84" +- "\x9b\x8e\x0a\x6c\x4c\x07\xdc\x6f\xbb\x48\x43\xe1\xd2\xaa\x97\xf7") ++ 32, U("\x03\x73\x81\xEC\x43\x96\x7B\xC2\xAC\x3D\xF5\x2A\xAE\x95\xA6\x8E" ++ "\xBE\x24\x58\xDB\xCE\x52\x28\x20\xAF\x5E\xB7\x04\xA2\x22\x71\x4F") + }; + + static const krb5_keyblock ticket_sig_server_key = { +- 0, ENCTYPE_ARCFOUR_HMAC, +- 16, U("\xed\x23\x11\x20\x7a\x21\x44\x20\xbf\xc0\x8d\x36\xf7\xf6\xb2\x3e") ++ 0, ENCTYPE_AES256_CTS_HMAC_SHA1_96, ++ 32, U("\x11\x4A\x84\xE3\x14\x8F\xAA\xB1\xFA\x7B\x53\x51\xB2\x8A\xC2\xF1" ++ "\xFD\x19\x6D\x61\xE0\xF3\xF2\x3E\x1F\xDB\xD3\xC1\x79\x7D\xC1\xEE") + }; + ++/* A ticket issued by an Active Directory KDC (Windows Server 2022), containing ++ * a PAC with a full checksum. */ + static const krb5_data ticket_data = { +- .length = 972, .data = +- "\x61\x82\x03\xC8\x30\x82\x03\xC4\xA0\x03\x02\x01\x05\xA1\x0A\x1B" +- "\x08\x43\x44\x4F\x4D\x2E\x43\x4F\x4D\xA2\x0F\x30\x0D\xA0\x03\x02" +- "\x01\x01\xA1\x06\x30\x04\x1B\x02\x73\x31\xA3\x82\x03\x9E\x30\x82" +- "\x03\x9A\xA0\x03\x02\x01\x17\xA1\x03\x02\x01\x03\xA2\x82\x03\x8C" +- "\x04\x82\x03\x88\x44\x31\x61\x20\x17\xC9\xFE\xBC\xAC\x46\xB5\x77" +- "\xE9\x68\x04\x4C\x9B\x31\x91\x0C\xC1\xD4\xDD\xEF\xC7\x34\x20\x08" +- "\x90\x91\xE8\x79\xE0\xB5\x03\x26\xA4\x65\xDE\xEC\x47\x03\x2A\x8F" +- "\x61\xE7\x4D\x38\x5A\x42\x95\x5A\xF9\x2F\x41\x2C\x2A\x6E\x60\xA1" +- "\xEB\x51\xB3\xBD\x4C\x00\x41\x2A\x44\x76\x08\x37\x1A\x51\xFD\x65" +- "\x67\x7E\xBF\x3D\x90\x86\xE3\x9A\x54\x6B\x67\xA8\x08\x7A\x73\xCC" +- "\xC3\xB7\x4B\xD5\x5C\x3A\x14\x6C\xC1\x5F\x54\x4B\x92\x55\xB4\xB7" +- "\x92\x23\x3F\x53\x89\x47\x8E\x1F\x8B\xB9\xDB\x3B\x93\xE8\x70\xE4" +- "\x24\xB8\x9D\xF0\x0E\x35\x28\xF8\x7A\x27\x5D\xF7\x25\x97\x9C\xF5" +- "\x9F\x9F\x64\x04\xF2\xA3\xAB\x11\x15\xB6\xDA\x18\xD6\x46\xD5\xE6" +- "\xB8\x08\xDE\x0A\x62\xFD\xF8\xAA\x52\x90\xD9\x67\x29\xB2\xCD\x06" +- "\xB6\xB0\x50\x2B\x3F\x0F\xA3\xA5\xBF\xAA\x6E\x40\x03\xD6\x5F\x02" +- "\xBC\xD8\x18\x47\x97\x09\xD7\xE4\x96\x3B\xCB\xEB\x92\x2C\x3C\x49" +- "\xFF\x1F\x71\xE0\x52\x94\x0F\x8B\x9F\xB8\x2A\xBB\x9C\xE2\xA3\xDD" +- "\x38\x89\xE2\xB1\x0B\x9E\x1F\x7A\xB3\xE3\xD2\xB0\x94\xDC\x87\xBE" +- "\x37\xA6\xD3\xB3\x29\x35\x9A\x72\xC3\x7A\xF1\xA9\xE6\xC5\xD1\x26" +- "\x83\x65\x44\x17\xBA\x55\xA8\x5E\x94\x26\xED\xE9\x8A\x93\x11\x5D" +- "\x7E\x20\x1B\x9C\x15\x9E\x13\x37\x03\x4D\xDD\x99\x51\xD8\x66\x29" +- "\x6A\xB9\xFB\x49\xFE\x52\x78\xDA\x86\x85\xA9\xA3\xB9\xEF\xEC\xAD" +- "\x35\xA6\x8D\xAC\x0F\x75\x22\xBB\x0B\x49\x1C\x13\x52\x40\xC9\x52" +- "\x69\x09\x54\xD1\x0F\x94\x3F\x22\x48\x67\xB0\x96\x28\xAA\xE6\x28" +- "\xD9\x0C\x08\xEF\x51\xED\x15\x5E\xA2\x53\x59\xA5\x03\xB4\x06\x20" +- "\x3D\xCC\xB4\xC5\xF8\x8C\x73\x67\xA3\x21\x3D\x19\xCD\xD4\x12\x28" +- "\xD2\x93\xDE\x0D\xF0\x71\x10\x50\xD6\x33\x35\x04\x11\x64\x43\x39" +- "\xC3\xDF\x96\xE3\x66\xE3\x85\xCA\xE7\x67\x14\x3A\xF0\x43\xAA\xBB" +- "\xD4\x1D\xB5\x24\xB5\x74\x90\x25\xA7\x87\x7E\xDB\xD3\x83\x8A\x3A" +- "\x69\xA8\x2D\xAF\xB7\xB8\xF3\xDC\x13\xAF\x45\x61\x3F\x59\x39\x7E" +- "\x69\xDE\x0C\x04\xF1\x10\x6B\xB4\x56\xFA\x21\x9F\x72\x2B\x60\x86" +- "\xE3\x23\x0E\xC4\x51\xF6\xBE\xD8\xE1\x5F\xEE\x73\x4C\x17\x4C\x2C" +- "\x1B\xFB\x9F\x1F\x7A\x3B\x07\x5B\x8E\xF1\x01\xAC\xD6\x30\x94\x8A" +- "\x5D\x22\x6F\x08\xCE\xED\x5E\xB6\xDB\x86\x8C\x87\xEB\x8D\x91\xFF" +- "\x0A\x86\x30\xBD\xC0\xF8\x25\xE7\xAE\x24\x35\xF2\xFC\xE5\xFD\x1B" +- "\xB0\x05\x4A\xA3\xE5\xEB\x2E\x05\xAD\x99\x67\x49\x87\xE6\xB3\x87" +- "\x82\xA4\x59\xA7\x6E\xDD\xF2\xB6\x66\xE8\xF7\x70\xF5\xBD\xC9\x0E" +- "\xFA\x9C\x79\x84\xD4\x9B\x05\x0E\xBB\xF5\xDB\xEF\xFC\xCC\x26\xF2" +- "\x93\xCF\xD2\x04\x3C\xA9\x2C\x65\x42\x97\x86\xD8\x38\x0A\x1E\xF6" +- "\xD6\xCA\x30\xB5\x1A\xEC\xFB\xBA\x3B\x84\x57\xB0\xFD\xFB\xE6\xBC" +- "\xF2\x76\xF6\x4C\xBB\xAB\xB1\x31\xA1\x27\x7C\xE6\xE6\x81\xB6\xCE" +- "\x84\x86\x40\xB6\x40\x33\xC4\xF8\xB4\x15\xCF\xAA\xA5\x51\x78\xB9" +- "\x8B\x50\x25\xB2\x88\x86\x96\x72\x8C\x71\x4D\xB5\x3A\x94\x86\x77" +- "\x0E\x95\x9B\x16\x93\xEF\x3A\x11\x79\xBA\x83\xF7\x74\xD3\x8D\xBA" +- "\x15\xE1\x2C\x04\x57\xA8\x92\x1E\x9D\x00\x8E\x20\xFD\x30\x70\xE7" +- "\xF5\x65\x2F\x19\x0C\x94\xBA\x03\x71\x12\x96\xCD\xC8\xB4\x96\xDB" +- "\xCE\x19\xC2\xDF\x3C\xC2\xF6\x3D\x53\xED\x98\xA5\x41\x72\x2A\x22" +- "\x7B\xF3\x2B\x17\x6C\xE1\x39\x7D\xAE\x9B\x11\xF9\xC1\xA6\x9E\x9F" +- "\x89\x3C\x12\xAA\x94\x74\xA7\x4F\x70\xE8\xB9\xDE\x04\xF0\x9D\x39" +- "\x24\x2D\x92\xE8\x46\x2D\x2E\xF0\x40\x66\x1A\xD9\x27\xF9\x98\xF1" +- "\x81\x1D\x70\x62\x63\x30\x6D\xCD\x84\x04\x5F\xFA\x83\xD3\xEC\x8D" +- "\x86\xFB\x40\x61\xC1\x8A\x45\xFF\x7B\xD9\xD4\x18\x61\x7F\x51\xE3" +- "\xFC\x1E\x18\xF0\xAF\xC6\x18\x2C\xE1\x6D\x5D\xF9\x62\xFC\x20\xA3" +- "\xB2\x8A\x5F\xE5\xBB\x29\x0F\x99\x63\x07\x88\x38\x3A\x3B\x73\x2A" +- "\x6D\xDA\x3D\xA8\x0D\x8F\x56\x41\x89\x82\xE5\xB8\x61\x00\x64\x7D" +- "\x17\x0C\xCE\x03\x55\x8F\xF4\x5B\x0D\x50\xF2\xEB\x05\x67\xBE\xDB" +- "\x7B\x75\xC5\xEA\xA1\xAB\x1D\xB0\x3C\x6D\x42\x08\x0B\x9A\x45\x20" +- "\xA8\x8F\xE5\x67\x47\x30\xDE\x93\x5F\x43\x05\xEB\xA8\x2D\x80\xF5" +- "\x1A\xB8\x4A\x4E\x42\x2D\x0B\x7A\xDC\x46\x20\x2D\x13\x17\xDD\x4B" +- "\x94\x96\xAA\x1F\x06\x0C\x1F\x62\x07\x9C\x40\xA1" ++ .length = 1307, .data = ++ "\x61\x82\x05\x17\x30\x82\x05\x13\xA0\x03\x02\x01\x05\xA1\x0F\x1B" ++ "\x0D\x57\x32\x30\x32\x32\x2D\x4C\x37\x2E\x42\x41\x53\x45\xA2\x2A" ++ "\x30\x28\xA0\x03\x02\x01\x01\xA1\x21\x30\x1F\x1B\x04\x63\x69\x66" ++ "\x73\x1B\x17\x77\x32\x30\x32\x32\x2D\x31\x31\x38\x2E\x77\x32\x30" ++ "\x32\x32\x2D\x6C\x37\x2E\x62\x61\x73\x65\xA3\x82\x04\xCD\x30\x82" ++ "\x04\xC9\xA0\x03\x02\x01\x12\xA1\x03\x02\x01\x05\xA2\x82\x04\xBB" ++ "\x04\x82\x04\xB7\x44\x5C\x7B\x5A\x3F\x2E\xA3\x50\x34\xDE\xB0\x69" ++ "\x23\x2D\x47\x89\x2C\xC0\xA3\xF9\xDD\x70\xAA\xA5\x1E\xFE\x74\xE5" ++ "\x19\xA2\x4F\x65\x6C\x9E\x00\xB4\x60\x00\x7C\x0C\x29\x43\x31\x99" ++ "\x77\x02\x73\xED\xB9\x40\xF5\xD2\xD1\xC9\x20\x0F\xE3\x38\xF9\xCC" ++ "\x5E\x2A\xBD\x1F\x91\x66\x1A\xD8\x2A\x80\x3C\x2C\x00\x3C\x1E\xC9" ++ "\x2A\x29\x19\x19\x96\x18\x54\x03\x97\x8F\x1D\x5F\xDB\xE9\x66\x68" ++ "\xCD\xB1\xD5\x00\x35\x69\x49\x45\xF1\x6A\x78\x7B\x37\x71\x87\x14" ++ "\x1C\x98\x4D\x69\xCB\x1B\xD8\xF5\xA3\xD8\x53\x4A\x75\x76\x62\xBA" ++ "\x6C\x3F\xEA\x8B\x97\x21\xCA\x8A\x46\x4B\x38\xDA\x09\x9F\x5A\xC8" ++ "\x38\xFF\x34\x97\x5B\xA2\xE5\xBA\xC9\x87\x17\xD8\x08\x05\x7A\x83" ++ "\x04\xD6\x02\x8E\x9B\x18\xB6\x40\x1A\xF7\x47\x25\x24\x3E\x37\x1E" ++ "\xF6\xC1\x3A\x1F\xCA\xB3\x43\x5A\xAE\x94\x83\x31\xAF\xFB\xEE\xED" ++ "\x46\x71\xEF\xE2\x37\x37\x15\xFE\x1B\x0B\x9E\xF8\x3E\x0C\x43\x96" ++ "\xB6\x0A\x04\x78\xF8\x5E\xAA\x33\x1F\xE2\x07\x5A\x8D\xC4\x4E\x32" ++ "\x6D\xD6\xA0\xC5\xEA\x3D\x12\x59\xD4\x41\x40\x4E\xA1\xD8\xBE\xED" ++ "\x17\xCB\x68\xCC\x59\xCB\x53\xB2\x0E\x58\x8A\xA9\x33\x7F\x6F\x2B" ++ "\x37\x89\x08\x44\xBA\xC7\x67\x17\xBB\x91\xF7\xC3\x0F\x00\xF8\xAA" ++ "\xA1\x33\xA6\x08\x47\xCA\xFA\xE8\x49\x27\x45\x46\xF1\xC1\xC3\x5F" ++ "\xE2\x45\x0A\x7D\x64\x52\x8C\x2E\xE1\xDE\xFF\xB2\x64\xEC\x69\x98" ++ "\x15\xDF\x9E\xB1\xEB\xD6\x9D\x08\x06\x4E\x73\xC1\x0B\x71\x21\x05" ++ "\x9E\xBC\xA2\x17\xCF\xB3\x70\xF4\xEF\xB8\x69\xA9\x94\x27\xFD\x5E" ++ "\x72\xB1\x2D\xD2\x20\x1B\x57\x80\xAB\x38\x97\xCF\x22\x68\x4F\xB8" ++ "\xB7\x17\x53\x25\x67\x0B\xED\xD1\x58\x20\x0D\x45\xF9\x09\xFA\xE7" ++ "\x61\x3E\xDB\xC2\x59\x7B\x3A\x3B\x59\x81\x51\xAA\xA4\x81\xF4\x96" ++ "\x3B\xE1\x6F\x6F\xF4\x8E\x68\x9E\xBA\x1E\x0F\xF2\x44\x68\x11\xFC" ++ "\x2B\x5F\xBE\xF2\xEA\x07\x80\xB9\xCA\x9E\x41\xBD\x2F\x81\xF5\x11" ++ "\x2A\x12\xF3\x4F\xD6\x12\x16\x0F\x21\x90\xF1\xD3\x1E\xF1\xA4\x94" ++ "\x46\xEA\x30\xF3\x84\x06\xC1\xA4\x51\xFC\x43\x35\xBD\xEF\x4D\x89" ++ "\x1D\xA5\x44\xB2\x69\xC4\x0F\xBF\x86\x01\x08\x44\x77\xD5\xB4\xB7" ++ "\x5C\x3F\xA7\xD4\x2F\x39\x73\x85\x88\xEE\xB1\x64\x1D\x80\x6C\xEE" ++ "\x6E\x31\x90\x92\x0D\xA1\xB7\xC4\x5C\xCC\xEE\x91\xC8\xCB\x11\x2D" ++ "\x4A\x1A\x7D\x43\x8F\xEB\x60\x09\xED\x1B\x07\x58\xBE\xBC\xBD\x29" ++ "\xF3\xB3\xA3\x4F\xC5\x8A\x30\x33\xB9\xA9\x9F\x43\x08\x27\x15\xC4" ++ "\x9C\x5D\x8E\xBD\x5C\x05\xC6\x05\x9C\x87\x60\x08\x1E\xE2\x52\xB8" ++ "\x45\x8D\x28\xB6\x2C\x15\x46\x74\x9F\x0E\xAA\x6B\x70\x3A\x2A\x55" ++ "\x45\x26\xB2\x58\x4D\x35\xA6\xF1\x96\xBE\x60\xB2\x71\x7B\xF8\x54" ++ "\xB9\x90\x21\x8E\xB9\x0F\x35\x98\x5E\x88\xEB\x1A\x53\xB4\x59\x7F" ++ "\xAF\x69\x1C\x61\x67\xF4\xF6\xBD\xAC\x24\xCD\xB7\xA9\x67\xE8\xA1" ++ "\x83\x85\x5F\x11\x74\x1F\xF7\x4C\x78\x36\xEF\x50\x74\x88\x58\x4B" ++ "\x1A\x9F\x84\x9A\x9A\x05\x92\xEC\x1D\xD5\xF3\xC4\x95\x51\x28\xE2" ++ "\x3F\x32\x87\xB2\xFD\x21\x27\x66\xE4\x6B\x85\x2F\xDC\x7B\xC0\x22" ++ "\xEB\x7A\x94\x20\x5A\x7B\xD3\x7A\xB9\x5B\xF8\x1A\x5A\x84\x4E\xA1" ++ "\x73\x41\x53\xD2\x60\xF7\x7C\xEE\x68\x59\x85\x80\xFC\x3D\x70\x4B" ++ "\x04\x32\xE7\xF2\xFD\xBD\xB3\xD9\x21\xE2\x37\x56\xA2\x16\xCC\xDE" ++ "\x8A\xD3\xBC\x71\xEF\x58\x19\x0E\x45\x8A\x5B\x53\xD6\x77\x30\x6A" ++ "\xA7\xF8\x68\x06\x4E\x07\xCA\xCE\x30\xD7\x35\xAB\x1A\xC7\x18\xD4" ++ "\xC6\x2F\x1A\xFF\xE9\x7A\x94\x0B\x76\x5E\x7E\x29\x0C\xE6\xD3\x3B" ++ "\x5B\x44\x96\xA8\xF1\x29\x23\x95\xD9\x79\xB3\x39\xFC\x76\xED\xE1" ++ "\x1E\x67\x4E\xF7\xE8\x7B\x7A\x12\x9E\xD8\x4B\x35\x09\x0A\xF2\xC1" ++ "\x63\x5B\xEE\xFD\x2A\xC2\xA6\x66\x30\x3C\x1F\x95\xAF\x65\x22\x95" ++ "\x14\x1D\xF5\xD5\xDC\x38\x79\x35\x1C\xCD\x24\x47\xE0\xFD\x08\xC8" ++ "\xF4\x15\x55\x9F\xD9\xC7\xAC\x3F\x67\xB3\x4F\xEB\x26\x7C\x8E\xD6" ++ "\x74\xB3\x0A\xCD\xE7\xFA\xBE\x7E\xA3\x3E\xEC\x61\x50\x77\x52\x56" ++ "\xCF\x90\x5D\x48\xFB\xD4\x2C\x6C\x61\x8B\xDD\x2B\xF5\x92\x1F\x30" ++ "\xBF\x3F\x80\x0D\x31\xDB\xB2\x0B\x7D\x84\xE3\xA6\x42\x7F\x00\x38" ++ "\x44\x02\xC5\xB8\xD9\x58\x29\x9D\x68\x5C\x32\x8B\x76\xAE\xED\x15" ++ "\xF9\x7C\xAE\x7B\xB6\x8E\xD6\x54\x24\xFF\xFA\x87\x05\xEF\x15\x08" ++ "\x5E\x4B\x21\xA2\x2F\x49\xE7\x0F\xC3\xD0\xB9\x49\x22\xEF\xD5\xCA" ++ "\xB2\x11\xF2\x17\xB6\x77\x24\x68\x76\xB2\x07\xF8\x0A\x73\xDD\x65" ++ "\x9C\x75\x64\xF7\xA1\xC6\x23\x08\x84\x72\x3E\x54\x2E\xEB\x9B\x40" ++ "\xA6\x83\x87\xEB\xB5\x00\x40\x4F\xE1\x72\x2A\x59\x3A\x06\x60\x29" ++ "\x7E\x25\x2F\xD8\x80\x40\x8C\x59\xCA\xCF\x8E\x44\xE4\x2D\x84\x7E" ++ "\xCB\xFD\x1E\x3B\xD5\xFF\x9A\xB9\x66\x93\x6D\x5E\xC8\xB7\x13\x26" ++ "\xD6\x38\x1B\x2B\xE1\x87\x96\x05\xD5\xF3\xAB\x68\xF7\x12\x62\x2C" ++ "\x58\xC1\xC9\x85\x3C\x72\xF1\x26\xEE\xC0\x09\x5F\x1D\x4B\xAC\x01" ++ "\x41\xC8\x12\xF8\xF3\x93\x43\x41\xFF\xEC\x0B\x80\xE2\xEE\x20\x85" ++ "\x25\xCD\x6C\x30\x8C\x0D\x24\x2E\xBA\x19\xEA\x28\x7F\xCF\xD5\x10" ++ "\x5C\xE9\xB2\x9D\x5F\x16\xE4\xC0\xF3\xCC\xD9\x68\x4A\x05\x08\x70" ++ "\x17\x26\xC8\x5C\x4A\xBF\x94\x6A\x0E\xD5\xDA\x67\x47\x4B\xAF\x44" ++ "\xE3\x94\xAA\x05\xDB\xA2\x49\x74\xFA\x5C\x69\xAB\x44\xB7\xF7\xBA" ++ "\xAE\x7A\x23\x87\xEB\x54\x7E\x80\xF1\x5B\x60\xA5\x93\xE5\xD4\x24" ++ "\x84\xF7\x0A\x16\x10\xBE\xE9\x4D\xD8\x6B\x15\x40\x5D\x74\xDA\x1B" ++ "\xFF\x2E\x4D\x17\x9D\x35\xF7\x0D\xCF\x66\x38\x0D\x8A\xE4\xDD\x6B" ++ "\xE1\x0F\x1F\xBD\xFD\x4F\x30\x37\x3F\x96\xB4\x92\x54\xD3\x9A\x7A" ++ "\xD1\x5B\x5B\xA9\x54\x16\xE6\x24\xAB\xD4\x23\x39\x7D\xD2\xC7\x09" ++ "\xFA\xD4\x86\x55\x4D\x60\xC2\x87\x67\x6B\xE6" + }; + + static void +@@ -686,7 +710,7 @@ test_pac_ticket_signature(krb5_context context) + { + krb5_error_code ret; + krb5_ticket *ticket; +- krb5_principal sprinc; ++ krb5_principal cprinc, sprinc; + krb5_authdata **authdata1, **authdata2; + krb5_pac pac, pac2, pac3; + uint32_t *list; +@@ -701,7 +725,13 @@ test_pac_ticket_signature(krb5_context context) + if (ret) + err(context, ret, "while decrypting ticket"); + +- ret = krb5_parse_name(context, "s1@CDOM.COM", &sprinc); ++ ret = krb5_parse_name(context, "administrator@W2022-L7.BASE", &cprinc); ++ if (ret) ++ err(context, ret, "krb5_parse_name"); ++ ++ ret = krb5_parse_name(context, ++ "cifs/w2022-118.w2022-l7.base@W2022-L7.BASE", ++ &sprinc); + if (ret) + err(context, ret, "krb5_parse_name"); + +@@ -713,7 +743,7 @@ test_pac_ticket_signature(krb5_context context) + + /* In this test, the server is also the client. */ + ret = krb5_pac_verify(context, pac, ticket->enc_part2->times.authtime, +- ticket->server, NULL, NULL); ++ cprinc, NULL, NULL); + if (ret) + err(context, ret, "while verifying PAC client info"); + +@@ -722,7 +752,7 @@ test_pac_ticket_signature(krb5_context context) + ticket->enc_part2->authorization_data = NULL; + + ret = krb5_kdc_sign_ticket(context, ticket->enc_part2, pac, sprinc, +- sprinc, &ticket_sig_server_key, ++ cprinc, &ticket_sig_server_key, + &ticket_sig_krbtgt_key, FALSE); + if (ret) + err(context, ret, "while signing ticket"); +@@ -781,6 +811,7 @@ test_pac_ticket_signature(krb5_context context) + krb5_pac_free(context, pac); + krb5_pac_free(context, pac2); + krb5_pac_free(context, pac3); ++ krb5_free_principal(context, cprinc); + krb5_free_principal(context, sprinc); + krb5_free_ticket(context, ticket); + } +diff --git a/src/tests/t_authdata.py b/src/tests/t_authdata.py +index 47ea9e4b47..e934799268 100644 +--- a/src/tests/t_authdata.py ++++ b/src/tests/t_authdata.py +@@ -11,7 +11,7 @@ realm = K5Realm(krb5_conf=conf) + # container. + mark('baseline authdata') + out = realm.run(['./adata', realm.host_princ]) +-if '?128: [6, 7, 10, 16]' not in out or '^-42: Hello' not in out: ++if '?128: [6, 7, 10, 16, 19]' not in out or '^-42: Hello' not in out: + fail('expected authdata not seen for basic request') + + # Requested authdata is copied into the ticket, with KDC-only types +@@ -243,7 +243,7 @@ out = realm.run(['./adata', '-p', realm.user_princ, 'service/2']) + if '+97: [indcl]' not in out or '[inds1]' in out: + fail('correct auth-indicator not seen for S4U2Proxy req') + # Make sure a PAC with an S4U_DELEGATION_INFO(11) buffer is included. +-if '?128: [1, 6, 7, 10, 11, 16]' not in out: ++if '?128: [1, 6, 7, 10, 11, 16, 19]' not in out: + fail('PAC with delegation info not seen for S4U2Proxy req') + + # Get another S4U2Proxy ticket including request-authdata. +-- +2.39.1 + diff --git a/krb5.spec b/krb5.spec index 3592f20..7800eea 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 8 +%global baserelease 9 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -75,6 +75,7 @@ Patch13: 0013-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch Patch14: 0014-downstream-Include-missing-OpenSSL-FIPS-header.patch Patch15: 0015-downstream-Do-not-set-root-as-ksu-file-owner.patch Patch16: 0016-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch +Patch17: 0017-Add-PAC-full-checksums.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -711,6 +712,10 @@ exit 0 %{_datarootdir}/%{name}-tests/ %changelog +* Tue Jan 31 2023 Julien Rische - 1.20.1-9 +- Add support for MS-PAC extended KDC signature (CVE-2022-37967) +- Resolves: rhbz#2166001 + * Mon Jan 30 2023 Julien Rische - 1.20.1-8 - Bypass FIPS restrictions to use KRB5KDF in case AES SHA-1 HMAC is enabled - Lazily load MD4/5 from OpenSSL if using RADIUS or RC4 enctype in FIPS mode From 0b340d0ef341c3e83f88fd931ea21d24eb9cd051 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Mon, 12 Jun 2023 16:21:32 +0200 Subject: [PATCH 083/103] New upstream version (1.21) Do not disable PKINIT if some of the well-known DH groups are unavailable Resolves: rhbz#2214297 Make PKINIT CMS SHA-1 signature verification available in FIPS mode Resolves: rhbz#2214300 Allow to set PAC ticket signature as optional Resolves: rhbz#2181311 Add support for MS-PAC extended KDC signature (CVE-2022-37967) Resolves: rhbz#2166001 Fix syntax error in aclocal.m4 Resolves: rhbz#2143306 Signed-off-by: Julien Rische --- .gitignore | 2 + 0001-downstream-ksu-pam-integration.patch | 10 +- 0002-downstream-SELinux-integration.patch | 38 +- ...ownstream-fix-debuginfo-with-y.tab.c.patch | 4 +- 0004-downstream-Remove-3des-support.patch | 172 ++--- ...am-FIPS-with-PRNG-and-RADIUS-and-MD4.patch | 8 +- ...-krad-UDP-TCP-localhost-connection-w.patch | 7 +- ...-variable-for-default-PKCS-11-module.patch | 201 ------ ...tests-compatible-with-sssd_krb5_loca.patch | 4 +- ...asonable-supportedCMSTypes-in-PKINIT.patch | 159 ----- ...-Include-missing-OpenSSL-FIPS-header.patch | 4 +- 0009-Simplify-plugin-loading-code.patch | 622 ---------------- ...am-Do-not-set-root-as-ksu-file-owner.patch | 4 +- ...rror-checking-for-OpenSSL-CMS_verify.patch | 48 -- ...low-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch | 4 +- ...-to-set-PAC-ticket-signature-as-opti.patch | 279 ++++++++ ...-SHA-1-digest-disallowed-error-for-P.patch | 28 - 0012-Add-and-use-ts_interval-helper.patch | 239 ------- ...PKINIT-CMS-SHA-1-signature-verificat.patch | 47 ++ ...T-if-at-least-one-group-is-available.patch | 218 ++++++ 0017-Add-PAC-full-checksums.patch | 672 ------------------ krb5-tests | 5 +- krb5.spec | 165 +++-- sources | 4 +- 24 files changed, 768 insertions(+), 2176 deletions(-) delete mode 100644 0007-Add-configure-variable-for-default-PKCS-11-module.patch rename 0013-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch => 0007-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch (94%) delete mode 100644 0008-Set-reasonable-supportedCMSTypes-in-PKINIT.patch rename 0014-downstream-Include-missing-OpenSSL-FIPS-header.patch => 0008-downstream-Include-missing-OpenSSL-FIPS-header.patch (98%) delete mode 100644 0009-Simplify-plugin-loading-code.patch rename 0015-downstream-Do-not-set-root-as-ksu-file-owner.patch => 0009-downstream-Do-not-set-root-as-ksu-file-owner.patch (93%) delete mode 100644 0010-Update-error-checking-for-OpenSSL-CMS_verify.patch rename 0016-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch => 0010-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch (98%) create mode 100644 0011-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch delete mode 100644 0011-downstream-Catch-SHA-1-digest-disallowed-error-for-P.patch delete mode 100644 0012-Add-and-use-ts_interval-helper.patch create mode 100644 0012-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch create mode 100644 0013-Enable-PKINIT-if-at-least-one-group-is-available.patch delete mode 100644 0017-Add-PAC-full-checksums.patch diff --git a/.gitignore b/.gitignore index 7fa0027..7db6eaa 100644 --- a/.gitignore +++ b/.gitignore @@ -202,3 +202,5 @@ /krb5-1.19.2.tar.gz.asc /krb5-1.20.1.tar.gz /krb5-1.20.1.tar.gz.asc +/krb5-1.21.tar.gz +/krb5-1.21.tar.gz.asc diff --git a/0001-downstream-ksu-pam-integration.patch b/0001-downstream-ksu-pam-integration.patch index 2b737c0..d33704a 100644 --- a/0001-downstream-ksu-pam-integration.patch +++ b/0001-downstream-ksu-pam-integration.patch @@ -1,4 +1,4 @@ -From 37d69135d0be7f46732c401cdbb3abc075bf4117 Mon Sep 17 00:00:00 2001 +From 67c82a09c6c53713c281045cd55de2720cd06907 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:29:58 -0400 Subject: [PATCH] [downstream] ksu pam integration @@ -30,7 +30,7 @@ Last-updated: krb5-1.18-beta1 create mode 100644 src/clients/ksu/pam.h diff --git a/src/aclocal.m4 b/src/aclocal.m4 -index 9920476f91..bf9da35bbc 100644 +index 3d66a876b3..ce3c5a9bac 100644 --- a/src/aclocal.m4 +++ b/src/aclocal.m4 @@ -1458,3 +1458,72 @@ if test "$with_ldap" = yes; then @@ -760,10 +760,10 @@ index 0000000000..0ab76569cb +void appl_pam_cleanup(void); +#endif diff --git a/src/configure.ac b/src/configure.ac -index f03028b5fd..aa970b0447 100644 +index 77be7a2025..587221936e 100644 --- a/src/configure.ac +++ b/src/configure.ac -@@ -1400,6 +1400,8 @@ AC_SUBST([VERTO_VERSION]) +@@ -1399,6 +1399,8 @@ AC_SUBST([VERTO_VERSION]) AC_PATH_PROG(GROFF, groff) @@ -773,5 +773,5 @@ index f03028b5fd..aa970b0447 100644 if test "${localedir+set}" != set; then localedir='$(datadir)/locale' -- -2.38.1 +2.40.1 diff --git a/0002-downstream-SELinux-integration.patch b/0002-downstream-SELinux-integration.patch index 4271d66..840c2a3 100644 --- a/0002-downstream-SELinux-integration.patch +++ b/0002-downstream-SELinux-integration.patch @@ -1,4 +1,4 @@ -From c6b58ed180ed91b579d322ff5004f68750f1eb4f Mon Sep 17 00:00:00 2001 +From dfbac76ab7bb7e6e2c3171eefcaa93573e6b630e Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:30:53 -0400 Subject: [PATCH] [downstream] SELinux integration @@ -69,7 +69,7 @@ Last-updated: krb5-1.20.1 create mode 100644 src/util/support/selinux.c diff --git a/src/aclocal.m4 b/src/aclocal.m4 -index bf9da35bbc..01283f482e 100644 +index ce3c5a9bac..3331970930 100644 --- a/src/aclocal.m4 +++ b/src/aclocal.m4 @@ -85,6 +85,7 @@ AC_SUBST_FILE(libnodeps_frag) @@ -133,10 +133,10 @@ index bf9da35bbc..01283f482e 100644 +AC_SUBST(SELINUX_LIBS) +])dnl diff --git a/src/build-tools/krb5-config.in b/src/build-tools/krb5-config.in -index dead0dddce..fef3e054fc 100755 +index 8e6eb86601..7677f37359 100755 --- a/src/build-tools/krb5-config.in +++ b/src/build-tools/krb5-config.in -@@ -41,6 +41,7 @@ DL_LIB='@DL_LIB@' +@@ -40,6 +40,7 @@ DL_LIB='@DL_LIB@' DEFCCNAME='@DEFCCNAME@' DEFKTNAME='@DEFKTNAME@' DEFCKTNAME='@DEFCKTNAME@' @@ -144,7 +144,7 @@ index dead0dddce..fef3e054fc 100755 LIBS='@LIBS@' GEN_LIB=@GEN_LIB@ -@@ -254,7 +255,7 @@ if test -n "$do_libs"; then +@@ -253,7 +254,7 @@ if test -n "$do_libs"; then fi # If we ever support a flag to generate output suitable for static @@ -175,10 +175,10 @@ index a0c60c70b3..7eaa2f351c 100644 GSS_LIBS = $(GSS_KRB5_LIB) # needs fixing if ever used on macOS! diff --git a/src/configure.ac b/src/configure.ac -index aa970b0447..40545f2bfc 100644 +index 587221936e..69be9030f8 100644 --- a/src/configure.ac +++ b/src/configure.ac -@@ -1402,6 +1402,8 @@ AC_PATH_PROG(GROFF, groff) +@@ -1401,6 +1401,8 @@ AC_PATH_PROG(GROFF, groff) KRB5_WITH_PAM @@ -188,7 +188,7 @@ index aa970b0447..40545f2bfc 100644 if test "${localedir+set}" != set; then localedir='$(datadir)/locale' diff --git a/src/include/k5-int.h b/src/include/k5-int.h -index 44dc1eeb3f..c3aecba7d4 100644 +index 2f7791b775..9c534faa8a 100644 --- a/src/include/k5-int.h +++ b/src/include/k5-int.h @@ -128,6 +128,7 @@ typedef unsigned char u_char; @@ -238,7 +238,7 @@ index 0000000000..dfaaa847cb +#endif +#endif diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin -index c0194c3c94..7e1dea2cbf 100644 +index 9c76780181..dd6430ece8 100644 --- a/src/include/krb5/krb5.hin +++ b/src/include/krb5/krb5.hin @@ -87,6 +87,12 @@ @@ -290,10 +290,10 @@ index a89b5144f6..4d6cc0bdf9 100644 com_err(progname, errno, _("while creating 'ok' file, '%s'"), file_ok); goto cleanup; diff --git a/src/kdc/main.c b/src/kdc/main.c -index 38b9299066..085afc9220 100644 +index bfdfef5c48..b43fe9a082 100644 --- a/src/kdc/main.c +++ b/src/kdc/main.c -@@ -848,7 +848,7 @@ write_pid_file(const char *path) +@@ -844,7 +844,7 @@ write_pid_file(const char *path) FILE *file; unsigned long pid; @@ -303,7 +303,7 @@ index 38b9299066..085afc9220 100644 return errno; pid = (unsigned long) getpid(); diff --git a/src/kprop/kpropd.c b/src/kprop/kpropd.c -index f2341d720f..ffdac9f397 100644 +index aa3c81ea30..cb9785aaeb 100644 --- a/src/kprop/kpropd.c +++ b/src/kprop/kpropd.c @@ -488,6 +488,9 @@ doit(int fd) @@ -333,10 +333,10 @@ index f2341d720f..ffdac9f397 100644 KRB5_LOCKMODE_EXCLUSIVE | KRB5_LOCKMODE_DONTBLOCK); if (retval) { diff --git a/src/lib/kadm5/logger.c b/src/lib/kadm5/logger.c -index c6885edf2a..9aec3c05e8 100644 +index e14da53790..b879a4049b 100644 --- a/src/lib/kadm5/logger.c +++ b/src/lib/kadm5/logger.c -@@ -309,7 +309,7 @@ krb5_klog_init(krb5_context kcontext, char *ename, char *whoami, krb5_boolean do +@@ -310,7 +310,7 @@ krb5_klog_init(krb5_context kcontext, char *ename, char *whoami, krb5_boolean do */ append = (cp[4] == ':') ? O_APPEND : 0; if (append || cp[4] == '=') { @@ -345,7 +345,7 @@ index c6885edf2a..9aec3c05e8 100644 S_IRUSR | S_IWUSR | S_IRGRP); if (fd != -1) f = fdopen(fd, append ? "a" : "w"); -@@ -776,7 +776,7 @@ krb5_klog_reopen(krb5_context kcontext) +@@ -777,7 +777,7 @@ krb5_klog_reopen(krb5_context kcontext) * In case the old logfile did not get moved out of the * way, open for append to prevent squashing the old logs. */ @@ -439,10 +439,10 @@ index e510211fc5..f3ea28c8ec 100644 goto report_errno; writevno = 1; diff --git a/src/lib/krb5/os/trace.c b/src/lib/krb5/os/trace.c -index 3369fc4ba6..95f82cda03 100644 +index 4cbbbb270a..c4058ddc96 100644 --- a/src/lib/krb5/os/trace.c +++ b/src/lib/krb5/os/trace.c -@@ -459,7 +459,7 @@ krb5_set_trace_filename(krb5_context context, const char *filename) +@@ -460,7 +460,7 @@ krb5_set_trace_filename(krb5_context context, const char *filename) fd = malloc(sizeof(*fd)); if (fd == NULL) return ENOMEM; @@ -452,7 +452,7 @@ index 3369fc4ba6..95f82cda03 100644 free(fd); return errno; diff --git a/src/plugins/kdb/db2/adb_openclose.c b/src/plugins/kdb/db2/adb_openclose.c -index 7db30a33b0..2b9d01921d 100644 +index 9a506e9d44..f92ab47143 100644 --- a/src/plugins/kdb/db2/adb_openclose.c +++ b/src/plugins/kdb/db2/adb_openclose.c @@ -152,7 +152,7 @@ osa_adb_init_db(osa_adb_db_t *dbp, char *filename, char *lockfilename, @@ -1034,5 +1034,5 @@ index 0000000000..807d039da3 + +#endif /* USE_SELINUX */ -- -2.38.1 +2.40.1 diff --git a/0003-downstream-fix-debuginfo-with-y.tab.c.patch b/0003-downstream-fix-debuginfo-with-y.tab.c.patch index 3c58cc1..40361ac 100644 --- a/0003-downstream-fix-debuginfo-with-y.tab.c.patch +++ b/0003-downstream-fix-debuginfo-with-y.tab.c.patch @@ -1,4 +1,4 @@ -From c7fe7cbd61f7debf052ddcc6cc5f01bb7e4f5385 Mon Sep 17 00:00:00 2001 +From a9c463ed5988c860ebb18de212d6c56da1cb1169 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:49:25 -0400 Subject: [PATCH] [downstream] fix debuginfo with y.tab.c @@ -40,5 +40,5 @@ index 8669c2436c..a22f23c02c 100644 install: $(INSTALL_PROGRAM) $(PROG) ${DESTDIR}$(ADMIN_BINDIR)/$(PROG) -- -2.38.1 +2.40.1 diff --git a/0004-downstream-Remove-3des-support.patch b/0004-downstream-Remove-3des-support.patch index 4ec3a0f..f7b5134 100644 --- a/0004-downstream-Remove-3des-support.patch +++ b/0004-downstream-Remove-3des-support.patch @@ -1,4 +1,4 @@ -From 7b40250066bbcc529b5348b68199c58fbad82376 Mon Sep 17 00:00:00 2001 +From 0691db92e13e0d224c2c9dd72c1421d8f7c3c078 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 26 Mar 2019 18:51:10 -0400 Subject: [PATCH] [downstream] Remove 3des support @@ -32,7 +32,7 @@ Last-updated: 1.20-final src/include/krb5/krb5.hin | 10 +- src/kdc/kdc_util.c | 4 - src/lib/crypto/Makefile.in | 8 +- - src/lib/crypto/builtin/Makefile.in | 6 +- + src/lib/crypto/builtin/Makefile.in | 4 +- src/lib/crypto/builtin/des/ISSUES | 13 - src/lib/crypto/builtin/des/Makefile.in | 82 ---- src/lib/crypto/builtin/des/d3_aead.c | 137 ------ @@ -74,7 +74,7 @@ Last-updated: 1.20-final src/lib/crypto/krb/prf_des.c | 47 --- src/lib/crypto/krb/random_to_key.c | 28 -- src/lib/crypto/libk5crypto.exports | 1 - - src/lib/crypto/openssl/Makefile.in | 8 +- + src/lib/crypto/openssl/Makefile.in | 4 +- src/lib/crypto/openssl/des/Makefile.in | 20 - src/lib/crypto/openssl/des/deps | 14 - src/lib/crypto/openssl/des/des_keys.c | 39 -- @@ -98,18 +98,19 @@ Last-updated: 1.20-final src/plugins/preauth/pkinit/pkinit_crypto.h | 10 +- src/plugins/preauth/pkinit/pkinit_kdf_test.c | 30 -- src/plugins/preauth/spake/t_vectors.c | 25 -- - src/tests/gssapi/t_enctypes.py | 33 +- + src/tests/gssapi/t_enctypes.py | 34 +- src/tests/gssapi/t_invalid.c | 12 - src/tests/gssapi/t_pcontok.c | 16 +- src/tests/gssapi/t_prf.c | 7 - src/tests/t_authdata.py | 2 +- - src/tests/t_etype_info.py | 18 +- + src/tests/t_etype_info.py | 20 +- src/tests/t_keyrollover.py | 8 +- src/tests/t_mkey.py | 35 -- src/tests/t_salt.py | 5 +- + src/tests/t_sesskeynego.py | 8 - src/util/k5test.py | 7 - .../leash/htmlhelp/html/Encryption_Types.htm | 13 - - 89 files changed, 151 insertions(+), 4713 deletions(-) + 90 files changed, 149 insertions(+), 4720 deletions(-) delete mode 100644 src/lib/crypto/builtin/des/ISSUES delete mode 100644 src/lib/crypto/builtin/des/Makefile.in delete mode 100644 src/lib/crypto/builtin/des/d3_aead.c @@ -199,10 +200,10 @@ index 74a0a2acef..846c58ed82 100644 While **aes128-cts** and **aes256-cts** are supported for all Kerberos diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst -index 694922c0d9..c4d5499d3b 100644 +index dce19ad43e..2b4ed7da0b 100644 --- a/doc/admin/enctypes.rst +++ b/doc/admin/enctypes.rst -@@ -129,7 +129,7 @@ enctype weak? krb5 Windows +@@ -146,7 +146,7 @@ enctype weak? krb5 Windows des-cbc-crc weak <1.18 >=2000 des-cbc-md4 weak <1.18 ? des-cbc-md5 weak <1.18 >=2000 @@ -211,7 +212,7 @@ index 694922c0d9..c4d5499d3b 100644 arcfour-hmac deprecated >=1.3 >=2000 arcfour-hmac-exp weak >=1.3 >=2000 aes128-cts-hmac-sha1-96 >=1.3 >=Vista -@@ -148,9 +148,11 @@ default. +@@ -165,9 +165,11 @@ default. krb5 releases 1.17 and later flag deprecated encryption types (including ``des3-cbc-sha1`` and ``arcfour-hmac``) in KDC logs and kadmin output. krb5 release 1.19 issues a warning during initial @@ -247,7 +248,7 @@ index ade5e1f87a..e4dc54f7e5 100644 .. _err_cert_chain_cert_expired: diff --git a/doc/appdev/refs/macros/index.rst b/doc/appdev/refs/macros/index.rst -index a0d4f26701..5f34dea5e8 100644 +index 45fe160d7f..b4b1f3bd93 100644 --- a/doc/appdev/refs/macros/index.rst +++ b/doc/appdev/refs/macros/index.rst @@ -36,7 +36,6 @@ Public @@ -259,10 +260,10 @@ index a0d4f26701..5f34dea5e8 100644 CKSUMTYPE_NIST_SHA.rst CKSUMTYPE_RSA_MD4.rst diff --git a/doc/conf.py b/doc/conf.py -index fa0eb80f1f..12168fa695 100644 +index cd76f5999f..1e1cfce80c 100644 --- a/doc/conf.py +++ b/doc/conf.py -@@ -278,7 +278,7 @@ else: +@@ -281,7 +281,7 @@ else: rst_epilog += ''' .. |krb5conf| replace:: ``/etc/krb5.conf`` .. |defkeysalts| replace:: ``aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal`` @@ -272,7 +273,7 @@ index fa0eb80f1f..12168fa695 100644 .. |copy| unicode:: U+000A9 ''' diff --git a/doc/mitK5features.rst b/doc/mitK5features.rst -index ca2d6ef117..100c64a1c1 100644 +index 10effcf175..cad0855724 100644 --- a/doc/mitK5features.rst +++ b/doc/mitK5features.rst @@ -37,7 +37,7 @@ Database backends: LDAP, DB2, LMDB @@ -307,10 +308,10 @@ index 8f14e9bf2c..ba3bb18eec 100644 ##DOS## $(WCONFIG) config < $@.in > $@ ##DOS##lib\crypto\builtin\camellia\Makefile: lib\crypto\builtin\camellia\Makefile.in $(MKFDEP) diff --git a/src/configure.ac b/src/configure.ac -index 40545f2bfc..8dc864718d 100644 +index 69be9030f8..2561e917a2 100644 --- a/src/configure.ac +++ b/src/configure.ac -@@ -1489,12 +1489,12 @@ V5_AC_OUTPUT_MAKEFILE(. +@@ -1513,12 +1513,12 @@ V5_AC_OUTPUT_MAKEFILE(. lib lib/kdb lib/crypto lib/crypto/krb lib/crypto/crypto_tests @@ -326,7 +327,7 @@ index 40545f2bfc..8dc864718d 100644 lib/krb5 lib/krb5/error_tables lib/krb5/asn.1 lib/krb5/ccache diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin -index 7e1dea2cbf..fb9f2a366c 100644 +index dd6430ece8..350bcf86f2 100644 --- a/src/include/krb5/krb5.hin +++ b/src/include/krb5/krb5.hin @@ -426,8 +426,8 @@ typedef struct _krb5_crypto_iov { @@ -362,10 +363,10 @@ index 7e1dea2cbf..fb9f2a366c 100644 #define CKSUMTYPE_HMAC_SHA1_96_AES128 0x000f /**< RFC 3962. Used with ENCTYPE_AES128_CTS_HMAC_SHA1_96 */ diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c -index 9f2a67d189..b7a9aa4992 100644 +index e54cc751f9..ea10e23a95 100644 --- a/src/kdc/kdc_util.c +++ b/src/kdc/kdc_util.c -@@ -1111,8 +1111,6 @@ enctype_name(krb5_enctype ktype, char *buf, size_t buflen) +@@ -1164,8 +1164,6 @@ enctype_name(krb5_enctype ktype, char *buf, size_t buflen) name = "rsaEncryption-EnvOID"; else if (ktype == ENCTYPE_RSA_ES_OAEP_ENV) name = "id-RSAES-OAEP-EnvOID"; @@ -374,7 +375,7 @@ index 9f2a67d189..b7a9aa4992 100644 else return krb5_enctype_to_name(ktype, FALSE, buf, buflen); -@@ -1704,8 +1702,6 @@ krb5_boolean +@@ -1657,8 +1655,6 @@ krb5_boolean enctype_requires_etype_info_2(krb5_enctype enctype) { switch(enctype) { @@ -414,7 +415,7 @@ index 10e8c74cf8..25c4f40cc3 100644 all-unix: all-liblinks install-unix: install-libs diff --git a/src/lib/crypto/builtin/Makefile.in b/src/lib/crypto/builtin/Makefile.in -index daf19da195..c9e967c807 100644 +index 243bb17ba3..30bfcd30c0 100644 --- a/src/lib/crypto/builtin/Makefile.in +++ b/src/lib/crypto/builtin/Makefile.in @@ -1,6 +1,6 @@ @@ -429,15 +430,6 @@ index daf19da195..c9e967c807 100644 $(srcdir)/kdf.c \ $(srcdir)/pbkdf2.c --STOBJLISTS= des/OBJS.ST md4/OBJS.ST \ -+STOBJLISTS= md4/OBJS.ST \ - md5/OBJS.ST sha1/OBJS.ST sha2/OBJS.ST \ - enc_provider/OBJS.ST \ - hash_provider/OBJS.ST \ -@@ -33,7 +33,7 @@ STOBJLISTS= des/OBJS.ST md4/OBJS.ST \ - camellia/OBJS.ST \ - OBJS.ST - -SUBDIROBJLISTS= des/OBJS.ST md4/OBJS.ST \ +SUBDIROBJLISTS= md4/OBJS.ST \ md5/OBJS.ST sha1/OBJS.ST sha2/OBJS.ST \ @@ -4862,7 +4854,7 @@ index 052f4d4b51..d8ffa63304 100644 krb5int_camellia_encrypt krb5int_cmac_checksum diff --git a/src/lib/crypto/openssl/Makefile.in b/src/lib/crypto/openssl/Makefile.in -index 08de047d0a..88f7fd0a09 100644 +index cf11f6847b..8e4cdb8bbf 100644 --- a/src/lib/crypto/openssl/Makefile.in +++ b/src/lib/crypto/openssl/Makefile.in @@ -1,6 +1,6 @@ @@ -4873,32 +4865,15 @@ index 08de047d0a..88f7fd0a09 100644 LOCALINCLUDES=-I$(srcdir)/../krb $(CRYPTO_IMPL_CFLAGS) STLIBOBJS=\ -@@ -24,14 +24,14 @@ SRCS=\ +@@ -24,7 +24,7 @@ SRCS=\ $(srcdir)/pbkdf2.c \ $(srcdir)/sha256.c --STOBJLISTS= des/OBJS.ST md4/OBJS.ST \ -+STOBJLISTS= md4/OBJS.ST \ - md5/OBJS.ST sha1/OBJS.ST sha2/OBJS.ST \ - enc_provider/OBJS.ST \ - hash_provider/OBJS.ST \ - aes/OBJS.ST \ - OBJS.ST - -SUBDIROBJLISTS= des/OBJS.ST md4/OBJS.ST \ +SUBDIROBJLISTS= md4/OBJS.ST \ md5/OBJS.ST sha1/OBJS.ST sha2/OBJS.ST \ enc_provider/OBJS.ST \ hash_provider/OBJS.ST \ -@@ -42,7 +42,7 @@ includes: depend - - depend: $(SRCS) - --clean-unix:: clean-libobjs -+clean-unix:: clean-libobjsn - - @lib_frag@ - @libobj_frag@ diff --git a/src/lib/crypto/openssl/des/Makefile.in b/src/lib/crypto/openssl/des/Makefile.in deleted file mode 100644 index a6cece1dd1..0000000000 @@ -5244,10 +5219,10 @@ index 41e845eae0..5a43c3d9eb 100644 } diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c -index d4e90793f9..1bc807172b 100644 +index b35e11bfb6..d7c2ad321e 100644 --- a/src/lib/gssapi/krb5/accept_sec_context.c +++ b/src/lib/gssapi/krb5/accept_sec_context.c -@@ -1030,7 +1030,6 @@ kg_accept_krb5(minor_status, context_handle, +@@ -1026,7 +1026,6 @@ kg_accept_krb5(minor_status, context_handle, } switch (negotiated_etype) { @@ -5256,7 +5231,7 @@ index d4e90793f9..1bc807172b 100644 case ENCTYPE_ARCFOUR_HMAC_EXP: /* RFC 4121 accidentally omits RC4-HMAC-EXP as a "not-newer" diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h -index a4446530fc..88d41130a7 100644 +index 7364607198..5aeb69aebc 100644 --- a/src/lib/gssapi/krb5/gssapiP_krb5.h +++ b/src/lib/gssapi/krb5/gssapiP_krb5.h @@ -125,14 +125,14 @@ enum sgn_alg { @@ -5286,10 +5261,10 @@ index a4446530fc..88d41130a7 100644 }; diff --git a/src/lib/gssapi/krb5/k5seal.c b/src/lib/gssapi/krb5/k5seal.c -index d1cdce486f..7f7146a0a2 100644 +index 99275be53a..0e5d10b115 100644 --- a/src/lib/gssapi/krb5/k5seal.c +++ b/src/lib/gssapi/krb5/k5seal.c -@@ -136,19 +136,12 @@ make_seal_token_v1 (krb5_context context, +@@ -142,19 +142,12 @@ make_seal_token_v1 (krb5_context context, /* pad the plaintext, encrypt if needed, and stick it in the token */ @@ -5315,7 +5290,7 @@ index d1cdce486f..7f7146a0a2 100644 code = krb5_c_checksum_length(context, md5cksum.checksum_type, &sumlen); if (code) { -@@ -196,20 +189,8 @@ make_seal_token_v1 (krb5_context context, +@@ -203,20 +196,8 @@ make_seal_token_v1 (krb5_context context, gssalloc_free(t); return(code); } @@ -5327,22 +5302,22 @@ index d1cdce486f..7f7146a0a2 100644 - */ - if (md5cksum.length != cksum_size) - abort (); -- memcpy (ptr+14, md5cksum.contents, md5cksum.length); +- memcpy(checksum, md5cksum.contents, md5cksum.length); - break; - case SGN_ALG_HMAC_MD5: -- memcpy (ptr+14, md5cksum.contents, cksum_size); +- memcpy(checksum, md5cksum.contents, cksum_size); - break; - } + -+ memcpy (ptr+14, md5cksum.contents, cksum_size); ++ memcpy(checksum, md5cksum.contents, cksum_size); krb5_free_checksum_contents(context, &md5cksum); diff --git a/src/lib/gssapi/krb5/k5sealiov.c b/src/lib/gssapi/krb5/k5sealiov.c -index 9bb2ee1099..9147bb2c78 100644 +index 7bf7609a48..d5e12cb436 100644 --- a/src/lib/gssapi/krb5/k5sealiov.c +++ b/src/lib/gssapi/krb5/k5sealiov.c -@@ -144,18 +144,11 @@ make_seal_token_v1_iov(krb5_context context, +@@ -147,18 +147,11 @@ make_seal_token_v1_iov(krb5_context context, /* pad the plaintext, encrypt if needed, and stick it in the token */ /* initialize the checksum */ @@ -5366,20 +5341,20 @@ index 9bb2ee1099..9147bb2c78 100644 code = krb5_c_checksum_length(context, md5cksum.checksum_type, &k5_trailerlen); if (code != 0) -@@ -177,15 +170,7 @@ make_seal_token_v1_iov(krb5_context context, +@@ -182,15 +175,7 @@ make_seal_token_v1_iov(krb5_context context, if (code != 0) goto cleanup; - switch (ctx->signalg) { - case SGN_ALG_HMAC_SHA1_DES3_KD: - assert(md5cksum.length == ctx->cksum_size); -- memcpy(ptr + 14, md5cksum.contents, md5cksum.length); +- memcpy(checksum, md5cksum.contents, md5cksum.length); - break; - case SGN_ALG_HMAC_MD5: -- memcpy(ptr + 14, md5cksum.contents, ctx->cksum_size); +- memcpy(checksum, md5cksum.contents, ctx->cksum_size); - break; - } -+ memcpy(ptr + 14, md5cksum.contents, ctx->cksum_size); ++ memcpy(checksum, md5cksum.contents, ctx->cksum_size); /* create the seq_num */ code = kg_make_seq_num(context, ctx->seq, ctx->initiate ? 0 : 0xFF, @@ -5618,7 +5593,7 @@ index 84f1949887..32150f5e34 100644 case ENCTYPE_ARCFOUR_HMAC_EXP: /* RFC 4121 accidentally omits RC4-HMAC-EXP as a "not-newer" enctype, diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c -index 87b486c53f..2b5abcd817 100644 +index a6c2bbeb54..18290b764b 100644 --- a/src/lib/krb5/krb/init_ctx.c +++ b/src/lib/krb5/krb/init_ctx.c @@ -59,7 +59,6 @@ @@ -5629,7 +5604,7 @@ index 87b486c53f..2b5abcd817 100644 ENCTYPE_ARCFOUR_HMAC, ENCTYPE_CAMELLIA128_CTS_CMAC, ENCTYPE_CAMELLIA256_CTS_CMAC, 0 -@@ -450,8 +449,6 @@ krb5int_parse_enctype_list(krb5_context context, const char *profkey, +@@ -460,8 +459,6 @@ krb5int_parse_enctype_list(krb5_context context, const char *profkey, /* Set all enctypes in the default list. */ for (i = 0; default_list[i]; i++) mod_list(default_list[i], sel, weak, &list); @@ -5769,10 +5744,10 @@ index e3d2846315..586661bb7e 100644 #define CKK_CAST3 (0x17) #define CKK_CAST128 (0x18) diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h -index 94a1b22fb1..65f6210727 100644 +index e22798f668..9fa315d7a0 100644 --- a/src/plugins/preauth/pkinit/pkinit_crypto.h +++ b/src/plugins/preauth/pkinit/pkinit_crypto.h -@@ -376,11 +376,11 @@ krb5_error_code server_process_dh +@@ -370,11 +370,11 @@ krb5_error_code server_process_dh * krb5_algorithm_identifier */ krb5_error_code create_krb5_supportedCMSTypes @@ -5874,10 +5849,10 @@ index 2279202d3a..96b0307d78 100644 /* initial key, w, x, y, T, S, K */ "8846F7EAEE8FB117AD06BDD830B7586C", diff --git a/src/tests/gssapi/t_enctypes.py b/src/tests/gssapi/t_enctypes.py -index 7494d7fcdb..2f95d89967 100755 +index f5f11842e2..1bb8c40b6b 100755 --- a/src/tests/gssapi/t_enctypes.py +++ b/src/tests/gssapi/t_enctypes.py -@@ -1,24 +1,17 @@ +@@ -1,25 +1,17 @@ from k5test import * -# Define some convenience abbreviations for enctypes we will see in @@ -5901,13 +5876,14 @@ index 7494d7fcdb..2f95d89967 100755 # These tests make assumptions about the default enctype lists, so set # them explicitly rather than relying on the library defaults. -supp='aes256-cts:normal aes128-cts:normal des3-cbc-sha1:normal rc4-hmac:normal' --conf = {'libdefaults': {'permitted_enctypes': 'aes des3 rc4'}, +-conf = {'libdefaults': {'permitted_enctypes': 'aes des3 rc4', +- 'allow_des3': 'true', 'allow_rc4': 'true'}, +supp='aes256-cts:normal aes128-cts:normal rc4-hmac:normal' -+conf = {'libdefaults': {'permitted_enctypes': 'aes rc4'}, ++conf = {'libdefaults': {'permitted_enctypes': 'aes rc4', 'allow_rc4': 'true'}, 'realms': {'$realm': {'supported_enctypes': supp}}} realm = K5Realm(krb5_conf=conf) shutil.copyfile(realm.ccache, os.path.join(realm.testdir, 'save')) -@@ -87,19 +80,12 @@ test('both aes128', 'aes128-cts', 'aes128-cts', +@@ -88,19 +80,12 @@ test('both aes128', 'aes128-cts', 'aes128-cts', test_err('acc aes128', None, 'aes128-cts', 'Encryption type aes256-cts-hmac-sha1-96 not permitted') @@ -5928,7 +5904,7 @@ index 7494d7fcdb..2f95d89967 100755 # subkey. test('upgrade noargs', None, None, tktenc=aes256, tktsession=d_rc4, -@@ -115,13 +101,6 @@ test('upgrade init aes128+rc4', 'aes128-cts rc4', None, +@@ -116,13 +101,6 @@ test('upgrade init aes128+rc4', 'aes128-cts rc4', None, tktenc=aes256, tktsession=d_rc4, proto='cfx', isubkey=rc4, asubkey=aes128) @@ -6019,10 +5995,10 @@ index f71774cdc9..d1857c433f 100644 "3BB3AE288C12B3B9D06B208A4151B3B6", "9AEA11A3BCF3C53F1F91F5A0BA2132E2501ADF5F3C28" diff --git a/src/tests/t_authdata.py b/src/tests/t_authdata.py -index 97e2474bf8..47ea9e4b47 100644 +index bde1c36844..8fcd30db51 100644 --- a/src/tests/t_authdata.py +++ b/src/tests/t_authdata.py -@@ -164,7 +164,7 @@ realm.run([kvno, 'restricted']) +@@ -179,7 +179,7 @@ realm.run([kvno, 'restricted']) # preferred krbtgt enctype changes. mark('#8139 regression test') realm.kinit(realm.user_princ, password('user'), ['-f']) @@ -6032,17 +6008,19 @@ index 97e2474bf8..47ea9e4b47 100644 realm.run(['./forward']) realm.run([kvno, realm.host_princ]) diff --git a/src/tests/t_etype_info.py b/src/tests/t_etype_info.py -index c982508d8b..96e90a69d2 100644 +index 38cf96ca8f..e82ff7ff07 100644 --- a/src/tests/t_etype_info.py +++ b/src/tests/t_etype_info.py -@@ -1,6 +1,6 @@ +@@ -1,7 +1,7 @@ from k5test import * -supported_enctypes = 'aes128-cts des3-cbc-sha1 rc4-hmac' +-conf = {'libdefaults': {'allow_des3': 'true', 'allow_rc4': 'true'}, +supported_enctypes = 'aes128-cts rc4-hmac' - conf = {'libdefaults': {'allow_weak_crypto': 'true'}, ++conf = {'libdefaults': {'allow_rc4': 'true'}, 'realms': {'$realm': {'supported_enctypes': supported_enctypes}}} realm = K5Realm(create_host=False, get_creds=False, krb5_conf=conf) + @@ -26,9 +26,9 @@ def test_etinfo(princ, enctypes, expected_lines): # With no newer enctypes in the request, PA-ETYPE-INFO2, # PA-ETYPE-INFO, and PA-PW-SALT appear in the AS-REP, each listing one @@ -6081,7 +6059,7 @@ index c982508d8b..96e90a69d2 100644 # Verify that etype-info2 is included in a MORE_PREAUTH_DATA_REQUIRED # error if the client does optimistic preauth. diff --git a/src/tests/t_keyrollover.py b/src/tests/t_keyrollover.py -index 2c825a6922..f29e0d5500 100755 +index e9840dfae8..583c2fa27e 100755 --- a/src/tests/t_keyrollover.py +++ b/src/tests/t_keyrollover.py @@ -37,9 +37,9 @@ realm.run([klist, '-e'], expected_msg=msg) @@ -6181,24 +6159,50 @@ index 65084bbf35..55ca897459 100755 # Test using different salt types in a principal's key list. # Parameters from one key in the list must not leak over to later ones. +diff --git a/src/tests/t_sesskeynego.py b/src/tests/t_sesskeynego.py +index 5a213617b5..c7dba0ff5b 100755 +--- a/src/tests/t_sesskeynego.py ++++ b/src/tests/t_sesskeynego.py +@@ -26,7 +26,6 @@ conf3 = {'libdefaults': { + 'default_tgs_enctypes': 'rc4-hmac,aes128-cts'}} + conf4 = {'libdefaults': {'permitted_enctypes': 'aes256-cts'}} + conf5 = {'libdefaults': {'allow_rc4': 'true'}} +-conf6 = {'libdefaults': {'allow_des3': 'true'}} + # Test with client request and session_enctypes preferring aes128, but + # aes256 long-term key. + realm = K5Realm(krb5_conf=conf1, create_host=False, get_creds=False) +@@ -78,13 +77,6 @@ realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'rc4-hmac']) + test_kvno(realm, 'DEPRECATED:arcfour-hmac', 'aes256-cts-hmac-sha1-96') + realm.stop() + +-# 6: allow_des3 permits negotiation of des3-cbc-sha1 session key. +-realm = K5Realm(krb5_conf=conf6, create_host=False, get_creds=False) +-realm.run([kadminl, 'addprinc', '-randkey', '-e', 'aes256-cts', 'server']) +-realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'des3-cbc-sha1']) +-test_kvno(realm, 'DEPRECATED:des3-cbc-sha1', 'aes256-cts-hmac-sha1-96') +-realm.stop() +- + # 7: default config negotiates aes256-sha1 session key for RC4-only service. + realm = K5Realm(create_host=False, get_creds=False) + realm.run([kadminl, 'addprinc', '-randkey', '-e', 'rc4-hmac', 'server']) diff --git a/src/util/k5test.py b/src/util/k5test.py -index 619f1995f8..771f82e3cc 100644 +index 8e5f5ba8e9..b953827018 100644 --- a/src/util/k5test.py +++ b/src/util/k5test.py -@@ -1344,13 +1344,6 @@ _passes = [ +@@ -1338,13 +1338,6 @@ _passes = [ # No special settings; exercises AES256. ('default', None, None, None), - # Exercise the DES3 enctype. - ('des3', None, -- {'libdefaults': {'permitted_enctypes': 'des3'}}, +- {'libdefaults': {'permitted_enctypes': 'des3 aes256-sha1'}}, - {'realms': {'$realm': { - 'supported_enctypes': 'des3-cbc-sha1:normal', - 'master_key_type': 'des3-cbc-sha1'}}}), - # Exercise the arcfour enctype. ('arcfour', None, - {'libdefaults': {'permitted_enctypes': 'rc4'}}, + {'libdefaults': {'permitted_enctypes': 'rc4 aes256-sha1'}}, diff --git a/src/windows/leash/htmlhelp/html/Encryption_Types.htm b/src/windows/leash/htmlhelp/html/Encryption_Types.htm index 1aebdd0b4a..c38eefd2bd 100644 --- a/src/windows/leash/htmlhelp/html/Encryption_Types.htm @@ -6224,5 +6228,5 @@ index 1aebdd0b4a..c38eefd2bd 100644 The AES Advanced Encryption Standard family, like 3DES, is a symmetric block cipher and was designed -- -2.38.1 +2.40.1 diff --git a/0005-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch b/0005-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch index ecf661d..e575b79 100644 --- a/0005-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch +++ b/0005-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch @@ -1,4 +1,4 @@ -From 239cd24624b801d4fc4bb4686bef8526e7675d77 Mon Sep 17 00:00:00 2001 +From 53191fd3a1acfeefa8e5c26e7e9d130688daf745 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 9 Nov 2018 15:12:21 -0500 Subject: [PATCH] [downstream] FIPS with PRNG and RADIUS and MD4 @@ -41,10 +41,10 @@ Last-updated: krb5-1.20 15 files changed, 155 insertions(+), 33 deletions(-) diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst -index d5d6e06ebb..2a4962069f 100644 +index ecdf917501..b78a3faf0a 100644 --- a/doc/admin/conf_files/krb5_conf.rst +++ b/doc/admin/conf_files/krb5_conf.rst -@@ -330,6 +330,12 @@ The libdefaults section may contain any of the following relations: +@@ -342,6 +342,12 @@ The libdefaults section may contain any of the following relations: qualification of shortnames, set this relation to the empty string with ``qualify_shortname = ""``. (New in release 1.18.) @@ -608,5 +608,5 @@ index 1a772d450f..232e78bc05 100644 vt->name = "spake"; vt->pa_type_list = pa_types; -- -2.38.1 +2.40.1 diff --git a/0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch b/0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch index b8e5429..68f10a0 100644 --- a/0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch +++ b/0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch @@ -1,8 +1,7 @@ -From 5587c755b6ca82bde093523e2d17b255158cd90e Mon Sep 17 00:00:00 2001 +From c19d0bd35cde40172118c67c38a44f164bce1e16 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Thu, 5 May 2022 17:15:12 +0200 -Subject: [PATCH] [downstream] Allow krad UDP/TCP localhost connection - with FIPS +Subject: [PATCH] [downstream] Allow krad UDP/TCP localhost connection with FIPS libkrad allows to establish connections only to UNIX socket in FIPS mode, because MD5 digest is not considered safe enough to be used for @@ -78,5 +77,5 @@ index 929f1cef67..063f17a613 100644 retval = ESOCKTNOSUPPORT; goto error; -- -2.38.1 +2.40.1 diff --git a/0007-Add-configure-variable-for-default-PKCS-11-module.patch b/0007-Add-configure-variable-for-default-PKCS-11-module.patch deleted file mode 100644 index 1445133..0000000 --- a/0007-Add-configure-variable-for-default-PKCS-11-module.patch +++ /dev/null @@ -1,201 +0,0 @@ -From 842b4c3b5695e2518e6f1a1545db78865c04b59c Mon Sep 17 00:00:00 2001 -From: Julien Rische -Date: Fri, 22 Apr 2022 14:12:37 +0200 -Subject: [PATCH] Add configure variable for default PKCS#11 module - -[ghudson@mit.edu: added documentation of configure variable and doc -substitution; shortened commit message] - -ticket: 9058 (new) ---- - doc/admin/conf_files/krb5_conf.rst | 2 +- - doc/build/options2configure.rst | 3 +++ - doc/conf.py | 3 +++ - doc/mitK5defaults.rst | 25 +++++++++++++------------ - src/configure.ac | 8 ++++++++ - src/doc/Makefile.in | 2 ++ - src/man/Makefile.in | 4 +++- - src/man/krb5.conf.man | 2 +- - src/plugins/preauth/pkinit/pkinit.h | 1 - - 9 files changed, 34 insertions(+), 16 deletions(-) - -diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst -index 2a4962069f..a33711d918 100644 ---- a/doc/admin/conf_files/krb5_conf.rst -+++ b/doc/admin/conf_files/krb5_conf.rst -@@ -1017,7 +1017,7 @@ information for PKINIT is as follows: - All keyword/values are optional. *modname* specifies the location - of a library implementing PKCS #11. If a value is encountered - with no keyword, it is assumed to be the *modname*. If no -- module-name is specified, the default is ``opensc-pkcs11.so``. -+ module-name is specified, the default is |pkcs11_modname|. - ``slotid=`` and/or ``token=`` may be specified to force the use of - a particular smard card reader or token if there is more than one - available. ``certid=`` and/or ``certlabel=`` may be specified to -diff --git a/doc/build/options2configure.rst b/doc/build/options2configure.rst -index 9e355dc2c5..e879b18bd2 100644 ---- a/doc/build/options2configure.rst -+++ b/doc/build/options2configure.rst -@@ -137,6 +137,9 @@ Environment variables - This option allows one to specify libraries to be passed to the - linker (e.g., ``-l``) - -+**PKCS11_MODNAME=**\ *library* -+ Override the built-in default PKCS11 library name. -+ - **SS_LIB=**\ *libs*... - If ``-lss`` is not the correct way to link in your installed ss - library, for example if additional support libraries are needed, -diff --git a/doc/conf.py b/doc/conf.py -index 12168fa695..0ab5ff9606 100644 ---- a/doc/conf.py -+++ b/doc/conf.py -@@ -242,6 +242,7 @@ if 'mansubs' in tags: - ccache = '``@CCNAME@``' - keytab = '``@KTNAME@``' - ckeytab = '``@CKTNAME@``' -+ pkcs11_modname = '``@PKCS11MOD@``' - elif 'pathsubs' in tags: - # Read configured paths from a file produced by the build system. - exec(open("paths.py").read()) -@@ -255,6 +256,7 @@ else: - ccache = ':ref:`DEFCCNAME `' - keytab = ':ref:`DEFKTNAME `' - ckeytab = ':ref:`DEFCKTNAME `' -+ pkcs11_modname = ':ref:`PKCS11_MODNAME `' - - rst_epilog = '\n' - -@@ -275,6 +277,7 @@ else: - rst_epilog += '.. |ccache| replace:: %s\n' % ccache - rst_epilog += '.. |keytab| replace:: %s\n' % keytab - rst_epilog += '.. |ckeytab| replace:: %s\n' % ckeytab -+ rst_epilog += '.. |pkcs11_modname| replace:: %s\n' % pkcs11_modname - rst_epilog += ''' - .. |krb5conf| replace:: ``/etc/krb5.conf`` - .. |defkeysalts| replace:: ``aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal`` -diff --git a/doc/mitK5defaults.rst b/doc/mitK5defaults.rst -index 74e69f4ad0..aea7af3dbb 100644 ---- a/doc/mitK5defaults.rst -+++ b/doc/mitK5defaults.rst -@@ -59,18 +59,19 @@ subdirectories of ``/usr/local``. When MIT krb5 is integrated into an - operating system, the paths are generally chosen to match the - operating system's filesystem layout. - --========================== ============= =========================== =========================== --Description Symbolic name Custom build path Typical OS path --========================== ============= =========================== =========================== --User programs BINDIR ``/usr/local/bin`` ``/usr/bin`` --Libraries and plugins LIBDIR ``/usr/local/lib`` ``/usr/lib`` --Parent of KDC state dir LOCALSTATEDIR ``/usr/local/var`` ``/var`` --Parent of KDC runtime dir RUNSTATEDIR ``/usr/local/var/run`` ``/run`` --Administrative programs SBINDIR ``/usr/local/sbin`` ``/usr/sbin`` --Alternate krb5.conf dir SYSCONFDIR ``/usr/local/etc`` ``/etc`` --Default ccache name DEFCCNAME ``FILE:/tmp/krb5cc_%{uid}`` ``FILE:/tmp/krb5cc_%{uid}`` --Default keytab name DEFKTNAME ``FILE:/etc/krb5.keytab`` ``FILE:/etc/krb5.keytab`` --========================== ============= =========================== =========================== -+========================== ============== =========================== =========================== -+Description Symbolic name Custom build path Typical OS path -+========================== ============== =========================== =========================== -+User programs BINDIR ``/usr/local/bin`` ``/usr/bin`` -+Libraries and plugins LIBDIR ``/usr/local/lib`` ``/usr/lib`` -+Parent of KDC state dir LOCALSTATEDIR ``/usr/local/var`` ``/var`` -+Parent of KDC runtime dir RUNSTATEDIR ``/usr/local/var/run`` ``/run`` -+Administrative programs SBINDIR ``/usr/local/sbin`` ``/usr/sbin`` -+Alternate krb5.conf dir SYSCONFDIR ``/usr/local/etc`` ``/etc`` -+Default ccache name DEFCCNAME ``FILE:/tmp/krb5cc_%{uid}`` ``FILE:/tmp/krb5cc_%{uid}`` -+Default keytab name DEFKTNAME ``FILE:/etc/krb5.keytab`` ``FILE:/etc/krb5.keytab`` -+Default PKCS11 module PKCS11_MODNAME ``opensc-pkcs11.so`` ``opensc-pkcs11.so`` -+========================== ============== =========================== =========================== - - The default client keytab name (DEFCKTNAME) typically defaults to - ``FILE:/usr/local/var/krb5/user/%{euid}/client.keytab`` for a custom -diff --git a/src/configure.ac b/src/configure.ac -index 8dc864718d..9774cb71ae 100644 ---- a/src/configure.ac -+++ b/src/configure.ac -@@ -1471,6 +1471,14 @@ AC_DEFINE_UNQUOTED(DEFKTNAME, ["$DEFKTNAME"], [Define to default keytab name]) - AC_DEFINE_UNQUOTED(DEFCKTNAME, ["$DEFCKTNAME"], - [Define to default client keytab name]) - -+AC_ARG_VAR(PKCS11_MODNAME, [Default PKCS11 module name]) -+if test "${PKCS11_MODNAME+set}" != set; then -+ PKCS11_MODNAME=opensc-pkcs11.so -+fi -+AC_MSG_NOTICE([Default PKCS11 module name: $PKCS11_MODNAME]) -+AC_DEFINE_UNQUOTED(PKCS11_MODNAME, ["$PKCS11_MODNAME"], -+ [Default PKCS11 module name]) -+ - AC_CONFIG_FILES([build-tools/krb5-config], [chmod +x build-tools/krb5-config]) - AC_CONFIG_FILES([build-tools/kadm-server.pc - build-tools/kadm-client.pc -diff --git a/src/doc/Makefile.in b/src/doc/Makefile.in -index 379bc36511..a1b0cff0a4 100644 ---- a/src/doc/Makefile.in -+++ b/src/doc/Makefile.in -@@ -10,6 +10,7 @@ sysconfdir=@sysconfdir@ - DEFCCNAME=@DEFCCNAME@ - DEFKTNAME=@DEFKTNAME@ - DEFCKTNAME=@DEFCKTNAME@ -+PKCS11_MODNAME=@PKCS11_MODNAME@ - - RST_SOURCES= _static \ - _templates \ -@@ -118,6 +119,7 @@ paths.py: - echo 'ccache = "``$(DEFCCNAME)``"' >> $@ - echo 'keytab = "``$(DEFKTNAME)``"' >> $@ - echo 'ckeytab = "``$(DEFCKTNAME)``"' >> $@ -+ echo 'pkcs11_modname = "``$(PKCS11_MODNAME)``"' >> $@ - - # Dummy rule that man/Makefile can invoke - version.py: $(docsrc)/version.py -diff --git a/src/man/Makefile.in b/src/man/Makefile.in -index 00b1b2de06..85cae0914e 100644 ---- a/src/man/Makefile.in -+++ b/src/man/Makefile.in -@@ -8,6 +8,7 @@ sysconfdir=@sysconfdir@ - DEFCCNAME=@DEFCCNAME@ - DEFKTNAME=@DEFKTNAME@ - DEFCKTNAME=@DEFCKTNAME@ -+PKCS11_MODNAME=@PKCS11_MODNAME@ - - MANSUBS=k5identity.sub k5login.sub k5srvutil.sub kadm5.acl.sub kadmin.sub \ - kadmind.sub kdb5_ldap_util.sub kdb5_util.sub kdc.conf.sub \ -@@ -47,7 +48,8 @@ $(docsrc)/version.py: $(top_srcdir)/patchlevel.h - -e 's|@SYSCONFDIR@|$(sysconfdir)|g' \ - -e 's|@CCNAME@|$(DEFCCNAME)|g' \ - -e 's|@KTNAME@|$(DEFKTNAME)|g' \ -- -e 's|@CKTNAME@|$(DEFCKTNAME)|g' $? > $@ -+ -e 's|@CKTNAME@|$(DEFCKTNAME)|g' \ -+ -e 's|@PKCS11MOD@|$(PKCS11_MODNAME)|g' $? > $@ - - all: $(MANSUBS) - -diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man -index 51acb38815..fd2c6f2bc4 100644 ---- a/src/man/krb5.conf.man -+++ b/src/man/krb5.conf.man -@@ -1148,7 +1148,7 @@ user\(aqs certificate and private key. - All keyword/values are optional. \fImodname\fP specifies the location - of a library implementing PKCS #11. If a value is encountered - with no keyword, it is assumed to be the \fImodname\fP\&. If no --module\-name is specified, the default is \fBopensc\-pkcs11.so\fP\&. -+module\-name is specified, the default is \fB@PKCS11MOD@\fP\&. - \fBslotid=\fP and/or \fBtoken=\fP may be specified to force the use of - a particular smard card reader or token if there is more than one - available. \fBcertid=\fP and/or \fBcertlabel=\fP may be specified to -diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h -index 8135535e2c..66f92d8f03 100644 ---- a/src/plugins/preauth/pkinit/pkinit.h -+++ b/src/plugins/preauth/pkinit/pkinit.h -@@ -42,7 +42,6 @@ - #ifndef WITHOUT_PKCS11 - #include "pkcs11.h" - --#define PKCS11_MODNAME "opensc-pkcs11.so" - #define PK_SIGLEN_GUESS 1000 - #define PK_NOSLOT 999999 - #endif --- -2.38.1 - diff --git a/0013-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch b/0007-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch similarity index 94% rename from 0013-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch rename to 0007-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch index 5840faa..f1c3ed6 100644 --- a/0013-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch +++ b/0007-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch @@ -1,4 +1,4 @@ -From 9a536113196d8b32e3143964a655356ac8af1347 Mon Sep 17 00:00:00 2001 +From 0366e8b5b2f960cb8305fd95839376b6c18aae42 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Wed, 7 Dec 2022 13:22:42 +0100 Subject: [PATCH] [downstream] Make tests compatible with @@ -37,5 +37,5 @@ index 87bac17929..26bc95a8dc 100644 fail('URI answers do not match') j += 1 -- -2.38.1 +2.40.1 diff --git a/0008-Set-reasonable-supportedCMSTypes-in-PKINIT.patch b/0008-Set-reasonable-supportedCMSTypes-in-PKINIT.patch deleted file mode 100644 index 3755c15..0000000 --- a/0008-Set-reasonable-supportedCMSTypes-in-PKINIT.patch +++ /dev/null @@ -1,159 +0,0 @@ -From 3fb8c4c68274d2ff4addb44b7b95b4698c2c4f34 Mon Sep 17 00:00:00 2001 -From: Julien Rische -Date: Wed, 1 Jun 2022 18:02:04 +0200 -Subject: [PATCH] Set reasonable supportedCMSTypes in PKINIT - -The PKINIT client uses AuthPack.supportedCMSTypes to let the KDC know -the algorithms it supports for verification of the CMS data signature. -(The MIT krb5 KDC currently ignores this list, but other -implementations use it.) - -Replace 3DES with sha512WithRSAEncryption and sha256WithRSAEncryption. - -[ghudson@mit.edu: simplified code and used appropriate helpers; edited -commit message] - -ticket: 9066 (new) ---- - src/plugins/preauth/pkinit/pkinit_constants.c | 33 ++++++++++++- - src/plugins/preauth/pkinit/pkinit_crypto.h | 4 ++ - .../preauth/pkinit/pkinit_crypto_openssl.c | 49 ++++++++++--------- - 3 files changed, 60 insertions(+), 26 deletions(-) - -diff --git a/src/plugins/preauth/pkinit/pkinit_constants.c b/src/plugins/preauth/pkinit/pkinit_constants.c -index 652897fa14..1da482e0b4 100644 ---- a/src/plugins/preauth/pkinit/pkinit_constants.c -+++ b/src/plugins/preauth/pkinit/pkinit_constants.c -@@ -32,9 +32,14 @@ - - #include "pkinit.h" - --/* statically declare OID constants for all three algorithms */ --static char sha1_oid[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x01}; -+/* RFC 8636 id-pkinit-kdf-ah-sha1: iso(1) identified-organization(3) dod(6) -+ * internet(1) security(5) kerberosv5(2) pkinit(3) kdf(6) sha1(1) */ -+static char sha1_oid[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x01 }; -+/* RFC 8636 id-pkinit-kdf-ah-sha256: iso(1) identified-organization(3) dod(6) -+ * internet(1) security(5) kerberosv5(2) pkinit(3) kdf(6) sha256(2) */ - static char sha256_oid[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x02 }; -+/* RFC 8636 id-pkinit-kdf-ah-sha512: iso(1) identified-organization(3) dod(6) -+ * internet(1) security(5) kerberosv5(2) pkinit(3) kdf(6) sha512(3) */ - static char sha512_oid[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x03 }; - - const krb5_data sha1_id = { KV5M_DATA, sizeof(sha1_oid), sha1_oid }; -@@ -48,6 +53,30 @@ krb5_data const * const supported_kdf_alg_ids[] = { - NULL - }; - -+/* RFC 4055 sha256WithRSAEncryption: iso(1) member-body(2) us(840) -+ * rsadsi(113549) pkcs(1) 1 11 */ -+static char sha256WithRSAEncr_oid[9] = { -+ 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b -+}; -+/* RFC 4055 sha256WithRSAEncryption: iso(1) member-body(2) us(840) -+ * rsadsi(113549) pkcs(1) 1 13 */ -+static char sha512WithRSAEncr_oid[9] = { -+ 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0d -+}; -+ -+const krb5_data sha256WithRSAEncr_id = { -+ KV5M_DATA, sizeof(sha256WithRSAEncr_oid), sha256WithRSAEncr_oid -+}; -+const krb5_data sha512WithRSAEncr_id = { -+ KV5M_DATA, sizeof(sha512WithRSAEncr_oid), sha512WithRSAEncr_oid -+}; -+ -+krb5_data const * const supported_cms_algs[] = { -+ &sha512WithRSAEncr_id, -+ &sha256WithRSAEncr_id, -+ NULL -+}; -+ - /* RFC 2412 section E.2 (well-known group 2) parameters, DER-encoded as - * DomainParameters (RFC 3279 section 2.3.3). */ - static const uint8_t o1024[] = { -diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h -index 65f6210727..64300da856 100644 ---- a/src/plugins/preauth/pkinit/pkinit_crypto.h -+++ b/src/plugins/preauth/pkinit/pkinit_crypto.h -@@ -620,6 +620,10 @@ extern const krb5_data oakley_4096; - */ - extern krb5_data const * const supported_kdf_alg_ids[]; - -+/* CMS signature algorithms supported by this implementation, in order of -+ * decreasing preference. */ -+extern krb5_data const * const supported_cms_algs[]; -+ - krb5_error_code - crypto_encode_der_cert(krb5_context context, pkinit_req_crypto_context reqctx, - uint8_t **der_out, size_t *der_len); -diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -index d500455dec..1c2aa02827 100644 ---- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -@@ -5475,37 +5475,38 @@ create_krb5_supportedCMSTypes(krb5_context context, - pkinit_plg_crypto_context plg_cryptoctx, - pkinit_req_crypto_context req_cryptoctx, - pkinit_identity_crypto_context id_cryptoctx, -- krb5_algorithm_identifier ***oids) -+ krb5_algorithm_identifier ***algs_out) - { -+ krb5_error_code ret; -+ krb5_algorithm_identifier **algs = NULL; -+ size_t i, count; - -- krb5_error_code retval = ENOMEM; -- krb5_algorithm_identifier **loids = NULL; -- krb5_data des3oid = {0, 8, "\x2A\x86\x48\x86\xF7\x0D\x03\x07" }; -+ *algs_out = NULL; - -- *oids = NULL; -- loids = malloc(2 * sizeof(krb5_algorithm_identifier *)); -- if (loids == NULL) -- goto cleanup; -- loids[1] = NULL; -- loids[0] = malloc(sizeof(krb5_algorithm_identifier)); -- if (loids[0] == NULL) { -- free(loids); -- goto cleanup; -- } -- retval = pkinit_copy_krb5_data(&loids[0]->algorithm, &des3oid); -- if (retval) { -- free(loids[0]); -- free(loids); -+ /* Count supported OIDs and allocate list (including null terminator). */ -+ for (count = 0; supported_cms_algs[count] != NULL; count++); -+ algs = k5calloc(count + 1, sizeof(*algs), &ret); -+ if (algs == NULL) - goto cleanup; -+ -+ /* Add an algorithm identifier for each OID, with no parameters. */ -+ for (i = 0; i < count; i++) { -+ algs[i] = k5alloc(sizeof(*algs[i]), &ret); -+ if (algs[i] == NULL) -+ goto cleanup; -+ ret = krb5int_copy_data_contents(context, supported_cms_algs[i], -+ &algs[i]->algorithm); -+ if (ret) -+ goto cleanup; -+ algs[i]->parameters = empty_data(); - } -- loids[0]->parameters.length = 0; -- loids[0]->parameters.data = NULL; - -- *oids = loids; -- retval = 0; --cleanup: -+ *algs_out = algs; -+ algs = NULL; - -- return retval; -+cleanup: -+ free_krb5_algorithm_identifiers(&algs); -+ return ret; - } - - krb5_error_code --- -2.38.1 - diff --git a/0014-downstream-Include-missing-OpenSSL-FIPS-header.patch b/0008-downstream-Include-missing-OpenSSL-FIPS-header.patch similarity index 98% rename from 0014-downstream-Include-missing-OpenSSL-FIPS-header.patch rename to 0008-downstream-Include-missing-OpenSSL-FIPS-header.patch index 24ba48a..43648a7 100644 --- a/0014-downstream-Include-missing-OpenSSL-FIPS-header.patch +++ b/0008-downstream-Include-missing-OpenSSL-FIPS-header.patch @@ -1,4 +1,4 @@ -From d57a804136c5ebf473ce053a9517edd71a56389f Mon Sep 17 00:00:00 2001 +From a567b9de563cd8ad262f77cf97a8bc528a884745 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Thu, 5 Jan 2023 20:06:47 +0100 Subject: [PATCH] [downstream] Include missing OpenSSL FIPS header @@ -116,5 +116,5 @@ index 232e78bc05..3394f8a58e 100644 * The SPAKE kdcpreauth module uses a secure cookie containing the following * concatenated fields (all integer fields are big-endian): -- -2.38.1 +2.40.1 diff --git a/0009-Simplify-plugin-loading-code.patch b/0009-Simplify-plugin-loading-code.patch deleted file mode 100644 index 42802e5..0000000 --- a/0009-Simplify-plugin-loading-code.patch +++ /dev/null @@ -1,622 +0,0 @@ -From ffb47e4120d68aef015453350a3a50a9bab1ec58 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Thu, 23 Jun 2022 16:41:40 -0400 -Subject: [PATCH] Simplify plugin loading code - -Remove the USE_CFBUNDLE code, which was only used by KfM. Handle -platform conditionals according to current practice. Use -k5_dir_filenames() instead of opendir() and remove the Windows -implementation of opendir(). ---- - src/util/support/plugins.c | 507 +++++++++++-------------------------- - 1 file changed, 150 insertions(+), 357 deletions(-) - -diff --git a/src/util/support/plugins.c b/src/util/support/plugins.c -index c6a9a21d57..0850565687 100644 ---- a/src/util/support/plugins.c -+++ b/src/util/support/plugins.c -@@ -29,16 +29,6 @@ - #if USE_DLOPEN - #include - #endif --#include --#ifdef HAVE_SYS_STAT_H --#include --#endif --#ifdef HAVE_SYS_PARAM_H --#include --#endif --#ifdef HAVE_UNISTD_H --#include --#endif - - #if USE_DLOPEN - #ifdef RTLD_GROUP -@@ -68,16 +58,6 @@ - #endif - #endif - --#if USE_DLOPEN && USE_CFBUNDLE --#include -- --/* Currently CoreFoundation only exists on the Mac so we just use -- * pthreads directly to avoid creating empty function calls on other -- * platforms. If a thread initializer ever gets created in the common -- * plugin code, move this there */ --static pthread_mutex_t krb5int_bundle_mutex = PTHREAD_MUTEX_INITIALIZER; --#endif -- - #include - static void Tprintf (const char *fmt, ...) - { -@@ -90,374 +70,193 @@ static void Tprintf (const char *fmt, ...) - } - - struct plugin_file_handle { --#if USE_DLOPEN -+#if defined(USE_DLOPEN) - void *dlhandle; --#endif --#ifdef _WIN32 -- HMODULE hinstPlugin; --#endif --#if !defined (USE_DLOPEN) && !defined (_WIN32) -+#elif defined(_WIN32) -+ HMODULE module; -+#else - char dummy; - #endif - }; - --#ifdef _WIN32 --struct dirent { -- long d_ino; /* inode (always 1 in WIN32) */ -- off_t d_off; /* offset to this dirent */ -- unsigned short d_reclen; /* length of d_name */ -- char d_name[_MAX_FNAME+1]; /* filename (null terminated) */ --}; -- --typedef struct { -- intptr_t handle; /* _findfirst/_findnext handle */ -- short offset; /* offset into directory */ -- short finished; /* 1 if there are not more files */ -- struct _finddata_t fileinfo;/* from _findfirst/_findnext */ -- char *dir; /* the dir we are reading */ -- struct dirent dent; /* the dirent to return */ --} DIR; -+#if defined(USE_DLOPEN) - --DIR * opendir(const char *dir) -+static long -+open_plugin_dlfcn(struct plugin_file_handle *h, const char *filename, -+ struct errinfo *ep) - { -- DIR *dp; -- char *filespec; -- intptr_t handle; -- int index; -- -- filespec = malloc(strlen(dir) + 2 + 1); -- strcpy(filespec, dir); -- index = strlen(filespec) - 1; -- if (index >= 0 && (filespec[index] == '/' || filespec[index] == '\\')) -- filespec[index] = '\0'; -- strcat(filespec, "/*"); -- -- dp = (DIR *)malloc(sizeof(DIR)); -- dp->offset = 0; -- dp->finished = 0; -- dp->dir = strdup(dir); -- -- if ((handle = _findfirst(filespec, &(dp->fileinfo))) < 0) { -- if (errno == ENOENT) -- dp->finished = 1; -- else { -- free(filespec); -- free(dp->dir); -- free(dp); -- return NULL; -- } -+ const char *e; -+ -+ h->dlhandle = dlopen(filename, PLUGIN_DLOPEN_FLAGS); -+ if (h->dlhandle == NULL) { -+ e = dlerror(); -+ if (e == NULL) -+ e = _("unknown failure"); -+ Tprintf("dlopen(%s): %s\n", filename, e); -+ k5_set_error(ep, ENOENT, _("unable to load plugin [%s]: %s"), -+ filename, e); -+ return ENOENT; - } -- -- dp->handle = handle; -- free(filespec); -- -- return dp; -+ return 0; - } -+#define open_plugin open_plugin_dlfcn - --struct dirent * readdir(DIR *dp) -+static long -+get_sym_dlfcn(struct plugin_file_handle *h, const char *csymname, -+ void **sym_out, struct errinfo *ep) - { -- if (!dp || dp->finished) return NULL; -- -- if (dp->offset != 0) { -- if (_findnext(dp->handle, &(dp->fileinfo)) < 0) { -- dp->finished = 1; -- return NULL; -- } -+ const char *e; -+ -+ if (h->dlhandle == NULL) -+ return ENOENT; -+ *sym_out = dlsym(h->dlhandle, csymname); -+ if (*sym_out == NULL) { -+ e = dlerror(); -+ if (e == NULL) -+ e = _("unknown failure"); -+ Tprintf("dlsym(%s): %s\n", csymname, e); -+ k5_set_error(ep, ENOENT, "%s", e); -+ return ENOENT; - } -- dp->offset++; -- -- strncpy(dp->dent.d_name, dp->fileinfo.name, _MAX_FNAME); -- dp->dent.d_ino = 1; -- dp->dent.d_reclen = (unsigned short)strlen(dp->dent.d_name); -- dp->dent.d_off = dp->offset; -- -- return &(dp->dent); --} -- --int closedir(DIR *dp) --{ -- if (!dp) return 0; -- _findclose(dp->handle); -- free(dp->dir); -- free(dp); -- - return 0; - } --#endif -+#define get_sym get_sym_dlfcn - --long KRB5_CALLCONV --krb5int_open_plugin (const char *filepath, struct plugin_file_handle **h, struct errinfo *ep) -+static void -+close_plugin_dlfcn(struct plugin_file_handle *h) - { -- long err = 0; -- struct plugin_file_handle *htmp = NULL; -- int got_plugin = 0; --#if defined(USE_CFBUNDLE) || defined(_WIN32) -- struct stat statbuf; -- -- if (!err) { -- if (stat (filepath, &statbuf) < 0) { -- err = errno; -- Tprintf ("stat(%s): %s\n", filepath, strerror (err)); -- k5_set_error(ep, err, _("unable to find plugin [%s]: %s"), -- filepath, strerror(err)); -- } -- } --#endif -- -- if (!err) { -- htmp = calloc (1, sizeof (*htmp)); /* calloc initializes ptrs to NULL */ -- if (htmp == NULL) { err = ENOMEM; } -- } -- --#if USE_DLOPEN -- if (!err --#if USE_CFBUNDLE -- && ((statbuf.st_mode & S_IFMT) == S_IFREG -- || (statbuf.st_mode & S_IFMT) == S_IFDIR) --#endif /* USE_CFBUNDLE */ -- ) { -- void *handle = NULL; -- --#if USE_CFBUNDLE -- char executablepath[MAXPATHLEN]; -- -- if ((statbuf.st_mode & S_IFMT) == S_IFDIR) { -- int lock_err = 0; -- CFStringRef pluginString = NULL; -- CFURLRef pluginURL = NULL; -- CFBundleRef pluginBundle = NULL; -- CFURLRef executableURL = NULL; -- -- /* Lock around CoreFoundation calls since objects are refcounted -- * and the refcounts are not thread-safe. Using pthreads directly -- * because this code is Mac-specific */ -- lock_err = pthread_mutex_lock(&krb5int_bundle_mutex); -- if (lock_err) { err = lock_err; } -- -- if (!err) { -- pluginString = CFStringCreateWithCString (kCFAllocatorDefault, -- filepath, -- kCFStringEncodingASCII); -- if (pluginString == NULL) { err = ENOMEM; } -- } -- -- if (!err) { -- pluginURL = CFURLCreateWithFileSystemPath (kCFAllocatorDefault, -- pluginString, -- kCFURLPOSIXPathStyle, -- true); -- if (pluginURL == NULL) { err = ENOMEM; } -- } -- -- if (!err) { -- pluginBundle = CFBundleCreate (kCFAllocatorDefault, pluginURL); -- if (pluginBundle == NULL) { err = ENOENT; } /* XXX need better error */ -- } -- -- if (!err) { -- executableURL = CFBundleCopyExecutableURL (pluginBundle); -- if (executableURL == NULL) { err = ENOMEM; } -- } -- -- if (!err) { -- if (!CFURLGetFileSystemRepresentation (executableURL, -- true, /* absolute */ -- (UInt8 *)executablepath, -- sizeof (executablepath))) { -- err = ENOMEM; -- } -- } -- -- if (!err) { -- /* override the path the caller passed in */ -- filepath = executablepath; -- } -- -- if (executableURL != NULL) { CFRelease (executableURL); } -- if (pluginBundle != NULL) { CFRelease (pluginBundle); } -- if (pluginURL != NULL) { CFRelease (pluginURL); } -- if (pluginString != NULL) { CFRelease (pluginString); } -- -- /* unlock after CFRelease calls since they modify refcounts */ -- if (!lock_err) { pthread_mutex_unlock (&krb5int_bundle_mutex); } -- } --#endif /* USE_CFBUNDLE */ -- -- if (!err) { -- handle = dlopen(filepath, PLUGIN_DLOPEN_FLAGS); -- if (handle == NULL) { -- const char *e = dlerror(); -- if (e == NULL) -- e = _("unknown failure"); -- Tprintf ("dlopen(%s): %s\n", filepath, e); -- err = ENOENT; /* XXX */ -- k5_set_error(ep, err, _("unable to load plugin [%s]: %s"), -- filepath, e); -- } -- } -+ if (h->dlhandle != NULL) -+ dlclose(h->dlhandle); -+} -+#define close_plugin close_plugin_dlfcn - -- if (!err) { -- got_plugin = 1; -- htmp->dlhandle = handle; -- handle = NULL; -- } -+#elif defined(_WIN32) - -- if (handle != NULL) { dlclose (handle); } -+static long -+open_plugin_win32(struct plugin_file_handle *h, const char *filename, -+ struct errinfo *ep) -+{ -+ h->module = LoadLibrary(filename); -+ if (h == NULL) { -+ Tprintf("Unable to load dll: %s\n", filename); -+ k5_set_error(ep, ENOENT, _("unable to load DLL [%s]"), filename); -+ return ENOENT; - } --#endif /* USE_DLOPEN */ -- --#ifdef _WIN32 -- if (!err && (statbuf.st_mode & S_IFMT) == S_IFREG) { -- HMODULE handle = NULL; -+ return 0; -+} -+#define open_plugin open_plugin_win32 - -- handle = LoadLibrary(filepath); -- if (handle == NULL) { -- Tprintf ("Unable to load dll: %s\n", filepath); -- err = ENOENT; /* XXX */ -- k5_set_error(ep, err, _("unable to load DLL [%s]"), filepath); -- } -+static long -+get_sym_win32(struct plugin_file_handle *h, const char *csymname, -+ void **sym_out, struct errinfo *ep) -+{ -+ LPVOID lpMsgBuf; -+ DWORD dw; - -- if (!err) { -- got_plugin = 1; -- htmp->hinstPlugin = handle; -- handle = NULL; -+ if (h->module == NULL) -+ return ENOENT; -+ *sym_out = GetProcAddress(h->module, csymname); -+ if (*sym_out == NULL) { -+ Tprintf("GetProcAddress(%s): %i\n", csymname, GetLastError()); -+ dw = GetLastError(); -+ if (FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | -+ FORMAT_MESSAGE_FROM_SYSTEM, -+ NULL, dw, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), -+ (LPTSTR)&lpMsgBuf, 0, NULL)) { -+ k5_set_error(ep, ENOENT, _("unable to get DLL Symbol: %s"), -+ (char *)lpMsgBuf); -+ LocalFree(lpMsgBuf); - } -- -- if (handle != NULL) -- FreeLibrary(handle); -- } --#endif -- -- if (!err && !got_plugin) { -- err = ENOENT; /* no plugin or no way to load plugins */ -- k5_set_error(ep, err, _("plugin unavailable: %s"), strerror(err)); -+ return ENOENT; - } -+ return 0; -+} -+#define get_sym get_sym_win32 - -- if (!err) { -- *h = htmp; -- htmp = NULL; /* h takes ownership */ -- } -+static void -+close_plugin_win32(struct plugin_file_handle *h) -+{ -+ if (h->module != NULL) -+ FreeLibrary(h->module); -+} -+#define close_plugin close_plugin_win32 - -- free(htmp); -+#else - -- return err; -+static long -+open_plugin_dummy(struct plugin_file_handle *h, const char *filename, -+ struct errinfo *ep) -+{ -+ k5_set_error(ep, ENOENT, _("plugin loading unavailable")); -+ return ENOENT; - } -+#define open_plugin open_plugin_dummy - - static long --krb5int_get_plugin_sym (struct plugin_file_handle *h, -- const char *csymname, int isfunc, void **ptr, -- struct errinfo *ep) -+get_sym_dummy(struct plugin_file_handle *h, const char *csymname, -+ void **sym_out, struct errinfo *ep) - { -- long err = 0; -- void *sym = NULL; -+ return ENOENT; -+} -+#define get_sym get_sym_dummy -+ -+static void -+close_plugin_dummy(struct plugin_file_handle *h) -+{ -+} -+#define close_plugin close_plugin_dummy - --#if USE_DLOPEN -- if (!err && !sym && (h->dlhandle != NULL)) { -- /* XXX Do we need to add a leading "_" to the symbol name on any -- modern platforms? */ -- sym = dlsym (h->dlhandle, csymname); -- if (sym == NULL) { -- const char *e = dlerror (); /* XXX copy and save away */ -- if (e == NULL) -- e = "unknown failure"; -- Tprintf ("dlsym(%s): %s\n", csymname, e); -- err = ENOENT; /* XXX */ -- k5_set_error(ep, err, "%s", e); -- } -- } - #endif - --#ifdef _WIN32 -- LPVOID lpMsgBuf; -- DWORD dw; -+long KRB5_CALLCONV -+krb5int_open_plugin(const char *filename, -+ struct plugin_file_handle **handle_out, struct errinfo *ep) -+{ -+ long ret; -+ struct plugin_file_handle *h; - -- if (!err && !sym && (h->hinstPlugin != NULL)) { -- sym = GetProcAddress(h->hinstPlugin, csymname); -- if (sym == NULL) { -- const char *e = "unable to get dll symbol"; /* XXX copy and save away */ -- Tprintf ("GetProcAddress(%s): %i\n", csymname, GetLastError()); -- err = ENOENT; /* XXX */ -- k5_set_error(ep, err, "%s", e); -- -- dw = GetLastError(); -- if (FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | -- FORMAT_MESSAGE_FROM_SYSTEM, -- NULL, -- dw, -- MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), -- (LPTSTR) &lpMsgBuf, -- 0, NULL )) { -- -- fprintf (stderr, "unable to get dll symbol, %s\n", (LPCTSTR)lpMsgBuf); -- LocalFree(lpMsgBuf); -- } -- } -- } --#endif -+ *handle_out = NULL; - -- if (!err && (sym == NULL)) { -- err = ENOENT; /* unimplemented */ -- } -+ h = calloc(1, sizeof(*h)); -+ if (h == NULL) -+ return ENOMEM; - -- if (!err) { -- *ptr = sym; -+ ret = open_plugin(h, filename, ep); -+ if (ret) { -+ free(h); -+ return ret; - } - -- return err; -+ *handle_out = h; -+ return 0; - } - - long KRB5_CALLCONV --krb5int_get_plugin_data (struct plugin_file_handle *h, const char *csymname, -- void **ptr, struct errinfo *ep) -+krb5int_get_plugin_data(struct plugin_file_handle *h, const char *csymname, -+ void **sym_out, struct errinfo *ep) - { -- return krb5int_get_plugin_sym (h, csymname, 0, ptr, ep); -+ return get_sym(h, csymname, sym_out, ep); - } - - long KRB5_CALLCONV --krb5int_get_plugin_func (struct plugin_file_handle *h, const char *csymname, -- void (**ptr)(), struct errinfo *ep) -+krb5int_get_plugin_func(struct plugin_file_handle *h, const char *csymname, -+ void (**sym_out)(), struct errinfo *ep) - { - void *dptr = NULL; -- long err = krb5int_get_plugin_sym (h, csymname, 1, &dptr, ep); -- if (!err) { -- /* Cast function pointers to avoid code duplication */ -- *ptr = (void (*)()) dptr; -- } -- return err; -+ long ret = get_sym(h, csymname, &dptr, ep); -+ -+ if (!ret) -+ *sym_out = (void (*)())dptr; -+ return ret; - } - - void KRB5_CALLCONV - krb5int_close_plugin (struct plugin_file_handle *h) - { --#if USE_DLOPEN -- if (h->dlhandle != NULL) { dlclose(h->dlhandle); } --#endif --#ifdef _WIN32 -- if (h->hinstPlugin != NULL) { FreeLibrary(h->hinstPlugin); } --#endif -- free (h); -+ close_plugin(h); -+ free(h); - } - --/* autoconf docs suggest using this preference order */ --#if HAVE_DIRENT_H || USE_DIRENT_H --#include --#define NAMELEN(D) strlen((D)->d_name) --#else --#ifndef _WIN32 --#define dirent direct --#define NAMELEN(D) ((D)->d->namlen) --#else --#define NAMELEN(D) strlen((D)->d_name) --#endif --#if HAVE_SYS_NDIR_H --# include --#elif HAVE_SYS_DIR_H --# include --#elif HAVE_NDIR_H --# include --#endif --#endif -- - static long - krb5int_plugin_file_handle_array_init (struct plugin_file_handle ***harray) - { -@@ -619,42 +418,36 @@ krb5int_open_plugin_dirs (const char * const *dirnames, - if (handle != NULL) { krb5int_close_plugin (handle); } - } - } else { -- /* load all plugins in each directory */ -- DIR *dir = opendir (dirnames[i]); -+ char **fnames = NULL; -+ int j; - -- while (dir != NULL && !err) { -- struct dirent *d = NULL; -+ err = k5_dir_filenames(dirnames[i], &fnames); -+ for (j = 0; !err && fnames[j] != NULL; j++) { - char *filepath = NULL; - struct plugin_file_handle *handle = NULL; - -- d = readdir (dir); -- if (d == NULL) { break; } -- -- if ((strcmp (d->d_name, ".") == 0) || -- (strcmp (d->d_name, "..") == 0)) { -+ if (strcmp(fnames[j], ".") == 0 || -+ strcmp(fnames[j], "..") == 0) - continue; -- } - -- if (!err) { -- int len = NAMELEN (d); -- if (asprintf(&filepath, "%s/%*s", dirnames[i], len, d->d_name) < 0) { -- filepath = NULL; -- err = ENOMEM; -- } -+ if (asprintf(&filepath, "%s/%s", dirnames[i], fnames[j]) < 0) { -+ filepath = NULL; -+ err = ENOMEM; - } - -- if (!err) { -- if (krb5int_open_plugin (filepath, &handle, ep) == 0) { -- err = krb5int_plugin_file_handle_array_add (&h, &count, handle); -- if (!err) { handle = NULL; } /* h takes ownership */ -- } -+ if (!err && krb5int_open_plugin(filepath, &handle, ep) == 0) { -+ err = krb5int_plugin_file_handle_array_add(&h, &count, -+ handle); -+ if (!err) -+ handle = NULL; /* h takes ownership */ - } - - free(filepath); -- if (handle != NULL) { krb5int_close_plugin (handle); } -+ if (handle != NULL) -+ krb5int_close_plugin(handle); - } - -- if (dir != NULL) { closedir (dir); } -+ k5_free_filenames(fnames); - } - } - --- -2.38.1 - diff --git a/0015-downstream-Do-not-set-root-as-ksu-file-owner.patch b/0009-downstream-Do-not-set-root-as-ksu-file-owner.patch similarity index 93% rename from 0015-downstream-Do-not-set-root-as-ksu-file-owner.patch rename to 0009-downstream-Do-not-set-root-as-ksu-file-owner.patch index 5c53868..0dd8834 100644 --- a/0015-downstream-Do-not-set-root-as-ksu-file-owner.patch +++ b/0009-downstream-Do-not-set-root-as-ksu-file-owner.patch @@ -1,4 +1,4 @@ -From 59d3ecdab7210e87ec475f4ae0d64888d5416b29 Mon Sep 17 00:00:00 2001 +From 6adfd97a3558aae4ace346685266bac9dae8bba9 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Mon, 9 Jan 2023 22:39:52 +0100 Subject: [PATCH] [downstream] Do not set root as ksu file owner @@ -27,5 +27,5 @@ index 7eaa2f351c..e9ae71471e 100644 ## ${prefix}. prefix=@prefix@ -- -2.38.1 +2.40.1 diff --git a/0010-Update-error-checking-for-OpenSSL-CMS_verify.patch b/0010-Update-error-checking-for-OpenSSL-CMS_verify.patch deleted file mode 100644 index 0fbd529..0000000 --- a/0010-Update-error-checking-for-OpenSSL-CMS_verify.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 963314f4f449e136195232bdada3109af65d0881 Mon Sep 17 00:00:00 2001 -From: Julien Rische -Date: Thu, 28 Jul 2022 15:20:12 +0200 -Subject: [PATCH] Update error checking for OpenSSL CMS_verify - -The code for CMS data verification was initially written for OpenSSL's -PKCS7_verify() function. It now uses CMS_verify(), but error handling -is still done using PKCS7_verify() error identifiers. Update the -recognized error codes so that the KDC generates -KDC_ERR_DIGEST_IN_SIGNED_DATA_NOT_ACCEPTED errors when appropriate. -Use ERR_peek_last_error() to observe the error generated closest to -the API surface. - -[ghudson@mit.edu: edited commit message] - -ticket: 9069 (new) -tags: pullup -target_version: 1.20-next ---- - src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 9 ++++++--- - 1 file changed, 6 insertions(+), 3 deletions(-) - -diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -index 1c2aa02827..16edf15cb2 100644 ---- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -@@ -2102,12 +2102,15 @@ cms_signeddata_verify(krb5_context context, - goto cleanup; - out = BIO_new(BIO_s_mem()); - if (CMS_verify(cms, NULL, store, NULL, out, flags) == 0) { -- unsigned long err = ERR_peek_error(); -+ unsigned long err = ERR_peek_last_error(); - switch(ERR_GET_REASON(err)) { -- case PKCS7_R_DIGEST_FAILURE: -+ case RSA_R_DIGEST_NOT_ALLOWED: -+ case CMS_R_UNKNOWN_DIGEST_ALGORITHM: -+ case CMS_R_NO_MATCHING_DIGEST: -+ case CMS_R_NO_MATCHING_SIGNATURE: - retval = KRB5KDC_ERR_DIGEST_IN_SIGNED_DATA_NOT_ACCEPTED; - break; -- case PKCS7_R_SIGNATURE_FAILURE: -+ case CMS_R_VERIFICATION_FAILURE: - default: - retval = KRB5KDC_ERR_INVALID_SIG; - } --- -2.38.1 - diff --git a/0016-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch b/0010-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch similarity index 98% rename from 0016-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch rename to 0010-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch index 227650e..a78d09c 100644 --- a/0016-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch +++ b/0010-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch @@ -1,4 +1,4 @@ -From d8f67df42efd68142aa904040f9e8cc0f9138c10 Mon Sep 17 00:00:00 2001 +From 73640dc4899494d010b83b080b3a65bd3e69177c Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Thu, 19 Jan 2023 19:22:27 +0100 Subject: [PATCH] [downstream] Allow KRB5KDF, MD5, and MD4 in FIPS mode @@ -161,5 +161,5 @@ index 5a43c3d9eb..8528ddc4a9 100644 ret = KRB5_CRYPTO_INTERNAL; goto done; -- -2.39.1 +2.40.1 diff --git a/0011-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch b/0011-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch new file mode 100644 index 0000000..8109a84 --- /dev/null +++ b/0011-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch @@ -0,0 +1,279 @@ +From f47c9eb8618006012600a906367295ed53c558d0 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Wed, 15 Mar 2023 15:56:34 +0100 +Subject: [PATCH] [downstream] Allow to set PAC ticket signature as optional + +MS-PAC states that "The ticket signature SHOULD be included in tickets +that are not encrypted to the krbtgt account". However, the +implementation of krb5_kdc_verify_ticket() will require the ticket +signature to be present in case the target of the request is a service +principal. + +In gradual upgrade environments, it results in S4U2Proxy requests +against a 1.20 KDC using a service ticket generated by an older version +KDC to fail. + +This commit adds a krb5_kdc_verify_ticket_ext() function with an extra +switch parameter to tolerate the absence of ticket signature in this +scenario. If the ticket signature is present, it has to be valid, +regardless of this parameter. + +This parameter is set based on the "optional_pac_tkt_chksum" string +attribute of the TGT KDB entry. +--- + doc/admin/admin_commands/kadmin_local.rst | 6 ++++ + doc/appdev/refs/api/index.rst | 1 + + src/include/kdb.h | 1 + + src/include/krb5/krb5.hin | 40 +++++++++++++++++++++++ + src/kdc/kdc_util.c | 32 ++++++++++++++---- + src/lib/krb5/krb/pac.c | 31 +++++++++++++++--- + src/lib/krb5/libkrb5.exports | 1 + + src/man/kadmin.man | 6 ++++ + 8 files changed, 108 insertions(+), 10 deletions(-) + +diff --git a/doc/admin/admin_commands/kadmin_local.rst b/doc/admin/admin_commands/kadmin_local.rst +index 2435b3c361..58ac79549f 100644 +--- a/doc/admin/admin_commands/kadmin_local.rst ++++ b/doc/admin/admin_commands/kadmin_local.rst +@@ -658,6 +658,12 @@ KDC: + Directory realm when using aes-sha2 keys on the local krbtgt + entry. + ++**optional_pac_tkt_chksum** ++ Boolean value defining the behavior of the KDC in case an expected ++ ticket checksum signed with one of this principal keys is not ++ present in the PAC. This is typically the case for TGS or ++ cross-realm TGS principals when processing S4U2Proxy requests. ++ + This command requires the **modify** privilege. + + Alias: **setstr** +diff --git a/doc/appdev/refs/api/index.rst b/doc/appdev/refs/api/index.rst +index d12be47c3c..9b95ebd0f9 100644 +--- a/doc/appdev/refs/api/index.rst ++++ b/doc/appdev/refs/api/index.rst +@@ -225,6 +225,7 @@ Rarely used public interfaces + krb5_is_referral_realm.rst + krb5_kdc_sign_ticket.rst + krb5_kdc_verify_ticket.rst ++ krb5_kdc_verify_ticket_ext.rst + krb5_kt_add_entry.rst + krb5_kt_end_seq_get.rst + krb5_kt_get_entry.rst +diff --git a/src/include/kdb.h b/src/include/kdb.h +index 745b24f351..6075349e5e 100644 +--- a/src/include/kdb.h ++++ b/src/include/kdb.h +@@ -136,6 +136,7 @@ + #define KRB5_KDB_SK_PAC_PRIVSVR_ENCTYPE "pac_privsvr_enctype" + #define KRB5_KDB_SK_SESSION_ENCTYPES "session_enctypes" + #define KRB5_KDB_SK_REQUIRE_AUTH "require_auth" ++#define KRB5_KDB_SK_OPTIONAL_PAC_TKT_CHKSUM "optional_pac_tkt_chksum" + + #if !defined(_WIN32) + +diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin +index 350bcf86f2..17e1b52266 100644 +--- a/src/include/krb5/krb5.hin ++++ b/src/include/krb5/krb5.hin +@@ -8356,6 +8356,46 @@ krb5_kdc_verify_ticket(krb5_context context, const krb5_enc_tkt_part *enc_tkt, + const krb5_keyblock *server, + const krb5_keyblock *privsvr, krb5_pac *pac_out); + ++/** ++ * Verify a PAC, possibly including ticket signature ++ * ++ * @param [in] context Library context ++ * @param [in] enc_tkt Ticket enc-part, possibly containing a PAC ++ * @param [in] server_princ Canonicalized name of ticket server ++ * @param [in] server Key to validate server checksum (or NULL) ++ * @param [in] privsvr Key to validate KDC checksum (or NULL) ++ * @paran [in] optional_tkt_chksum Whether to require a ticket checksum ++ * @param [out] pac_out Verified PAC (NULL if no PAC included) ++ * ++ * This function is an extension of krb5_kdc_verify_ticket(), adding the @a ++ * optional_tkt_chksum parameter allowing to tolerate the absence of the PAC ++ * ticket signature. ++ * ++ * If a PAC is present in @a enc_tkt, verify its signatures. If @a privsvr is ++ * not NULL and @a server_princ is not a krbtgt or kadmin/changepw service and ++ * @a optional_tkt_chksum is FALSE, require a ticket signature over @a enc_tkt ++ * in addition to the KDC signature. Place the verified PAC in @a pac_out. If ++ * an invalid PAC signature is found, return an error matching the Windows KDC ++ * protocol code for that condition as closely as possible. ++ * ++ * If no PAC is present in @a enc_tkt, set @a pac_out to NULL and return ++ * successfully. ++ * ++ * @note This function does not validate the PAC_CLIENT_INFO buffer. If a ++ * specific value is expected, the caller can make a separate call to ++ * krb5_pac_verify_ext() with a principal but no keys. ++ * ++ * @retval 0 Success; otherwise - Kerberos error codes ++ */ ++krb5_error_code KRB5_CALLCONV ++krb5_kdc_verify_ticket_ext(krb5_context context, ++ const krb5_enc_tkt_part *enc_tkt, ++ krb5_const_principal server_princ, ++ const krb5_keyblock *server, ++ const krb5_keyblock *privsvr, ++ krb5_boolean optional_tkt_chksum, ++ krb5_pac *pac_out); ++ + /** @deprecated Use krb5_kdc_sign_ticket() instead. */ + krb5_error_code KRB5_CALLCONV + krb5_pac_sign(krb5_context context, krb5_pac pac, krb5_timestamp authtime, +diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c +index ea10e23a95..c7b6e4090d 100644 +--- a/src/kdc/kdc_util.c ++++ b/src/kdc/kdc_util.c +@@ -560,16 +560,36 @@ cleanup: + static krb5_error_code + try_verify_pac(krb5_context context, const krb5_enc_tkt_part *enc_tkt, + krb5_db_entry *server, krb5_keyblock *server_key, +- const krb5_keyblock *tgt_key, krb5_pac *pac_out) ++ krb5_db_entry *tgt, const krb5_keyblock *tgt_key, ++ krb5_pac *pac_out) + { + krb5_error_code ret; ++ krb5_boolean optional_tkt_chksum; ++ char *str = NULL; + krb5_keyblock *privsvr_key; + + ret = pac_privsvr_key(context, server, tgt_key, &privsvr_key); + if (ret) + return ret; +- ret = krb5_kdc_verify_ticket(context, enc_tkt, server->princ, server_key, +- privsvr_key, pac_out); ++ ++ /* Check if the absence of ticket signature is tolerated for this realm */ ++ ret = krb5_dbe_get_string(context, tgt, ++ KRB5_KDB_SK_OPTIONAL_PAC_TKT_CHKSUM, &str); ++ /* TODO: should be using _krb5_conf_boolean(), but os-proto.h is not ++ * available here. ++ */ ++ optional_tkt_chksum = !ret && str && (strncasecmp(str, "true", 4) == 0 ++ || strncasecmp(str, "t", 1) == 0 ++ || strncasecmp(str, "yes", 3) == 0 ++ || strncasecmp(str, "y", 1) == 0 ++ || strncasecmp(str, "1", 1) == 0 ++ || strncasecmp(str, "on", 2) == 0); ++ ++ krb5_dbe_free_string(context, str); ++ ++ ret = krb5_kdc_verify_ticket_ext(context, enc_tkt, server->princ, ++ server_key, privsvr_key, ++ optional_tkt_chksum, pac_out); + krb5_free_keyblock(context, privsvr_key); + return ret; + } +@@ -599,7 +619,7 @@ get_verified_pac(krb5_context context, const krb5_enc_tkt_part *enc_tkt, + server_key, NULL, pac_out); + } + +- ret = try_verify_pac(context, enc_tkt, server, server_key, tgt_key, ++ ret = try_verify_pac(context, enc_tkt, server, server_key, tgt, tgt_key, + pac_out); + if (ret != KRB5KRB_AP_ERR_MODIFIED && ret != KRB5_BAD_ENCTYPE) + return ret; +@@ -613,8 +633,8 @@ get_verified_pac(krb5_context context, const krb5_enc_tkt_part *enc_tkt, + ret = krb5_dbe_decrypt_key_data(context, NULL, kd, &old_key, NULL); + if (ret) + return ret; +- ret = try_verify_pac(context, enc_tkt, server, server_key, &old_key, +- pac_out); ++ ret = try_verify_pac(context, enc_tkt, server, server_key, tgt, ++ &old_key, pac_out); + krb5_free_keyblock_contents(context, &old_key); + if (!ret) + return 0; +diff --git a/src/lib/krb5/krb/pac.c b/src/lib/krb5/krb/pac.c +index 5d1fdf1ba0..0c0e2ada68 100644 +--- a/src/lib/krb5/krb/pac.c ++++ b/src/lib/krb5/krb/pac.c +@@ -594,6 +594,19 @@ krb5_kdc_verify_ticket(krb5_context context, const krb5_enc_tkt_part *enc_tkt, + krb5_const_principal server_princ, + const krb5_keyblock *server, + const krb5_keyblock *privsvr, krb5_pac *pac_out) ++{ ++ return krb5_kdc_verify_ticket_ext(context, enc_tkt, server_princ, server, ++ privsvr, FALSE, pac_out); ++} ++ ++krb5_error_code KRB5_CALLCONV ++krb5_kdc_verify_ticket_ext(krb5_context context, ++ const krb5_enc_tkt_part *enc_tkt, ++ krb5_const_principal server_princ, ++ const krb5_keyblock *server, ++ const krb5_keyblock *privsvr, ++ krb5_boolean optional_tkt_chksum, ++ krb5_pac *pac_out) + { + krb5_error_code ret; + krb5_pac pac = NULL; +@@ -602,7 +615,7 @@ krb5_kdc_verify_ticket(krb5_context context, const krb5_enc_tkt_part *enc_tkt, + krb5_authdata *orig, **ifrel = NULL, **recoded_ifrel = NULL; + uint8_t z = 0; + krb5_authdata zpac = { KV5M_AUTHDATA, KRB5_AUTHDATA_WIN2K_PAC, 1, &z }; +- krb5_boolean is_service_tkt; ++ krb5_boolean is_service_tkt, has_tkt_chksum = FALSE; + size_t i, j; + + *pac_out = NULL; +@@ -667,11 +680,21 @@ krb5_kdc_verify_ticket(krb5_context context, const krb5_enc_tkt_part *enc_tkt, + + ret = verify_checksum(context, pac, KRB5_PAC_TICKET_CHECKSUM, privsvr, + KRB5_KEYUSAGE_APP_DATA_CKSUM, recoded_tkt); +- if (ret) +- goto cleanup; ++ if (ret) { ++ if (!optional_tkt_chksum) ++ goto cleanup; ++ else if (ret != ENOENT) ++ goto cleanup; ++ /* Otherwise ticket signature is absent but optional. Proceed... */ ++ } else { ++ has_tkt_chksum = TRUE; ++ } + } ++ /* Else, we make the assumption the ticket signature is absent in case this ++ * is not a service ticket. ++ */ + +- ret = verify_pac_checksums(context, pac, is_service_tkt, server, privsvr); ++ ret = verify_pac_checksums(context, pac, has_tkt_chksum, server, privsvr); + if (ret) + goto cleanup; + +diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports +index 4c50e935a2..d4b0455c8c 100644 +--- a/src/lib/krb5/libkrb5.exports ++++ b/src/lib/krb5/libkrb5.exports +@@ -463,6 +463,7 @@ krb5_is_thread_safe + krb5_kdc_rep_decrypt_proc + krb5_kdc_sign_ticket + krb5_kdc_verify_ticket ++krb5_kdc_verify_ticket_ext + krb5_kt_add_entry + krb5_kt_client_default + krb5_kt_close +diff --git a/src/man/kadmin.man b/src/man/kadmin.man +index d028dc2975..2c8d10067f 100644 +--- a/src/man/kadmin.man ++++ b/src/man/kadmin.man +@@ -724,6 +724,12 @@ encryption type. It may be necessary to set this value to + "aes256\-sha1" on the cross\-realm krbtgt entry for an Active + Directory realm when using aes\-sha2 keys on the local krbtgt + entry. ++.TP ++\fBoptional_pac_tkt_chksum\fP ++Boolean value defining the behavior of the KDC in case an expected ticket ++checksum signed with one of this principal keys is not present in the PAC. This ++is typically the case for TGS or cross-realm TGS principals when processing ++S4U2Proxy requests. + .UNINDENT + .sp + This command requires the \fBmodify\fP privilege. +-- +2.40.1 + diff --git a/0011-downstream-Catch-SHA-1-digest-disallowed-error-for-P.patch b/0011-downstream-Catch-SHA-1-digest-disallowed-error-for-P.patch deleted file mode 100644 index 373cd1a..0000000 --- a/0011-downstream-Catch-SHA-1-digest-disallowed-error-for-P.patch +++ /dev/null @@ -1,28 +0,0 @@ -From c7d2d7c090bc000acd67b358150b9487f606ff20 Mon Sep 17 00:00:00 2001 -From: Julien Rische -Date: Fri, 19 Aug 2022 10:34:52 +0200 -Subject: [PATCH] [downstream] Catch SHA-1 digest disallowed error for - PKINIT - -An OpenSSL patch causes EVP_R_INVALID_DIGEST error to be raised if -CMS_verify is called to verify a SHA-1 signature. If this error is -caught, it will now return KDC_ERR_DIGEST_IN_SIGNED_DATA_NOT_ACCEPTED. ---- - src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -index 16edf15cb2..bfa3fe8e91 100644 ---- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -@@ -2104,6 +2104,7 @@ cms_signeddata_verify(krb5_context context, - if (CMS_verify(cms, NULL, store, NULL, out, flags) == 0) { - unsigned long err = ERR_peek_last_error(); - switch(ERR_GET_REASON(err)) { -+ case EVP_R_INVALID_DIGEST: - case RSA_R_DIGEST_NOT_ALLOWED: - case CMS_R_UNKNOWN_DIGEST_ALGORITHM: - case CMS_R_NO_MATCHING_DIGEST: --- -2.38.1 - diff --git a/0012-Add-and-use-ts_interval-helper.patch b/0012-Add-and-use-ts_interval-helper.patch deleted file mode 100644 index 5f9647e..0000000 --- a/0012-Add-and-use-ts_interval-helper.patch +++ /dev/null @@ -1,239 +0,0 @@ -From 07ec260c65ec036d44362868df0f796a53495f27 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Mon, 19 Sep 2022 15:18:50 -0400 -Subject: [PATCH] Add and use ts_interval() helper - -ts_delta() returns a signed result, which cannot hold an interval -larger than 2^31-1 seconds. Intervals like this have been seen when -admins set password expiration dates more than 68 years in the future. - -Add a second helper ts_interval() which returns a signed result, and -has the arguments reversed so that the start time is first. Use it in -warn_pw_expiry() to handle the password expiration case, in the GSS -krb5 mech where we return an unsigned context or credential lifetime -to the caller, and in the KEYRING ccache type where we compute an -unsigned keyring timeout. - -ticket: 9071 (new) ---- - src/include/k5-int.h | 9 +++++++++ - src/lib/gssapi/krb5/accept_sec_context.c | 10 ++++++---- - src/lib/gssapi/krb5/acquire_cred.c | 3 +-- - src/lib/gssapi/krb5/context_time.c | 2 +- - src/lib/gssapi/krb5/init_sec_context.c | 4 ++-- - src/lib/gssapi/krb5/inq_context.c | 2 +- - src/lib/gssapi/krb5/inq_cred.c | 2 +- - src/lib/gssapi/krb5/s4u_gss_glue.c | 2 +- - src/lib/krb5/ccache/cc_keyring.c | 4 ++-- - src/lib/krb5/krb/get_in_tkt.c | 15 +++++++-------- - 10 files changed, 31 insertions(+), 22 deletions(-) - -diff --git a/src/include/k5-int.h b/src/include/k5-int.h -index c3aecba7d4..768110e5ef 100644 ---- a/src/include/k5-int.h -+++ b/src/include/k5-int.h -@@ -2325,6 +2325,15 @@ ts_delta(krb5_timestamp a, krb5_timestamp b) - return (krb5_deltat)((uint32_t)a - (uint32_t)b); - } - -+/* Return (end - start) as an unsigned 32-bit value, or 0 if start > end. */ -+static inline uint32_t -+ts_interval(krb5_timestamp start, krb5_timestamp end) -+{ -+ if ((uint32_t)start > (uint32_t)end) -+ return 0; -+ return (uint32_t)end - (uint32_t)start; -+} -+ - /* Increment a timestamp by a signed 32-bit interval, without relying on - * undefined behavior. */ - static inline krb5_timestamp -diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c -index 1bc807172b..7de2c9fd77 100644 ---- a/src/lib/gssapi/krb5/accept_sec_context.c -+++ b/src/lib/gssapi/krb5/accept_sec_context.c -@@ -353,8 +353,8 @@ kg_accept_dce(minor_status, context_handle, verifier_cred_handle, - *mech_type = ctx->mech_used; - - if (time_rec) { -- *time_rec = ts_delta(ctx->krb_times.endtime, now) + -- ctx->k5_context->clockskew; -+ *time_rec = ts_interval(now - ctx->k5_context->clockskew, -+ ctx->krb_times.endtime); - } - - /* Never return GSS_C_DELEG_FLAG since we don't support DCE credential -@@ -1151,8 +1151,10 @@ kg_accept_krb5(minor_status, context_handle, - - /* Add the maximum allowable clock skew as a grace period for context - * expiration, just as we do for the ticket. */ -- if (time_rec) -- *time_rec = ts_delta(ctx->krb_times.endtime, now) + context->clockskew; -+ if (time_rec) { -+ *time_rec = ts_interval(now - context->clockskew, -+ ctx->krb_times.endtime); -+ } - - if (ret_flags) - *ret_flags = ctx->gss_flags; -diff --git a/src/lib/gssapi/krb5/acquire_cred.c b/src/lib/gssapi/krb5/acquire_cred.c -index e226a02692..006eba114d 100644 ---- a/src/lib/gssapi/krb5/acquire_cred.c -+++ b/src/lib/gssapi/krb5/acquire_cred.c -@@ -879,8 +879,7 @@ acquire_cred_context(krb5_context context, OM_uint32 *minor_status, - GSS_C_NO_NAME); - if (GSS_ERROR(ret)) - goto error_out; -- *time_rec = ts_after(cred->expire, now) ? -- ts_delta(cred->expire, now) : 0; -+ *time_rec = ts_interval(now, cred->expire); - k5_mutex_unlock(&cred->lock); - } - } -diff --git a/src/lib/gssapi/krb5/context_time.c b/src/lib/gssapi/krb5/context_time.c -index 1fdb5a16f2..5469d8154c 100644 ---- a/src/lib/gssapi/krb5/context_time.c -+++ b/src/lib/gssapi/krb5/context_time.c -@@ -51,7 +51,7 @@ krb5_gss_context_time(minor_status, context_handle, time_rec) - return(GSS_S_FAILURE); - } - -- lifetime = ts_delta(ctx->krb_times.endtime, now); -+ lifetime = ts_interval(now, ctx->krb_times.endtime); - if (!ctx->initiate) - lifetime += ctx->k5_context->clockskew; - if (lifetime <= 0) { -diff --git a/src/lib/gssapi/krb5/init_sec_context.c b/src/lib/gssapi/krb5/init_sec_context.c -index ea87cf6432..f0f094ccb7 100644 ---- a/src/lib/gssapi/krb5/init_sec_context.c -+++ b/src/lib/gssapi/krb5/init_sec_context.c -@@ -664,7 +664,7 @@ kg_new_connection( - if (time_rec) { - if ((code = krb5_timeofday(context, &now))) - goto cleanup; -- *time_rec = ts_delta(ctx->krb_times.endtime, now); -+ *time_rec = ts_interval(now, ctx->krb_times.endtime); - } - - /* set the other returns */ -@@ -878,7 +878,7 @@ mutual_auth( - if (time_rec) { - if ((code = krb5_timeofday(context, &now))) - goto fail; -- *time_rec = ts_delta(ctx->krb_times.endtime, now); -+ *time_rec = ts_interval(now, ctx->krb_times.endtime); - } - - if (ret_flags) -diff --git a/src/lib/gssapi/krb5/inq_context.c b/src/lib/gssapi/krb5/inq_context.c -index cac024da1f..51c484fdfe 100644 ---- a/src/lib/gssapi/krb5/inq_context.c -+++ b/src/lib/gssapi/krb5/inq_context.c -@@ -120,7 +120,7 @@ krb5_gss_inquire_context(minor_status, context_handle, initiator_name, - - /* Add the maximum allowable clock skew as a grace period for context - * expiration, just as we do for the ticket during authentication. */ -- lifetime = ts_delta(ctx->krb_times.endtime, now); -+ lifetime = ts_interval(now, ctx->krb_times.endtime); - if (!ctx->initiate) - lifetime += context->clockskew; - if (lifetime < 0) -diff --git a/src/lib/gssapi/krb5/inq_cred.c b/src/lib/gssapi/krb5/inq_cred.c -index bb63b726c8..0e675959a3 100644 ---- a/src/lib/gssapi/krb5/inq_cred.c -+++ b/src/lib/gssapi/krb5/inq_cred.c -@@ -131,7 +131,7 @@ krb5_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret, - } - - if (cred->expire != 0) { -- lifetime = ts_delta(cred->expire, now); -+ lifetime = ts_interval(now, cred->expire); - if (lifetime < 0) - lifetime = 0; - } -diff --git a/src/lib/gssapi/krb5/s4u_gss_glue.c b/src/lib/gssapi/krb5/s4u_gss_glue.c -index 7dcfe4e1eb..fa7f980af7 100644 ---- a/src/lib/gssapi/krb5/s4u_gss_glue.c -+++ b/src/lib/gssapi/krb5/s4u_gss_glue.c -@@ -279,7 +279,7 @@ kg_compose_deleg_cred(OM_uint32 *minor_status, - if (code != 0) - goto cleanup; - -- *time_rec = ts_delta(cred->expire, now); -+ *time_rec = ts_interval(now, cred->expire); - } - - major_status = GSS_S_COMPLETE; -diff --git a/src/lib/krb5/ccache/cc_keyring.c b/src/lib/krb5/ccache/cc_keyring.c -index ebef37d607..1dadeef64f 100644 ---- a/src/lib/krb5/ccache/cc_keyring.c -+++ b/src/lib/krb5/ccache/cc_keyring.c -@@ -762,7 +762,7 @@ update_keyring_expiration(krb5_context context, krb5_ccache id) - - /* Setting the timeout to zero would reset the timeout, so we set it to one - * second instead if creds are already expired. */ -- timeout = ts_after(endtime, now) ? ts_delta(endtime, now) : 1; -+ timeout = ts_after(endtime, now) ? ts_interval(now, endtime) : 1; - (void)keyctl_set_timeout(data->cache_id, timeout); - } - -@@ -1343,7 +1343,7 @@ krcc_store(krb5_context context, krb5_ccache id, krb5_creds *creds) - - if (ts_after(creds->times.endtime, now)) { - (void)keyctl_set_timeout(cred_key, -- ts_delta(creds->times.endtime, now)); -+ ts_interval(now, creds->times.endtime)); - } - - update_keyring_expiration(context, id); -diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c -index 8b5ab595e9..1b420a3ac2 100644 ---- a/src/lib/krb5/krb/get_in_tkt.c -+++ b/src/lib/krb5/krb/get_in_tkt.c -@@ -1522,7 +1522,7 @@ warn_pw_expiry(krb5_context context, krb5_get_init_creds_opt *options, - void *expire_data; - krb5_timestamp pw_exp, acct_exp, now; - krb5_boolean is_last_req; -- krb5_deltat delta; -+ uint32_t interval; - char ts[256], banner[1024]; - - if (as_reply == NULL || as_reply->enc_part2 == NULL) -@@ -1553,8 +1553,8 @@ warn_pw_expiry(krb5_context context, krb5_get_init_creds_opt *options, - ret = krb5_timeofday(context, &now); - if (ret != 0) - return; -- if (!is_last_req && -- (ts_after(now, pw_exp) || ts_delta(pw_exp, now) > 7 * 24 * 60 * 60)) -+ interval = ts_interval(now, pw_exp); -+ if (!is_last_req && (!interval || interval > 7 * 24 * 60 * 60)) - return; - - if (!prompter) -@@ -1564,19 +1564,18 @@ warn_pw_expiry(krb5_context context, krb5_get_init_creds_opt *options, - if (ret != 0) - return; - -- delta = ts_delta(pw_exp, now); -- if (delta < 3600) { -+ if (interval < 3600) { - snprintf(banner, sizeof(banner), - _("Warning: Your password will expire in less than one hour " - "on %s"), ts); -- } else if (delta < 86400 * 2) { -+ } else if (interval < 86400 * 2) { - snprintf(banner, sizeof(banner), - _("Warning: Your password will expire in %d hour%s on %s"), -- delta / 3600, delta < 7200 ? "" : "s", ts); -+ interval / 3600, interval < 7200 ? "" : "s", ts); - } else { - snprintf(banner, sizeof(banner), - _("Warning: Your password will expire in %d days on %s"), -- delta / 86400, ts); -+ interval / 86400, ts); - } - - /* PROMPTER_INVOCATION */ --- -2.38.1 - diff --git a/0012-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch b/0012-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch new file mode 100644 index 0000000..c40ed12 --- /dev/null +++ b/0012-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch @@ -0,0 +1,47 @@ +From d1322546dca51100759eac318ce554bd301c50c3 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Tue, 23 May 2023 12:19:54 +0200 +Subject: [PATCH] [downstream] Make PKINIT CMS SHA-1 signature verification + available in FIPS mode + +We recommend using the SHA1 crypto-module in order to allow the +verification of SHA-1 signature for CMS messages. However, this module +does not work in FIPS mode, because the SHA-1 algorithm is absent from +the OpenSSL FIPS provider. + +This commit enables the signature verification process to fetch the +algorithm from a non-FIPS OpenSSL provider. + +Support for SHA-1 CMS signature is still required, especially in order +to interoperate with Active Directory. At least it is until elliptic +curve cryptography is implemented for PKINIT in MIT krb5. +--- + src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index f41328763e..263ef7845e 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -1844,8 +1844,17 @@ cms_signeddata_verify(krb5_context context, + if (oid == NULL) + goto cleanup; + ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++ /* Do not use FIPS provider (even in FIPS mode) because it keeps from ++ * allowing SHA-1 signature verification using the SHA1 crypto-module ++ */ ++ cms = CMS_ContentInfo_new_ex(NULL, "-fips"); ++ if (!cms) ++ goto cleanup; ++#endif ++ + /* decode received CMS message */ +- if ((cms = d2i_CMS_ContentInfo(NULL, &p, (int)signed_data_len)) == NULL) { ++ if (!d2i_CMS_ContentInfo(&cms, &p, (int)signed_data_len)) { + retval = oerr(context, 0, _("Failed to decode CMS message")); + goto cleanup; + } +-- +2.40.1 + diff --git a/0013-Enable-PKINIT-if-at-least-one-group-is-available.patch b/0013-Enable-PKINIT-if-at-least-one-group-is-available.patch new file mode 100644 index 0000000..ebfa323 --- /dev/null +++ b/0013-Enable-PKINIT-if-at-least-one-group-is-available.patch @@ -0,0 +1,218 @@ +From a378b1970d92692baeddf6a8681f47efb13e343d Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Tue, 30 May 2023 01:21:48 -0400 +Subject: [PATCH] Enable PKINIT if at least one group is available + +OpenSSL may no longer allow decoding of non-well-known Diffie-Hellman +group parameters as EVP_PKEY objects in FIPS mode. However, OpenSSL +does not know about MODP group 2 (1024-bit), which is considered as a +custom group. As a consequence, the PKINIT kdcpreauth module fails to +load in FIPS mode. + +Allow initialization of PKINIT plugin if at least one of the MODP +well-known group parameters successfully decodes. + +[ghudson@mit.edu: minor commit message and code edits] + +ticket: 9096 (new) +(cherry picked from commit 509d8db922e9ad6f108883838473b6178f89874a) +--- + src/plugins/preauth/pkinit/pkinit_clnt.c | 2 +- + src/plugins/preauth/pkinit/pkinit_crypto.h | 3 +- + .../preauth/pkinit/pkinit_crypto_openssl.c | 76 +++++++++++-------- + src/plugins/preauth/pkinit/pkinit_srv.c | 2 +- + src/plugins/preauth/pkinit/pkinit_trace.h | 3 + + 5 files changed, 51 insertions(+), 35 deletions(-) + +diff --git a/src/plugins/preauth/pkinit/pkinit_clnt.c b/src/plugins/preauth/pkinit/pkinit_clnt.c +index 725d5bc438..ea9ba454df 100644 +--- a/src/plugins/preauth/pkinit/pkinit_clnt.c ++++ b/src/plugins/preauth/pkinit/pkinit_clnt.c +@@ -1378,7 +1378,7 @@ pkinit_client_plugin_init(krb5_context context, + if (retval) + goto errout; + +- retval = pkinit_init_plg_crypto(&ctx->cryptoctx); ++ retval = pkinit_init_plg_crypto(context, &ctx->cryptoctx); + if (retval) + goto errout; + +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h +index 9fa315d7a0..8bdbea8e95 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto.h ++++ b/src/plugins/preauth/pkinit/pkinit_crypto.h +@@ -103,7 +103,8 @@ typedef struct _pkinit_cert_matching_data { + /* + * Functions to initialize and cleanup crypto contexts + */ +-krb5_error_code pkinit_init_plg_crypto(pkinit_plg_crypto_context *); ++krb5_error_code pkinit_init_plg_crypto(krb5_context, ++ pkinit_plg_crypto_context *); + void pkinit_fini_plg_crypto(pkinit_plg_crypto_context); + + krb5_error_code pkinit_init_req_crypto(pkinit_req_crypto_context *); +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index 263ef7845e..d646073d55 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -47,7 +47,8 @@ + static krb5_error_code pkinit_init_pkinit_oids(pkinit_plg_crypto_context ); + static void pkinit_fini_pkinit_oids(pkinit_plg_crypto_context ); + +-static krb5_error_code pkinit_init_dh_params(pkinit_plg_crypto_context ); ++static krb5_error_code pkinit_init_dh_params(krb5_context, ++ pkinit_plg_crypto_context); + static void pkinit_fini_dh_params(pkinit_plg_crypto_context ); + + static krb5_error_code pkinit_init_certs(pkinit_identity_crypto_context ctx); +@@ -951,7 +952,8 @@ oerr_cert(krb5_context context, krb5_error_code code, X509_STORE_CTX *certctx, + } + + krb5_error_code +-pkinit_init_plg_crypto(pkinit_plg_crypto_context *cryptoctx) ++pkinit_init_plg_crypto(krb5_context context, ++ pkinit_plg_crypto_context *cryptoctx) + { + krb5_error_code retval = ENOMEM; + pkinit_plg_crypto_context ctx = NULL; +@@ -969,7 +971,7 @@ pkinit_init_plg_crypto(pkinit_plg_crypto_context *cryptoctx) + if (retval) + goto out; + +- retval = pkinit_init_dh_params(ctx); ++ retval = pkinit_init_dh_params(context, ctx); + if (retval) + goto out; + +@@ -1278,30 +1280,36 @@ pkinit_fini_pkinit_oids(pkinit_plg_crypto_context ctx) + ASN1_OBJECT_free(ctx->id_kp_serverAuth); + } + +-static krb5_error_code +-pkinit_init_dh_params(pkinit_plg_crypto_context plgctx) ++static int ++try_import_group(krb5_context context, const krb5_data *params, ++ const char *name, EVP_PKEY **pkey_out) + { +- krb5_error_code retval = ENOMEM; +- +- plgctx->dh_1024 = decode_dh_params(&oakley_1024); +- if (plgctx->dh_1024 == NULL) +- goto cleanup; +- +- plgctx->dh_2048 = decode_dh_params(&oakley_2048); +- if (plgctx->dh_2048 == NULL) +- goto cleanup; ++ *pkey_out = decode_dh_params(params); ++ if (*pkey_out == NULL) ++ TRACE_PKINIT_DH_GROUP_UNAVAILABLE(context, name); ++ return (*pkey_out != NULL) ? 1 : 0; ++} + +- plgctx->dh_4096 = decode_dh_params(&oakley_4096); +- if (plgctx->dh_4096 == NULL) +- goto cleanup; ++static krb5_error_code ++pkinit_init_dh_params(krb5_context context, pkinit_plg_crypto_context plgctx) ++{ ++ int n = 0; + +- retval = 0; ++ n += try_import_group(context, &oakley_1024, "MODP 2 (1024-bit)", ++ &plgctx->dh_1024); ++ n += try_import_group(context, &oakley_2048, "MODP 14 (2048-bit)", ++ &plgctx->dh_2048); ++ n += try_import_group(context, &oakley_4096, "MODP 16 (4096-bit)", ++ &plgctx->dh_4096); + +-cleanup: +- if (retval) ++ if (n == 0) { + pkinit_fini_dh_params(plgctx); ++ k5_setmsg(context, ENOMEM, ++ _("PKINIT cannot initialize any key exchange groups")); ++ return ENOMEM; ++ } + +- return retval; ++ return 0; + } + + static void +@@ -2910,11 +2918,11 @@ client_create_dh(krb5_context context, + + if (cryptoctx->received_params != NULL) + params = cryptoctx->received_params; +- else if (dh_size == 1024) ++ else if (plg_cryptoctx->dh_1024 != NULL && dh_size == 1024) + params = plg_cryptoctx->dh_1024; +- else if (dh_size == 2048) ++ else if (plg_cryptoctx->dh_2048 != NULL && dh_size == 2048) + params = plg_cryptoctx->dh_2048; +- else if (dh_size == 4096) ++ else if (plg_cryptoctx->dh_4096 != NULL && dh_size == 4096) + params = plg_cryptoctx->dh_4096; + else + goto cleanup; +@@ -3210,19 +3218,23 @@ pkinit_create_td_dh_parameters(krb5_context context, + krb5_algorithm_identifier alg_4096 = { dh_oid, oakley_4096 }; + krb5_algorithm_identifier *alglist[4]; + +- if (opts->dh_min_bits > 4096) { +- ret = KRB5KRB_ERR_GENERIC; +- goto cleanup; +- } +- + i = 0; +- if (opts->dh_min_bits <= 2048) ++ if (plg_cryptoctx->dh_2048 != NULL && opts->dh_min_bits <= 2048) + alglist[i++] = &alg_2048; +- alglist[i++] = &alg_4096; +- if (opts->dh_min_bits <= 1024) ++ if (plg_cryptoctx->dh_4096 != NULL && opts->dh_min_bits <= 4096) ++ alglist[i++] = &alg_4096; ++ if (plg_cryptoctx->dh_1024 != NULL && opts->dh_min_bits <= 1024) + alglist[i++] = &alg_1024; + alglist[i] = NULL; + ++ if (i == 0) { ++ ret = KRB5KRB_ERR_GENERIC; ++ k5_setmsg(context, ret, ++ _("OpenSSL has no supported key exchange groups for " ++ "pkinit_dh_min_bits=%d"), opts->dh_min_bits); ++ goto cleanup; ++ } ++ + ret = k5int_encode_krb5_td_dh_parameters(alglist, &der_alglist); + if (ret) + goto cleanup; +diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c +index 1b3bf6d4d0..768a4e559f 100644 +--- a/src/plugins/preauth/pkinit/pkinit_srv.c ++++ b/src/plugins/preauth/pkinit/pkinit_srv.c +@@ -1222,7 +1222,7 @@ pkinit_server_plugin_init_realm(krb5_context context, const char *realmname, + goto errout; + plgctx->realmname_len = strlen(plgctx->realmname); + +- retval = pkinit_init_plg_crypto(&plgctx->cryptoctx); ++ retval = pkinit_init_plg_crypto(context, &plgctx->cryptoctx); + if (retval) + goto errout; + +diff --git a/src/plugins/preauth/pkinit/pkinit_trace.h b/src/plugins/preauth/pkinit/pkinit_trace.h +index 259e95c6c2..5ee39c085c 100644 +--- a/src/plugins/preauth/pkinit/pkinit_trace.h ++++ b/src/plugins/preauth/pkinit/pkinit_trace.h +@@ -90,6 +90,9 @@ + #define TRACE_PKINIT_CLIENT_TRYAGAIN(c) \ + TRACE(c, "PKINIT client trying again with KDC-provided parameters") + ++#define TRACE_PKINIT_DH_GROUP_UNAVAILABLE(c, name) \ ++ TRACE(c, "PKINIT key exchange group {str} unsupported", name) ++ + #define TRACE_PKINIT_OPENSSL_ERROR(c, msg) \ + TRACE(c, "PKINIT OpenSSL error: {str}", msg) + +-- +2.40.1 + diff --git a/0017-Add-PAC-full-checksums.patch b/0017-Add-PAC-full-checksums.patch deleted file mode 100644 index f0a20f6..0000000 --- a/0017-Add-PAC-full-checksums.patch +++ /dev/null @@ -1,672 +0,0 @@ -From 5801da1ddc3b0984ad6997bb7a692eac85ff7dd3 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Thu, 22 Dec 2022 03:05:23 -0500 -Subject: [PATCH] Add PAC full checksums - -A paper by Tom Tervoort noted that computing the PAC privsvr checksum -over only the server checksum is vulnerable to collision attacks -(CVE-2022-37967). In response, Microsoft has added a second KDC -checksum over the full contents of the PAC. Generate and verify full -KDC checksums in PACs for service tickets. Update the t_pac.c ticket -test case to use a ticket issued by a recent version of Active -Directory (provided by Stefan Metzmacher). - -ticket: 9084 (new) ---- - doc/appdev/refs/macros/index.rst | 1 + - src/include/krb5/krb5.hin | 1 + - src/lib/krb5/krb/pac.c | 92 +++++++++-------- - src/lib/krb5/krb/pac_sign.c | 146 +++++++++++++++----------- - src/lib/krb5/krb/t_pac.c | 171 ++++++++++++++++++------------- - src/tests/t_authdata.py | 4 +- - 6 files changed, 240 insertions(+), 175 deletions(-) - -diff --git a/doc/appdev/refs/macros/index.rst b/doc/appdev/refs/macros/index.rst -index 5f34dea5e8..3eeee25593 100644 ---- a/doc/appdev/refs/macros/index.rst -+++ b/doc/appdev/refs/macros/index.rst -@@ -247,6 +247,7 @@ Public - KRB5_PAC_SERVER_CHECKSUM.rst - KRB5_PAC_TICKET_CHECKSUM.rst - KRB5_PAC_UPN_DNS_INFO.rst -+ KRB5_PAC_FULL_CHECKSUM.rst - KRB5_PADATA_AFS3_SALT.rst - KRB5_PADATA_AP_REQ.rst - KRB5_PADATA_AS_CHECKSUM.rst -diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin -index fb9f2a366c..2ba4010514 100644 ---- a/src/include/krb5/krb5.hin -+++ b/src/include/krb5/krb5.hin -@@ -8164,6 +8164,7 @@ krb5_verify_authdata_kdc_issued(krb5_context context, - #define KRB5_PAC_TICKET_CHECKSUM 16 /**< Ticket checksum */ - #define KRB5_PAC_ATTRIBUTES_INFO 17 /**< PAC attributes */ - #define KRB5_PAC_REQUESTOR 18 /**< PAC requestor SID */ -+#define KRB5_PAC_FULL_CHECKSUM 19 /**< KDC full checksum */ - - struct krb5_pac_data; - /** PAC data structure to convey authorization information */ -diff --git a/src/lib/krb5/krb/pac.c b/src/lib/krb5/krb/pac.c -index f6c4373de0..954482e0c7 100644 ---- a/src/lib/krb5/krb/pac.c -+++ b/src/lib/krb5/krb/pac.c -@@ -490,7 +490,8 @@ zero_signature(krb5_context context, const krb5_pac pac, krb5_ui_4 type, - size_t i; - - assert(type == KRB5_PAC_SERVER_CHECKSUM || -- type == KRB5_PAC_PRIVSVR_CHECKSUM); -+ type == KRB5_PAC_PRIVSVR_CHECKSUM || -+ type == KRB5_PAC_FULL_CHECKSUM); - assert(data->length >= pac->data.length); - - for (i = 0; i < pac->pac->cBuffers; i++) { -@@ -557,17 +558,17 @@ verify_checksum(krb5_context context, const krb5_pac pac, uint32_t buffer_type, - } - - static krb5_error_code --verify_server_checksum(krb5_context context, const krb5_pac pac, -- const krb5_keyblock *server) -+verify_pac_checksums(krb5_context context, const krb5_pac pac, -+ krb5_boolean expect_full_checksum, -+ const krb5_keyblock *server, const krb5_keyblock *privsvr) - { - krb5_error_code ret; -- krb5_data copy; /* PAC with zeroed checksums */ -+ krb5_data copy, server_checksum; - -+ /* Make a copy of the PAC with zeroed out server and privsvr checksums. */ - ret = krb5int_copy_data_contents(context, &pac->data, ©); - if (ret) - return ret; -- -- /* Zero out both checksum buffers */ - ret = zero_signature(context, pac, KRB5_PAC_SERVER_CHECKSUM, ©); - if (ret) - goto cleanup; -@@ -575,32 +576,46 @@ verify_server_checksum(krb5_context context, const krb5_pac pac, - if (ret) - goto cleanup; - -- ret = verify_checksum(context, pac, KRB5_PAC_SERVER_CHECKSUM, server, -- KRB5_KEYUSAGE_APP_DATA_CKSUM, ©); -+ if (server != NULL) { -+ /* Verify the server checksum over the PAC copy. */ -+ ret = verify_checksum(context, pac, KRB5_PAC_SERVER_CHECKSUM, server, -+ KRB5_KEYUSAGE_APP_DATA_CKSUM, ©); -+ } - --cleanup: -- free(copy.data); -- return ret; --} -+ if (privsvr != NULL && expect_full_checksum) { -+ /* Zero the full checksum buffer in the copy and verify the full -+ * checksum over the copy with all three checksums zeroed. */ -+ ret = zero_signature(context, pac, KRB5_PAC_FULL_CHECKSUM, ©); -+ if (ret) -+ goto cleanup; -+ ret = verify_checksum(context, pac, KRB5_PAC_FULL_CHECKSUM, privsvr, -+ KRB5_KEYUSAGE_APP_DATA_CKSUM, ©); -+ if (ret) -+ goto cleanup; -+ } - --static krb5_error_code --verify_kdc_checksum(krb5_context context, const krb5_pac pac, -- const krb5_keyblock *privsvr) --{ -- krb5_error_code ret; -- krb5_data server_checksum; -+ if (privsvr != NULL) { -+ /* Verify the privsvr checksum over the server checksum. */ -+ ret = k5_pac_locate_buffer(context, pac, KRB5_PAC_SERVER_CHECKSUM, -+ &server_checksum); -+ if (ret) -+ return ret; -+ if (server_checksum.length < PAC_SIGNATURE_DATA_LENGTH) -+ return KRB5_BAD_MSIZE; -+ server_checksum.data += PAC_SIGNATURE_DATA_LENGTH; -+ server_checksum.length -= PAC_SIGNATURE_DATA_LENGTH; - -- ret = k5_pac_locate_buffer(context, pac, KRB5_PAC_SERVER_CHECKSUM, -- &server_checksum); -- if (ret) -- return ret; -- if (server_checksum.length < PAC_SIGNATURE_DATA_LENGTH) -- return KRB5_BAD_MSIZE; -- server_checksum.data += PAC_SIGNATURE_DATA_LENGTH; -- server_checksum.length -= PAC_SIGNATURE_DATA_LENGTH; -+ ret = verify_checksum(context, pac, KRB5_PAC_PRIVSVR_CHECKSUM, privsvr, -+ KRB5_KEYUSAGE_APP_DATA_CKSUM, &server_checksum); -+ if (ret) -+ goto cleanup; -+ } -+ -+ pac->verified = TRUE; - -- return verify_checksum(context, pac, KRB5_PAC_PRIVSVR_CHECKSUM, privsvr, -- KRB5_KEYUSAGE_APP_DATA_CKSUM, &server_checksum); -+cleanup: -+ free(copy.data); -+ return ret; - } - - /* Per MS-PAC 2.8.3, tickets encrypted to TGS and password change principals -@@ -628,6 +643,7 @@ krb5_kdc_verify_ticket(krb5_context context, const krb5_enc_tkt_part *enc_tkt, - krb5_authdata **authdata, *orig, **ifrel = NULL, **recoded_ifrel = NULL; - uint8_t z = 0; - krb5_authdata zpac = { KV5M_AUTHDATA, KRB5_AUTHDATA_WIN2K_PAC, 1, &z }; -+ krb5_boolean is_service_tkt; - size_t i, j; - - *pac_out = NULL; -@@ -669,7 +685,8 @@ krb5_kdc_verify_ticket(krb5_context context, const krb5_enc_tkt_part *enc_tkt, - if (ret) - goto cleanup; - -- if (privsvr != NULL && k5_pac_should_have_ticket_signature(server_princ)) { -+ is_service_tkt = k5_pac_should_have_ticket_signature(server_princ); -+ if (privsvr != NULL && is_service_tkt) { - /* To check the PAC ticket signatures, re-encode the ticket with the - * PAC contents replaced by a single zero. */ - orig = ifrel[j]; -@@ -693,8 +710,9 @@ krb5_kdc_verify_ticket(krb5_context context, const krb5_enc_tkt_part *enc_tkt, - goto cleanup; - } - -- ret = krb5_pac_verify_ext(context, pac, enc_tkt->times.authtime, NULL, -- server, privsvr, FALSE); -+ ret = verify_pac_checksums(context, pac, is_service_tkt, server, privsvr); -+ if (ret) -+ goto cleanup; - - *pac_out = pac; - pac = NULL; -@@ -730,14 +748,8 @@ krb5_pac_verify_ext(krb5_context context, - { - krb5_error_code ret; - -- if (server != NULL) { -- ret = verify_server_checksum(context, pac, server); -- if (ret != 0) -- return ret; -- } -- -- if (privsvr != NULL) { -- ret = verify_kdc_checksum(context, pac, privsvr); -+ if (server != NULL || privsvr != NULL) { -+ ret = verify_pac_checksums(context, pac, FALSE, server, privsvr); - if (ret != 0) - return ret; - } -@@ -749,8 +761,6 @@ krb5_pac_verify_ext(krb5_context context, - return ret; - } - -- pac->verified = TRUE; -- - return 0; - } - -diff --git a/src/lib/krb5/krb/pac_sign.c b/src/lib/krb5/krb/pac_sign.c -index 0f9581abbb..8ea61ac17b 100644 ---- a/src/lib/krb5/krb/pac_sign.c -+++ b/src/lib/krb5/krb/pac_sign.c -@@ -187,26 +187,41 @@ k5_pac_encode_header(krb5_context context, krb5_pac pac) - return 0; - } - --krb5_error_code KRB5_CALLCONV --krb5_pac_sign(krb5_context context, krb5_pac pac, krb5_timestamp authtime, -- krb5_const_principal principal, const krb5_keyblock *server_key, -- const krb5_keyblock *privsvr_key, krb5_data *data) -+/* Find the buffer of type buftype in pac and write within it a checksum of -+ * type cksumtype over data. Set *cksum_out to the checksum. */ -+static krb5_error_code -+compute_pac_checksum(krb5_context context, krb5_pac pac, uint32_t buftype, -+ const krb5_keyblock *key, krb5_cksumtype cksumtype, -+ const krb5_data *data, krb5_data *cksum_out) - { -- return krb5_pac_sign_ext(context, pac, authtime, principal, server_key, -- privsvr_key, FALSE, data); -+ krb5_error_code ret; -+ krb5_data buf; -+ krb5_crypto_iov iov[2]; -+ -+ ret = k5_pac_locate_buffer(context, pac, buftype, &buf); -+ if (ret) -+ return ret; -+ -+ assert(buf.length > PAC_SIGNATURE_DATA_LENGTH); -+ *cksum_out = make_data(buf.data + PAC_SIGNATURE_DATA_LENGTH, -+ buf.length - PAC_SIGNATURE_DATA_LENGTH); -+ iov[0].flags = KRB5_CRYPTO_TYPE_DATA; -+ iov[0].data = *data; -+ iov[1].flags = KRB5_CRYPTO_TYPE_CHECKSUM; -+ iov[1].data = *cksum_out; -+ return krb5_c_make_checksum_iov(context, cksumtype, key, -+ KRB5_KEYUSAGE_APP_DATA_CKSUM, iov, 2); - } - --krb5_error_code KRB5_CALLCONV --krb5_pac_sign_ext(krb5_context context, krb5_pac pac, krb5_timestamp authtime, -- krb5_const_principal principal, -- const krb5_keyblock *server_key, -- const krb5_keyblock *privsvr_key, krb5_boolean with_realm, -- krb5_data *data) -+static krb5_error_code -+sign_pac(krb5_context context, krb5_pac pac, krb5_timestamp authtime, -+ krb5_const_principal principal, const krb5_keyblock *server_key, -+ const krb5_keyblock *privsvr_key, krb5_boolean with_realm, -+ krb5_boolean is_service_tkt, krb5_data *data) - { - krb5_error_code ret; -- krb5_data server_cksum, privsvr_cksum; -+ krb5_data full_cksum, server_cksum, privsvr_cksum; - krb5_cksumtype server_cksumtype, privsvr_cksumtype; -- krb5_crypto_iov iov[2]; - - data->length = 0; - data->data = NULL; -@@ -214,67 +229,53 @@ krb5_pac_sign_ext(krb5_context context, krb5_pac pac, krb5_timestamp authtime, - if (principal != NULL) { - ret = k5_insert_client_info(context, pac, authtime, principal, - with_realm); -- if (ret != 0) -+ if (ret) - return ret; - } - -- /* Create zeroed buffers for both checksums */ -+ /* Create zeroed buffers for all checksums. */ - ret = k5_insert_checksum(context, pac, KRB5_PAC_SERVER_CHECKSUM, - server_key, &server_cksumtype); -- if (ret != 0) -+ if (ret) - return ret; -- - ret = k5_insert_checksum(context, pac, KRB5_PAC_PRIVSVR_CHECKSUM, - privsvr_key, &privsvr_cksumtype); -- if (ret != 0) -+ if (ret) - return ret; -+ if (is_service_tkt) { -+ ret = k5_insert_checksum(context, pac, KRB5_PAC_FULL_CHECKSUM, -+ privsvr_key, &privsvr_cksumtype); -+ if (ret) -+ return ret; -+ } - -- /* Now, encode the PAC header so that the checksums will include it */ -+ /* Encode the PAC header so that the checksums will include it. */ - ret = k5_pac_encode_header(context, pac); -- if (ret != 0) -- return ret; -- -- /* Generate the server checksum over the entire PAC */ -- ret = k5_pac_locate_buffer(context, pac, KRB5_PAC_SERVER_CHECKSUM, -- &server_cksum); -- if (ret != 0) -+ if (ret) - return ret; - -- assert(server_cksum.length > PAC_SIGNATURE_DATA_LENGTH); -- -- iov[0].flags = KRB5_CRYPTO_TYPE_DATA; -- iov[0].data = pac->data; -- -- iov[1].flags = KRB5_CRYPTO_TYPE_CHECKSUM; -- iov[1].data.data = server_cksum.data + PAC_SIGNATURE_DATA_LENGTH; -- iov[1].data.length = server_cksum.length - PAC_SIGNATURE_DATA_LENGTH; -+ if (is_service_tkt) { -+ /* Generate a full KDC checksum over the whole PAC. */ -+ ret = compute_pac_checksum(context, pac, KRB5_PAC_FULL_CHECKSUM, -+ privsvr_key, privsvr_cksumtype, -+ &pac->data, &full_cksum); -+ if (ret) -+ return ret; -+ } - -- ret = krb5_c_make_checksum_iov(context, server_cksumtype, -- server_key, KRB5_KEYUSAGE_APP_DATA_CKSUM, -- iov, sizeof(iov)/sizeof(iov[0])); -- if (ret != 0) -+ /* Generate the server checksum over the whole PAC, including the full KDC -+ * checksum if we added one. */ -+ ret = compute_pac_checksum(context, pac, KRB5_PAC_SERVER_CHECKSUM, -+ server_key, server_cksumtype, &pac->data, -+ &server_cksum); -+ if (ret) - return ret; - -- /* Generate the privsvr checksum over the server checksum buffer */ -- ret = k5_pac_locate_buffer(context, pac, KRB5_PAC_PRIVSVR_CHECKSUM, -+ /* Generate the privsvr checksum over the server checksum buffer. */ -+ ret = compute_pac_checksum(context, pac, KRB5_PAC_PRIVSVR_CHECKSUM, -+ privsvr_key, privsvr_cksumtype, &server_cksum, - &privsvr_cksum); -- if (ret != 0) -- return ret; -- -- assert(privsvr_cksum.length > PAC_SIGNATURE_DATA_LENGTH); -- -- iov[0].flags = KRB5_CRYPTO_TYPE_DATA; -- iov[0].data.data = server_cksum.data + PAC_SIGNATURE_DATA_LENGTH; -- iov[0].data.length = server_cksum.length - PAC_SIGNATURE_DATA_LENGTH; -- -- iov[1].flags = KRB5_CRYPTO_TYPE_CHECKSUM; -- iov[1].data.data = privsvr_cksum.data + PAC_SIGNATURE_DATA_LENGTH; -- iov[1].data.length = privsvr_cksum.length - PAC_SIGNATURE_DATA_LENGTH; -- -- ret = krb5_c_make_checksum_iov(context, privsvr_cksumtype, -- privsvr_key, KRB5_KEYUSAGE_APP_DATA_CKSUM, -- iov, sizeof(iov)/sizeof(iov[0])); -- if (ret != 0) -+ if (ret) - return ret; - - data->data = k5memdup(pac->data.data, pac->data.length, &ret); -@@ -288,6 +289,26 @@ krb5_pac_sign_ext(krb5_context context, krb5_pac pac, krb5_timestamp authtime, - return 0; - } - -+krb5_error_code KRB5_CALLCONV -+krb5_pac_sign(krb5_context context, krb5_pac pac, krb5_timestamp authtime, -+ krb5_const_principal principal, const krb5_keyblock *server_key, -+ const krb5_keyblock *privsvr_key, krb5_data *data) -+{ -+ return sign_pac(context, pac, authtime, principal, server_key, -+ privsvr_key, FALSE, FALSE, data); -+} -+ -+krb5_error_code KRB5_CALLCONV -+krb5_pac_sign_ext(krb5_context context, krb5_pac pac, krb5_timestamp authtime, -+ krb5_const_principal principal, -+ const krb5_keyblock *server_key, -+ const krb5_keyblock *privsvr_key, krb5_boolean with_realm, -+ krb5_data *data) -+{ -+ return sign_pac(context, pac, authtime, principal, server_key, privsvr_key, -+ with_realm, FALSE, data); -+} -+ - /* Add a signature over der_enc_tkt in privsvr to pac. der_enc_tkt should be - * encoded with a dummy PAC authdata element containing a single zero byte. */ - static krb5_error_code -@@ -359,6 +380,7 @@ krb5_kdc_sign_ticket(krb5_context context, krb5_enc_tkt_part *enc_tkt, - krb5_error_code ret; - krb5_data *der_enc_tkt = NULL, pac_data = empty_data(); - krb5_authdata **list, *pac_ad; -+ krb5_boolean is_service_tkt; - size_t count; - - /* Reallocate space for another authdata element in enc_tkt. */ -@@ -377,7 +399,8 @@ krb5_kdc_sign_ticket(krb5_context context, krb5_enc_tkt_part *enc_tkt, - memmove(list + 1, list, (count + 1) * sizeof(*list)); - list[0] = pac_ad; - -- if (k5_pac_should_have_ticket_signature(server_princ)) { -+ is_service_tkt = k5_pac_should_have_ticket_signature(server_princ); -+ if (is_service_tkt) { - ret = encode_krb5_enc_tkt_part(enc_tkt, &der_enc_tkt); - if (ret) - goto cleanup; -@@ -388,9 +411,8 @@ krb5_kdc_sign_ticket(krb5_context context, krb5_enc_tkt_part *enc_tkt, - goto cleanup; - } - -- ret = krb5_pac_sign_ext(context, pac, enc_tkt->times.authtime, -- client_princ, server, privsvr, with_realm, -- &pac_data); -+ ret = sign_pac(context, pac, enc_tkt->times.authtime, client_princ, server, -+ privsvr, with_realm, is_service_tkt, &pac_data); - if (ret) - goto cleanup; - -diff --git a/src/lib/krb5/krb/t_pac.c b/src/lib/krb5/krb/t_pac.c -index 173bde7bab..81f1642ab0 100644 ---- a/src/lib/krb5/krb/t_pac.c -+++ b/src/lib/krb5/krb/t_pac.c -@@ -607,78 +607,102 @@ check_pac(krb5_context context, int index, const unsigned char *pdata, - - static const krb5_keyblock ticket_sig_krbtgt_key = { - 0, ENCTYPE_AES256_CTS_HMAC_SHA1_96, -- 32, U("\x7a\x58\x98\xd2\xaf\xa6\xaf\xc0\x6a\xce\x06\x04\x4b\xc2\x70\x84" -- "\x9b\x8e\x0a\x6c\x4c\x07\xdc\x6f\xbb\x48\x43\xe1\xd2\xaa\x97\xf7") -+ 32, U("\x03\x73\x81\xEC\x43\x96\x7B\xC2\xAC\x3D\xF5\x2A\xAE\x95\xA6\x8E" -+ "\xBE\x24\x58\xDB\xCE\x52\x28\x20\xAF\x5E\xB7\x04\xA2\x22\x71\x4F") - }; - - static const krb5_keyblock ticket_sig_server_key = { -- 0, ENCTYPE_ARCFOUR_HMAC, -- 16, U("\xed\x23\x11\x20\x7a\x21\x44\x20\xbf\xc0\x8d\x36\xf7\xf6\xb2\x3e") -+ 0, ENCTYPE_AES256_CTS_HMAC_SHA1_96, -+ 32, U("\x11\x4A\x84\xE3\x14\x8F\xAA\xB1\xFA\x7B\x53\x51\xB2\x8A\xC2\xF1" -+ "\xFD\x19\x6D\x61\xE0\xF3\xF2\x3E\x1F\xDB\xD3\xC1\x79\x7D\xC1\xEE") - }; - -+/* A ticket issued by an Active Directory KDC (Windows Server 2022), containing -+ * a PAC with a full checksum. */ - static const krb5_data ticket_data = { -- .length = 972, .data = -- "\x61\x82\x03\xC8\x30\x82\x03\xC4\xA0\x03\x02\x01\x05\xA1\x0A\x1B" -- "\x08\x43\x44\x4F\x4D\x2E\x43\x4F\x4D\xA2\x0F\x30\x0D\xA0\x03\x02" -- "\x01\x01\xA1\x06\x30\x04\x1B\x02\x73\x31\xA3\x82\x03\x9E\x30\x82" -- "\x03\x9A\xA0\x03\x02\x01\x17\xA1\x03\x02\x01\x03\xA2\x82\x03\x8C" -- "\x04\x82\x03\x88\x44\x31\x61\x20\x17\xC9\xFE\xBC\xAC\x46\xB5\x77" -- "\xE9\x68\x04\x4C\x9B\x31\x91\x0C\xC1\xD4\xDD\xEF\xC7\x34\x20\x08" -- "\x90\x91\xE8\x79\xE0\xB5\x03\x26\xA4\x65\xDE\xEC\x47\x03\x2A\x8F" -- "\x61\xE7\x4D\x38\x5A\x42\x95\x5A\xF9\x2F\x41\x2C\x2A\x6E\x60\xA1" -- "\xEB\x51\xB3\xBD\x4C\x00\x41\x2A\x44\x76\x08\x37\x1A\x51\xFD\x65" -- "\x67\x7E\xBF\x3D\x90\x86\xE3\x9A\x54\x6B\x67\xA8\x08\x7A\x73\xCC" -- "\xC3\xB7\x4B\xD5\x5C\x3A\x14\x6C\xC1\x5F\x54\x4B\x92\x55\xB4\xB7" -- "\x92\x23\x3F\x53\x89\x47\x8E\x1F\x8B\xB9\xDB\x3B\x93\xE8\x70\xE4" -- "\x24\xB8\x9D\xF0\x0E\x35\x28\xF8\x7A\x27\x5D\xF7\x25\x97\x9C\xF5" -- "\x9F\x9F\x64\x04\xF2\xA3\xAB\x11\x15\xB6\xDA\x18\xD6\x46\xD5\xE6" -- "\xB8\x08\xDE\x0A\x62\xFD\xF8\xAA\x52\x90\xD9\x67\x29\xB2\xCD\x06" -- "\xB6\xB0\x50\x2B\x3F\x0F\xA3\xA5\xBF\xAA\x6E\x40\x03\xD6\x5F\x02" -- "\xBC\xD8\x18\x47\x97\x09\xD7\xE4\x96\x3B\xCB\xEB\x92\x2C\x3C\x49" -- "\xFF\x1F\x71\xE0\x52\x94\x0F\x8B\x9F\xB8\x2A\xBB\x9C\xE2\xA3\xDD" -- "\x38\x89\xE2\xB1\x0B\x9E\x1F\x7A\xB3\xE3\xD2\xB0\x94\xDC\x87\xBE" -- "\x37\xA6\xD3\xB3\x29\x35\x9A\x72\xC3\x7A\xF1\xA9\xE6\xC5\xD1\x26" -- "\x83\x65\x44\x17\xBA\x55\xA8\x5E\x94\x26\xED\xE9\x8A\x93\x11\x5D" -- "\x7E\x20\x1B\x9C\x15\x9E\x13\x37\x03\x4D\xDD\x99\x51\xD8\x66\x29" -- "\x6A\xB9\xFB\x49\xFE\x52\x78\xDA\x86\x85\xA9\xA3\xB9\xEF\xEC\xAD" -- "\x35\xA6\x8D\xAC\x0F\x75\x22\xBB\x0B\x49\x1C\x13\x52\x40\xC9\x52" -- "\x69\x09\x54\xD1\x0F\x94\x3F\x22\x48\x67\xB0\x96\x28\xAA\xE6\x28" -- "\xD9\x0C\x08\xEF\x51\xED\x15\x5E\xA2\x53\x59\xA5\x03\xB4\x06\x20" -- "\x3D\xCC\xB4\xC5\xF8\x8C\x73\x67\xA3\x21\x3D\x19\xCD\xD4\x12\x28" -- "\xD2\x93\xDE\x0D\xF0\x71\x10\x50\xD6\x33\x35\x04\x11\x64\x43\x39" -- "\xC3\xDF\x96\xE3\x66\xE3\x85\xCA\xE7\x67\x14\x3A\xF0\x43\xAA\xBB" -- "\xD4\x1D\xB5\x24\xB5\x74\x90\x25\xA7\x87\x7E\xDB\xD3\x83\x8A\x3A" -- "\x69\xA8\x2D\xAF\xB7\xB8\xF3\xDC\x13\xAF\x45\x61\x3F\x59\x39\x7E" -- "\x69\xDE\x0C\x04\xF1\x10\x6B\xB4\x56\xFA\x21\x9F\x72\x2B\x60\x86" -- "\xE3\x23\x0E\xC4\x51\xF6\xBE\xD8\xE1\x5F\xEE\x73\x4C\x17\x4C\x2C" -- "\x1B\xFB\x9F\x1F\x7A\x3B\x07\x5B\x8E\xF1\x01\xAC\xD6\x30\x94\x8A" -- "\x5D\x22\x6F\x08\xCE\xED\x5E\xB6\xDB\x86\x8C\x87\xEB\x8D\x91\xFF" -- "\x0A\x86\x30\xBD\xC0\xF8\x25\xE7\xAE\x24\x35\xF2\xFC\xE5\xFD\x1B" -- "\xB0\x05\x4A\xA3\xE5\xEB\x2E\x05\xAD\x99\x67\x49\x87\xE6\xB3\x87" -- "\x82\xA4\x59\xA7\x6E\xDD\xF2\xB6\x66\xE8\xF7\x70\xF5\xBD\xC9\x0E" -- "\xFA\x9C\x79\x84\xD4\x9B\x05\x0E\xBB\xF5\xDB\xEF\xFC\xCC\x26\xF2" -- "\x93\xCF\xD2\x04\x3C\xA9\x2C\x65\x42\x97\x86\xD8\x38\x0A\x1E\xF6" -- "\xD6\xCA\x30\xB5\x1A\xEC\xFB\xBA\x3B\x84\x57\xB0\xFD\xFB\xE6\xBC" -- "\xF2\x76\xF6\x4C\xBB\xAB\xB1\x31\xA1\x27\x7C\xE6\xE6\x81\xB6\xCE" -- "\x84\x86\x40\xB6\x40\x33\xC4\xF8\xB4\x15\xCF\xAA\xA5\x51\x78\xB9" -- "\x8B\x50\x25\xB2\x88\x86\x96\x72\x8C\x71\x4D\xB5\x3A\x94\x86\x77" -- "\x0E\x95\x9B\x16\x93\xEF\x3A\x11\x79\xBA\x83\xF7\x74\xD3\x8D\xBA" -- "\x15\xE1\x2C\x04\x57\xA8\x92\x1E\x9D\x00\x8E\x20\xFD\x30\x70\xE7" -- "\xF5\x65\x2F\x19\x0C\x94\xBA\x03\x71\x12\x96\xCD\xC8\xB4\x96\xDB" -- "\xCE\x19\xC2\xDF\x3C\xC2\xF6\x3D\x53\xED\x98\xA5\x41\x72\x2A\x22" -- "\x7B\xF3\x2B\x17\x6C\xE1\x39\x7D\xAE\x9B\x11\xF9\xC1\xA6\x9E\x9F" -- "\x89\x3C\x12\xAA\x94\x74\xA7\x4F\x70\xE8\xB9\xDE\x04\xF0\x9D\x39" -- "\x24\x2D\x92\xE8\x46\x2D\x2E\xF0\x40\x66\x1A\xD9\x27\xF9\x98\xF1" -- "\x81\x1D\x70\x62\x63\x30\x6D\xCD\x84\x04\x5F\xFA\x83\xD3\xEC\x8D" -- "\x86\xFB\x40\x61\xC1\x8A\x45\xFF\x7B\xD9\xD4\x18\x61\x7F\x51\xE3" -- "\xFC\x1E\x18\xF0\xAF\xC6\x18\x2C\xE1\x6D\x5D\xF9\x62\xFC\x20\xA3" -- "\xB2\x8A\x5F\xE5\xBB\x29\x0F\x99\x63\x07\x88\x38\x3A\x3B\x73\x2A" -- "\x6D\xDA\x3D\xA8\x0D\x8F\x56\x41\x89\x82\xE5\xB8\x61\x00\x64\x7D" -- "\x17\x0C\xCE\x03\x55\x8F\xF4\x5B\x0D\x50\xF2\xEB\x05\x67\xBE\xDB" -- "\x7B\x75\xC5\xEA\xA1\xAB\x1D\xB0\x3C\x6D\x42\x08\x0B\x9A\x45\x20" -- "\xA8\x8F\xE5\x67\x47\x30\xDE\x93\x5F\x43\x05\xEB\xA8\x2D\x80\xF5" -- "\x1A\xB8\x4A\x4E\x42\x2D\x0B\x7A\xDC\x46\x20\x2D\x13\x17\xDD\x4B" -- "\x94\x96\xAA\x1F\x06\x0C\x1F\x62\x07\x9C\x40\xA1" -+ .length = 1307, .data = -+ "\x61\x82\x05\x17\x30\x82\x05\x13\xA0\x03\x02\x01\x05\xA1\x0F\x1B" -+ "\x0D\x57\x32\x30\x32\x32\x2D\x4C\x37\x2E\x42\x41\x53\x45\xA2\x2A" -+ "\x30\x28\xA0\x03\x02\x01\x01\xA1\x21\x30\x1F\x1B\x04\x63\x69\x66" -+ "\x73\x1B\x17\x77\x32\x30\x32\x32\x2D\x31\x31\x38\x2E\x77\x32\x30" -+ "\x32\x32\x2D\x6C\x37\x2E\x62\x61\x73\x65\xA3\x82\x04\xCD\x30\x82" -+ "\x04\xC9\xA0\x03\x02\x01\x12\xA1\x03\x02\x01\x05\xA2\x82\x04\xBB" -+ "\x04\x82\x04\xB7\x44\x5C\x7B\x5A\x3F\x2E\xA3\x50\x34\xDE\xB0\x69" -+ "\x23\x2D\x47\x89\x2C\xC0\xA3\xF9\xDD\x70\xAA\xA5\x1E\xFE\x74\xE5" -+ "\x19\xA2\x4F\x65\x6C\x9E\x00\xB4\x60\x00\x7C\x0C\x29\x43\x31\x99" -+ "\x77\x02\x73\xED\xB9\x40\xF5\xD2\xD1\xC9\x20\x0F\xE3\x38\xF9\xCC" -+ "\x5E\x2A\xBD\x1F\x91\x66\x1A\xD8\x2A\x80\x3C\x2C\x00\x3C\x1E\xC9" -+ "\x2A\x29\x19\x19\x96\x18\x54\x03\x97\x8F\x1D\x5F\xDB\xE9\x66\x68" -+ "\xCD\xB1\xD5\x00\x35\x69\x49\x45\xF1\x6A\x78\x7B\x37\x71\x87\x14" -+ "\x1C\x98\x4D\x69\xCB\x1B\xD8\xF5\xA3\xD8\x53\x4A\x75\x76\x62\xBA" -+ "\x6C\x3F\xEA\x8B\x97\x21\xCA\x8A\x46\x4B\x38\xDA\x09\x9F\x5A\xC8" -+ "\x38\xFF\x34\x97\x5B\xA2\xE5\xBA\xC9\x87\x17\xD8\x08\x05\x7A\x83" -+ "\x04\xD6\x02\x8E\x9B\x18\xB6\x40\x1A\xF7\x47\x25\x24\x3E\x37\x1E" -+ "\xF6\xC1\x3A\x1F\xCA\xB3\x43\x5A\xAE\x94\x83\x31\xAF\xFB\xEE\xED" -+ "\x46\x71\xEF\xE2\x37\x37\x15\xFE\x1B\x0B\x9E\xF8\x3E\x0C\x43\x96" -+ "\xB6\x0A\x04\x78\xF8\x5E\xAA\x33\x1F\xE2\x07\x5A\x8D\xC4\x4E\x32" -+ "\x6D\xD6\xA0\xC5\xEA\x3D\x12\x59\xD4\x41\x40\x4E\xA1\xD8\xBE\xED" -+ "\x17\xCB\x68\xCC\x59\xCB\x53\xB2\x0E\x58\x8A\xA9\x33\x7F\x6F\x2B" -+ "\x37\x89\x08\x44\xBA\xC7\x67\x17\xBB\x91\xF7\xC3\x0F\x00\xF8\xAA" -+ "\xA1\x33\xA6\x08\x47\xCA\xFA\xE8\x49\x27\x45\x46\xF1\xC1\xC3\x5F" -+ "\xE2\x45\x0A\x7D\x64\x52\x8C\x2E\xE1\xDE\xFF\xB2\x64\xEC\x69\x98" -+ "\x15\xDF\x9E\xB1\xEB\xD6\x9D\x08\x06\x4E\x73\xC1\x0B\x71\x21\x05" -+ "\x9E\xBC\xA2\x17\xCF\xB3\x70\xF4\xEF\xB8\x69\xA9\x94\x27\xFD\x5E" -+ "\x72\xB1\x2D\xD2\x20\x1B\x57\x80\xAB\x38\x97\xCF\x22\x68\x4F\xB8" -+ "\xB7\x17\x53\x25\x67\x0B\xED\xD1\x58\x20\x0D\x45\xF9\x09\xFA\xE7" -+ "\x61\x3E\xDB\xC2\x59\x7B\x3A\x3B\x59\x81\x51\xAA\xA4\x81\xF4\x96" -+ "\x3B\xE1\x6F\x6F\xF4\x8E\x68\x9E\xBA\x1E\x0F\xF2\x44\x68\x11\xFC" -+ "\x2B\x5F\xBE\xF2\xEA\x07\x80\xB9\xCA\x9E\x41\xBD\x2F\x81\xF5\x11" -+ "\x2A\x12\xF3\x4F\xD6\x12\x16\x0F\x21\x90\xF1\xD3\x1E\xF1\xA4\x94" -+ "\x46\xEA\x30\xF3\x84\x06\xC1\xA4\x51\xFC\x43\x35\xBD\xEF\x4D\x89" -+ "\x1D\xA5\x44\xB2\x69\xC4\x0F\xBF\x86\x01\x08\x44\x77\xD5\xB4\xB7" -+ "\x5C\x3F\xA7\xD4\x2F\x39\x73\x85\x88\xEE\xB1\x64\x1D\x80\x6C\xEE" -+ "\x6E\x31\x90\x92\x0D\xA1\xB7\xC4\x5C\xCC\xEE\x91\xC8\xCB\x11\x2D" -+ "\x4A\x1A\x7D\x43\x8F\xEB\x60\x09\xED\x1B\x07\x58\xBE\xBC\xBD\x29" -+ "\xF3\xB3\xA3\x4F\xC5\x8A\x30\x33\xB9\xA9\x9F\x43\x08\x27\x15\xC4" -+ "\x9C\x5D\x8E\xBD\x5C\x05\xC6\x05\x9C\x87\x60\x08\x1E\xE2\x52\xB8" -+ "\x45\x8D\x28\xB6\x2C\x15\x46\x74\x9F\x0E\xAA\x6B\x70\x3A\x2A\x55" -+ "\x45\x26\xB2\x58\x4D\x35\xA6\xF1\x96\xBE\x60\xB2\x71\x7B\xF8\x54" -+ "\xB9\x90\x21\x8E\xB9\x0F\x35\x98\x5E\x88\xEB\x1A\x53\xB4\x59\x7F" -+ "\xAF\x69\x1C\x61\x67\xF4\xF6\xBD\xAC\x24\xCD\xB7\xA9\x67\xE8\xA1" -+ "\x83\x85\x5F\x11\x74\x1F\xF7\x4C\x78\x36\xEF\x50\x74\x88\x58\x4B" -+ "\x1A\x9F\x84\x9A\x9A\x05\x92\xEC\x1D\xD5\xF3\xC4\x95\x51\x28\xE2" -+ "\x3F\x32\x87\xB2\xFD\x21\x27\x66\xE4\x6B\x85\x2F\xDC\x7B\xC0\x22" -+ "\xEB\x7A\x94\x20\x5A\x7B\xD3\x7A\xB9\x5B\xF8\x1A\x5A\x84\x4E\xA1" -+ "\x73\x41\x53\xD2\x60\xF7\x7C\xEE\x68\x59\x85\x80\xFC\x3D\x70\x4B" -+ "\x04\x32\xE7\xF2\xFD\xBD\xB3\xD9\x21\xE2\x37\x56\xA2\x16\xCC\xDE" -+ "\x8A\xD3\xBC\x71\xEF\x58\x19\x0E\x45\x8A\x5B\x53\xD6\x77\x30\x6A" -+ "\xA7\xF8\x68\x06\x4E\x07\xCA\xCE\x30\xD7\x35\xAB\x1A\xC7\x18\xD4" -+ "\xC6\x2F\x1A\xFF\xE9\x7A\x94\x0B\x76\x5E\x7E\x29\x0C\xE6\xD3\x3B" -+ "\x5B\x44\x96\xA8\xF1\x29\x23\x95\xD9\x79\xB3\x39\xFC\x76\xED\xE1" -+ "\x1E\x67\x4E\xF7\xE8\x7B\x7A\x12\x9E\xD8\x4B\x35\x09\x0A\xF2\xC1" -+ "\x63\x5B\xEE\xFD\x2A\xC2\xA6\x66\x30\x3C\x1F\x95\xAF\x65\x22\x95" -+ "\x14\x1D\xF5\xD5\xDC\x38\x79\x35\x1C\xCD\x24\x47\xE0\xFD\x08\xC8" -+ "\xF4\x15\x55\x9F\xD9\xC7\xAC\x3F\x67\xB3\x4F\xEB\x26\x7C\x8E\xD6" -+ "\x74\xB3\x0A\xCD\xE7\xFA\xBE\x7E\xA3\x3E\xEC\x61\x50\x77\x52\x56" -+ "\xCF\x90\x5D\x48\xFB\xD4\x2C\x6C\x61\x8B\xDD\x2B\xF5\x92\x1F\x30" -+ "\xBF\x3F\x80\x0D\x31\xDB\xB2\x0B\x7D\x84\xE3\xA6\x42\x7F\x00\x38" -+ "\x44\x02\xC5\xB8\xD9\x58\x29\x9D\x68\x5C\x32\x8B\x76\xAE\xED\x15" -+ "\xF9\x7C\xAE\x7B\xB6\x8E\xD6\x54\x24\xFF\xFA\x87\x05\xEF\x15\x08" -+ "\x5E\x4B\x21\xA2\x2F\x49\xE7\x0F\xC3\xD0\xB9\x49\x22\xEF\xD5\xCA" -+ "\xB2\x11\xF2\x17\xB6\x77\x24\x68\x76\xB2\x07\xF8\x0A\x73\xDD\x65" -+ "\x9C\x75\x64\xF7\xA1\xC6\x23\x08\x84\x72\x3E\x54\x2E\xEB\x9B\x40" -+ "\xA6\x83\x87\xEB\xB5\x00\x40\x4F\xE1\x72\x2A\x59\x3A\x06\x60\x29" -+ "\x7E\x25\x2F\xD8\x80\x40\x8C\x59\xCA\xCF\x8E\x44\xE4\x2D\x84\x7E" -+ "\xCB\xFD\x1E\x3B\xD5\xFF\x9A\xB9\x66\x93\x6D\x5E\xC8\xB7\x13\x26" -+ "\xD6\x38\x1B\x2B\xE1\x87\x96\x05\xD5\xF3\xAB\x68\xF7\x12\x62\x2C" -+ "\x58\xC1\xC9\x85\x3C\x72\xF1\x26\xEE\xC0\x09\x5F\x1D\x4B\xAC\x01" -+ "\x41\xC8\x12\xF8\xF3\x93\x43\x41\xFF\xEC\x0B\x80\xE2\xEE\x20\x85" -+ "\x25\xCD\x6C\x30\x8C\x0D\x24\x2E\xBA\x19\xEA\x28\x7F\xCF\xD5\x10" -+ "\x5C\xE9\xB2\x9D\x5F\x16\xE4\xC0\xF3\xCC\xD9\x68\x4A\x05\x08\x70" -+ "\x17\x26\xC8\x5C\x4A\xBF\x94\x6A\x0E\xD5\xDA\x67\x47\x4B\xAF\x44" -+ "\xE3\x94\xAA\x05\xDB\xA2\x49\x74\xFA\x5C\x69\xAB\x44\xB7\xF7\xBA" -+ "\xAE\x7A\x23\x87\xEB\x54\x7E\x80\xF1\x5B\x60\xA5\x93\xE5\xD4\x24" -+ "\x84\xF7\x0A\x16\x10\xBE\xE9\x4D\xD8\x6B\x15\x40\x5D\x74\xDA\x1B" -+ "\xFF\x2E\x4D\x17\x9D\x35\xF7\x0D\xCF\x66\x38\x0D\x8A\xE4\xDD\x6B" -+ "\xE1\x0F\x1F\xBD\xFD\x4F\x30\x37\x3F\x96\xB4\x92\x54\xD3\x9A\x7A" -+ "\xD1\x5B\x5B\xA9\x54\x16\xE6\x24\xAB\xD4\x23\x39\x7D\xD2\xC7\x09" -+ "\xFA\xD4\x86\x55\x4D\x60\xC2\x87\x67\x6B\xE6" - }; - - static void -@@ -686,7 +710,7 @@ test_pac_ticket_signature(krb5_context context) - { - krb5_error_code ret; - krb5_ticket *ticket; -- krb5_principal sprinc; -+ krb5_principal cprinc, sprinc; - krb5_authdata **authdata1, **authdata2; - krb5_pac pac, pac2, pac3; - uint32_t *list; -@@ -701,7 +725,13 @@ test_pac_ticket_signature(krb5_context context) - if (ret) - err(context, ret, "while decrypting ticket"); - -- ret = krb5_parse_name(context, "s1@CDOM.COM", &sprinc); -+ ret = krb5_parse_name(context, "administrator@W2022-L7.BASE", &cprinc); -+ if (ret) -+ err(context, ret, "krb5_parse_name"); -+ -+ ret = krb5_parse_name(context, -+ "cifs/w2022-118.w2022-l7.base@W2022-L7.BASE", -+ &sprinc); - if (ret) - err(context, ret, "krb5_parse_name"); - -@@ -713,7 +743,7 @@ test_pac_ticket_signature(krb5_context context) - - /* In this test, the server is also the client. */ - ret = krb5_pac_verify(context, pac, ticket->enc_part2->times.authtime, -- ticket->server, NULL, NULL); -+ cprinc, NULL, NULL); - if (ret) - err(context, ret, "while verifying PAC client info"); - -@@ -722,7 +752,7 @@ test_pac_ticket_signature(krb5_context context) - ticket->enc_part2->authorization_data = NULL; - - ret = krb5_kdc_sign_ticket(context, ticket->enc_part2, pac, sprinc, -- sprinc, &ticket_sig_server_key, -+ cprinc, &ticket_sig_server_key, - &ticket_sig_krbtgt_key, FALSE); - if (ret) - err(context, ret, "while signing ticket"); -@@ -781,6 +811,7 @@ test_pac_ticket_signature(krb5_context context) - krb5_pac_free(context, pac); - krb5_pac_free(context, pac2); - krb5_pac_free(context, pac3); -+ krb5_free_principal(context, cprinc); - krb5_free_principal(context, sprinc); - krb5_free_ticket(context, ticket); - } -diff --git a/src/tests/t_authdata.py b/src/tests/t_authdata.py -index 47ea9e4b47..e934799268 100644 ---- a/src/tests/t_authdata.py -+++ b/src/tests/t_authdata.py -@@ -11,7 +11,7 @@ realm = K5Realm(krb5_conf=conf) - # container. - mark('baseline authdata') - out = realm.run(['./adata', realm.host_princ]) --if '?128: [6, 7, 10, 16]' not in out or '^-42: Hello' not in out: -+if '?128: [6, 7, 10, 16, 19]' not in out or '^-42: Hello' not in out: - fail('expected authdata not seen for basic request') - - # Requested authdata is copied into the ticket, with KDC-only types -@@ -243,7 +243,7 @@ out = realm.run(['./adata', '-p', realm.user_princ, 'service/2']) - if '+97: [indcl]' not in out or '[inds1]' in out: - fail('correct auth-indicator not seen for S4U2Proxy req') - # Make sure a PAC with an S4U_DELEGATION_INFO(11) buffer is included. --if '?128: [1, 6, 7, 10, 11, 16]' not in out: -+if '?128: [1, 6, 7, 10, 11, 16, 19]' not in out: - fail('PAC with delegation info not seen for S4U2Proxy req') - - # Get another S4U2Proxy ticket including request-authdata. --- -2.39.1 - diff --git a/krb5-tests b/krb5-tests index cbbb302..beaeb2b 100644 --- a/krb5-tests +++ b/krb5-tests @@ -5,10 +5,13 @@ export RPM_PACKAGE_NAME={{ name }} export RPM_PACKAGE_VERSION={{ version }} export RPM_PACKAGE_RELEASE={{ release }} export RPM_ARCH={{ arch }} +export RPM_BUILD_NCPUS="$(getconf _NPROCESSORS_ONLN)" testdir="$(mktemp -d)" trap "rm -rf ${testdir}" EXIT +build_flags="$(eval "echo $(rpm --eval '%{_smp_mflags}')")" + cp -rp /usr/share/{{ name }}-tests "${testdir}/" -make -C "${testdir}/{{ name }}-tests" $(rpm --eval '%{_smp_mflags}') +make -C "${testdir}/{{ name }}-tests" $build_flags keyctl session - make -C "${testdir}/{{ name }}-tests" check diff --git a/krb5.spec b/krb5.spec index 7800eea..a16e111 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 9 +%global baserelease 1 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -22,9 +22,9 @@ %endif %global krb5_version_major 1 -%global krb5_version_minor 20 +%global krb5_version_minor 21 # For a release without a patch number set to %%nil -%global krb5_version_patch 1 +%global krb5_version_patch %nil %global krb5_version_major_minor %{krb5_version_major}.%{krb5_version_minor} %global krb5_version %{krb5_version_major_minor} @@ -59,23 +59,19 @@ Source13: kadmind.logrotate Source14: krb5-krb5kdc.conf Source15: %{name}-tests -Patch1: 0001-downstream-ksu-pam-integration.patch -Patch2: 0002-downstream-SELinux-integration.patch -Patch3: 0003-downstream-fix-debuginfo-with-y.tab.c.patch -Patch4: 0004-downstream-Remove-3des-support.patch -Patch5: 0005-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch -Patch6: 0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch -Patch7: 0007-Add-configure-variable-for-default-PKCS-11-module.patch -Patch8: 0008-Set-reasonable-supportedCMSTypes-in-PKINIT.patch -Patch9: 0009-Simplify-plugin-loading-code.patch -Patch10: 0010-Update-error-checking-for-OpenSSL-CMS_verify.patch -Patch11: 0011-downstream-Catch-SHA-1-digest-disallowed-error-for-P.patch -Patch12: 0012-Add-and-use-ts_interval-helper.patch -Patch13: 0013-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch -Patch14: 0014-downstream-Include-missing-OpenSSL-FIPS-header.patch -Patch15: 0015-downstream-Do-not-set-root-as-ksu-file-owner.patch -Patch16: 0016-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch -Patch17: 0017-Add-PAC-full-checksums.patch +Patch0001: 0001-downstream-ksu-pam-integration.patch +Patch0002: 0002-downstream-SELinux-integration.patch +Patch0003: 0003-downstream-fix-debuginfo-with-y.tab.c.patch +Patch0004: 0004-downstream-Remove-3des-support.patch +Patch0005: 0005-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch +Patch0006: 0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch +Patch0007: 0007-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch +Patch0008: 0008-downstream-Include-missing-OpenSSL-FIPS-header.patch +Patch0009: 0009-downstream-Do-not-set-root-as-ksu-file-owner.patch +Patch0010: 0010-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch +Patch0011: 0011-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch +Patch0012: 0012-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch +Patch0013: 0013-Enable-PKINIT-if-at-least-one-group-is-available.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -712,9 +708,22 @@ exit 0 %{_datarootdir}/%{name}-tests/ %changelog +* Mon Jun 12 2023 Julien Rische - 1.21-1 +- New upstream version (1.21) +- Do not disable PKINIT if some of the well-known DH groups are unavailable + Resolves: rhbz#2214297 +- Make PKINIT CMS SHA-1 signature verification available in FIPS mode + Resolves: rhbz#2214300 +- Allow to set PAC ticket signature as optional + Resolves: rhbz#2181311 +- Add support for MS-PAC extended KDC signature (CVE-2022-37967) + Resolves: rhbz#2166001 +- Fix syntax error in aclocal.m4 + Resolves: rhbz#2143306 + * Tue Jan 31 2023 Julien Rische - 1.20.1-9 - Add support for MS-PAC extended KDC signature (CVE-2022-37967) -- Resolves: rhbz#2166001 + Resolves: rhbz#2166001 * Mon Jan 30 2023 Julien Rische - 1.20.1-8 - Bypass FIPS restrictions to use KRB5KDF in case AES SHA-1 HMAC is enabled @@ -726,7 +735,7 @@ exit 0 * Wed Jan 18 2023 Julien Rische - 1.20.1-6 - Set aes256-cts-hmac-sha384-192 as EXAMLE.COM master key in kdc.conf - Add AES SHA-2 HMAC family as EXAMPLE.COM supported etypes in kdc.conf -- Resolves: rhbz#2114771 + Resolves: rhbz#2114771 * Mon Jan 09 2023 Julien Rische - 1.20.1-5 - Strip debugging data from ksu executable file @@ -743,18 +752,18 @@ exit 0 * Wed Nov 23 2022 Julien Rische - 1.20.1-1 - New upstream version (1.20.1) -- Resolves: rhbz#2124463 + Resolves: rhbz#2124463 - Restore "supportedCMSTypes" attribute in PKINIT preauth requests - Set SHA-512 or SHA-256 with RSA as preferred CMS signature algorithms -- Resolves: rhbz#2114766 + Resolves: rhbz#2114766 - Update error checking for OpenSSL CMS_verify -- Resolves: rhbz#2119704 + Resolves: rhbz#2119704 - Remove invalid password expiry warning -- Resolves: rhbz#2129113 + Resolves: rhbz#2129113 * Wed Nov 09 2022 Julien Rische - 1.19.2-13 - Fix integer overflows in PAC parsing (CVE-2022-42898) -- Resolves: rhbz#2143011 + Resolves: rhbz#2143011 * Tue Aug 02 2022 Andreas Schneider - 1.19.2-12 - Use baserelease to set the release number @@ -766,14 +775,14 @@ exit 0 * Wed Jun 15 2022 Julien Rische - 1.19.2-11 - Allow libkrad UDP/TCP connection to localhost in FIPS mode -- Resolves: rhbz#2082189 + Resolves: rhbz#2082189 - Read GSS configuration files with mtime 0 * Mon May 2 2022 Julien Rische - 1.19.2-10 - Use p11-kit as default PKCS11 module -- Resolves: rhbz#2073274 + Resolves: rhbz#2073274 - Try harder to avoid password change replay errors -- Resolves: rhbz#2072059 + Resolves: rhbz#2072059 * Tue Apr 05 2022 Alexander Bokovoy - 1.19.2-9 - Fix libkrad client cleanup @@ -791,7 +800,7 @@ exit 0 * Wed Feb 02 2022 Alexander Bokovoy - 1.19.2-5 - Temporarily remove package note to unblock krb5-dependent packages -- Resolves: rhbz#2048909 + Resolves: rhbz#2048909 * Thu Jan 20 2022 Fedora Release Engineering - 1.19.2-4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild @@ -909,7 +918,7 @@ exit 0 * Tue Nov 17 2020 Robbie Harwood - 1.18.2-30 - Migrate /var/run to /run, an exercise in pointlessness -- Resolves: #1898410 + Resolves: rhbz#1898410 * Thu Nov 05 2020 Robbie Harwood - 1.18.2-29 - Add recursion limit for ASN.1 indefinite lengths (CVE-2020-28196) @@ -931,14 +940,14 @@ exit 0 * Thu Sep 10 2020 Robbie Harwood - 1.18.2-23 - Use `systemctl reload` to HUP the KDC during logrotate -- Resolves: #1877692 + Resolves: rhbz#1877692 * Wed Sep 09 2020 Robbie Harwood - 1.18.2-22 - Fix input length checking in SPNEGO DER decoding * Fri Aug 28 2020 Robbie Harwood - 1.18.2-21 - Mark crypto-polices snippet as missingok -- Resolves: #1868379 + Resolves: rhbz#1868379 * Thu Aug 13 2020 Robbie Harwood - 1.18.2-20 - Temporarily dns_canonicalize_hostname=fallback changes @@ -955,7 +964,7 @@ exit 0 * Mon Aug 03 2020 Robbie Harwood - 1.18.2-16 - Disable tests on s390x -- Resolves: #1863952 + Resolves: rhbz#1863952 * Sat Aug 01 2020 Fedora Release Engineering - 1.18.2-15 - Second attempt - Rebuilt for @@ -976,7 +985,7 @@ exit 0 * Wed Jul 08 2020 Robbie Harwood - 1.18.2-10 - Set qualify_shortname empty in default configuration -- Resolves: #1852041 + Resolves: rhbz#1852041 * Mon Jun 15 2020 Robbie Harwood - 1.18.2-9 - Use two queues for concurrent t_otp.py daemons @@ -1150,7 +1159,7 @@ exit 0 * Mon Jul 15 2019 Robbie Harwood - 1.17-35 - Don't error on invalid enctypes in keytab -- Resolves: #1724380 + Resolves: rhbz#1724380 * Tue Jul 02 2019 Robbie Harwood - 1.17-34 - Remove now-unused checksum functions @@ -1235,7 +1244,7 @@ exit 0 * Thu Apr 11 2019 Robbie Harwood - 1.17-8 - Implement krb5_cc_remove_cred for remaining types -- Resolves: #1693836 + Resolves: rhbz#1693836 * Mon Apr 01 2019 Robbie Harwood - 1.17-7 - FIPS-aware SPAKE group negotiation @@ -1270,7 +1279,7 @@ exit 0 * Mon Dec 17 2018 Robbie Harwood - 1.17-1.beta2.2 - Restore pdfs source file -- Resolves: #1659716 + Resolves: rhbz#1659716 * Thu Dec 06 2018 Robbie Harwood - 1.17-1.beta2.1 - New upstream release (1.17-beta2) @@ -1284,26 +1293,26 @@ exit 0 * Thu Nov 08 2018 Robbie Harwood - 1.17-1.beta1.1 - Fix spurious errors from kcmio_unix_socket_write -- Resolves: #1645912 + Resolves: rhbz#1645912 * Thu Nov 01 2018 Robbie Harwood - 1.17-0.beta1.1 - New upstream beta release * Wed Oct 24 2018 Robbie Harwood - 1.16.1-25 - Update man pages to reference kerberos(7) -- Resolves: #1143767 + Resolves: rhbz#1143767 * Wed Oct 17 2018 Robbie Harwood - 1.16.1-24 - Use port-sockets.h macros in cc_kcm, sendto_kdc -- Resolves: #1631998 + Resolves: rhbz#1631998 * Wed Oct 17 2018 Robbie Harwood - 1.16.1-23 - Correct kpasswd_server description in krb5.conf(5) -- Resolves: #1640272 + Resolves: rhbz#1640272 * Mon Oct 15 2018 Robbie Harwood - 1.16.1-22 - Prefer TCP to UDP for password changes -- Resolves: #1637611 + Resolves: rhbz#1637611 * Tue Oct 09 2018 Adam Williamson - 1.16.1-21 - Revert the patch from -20 for now as it seems to make FreeIPA worse @@ -1352,18 +1361,18 @@ exit 0 * Thu Jun 14 2018 Robbie Harwood - 1.16.1-6 - Switch to python3-sphinx for docs -- Resolves: #1590928 + Resolves: rhbz#1590928 * Thu Jun 14 2018 Robbie Harwood - 1.16.1-5 - Make docs build python3-compatible -- Resolves: #1590928 + Resolves: rhbz#1590928 * Thu Jun 07 2018 Robbie Harwood - 1.16.1-4 - Update includedir processing to match upstream * Fri Jun 01 2018 Robbie Harwood - 1.16.1-3 - Log when non-root ksu authorization fails -- Resolves: #1575771 + Resolves: rhbz#1575771 * Fri May 04 2018 Robbie Harwood - 1.16.1-2 - Remove "-nodes" option from make-certs scripts @@ -1385,7 +1394,7 @@ exit 0 * Mon Apr 23 2018 Robbie Harwood - 1.16-23 - Explicitly use openssl rather than builtin crypto -- Resolves: #1570910 + Resolves: rhbz#1570910 * Tue Apr 17 2018 Robbie Harwood - 1.16-22 - Merge duplicate subsections in profile library @@ -1435,7 +1444,7 @@ exit 0 * Wed Mar 07 2018 Robbie Harwood - 1.16-8 - Fix capaths "." values on client -- Resolves: 1551099 + Resolves: 1551099 * Tue Feb 13 2018 Robbie Harwood - 1.16-7 - Fix flaws in LDAP DN checking @@ -1444,7 +1453,7 @@ exit 0 * Mon Feb 12 2018 Robbie Harwood - 1.16-6 - Fix a leak in the previous commit - Restore dist macro that was accidentally removed -- Resolves: #1540939 + Resolves: rhbz#1540939 * Wed Feb 07 2018 Fedora Release Engineering - 1.16-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild @@ -1457,7 +1466,7 @@ exit 0 * Tue Dec 12 2017 Robbie Harwood - 1.16-2 - Fix network service dependencies -- Resolves: #1525230 + Resolves: rhbz#1525230 * Wed Dec 06 2017 Robbie Harwood - 1.16-1 - New upstream release (1.16) @@ -1487,12 +1496,12 @@ exit 0 * Wed Sep 06 2017 Robbie Harwood - 1.15.1-28 - Save other programs from worrying about CVE-2017-11462 -- Resolves: #1488873 -- Resolves: #1488874 + Resolves: rhbz#1488873 + Resolves: rhbz#1488874 * Tue Sep 05 2017 Robbie Harwood - 1.15.1-27 - Add hostname-based ccselect module -- Resolves: #1463665 + Resolves: rhbz#1463665 * Tue Sep 05 2017 Robbie Harwood - 1.15.1-26 - Backport upstream certauth EKU fixes @@ -1543,7 +1552,7 @@ exit 0 * Fri Jun 23 2017 Robbie Harwood - 1.15.1-11 - Include more test suite changes from upstream -- Resolves: #1464381 + Resolves: rhbz#1464381 * Wed Jun 07 2017 Robbie Harwood - 1.15.1-10 - Fix custom build with -DDEBUG @@ -1559,12 +1568,12 @@ exit 0 * Thu Apr 13 2017 Robbie Harwood - 1.15.1-6 - Include fixes for previous commit -- Resolves: #1433083 + Resolves: rhbz#1433083 * Thu Apr 13 2017 Robbie Harwood - 1.15.1-5 - Automatically add includedir where not present - Try removing sleep statement to see if it is still needed -- Resolves: #1433083 + Resolves: rhbz#1433083 * Fri Apr 07 2017 Robbie Harwood - 1.15.1-4 - Fix use of enterprise principals with forwarding @@ -1574,7 +1583,7 @@ exit 0 * Tue Mar 07 2017 Robbie Harwood - 1.15.1-2 - Remove duplication between subpackages -- Resolves: #1250228 + Resolves: rhbz#1250228 * Fri Mar 03 2017 Robbie Harwood - 1.15.1-1 - New upstream release - 1.15.1 @@ -1608,14 +1617,14 @@ exit 0 * Thu Oct 20 2016 Robbie Harwood - 1.15-beta1-1 - New upstream release - Update selinux with RHEL hygene -- Resolves: #1314096 + Resolves: rhbz#1314096 * Tue Oct 11 2016 Tomáš Mráz - 1.14.4-6 - rebuild with OpenSSL 1.1.0, added backported upstream patch * Fri Sep 30 2016 Robbie Harwood - 1.14.4-5 - Properly close krad sockets -- Resolves: #1380836 + Resolves: rhbz#1380836 * Fri Sep 30 2016 Robbie Harwood - 1.14.4-4 - Fix backward check in kprop.service @@ -1634,42 +1643,42 @@ exit 0 * Mon Sep 19 2016 Robbie Harwood - 1.14.3-9 - Add krb5_db_register_keytab -- Resolves: #1376812 + Resolves: rhbz#1376812 * Mon Aug 29 2016 Robbie Harwood - 1.14.3-8 - Use responder for non-preauth AS requests -- Resolves: #1370622 + Resolves: rhbz#1370622 * Mon Aug 29 2016 Robbie Harwood - 1.14.3-7 - Guess Samba client mutual flag using ap_option -- Resolves: #1370980 + Resolves: rhbz#1370980 * Thu Aug 25 2016 Robbie Harwood - 1.14.3-6 - Fix KDC return code and set prompt types for OTP client preauth -- Resolves: #1370072 + Resolves: rhbz#1370072 * Mon Aug 15 2016 Robbie Harwood - 1.14.3-5 - Turn OFD locks back on with glibc workaround -- Resolves: #1274922 + Resolves: rhbz#1274922 * Wed Aug 10 2016 Robbie Harwood - 1.14.3-4 - Fix use of KKDCPP with SNI -- Resolves: #1365027 + Resolves: rhbz#1365027 * Fri Aug 05 2016 Robbie Harwood - 1.14.3-3 - Make krb5-devel depend on libkadm5 -- Resolves: #1364487 + Resolves: rhbz#1364487 * Wed Aug 03 2016 Robbie Harwood - 1.14.3-2 - Up-port a bunch of stuff from the el-7.3 cycle -- Resolves: #1255450, #1314989 + Resolves: rhbz#1255450, rhbz#1314989 * Mon Aug 01 2016 Robbie Harwood - 1.14.3-1 - New upstream version 1.14.3 * Thu Jul 28 2016 Robbie Harwood - 1.14.1-9 - Fix CVE-2016-3120 -- Resolves: #1361051 + Resolves: rhbz#1361051 * Wed Jun 22 2016 Robbie Harwood - 1.14.1-8 - Fix incorrect recv() size calculation in libkrad @@ -1682,18 +1691,18 @@ exit 0 * Tue Apr 05 2016 Robbie Harwood - 1.14.1-5 - Use the correct patches this time. -- Resolves: #1321135 + Resolves: rhbz#1321135 * Mon Apr 04 2016 Robbie Harwood - 1.14.1-4 - Add send/receive sendto_kdc hooks and corresponding tests -- Resolves: #1321135 + Resolves: rhbz#1321135 * Fri Mar 18 2016 Robbie Harwood - 1.14.1-3 - Fix CVE-2016-3119 (NULL deref in LDAP module) * Thu Mar 17 2016 Robbie Harwood - 1.14.1-2 - Backport OID mech fix -- Resolves: #1317609 + Resolves: rhbz#1317609 * Mon Feb 29 2016 Robbie Harwood - 1.14.1-1 - New rawhide, new upstream version @@ -1703,7 +1712,7 @@ exit 0 * Mon Feb 22 2016 Robbie Harwood - 1.14-23 - Fix log file permissions patch with our selinux -- Resolves: #1309421 + Resolves: rhbz#1309421 * Fri Feb 19 2016 Robbie Harwood - 1.14-22 - Backport my interposer fixes from upstream @@ -1712,7 +1721,7 @@ exit 0 * Tue Feb 16 2016 Robbie Harwood - 1.14-21 - Adjust dependency on crypto-polices to be just the file we want - Patch courtesy of lslebodn -- Resolves: #1308984 + Resolves: rhbz#1308984 * Thu Feb 04 2016 Fedora Release Engineering - 1.14-20 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild @@ -1720,21 +1729,21 @@ exit 0 * Thu Jan 28 2016 Robbie Harwood - 1.14-19 - Replace _kadmin/_kprop with systemd macros - Remove traces of upstart from fedora package per policy -- Resolves: #1290185 + Resolves: rhbz#1290185 * Wed Jan 27 2016 Robbie Harwood - 1.14-18 - Fix CVE-2015-8629, CVE-2015-8630, CVE-2015-8631 * Thu Jan 21 2016 Robbie Harwood - 1.14-17 - Make krb5kdc.log not world-readable by default -- Resolves: #1276484 + Resolves: rhbz#1276484 * Thu Jan 21 2016 Robbie Harwood - 1.14-16 - Allow verification of attributes on krb5.conf * Wed Jan 20 2016 Robbie Harwood - 1.14-15 - Use "new" systemd macros for service handling. (Thanks vpavlin!) -- Resolves: #850399 + Resolves: rhbz#850399 * Wed Jan 20 2016 Robbie Harwood - 1.14-14 - Remove WITH_NSS macro (always false) @@ -1744,7 +1753,7 @@ exit 0 * Fri Jan 08 2016 Robbie Harwood - 1.14-13 - Backport fix for chrome crash in spnego_gss_inquire_context -- Resolves: #1295893 + Resolves: rhbz#1295893 * Wed Dec 16 2015 Robbie Harwood - 1.14-12 - Backport patch to fix mechglue for gss_inqure_attrs_for_mech() diff --git a/sources b/sources index 9bc9770..d6c0df1 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (krb5-1.20.1.tar.gz) = 6f57479f13f107cd84f30de5c758eb6b9fc59171329c13e5da6073b806755f8d163eb7bd84767ea861ad6458ea0c9eeb00ee044d3bcad01ef136e9888564b6a2 -SHA512 (krb5-1.20.1.tar.gz.asc) = 1d3312bd67581e07adfdadf2c5fe394179631d8add8bd075efefe982a0de22369004e60a14422d426382c8c591e4181b9897088afe9d4e86f0b5a97e5954c67a +SHA512 (krb5-1.21.tar.gz) = 8ee2366888f6d553a44fc642a89c69a57dbc1ec4c89a36b9ba8b00584a9a32c73a2b0566ba5f21852ad9617046666c276dac402393bf8eb19fbe0c07a838071a +SHA512 (krb5-1.21.tar.gz.asc) = 7147a44a13f4f26c5c1d9aba738b32892b50e351ad149dcaf0b6f2c010e3c51d7d51540d0a51b085450ffa31d5027b5f2e5841109d7af8bdaddbdd3a569582d5 From a2c04215f003875c12fa2bd2caeba7c46dd0d04c Mon Sep 17 00:00:00 2001 From: Marek Blaha Date: Thu, 29 Jun 2023 08:12:27 +0200 Subject: [PATCH 084/103] Replace file dependency by package name By default, dnf5 does not download the filelists repository metadata required to resolve file dependencies outside of /usr/(s)bin or /etc. This causes the krb5-server file to become uninstallable. $ dnf5 install krb5-server Repositories loaded. Failed to resolve the transaction: Problem: conflicting requests - nothing provides /usr/share/dict/words needed by krb5-server-1.21-1.fc39.x86_64 This change aligns with the Fedora packaging guidelines, as stated here: https://docs.fedoraproject.org/en-US/packaging-guidelines/#_file_and_directory_dependencies Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2216903 --- krb5.spec | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/krb5.spec b/krb5.spec index a16e111..f67b1a5 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 1 +%global baserelease 2 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -154,8 +154,8 @@ Requires(preun): systemd-units Requires(postun): systemd-units # we drop files in its directory, but we don't want to own that directory Requires: logrotate -# we specify /usr/share/dict/words as the default dict_file in kdc.conf -Requires: /usr/share/dict/words +# we specify /usr/share/dict/words (provided by words) as the default dict_file in kdc.conf +Requires: words # for run-time, and for parts of the test suite BuildRequires: libverto-module-base Requires: libverto-module-base @@ -252,7 +252,7 @@ Requires: python3-kdcproxy Requires: python3-pyrad Requires: resolv_wrapper Requires: /etc/crypto-policies/back-ends/krb5.config -Requires: /usr/share/dict/words +Requires: words #Requires: openldap-servers, openldap-clients %description tests @@ -708,6 +708,10 @@ exit 0 %{_datarootdir}/%{name}-tests/ %changelog +* Thu Jun 29 2023 Marek Blaha - 1.21-2 +- Replace file dependency with package name + Resolves: rhbz#2216903 + * Mon Jun 12 2023 Julien Rische - 1.21-1 - New upstream version (1.21) - Do not disable PKINIT if some of the well-known DH groups are unavailable From ae2cf9bef37cecb11eeb4c1d094a894340b711a7 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jul 2023 09:33:35 +0000 Subject: [PATCH 085/103] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- krb5.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/krb5.spec b/krb5.spec index f67b1a5..4932c63 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 2 +%global baserelease 3 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -708,6 +708,9 @@ exit 0 %{_datarootdir}/%{name}-tests/ %changelog +* Thu Jul 20 2023 Fedora Release Engineering - 1.21-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Thu Jun 29 2023 Marek Blaha - 1.21-2 - Replace file dependency with package name Resolves: rhbz#2216903 From f5676fd2337e1b89f2147be08ef013f821930702 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Wed, 16 Aug 2023 10:54:48 +0200 Subject: [PATCH 086/103] New upstream version (1.21.2) - Fix double-free in KDC TGS processing (CVE-2023-39975) Resolves: rhbz#2229113 - Make tests compatible with Python 3.12 Resolves: rhbz#2224013 Signed-off-by: Julien Rische --- .gitignore | 2 + ...ue-session-keys-with-deprecated-enct.patch | 309 +++++++++ ... 0002-downstream-ksu-pam-integration.patch | 4 +- ... 0003-downstream-SELinux-integration.patch | 6 +- ...ownstream-fix-debuginfo-with-y.tab.c.patch | 4 +- ... 0005-downstream-Remove-3des-support.patch | 91 +-- ...am-FIPS-with-PRNG-and-RADIUS-and-MD4.patch | 8 +- ...-krad-UDP-TCP-localhost-connection-w.patch | 4 +- ...tests-compatible-with-sssd_krb5_loca.patch | 4 +- ...-Include-missing-OpenSSL-FIPS-header.patch | 4 +- ...am-Do-not-set-root-as-ksu-file-owner.patch | 4 +- ...low-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch | 4 +- ...-to-set-PAC-ticket-signature-as-opti.patch | 8 +- ...PKINIT-CMS-SHA-1-signature-verificat.patch | 4 +- ...T-if-at-least-one-group-is-available.patch | 4 +- 0015-Replace-ssl.wrap_socket-for-tests.patch | 64 ++ krb5.spec | 601 +++++++++--------- sources | 4 +- 18 files changed, 743 insertions(+), 386 deletions(-) create mode 100644 0001-Revert-Don-t-issue-session-keys-with-deprecated-enct.patch rename 0001-downstream-ksu-pam-integration.patch => 0002-downstream-ksu-pam-integration.patch (99%) rename 0002-downstream-SELinux-integration.patch => 0003-downstream-SELinux-integration.patch (99%) rename 0003-downstream-fix-debuginfo-with-y.tab.c.patch => 0004-downstream-fix-debuginfo-with-y.tab.c.patch (95%) rename 0004-downstream-Remove-3des-support.patch => 0005-downstream-Remove-3des-support.patch (98%) rename 0005-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch => 0006-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch (99%) rename 0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch => 0007-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch (97%) rename 0007-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch => 0008-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch (94%) rename 0008-downstream-Include-missing-OpenSSL-FIPS-header.patch => 0009-downstream-Include-missing-OpenSSL-FIPS-header.patch (98%) rename 0009-downstream-Do-not-set-root-as-ksu-file-owner.patch => 0010-downstream-Do-not-set-root-as-ksu-file-owner.patch (93%) rename 0010-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch => 0011-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch (98%) rename 0011-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch => 0012-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch (98%) rename 0012-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch => 0013-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch (96%) rename 0013-Enable-PKINIT-if-at-least-one-group-is-available.patch => 0014-Enable-PKINIT-if-at-least-one-group-is-available.patch (99%) create mode 100644 0015-Replace-ssl.wrap_socket-for-tests.patch diff --git a/.gitignore b/.gitignore index 7db6eaa..7057bf9 100644 --- a/.gitignore +++ b/.gitignore @@ -204,3 +204,5 @@ /krb5-1.20.1.tar.gz.asc /krb5-1.21.tar.gz /krb5-1.21.tar.gz.asc +/krb5-1.21.2.tar.gz +/krb5-1.21.2.tar.gz.asc diff --git a/0001-Revert-Don-t-issue-session-keys-with-deprecated-enct.patch b/0001-Revert-Don-t-issue-session-keys-with-deprecated-enct.patch new file mode 100644 index 0000000..cc457ae --- /dev/null +++ b/0001-Revert-Don-t-issue-session-keys-with-deprecated-enct.patch @@ -0,0 +1,309 @@ +From 087d150e4afe47a8d269d5e80dcef2204b007ceb Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Wed, 16 Aug 2023 10:00:30 +0200 +Subject: [PATCH] Revert "Don't issue session keys with deprecated enctypes" + +This reverts commit 1b57a4d134bbd0e7c52d5885a92eccc815726463. +--- + doc/admin/conf_files/krb5_conf.rst | 12 ------------ + doc/admin/enctypes.rst | 23 +++------------------- + src/include/k5-int.h | 4 ---- + src/kdc/kdc_util.c | 10 ---------- + src/lib/krb5/krb/get_in_tkt.c | 31 +++++++++++------------------- + src/lib/krb5/krb/init_ctx.c | 10 ---------- + src/tests/gssapi/t_enctypes.py | 3 +-- + src/tests/t_etype_info.py | 2 +- + src/tests/t_sesskeynego.py | 28 ++------------------------- + src/util/k5test.py | 4 ++-- + 10 files changed, 20 insertions(+), 107 deletions(-) + +diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst +index ecdf917501..f22d5db11b 100644 +--- a/doc/admin/conf_files/krb5_conf.rst ++++ b/doc/admin/conf_files/krb5_conf.rst +@@ -95,18 +95,6 @@ Additionally, krb5.conf may include any of the relations described in + + The libdefaults section may contain any of the following relations: + +-**allow_des3** +- Permit the KDC to issue tickets with des3-cbc-sha1 session keys. +- In future releases, this flag will allow des3-cbc-sha1 to be used +- at all. The default value for this tag is false. (Added in +- release 1.21.) +- +-**allow_rc4** +- Permit the KDC to issue tickets with arcfour-hmac session keys. +- In future releases, this flag will allow arcfour-hmac to be used +- at all. The default value for this tag is false. (Added in +- release 1.21.) +- + **allow_weak_crypto** + If this flag is set to false, then weak encryption types (as noted + in :ref:`Encryption_types` in :ref:`kdc.conf(5)`) will be filtered +diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst +index dce19ad43e..694922c0d9 100644 +--- a/doc/admin/enctypes.rst ++++ b/doc/admin/enctypes.rst +@@ -48,15 +48,12 @@ Session key selection + The KDC chooses the session key enctype by taking the intersection of + its **permitted_enctypes** list, the list of long-term keys for the + most recent kvno of the service, and the client's requested list of +-enctypes. Starting in krb5-1.21, all services are assumed to support +-aes256-cts-hmac-sha1-96; also, des3-cbc-sha1 and arcfour-hmac session +-keys will not be issued by default. ++enctypes. + + Starting in krb5-1.11, it is possible to set a string attribute on a + service principal to control what session key enctypes the KDC may +-issue for service tickets for that principal, overriding the service's +-long-term keys and the assumption of aes256-cts-hmac-sha1-96 support. +-See :ref:`set_string` in :ref:`kadmin(1)` for details. ++issue for service tickets for that principal. See :ref:`set_string` ++in :ref:`kadmin(1)` for details. + + + Choosing enctypes for a service +@@ -90,20 +87,6 @@ affect how enctypes are chosen. + acceptable risk for your environment and the weak enctypes are + required for backward compatibility. + +-**allow_des3** +- was added in release 1.21 and defaults to *false*. Unless this +- flag is set to *true*, the KDC will not issue tickets with +- des3-cbc-sha1 session keys. In a future release, this flag will +- control whether des3-cbc-sha1 is permitted in similar fashion to +- weak enctypes. +- +-**allow_rc4** +- was added in release 1.21 and defaults to *false*. Unless this +- flag is set to *true*, the KDC will not issue tickets with +- arcfour-hmac session keys. In a future release, this flag will +- control whether arcfour-hmac is permitted in similar fashion to +- weak enctypes. +- + **permitted_enctypes** + controls the set of enctypes that a service will permit for + session keys and for ticket and authenticator encryption. The KDC +diff --git a/src/include/k5-int.h b/src/include/k5-int.h +index 2f7791b775..1d1c8293f4 100644 +--- a/src/include/k5-int.h ++++ b/src/include/k5-int.h +@@ -180,8 +180,6 @@ typedef unsigned char u_char; + * matches the variable name. Keep these alphabetized. */ + #define KRB5_CONF_ACL_FILE "acl_file" + #define KRB5_CONF_ADMIN_SERVER "admin_server" +-#define KRB5_CONF_ALLOW_DES3 "allow_des3" +-#define KRB5_CONF_ALLOW_RC4 "allow_rc4" + #define KRB5_CONF_ALLOW_WEAK_CRYPTO "allow_weak_crypto" + #define KRB5_CONF_AUTH_TO_LOCAL "auth_to_local" + #define KRB5_CONF_AUTH_TO_LOCAL_NAMES "auth_to_local_names" +@@ -1240,8 +1238,6 @@ struct _krb5_context { + struct _kdb_log_context *kdblog_context; + + krb5_boolean allow_weak_crypto; +- krb5_boolean allow_des3; +- krb5_boolean allow_rc4; + krb5_boolean ignore_acceptor_hostname; + krb5_boolean enforce_ok_as_delegate; + enum dns_canonhost dns_canonicalize_hostname; +diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c +index e54cc751f9..75e04b73db 100644 +--- a/src/kdc/kdc_util.c ++++ b/src/kdc/kdc_util.c +@@ -1088,16 +1088,6 @@ select_session_keytype(krb5_context context, krb5_db_entry *server, + if (!krb5_is_permitted_enctype(context, ktype[i])) + continue; + +- /* +- * Prevent these deprecated enctypes from being used as session keys +- * unless they are explicitly allowed. In the future they will be more +- * comprehensively disabled and eventually removed. +- */ +- if (ktype[i] == ENCTYPE_DES3_CBC_SHA1 && !context->allow_des3) +- continue; +- if (ktype[i] == ENCTYPE_ARCFOUR_HMAC && !context->allow_rc4) +- continue; +- + if (dbentry_supports_enctype(context, server, ktype[i])) + return ktype[i]; + } +diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c +index ea089f0fcc..1b420a3ac2 100644 +--- a/src/lib/krb5/krb/get_in_tkt.c ++++ b/src/lib/krb5/krb/get_in_tkt.c +@@ -1582,31 +1582,22 @@ warn_pw_expiry(krb5_context context, krb5_get_init_creds_opt *options, + (*prompter)(context, data, 0, banner, 0, 0); + } + +-/* Display a warning via the prompter if a deprecated enctype was used for +- * either the reply key or the session key. */ ++/* Display a warning via the prompter if des3-cbc-sha1 was used for either the ++ * reply key or the session key. */ + static void +-warn_deprecated(krb5_context context, krb5_init_creds_context ctx, +- krb5_enctype as_key_enctype) ++warn_des3(krb5_context context, krb5_init_creds_context ctx, ++ krb5_enctype as_key_enctype) + { +- krb5_enctype etype; +- char encbuf[128], banner[256]; ++ const char *banner; + +- if (ctx->prompter == NULL) +- return; +- +- if (krb5int_c_deprecated_enctype(as_key_enctype)) +- etype = as_key_enctype; +- else if (krb5int_c_deprecated_enctype(ctx->cred.keyblock.enctype)) +- etype = ctx->cred.keyblock.enctype; +- else ++ if (as_key_enctype != ENCTYPE_DES3_CBC_SHA1 && ++ ctx->cred.keyblock.enctype != ENCTYPE_DES3_CBC_SHA1) + return; +- +- if (krb5_enctype_to_name(etype, FALSE, encbuf, sizeof(encbuf)) != 0) ++ if (ctx->prompter == NULL) + return; +- snprintf(banner, sizeof(banner), +- _("Warning: encryption type %s used for authentication is " +- "deprecated and will be disabled"), encbuf); + ++ banner = _("Warning: encryption type des3-cbc-sha1 used for " ++ "authentication is weak and will be disabled"); + /* PROMPTER_INVOCATION */ + (*ctx->prompter)(context, ctx->prompter_data, NULL, banner, 0, NULL); + } +@@ -1857,7 +1848,7 @@ init_creds_step_reply(krb5_context context, + ctx->complete = TRUE; + warn_pw_expiry(context, ctx->opt, ctx->prompter, ctx->prompter_data, + ctx->in_tkt_service, ctx->reply); +- warn_deprecated(context, ctx, encrypting_key.enctype); ++ warn_des3(context, ctx, encrypting_key.enctype); + + cleanup: + krb5_free_pa_data(context, kdc_padata); +diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c +index a6c2bbeb54..87b486c53f 100644 +--- a/src/lib/krb5/krb/init_ctx.c ++++ b/src/lib/krb5/krb/init_ctx.c +@@ -221,16 +221,6 @@ krb5_init_context_profile(profile_t profile, krb5_flags flags, + goto cleanup; + ctx->allow_weak_crypto = tmp; + +- retval = get_boolean(ctx, KRB5_CONF_ALLOW_DES3, 0, &tmp); +- if (retval) +- goto cleanup; +- ctx->allow_des3 = tmp; +- +- retval = get_boolean(ctx, KRB5_CONF_ALLOW_RC4, 0, &tmp); +- if (retval) +- goto cleanup; +- ctx->allow_rc4 = tmp; +- + retval = get_boolean(ctx, KRB5_CONF_IGNORE_ACCEPTOR_HOSTNAME, 0, &tmp); + if (retval) + goto cleanup; +diff --git a/src/tests/gssapi/t_enctypes.py b/src/tests/gssapi/t_enctypes.py +index f5f11842e2..7494d7fcdb 100755 +--- a/src/tests/gssapi/t_enctypes.py ++++ b/src/tests/gssapi/t_enctypes.py +@@ -18,8 +18,7 @@ d_rc4 = 'DEPRECATED:arcfour-hmac' + # These tests make assumptions about the default enctype lists, so set + # them explicitly rather than relying on the library defaults. + supp='aes256-cts:normal aes128-cts:normal des3-cbc-sha1:normal rc4-hmac:normal' +-conf = {'libdefaults': {'permitted_enctypes': 'aes des3 rc4', +- 'allow_des3': 'true', 'allow_rc4': 'true'}, ++conf = {'libdefaults': {'permitted_enctypes': 'aes des3 rc4'}, + 'realms': {'$realm': {'supported_enctypes': supp}}} + realm = K5Realm(krb5_conf=conf) + shutil.copyfile(realm.ccache, os.path.join(realm.testdir, 'save')) +diff --git a/src/tests/t_etype_info.py b/src/tests/t_etype_info.py +index 38cf96ca8f..c982508d8b 100644 +--- a/src/tests/t_etype_info.py ++++ b/src/tests/t_etype_info.py +@@ -1,7 +1,7 @@ + from k5test import * + + supported_enctypes = 'aes128-cts des3-cbc-sha1 rc4-hmac' +-conf = {'libdefaults': {'allow_des3': 'true', 'allow_rc4': 'true'}, ++conf = {'libdefaults': {'allow_weak_crypto': 'true'}, + 'realms': {'$realm': {'supported_enctypes': supported_enctypes}}} + realm = K5Realm(create_host=False, get_creds=False, krb5_conf=conf) + +diff --git a/src/tests/t_sesskeynego.py b/src/tests/t_sesskeynego.py +index 5a213617b5..9024aee838 100755 +--- a/src/tests/t_sesskeynego.py ++++ b/src/tests/t_sesskeynego.py +@@ -25,8 +25,6 @@ conf3 = {'libdefaults': { + 'default_tkt_enctypes': 'aes128-cts', + 'default_tgs_enctypes': 'rc4-hmac,aes128-cts'}} + conf4 = {'libdefaults': {'permitted_enctypes': 'aes256-cts'}} +-conf5 = {'libdefaults': {'allow_rc4': 'true'}} +-conf6 = {'libdefaults': {'allow_des3': 'true'}} + # Test with client request and session_enctypes preferring aes128, but + # aes256 long-term key. + realm = K5Realm(krb5_conf=conf1, create_host=False, get_creds=False) +@@ -56,12 +54,10 @@ realm.run([kadminl, 'setstr', 'server', 'session_enctypes', + 'aes128-cts,aes256-cts']) + test_kvno(realm, 'aes128-cts-hmac-sha1-96', 'aes256-cts-hmac-sha1-96') + +-# 3b: Skip RC4 (as the KDC does not allow it for session keys by +-# default) and negotiate aes128-cts session key, with only an aes256 +-# long-term service key. ++# 3b: Negotiate rc4-hmac session key when principal only has aes256 long-term. + realm.run([kadminl, 'setstr', 'server', 'session_enctypes', + 'rc4-hmac,aes128-cts,aes256-cts']) +-test_kvno(realm, 'aes128-cts-hmac-sha1-96', 'aes256-cts-hmac-sha1-96') ++test_kvno(realm, 'DEPRECATED:arcfour-hmac', 'aes256-cts-hmac-sha1-96') + realm.stop() + + # 4: Check that permitted_enctypes is a default for session key enctypes. +@@ -71,24 +67,4 @@ realm.run([kvno, 'user'], + expected_trace=('etypes requested in TGS request: aes256-cts',)) + realm.stop() + +-# 5: allow_rc4 permits negotiation of rc4-hmac session key. +-realm = K5Realm(krb5_conf=conf5, create_host=False, get_creds=False) +-realm.run([kadminl, 'addprinc', '-randkey', '-e', 'aes256-cts', 'server']) +-realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'rc4-hmac']) +-test_kvno(realm, 'DEPRECATED:arcfour-hmac', 'aes256-cts-hmac-sha1-96') +-realm.stop() +- +-# 6: allow_des3 permits negotiation of des3-cbc-sha1 session key. +-realm = K5Realm(krb5_conf=conf6, create_host=False, get_creds=False) +-realm.run([kadminl, 'addprinc', '-randkey', '-e', 'aes256-cts', 'server']) +-realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'des3-cbc-sha1']) +-test_kvno(realm, 'DEPRECATED:des3-cbc-sha1', 'aes256-cts-hmac-sha1-96') +-realm.stop() +- +-# 7: default config negotiates aes256-sha1 session key for RC4-only service. +-realm = K5Realm(create_host=False, get_creds=False) +-realm.run([kadminl, 'addprinc', '-randkey', '-e', 'rc4-hmac', 'server']) +-test_kvno(realm, 'aes256-cts-hmac-sha1-96', 'DEPRECATED:arcfour-hmac') +-realm.stop() +- + success('sesskeynego') +diff --git a/src/util/k5test.py b/src/util/k5test.py +index 8e5f5ba8e9..2a86c5cdfc 100644 +--- a/src/util/k5test.py ++++ b/src/util/k5test.py +@@ -1340,14 +1340,14 @@ _passes = [ + + # Exercise the DES3 enctype. + ('des3', None, +- {'libdefaults': {'permitted_enctypes': 'des3 aes256-sha1'}}, ++ {'libdefaults': {'permitted_enctypes': 'des3'}}, + {'realms': {'$realm': { + 'supported_enctypes': 'des3-cbc-sha1:normal', + 'master_key_type': 'des3-cbc-sha1'}}}), + + # Exercise the arcfour enctype. + ('arcfour', None, +- {'libdefaults': {'permitted_enctypes': 'rc4 aes256-sha1'}}, ++ {'libdefaults': {'permitted_enctypes': 'rc4'}}, + {'realms': {'$realm': { + 'supported_enctypes': 'arcfour-hmac:normal', + 'master_key_type': 'arcfour-hmac'}}}), +-- +2.41.0 + diff --git a/0001-downstream-ksu-pam-integration.patch b/0002-downstream-ksu-pam-integration.patch similarity index 99% rename from 0001-downstream-ksu-pam-integration.patch rename to 0002-downstream-ksu-pam-integration.patch index d33704a..08bfeab 100644 --- a/0001-downstream-ksu-pam-integration.patch +++ b/0002-downstream-ksu-pam-integration.patch @@ -1,4 +1,4 @@ -From 67c82a09c6c53713c281045cd55de2720cd06907 Mon Sep 17 00:00:00 2001 +From 2080ff4c57d29e74466987d673aaf25273160534 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:29:58 -0400 Subject: [PATCH] [downstream] ksu pam integration @@ -773,5 +773,5 @@ index 77be7a2025..587221936e 100644 if test "${localedir+set}" != set; then localedir='$(datadir)/locale' -- -2.40.1 +2.41.0 diff --git a/0002-downstream-SELinux-integration.patch b/0003-downstream-SELinux-integration.patch similarity index 99% rename from 0002-downstream-SELinux-integration.patch rename to 0003-downstream-SELinux-integration.patch index 840c2a3..cac0604 100644 --- a/0002-downstream-SELinux-integration.patch +++ b/0003-downstream-SELinux-integration.patch @@ -1,4 +1,4 @@ -From dfbac76ab7bb7e6e2c3171eefcaa93573e6b630e Mon Sep 17 00:00:00 2001 +From 3efc0e3ce4ccc8a89700f35bef041794982d95ca Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:30:53 -0400 Subject: [PATCH] [downstream] SELinux integration @@ -188,7 +188,7 @@ index 587221936e..69be9030f8 100644 if test "${localedir+set}" != set; then localedir='$(datadir)/locale' diff --git a/src/include/k5-int.h b/src/include/k5-int.h -index 2f7791b775..9c534faa8a 100644 +index 1d1c8293f4..768110e5ef 100644 --- a/src/include/k5-int.h +++ b/src/include/k5-int.h @@ -128,6 +128,7 @@ typedef unsigned char u_char; @@ -1034,5 +1034,5 @@ index 0000000000..807d039da3 + +#endif /* USE_SELINUX */ -- -2.40.1 +2.41.0 diff --git a/0003-downstream-fix-debuginfo-with-y.tab.c.patch b/0004-downstream-fix-debuginfo-with-y.tab.c.patch similarity index 95% rename from 0003-downstream-fix-debuginfo-with-y.tab.c.patch rename to 0004-downstream-fix-debuginfo-with-y.tab.c.patch index 40361ac..9368aa6 100644 --- a/0003-downstream-fix-debuginfo-with-y.tab.c.patch +++ b/0004-downstream-fix-debuginfo-with-y.tab.c.patch @@ -1,4 +1,4 @@ -From a9c463ed5988c860ebb18de212d6c56da1cb1169 Mon Sep 17 00:00:00 2001 +From 28677b932c200eba07576358b4e5df2ae22c8ecd Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:49:25 -0400 Subject: [PATCH] [downstream] fix debuginfo with y.tab.c @@ -40,5 +40,5 @@ index 8669c2436c..a22f23c02c 100644 install: $(INSTALL_PROGRAM) $(PROG) ${DESTDIR}$(ADMIN_BINDIR)/$(PROG) -- -2.40.1 +2.41.0 diff --git a/0004-downstream-Remove-3des-support.patch b/0005-downstream-Remove-3des-support.patch similarity index 98% rename from 0004-downstream-Remove-3des-support.patch rename to 0005-downstream-Remove-3des-support.patch index f7b5134..6c8ce3b 100644 --- a/0004-downstream-Remove-3des-support.patch +++ b/0005-downstream-Remove-3des-support.patch @@ -1,4 +1,4 @@ -From 0691db92e13e0d224c2c9dd72c1421d8f7c3c078 Mon Sep 17 00:00:00 2001 +From 6734a067c600ea6ad81d08fcc481609c2bad9fbb Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 26 Mar 2019 18:51:10 -0400 Subject: [PATCH] [downstream] Remove 3des support @@ -8,7 +8,7 @@ des3-hmac-sha1, des3-cbc-sha1-kd). Update all tests and documentation to user other enctypes. Mark the 3DES enctypes UNSUPPORTED and retain their constants. -Last-updated: 1.20-final +Last-updated: 1.21.1-final [antorres@redhat.com: remove diffs for: - src/kdamin/testing/proto/kdc.conf.proto - src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp @@ -98,19 +98,18 @@ Last-updated: 1.20-final src/plugins/preauth/pkinit/pkinit_crypto.h | 10 +- src/plugins/preauth/pkinit/pkinit_kdf_test.c | 30 -- src/plugins/preauth/spake/t_vectors.c | 25 -- - src/tests/gssapi/t_enctypes.py | 34 +- + src/tests/gssapi/t_enctypes.py | 33 +- src/tests/gssapi/t_invalid.c | 12 - src/tests/gssapi/t_pcontok.c | 16 +- src/tests/gssapi/t_prf.c | 7 - src/tests/t_authdata.py | 2 +- - src/tests/t_etype_info.py | 20 +- + src/tests/t_etype_info.py | 21 +- src/tests/t_keyrollover.py | 8 +- src/tests/t_mkey.py | 35 -- src/tests/t_salt.py | 5 +- - src/tests/t_sesskeynego.py | 8 - src/util/k5test.py | 7 - .../leash/htmlhelp/html/Encryption_Types.htm | 13 - - 90 files changed, 149 insertions(+), 4720 deletions(-) + 89 files changed, 149 insertions(+), 4712 deletions(-) delete mode 100644 src/lib/crypto/builtin/des/ISSUES delete mode 100644 src/lib/crypto/builtin/des/Makefile.in delete mode 100644 src/lib/crypto/builtin/des/d3_aead.c @@ -200,10 +199,10 @@ index 74a0a2acef..846c58ed82 100644 While **aes128-cts** and **aes256-cts** are supported for all Kerberos diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst -index dce19ad43e..2b4ed7da0b 100644 +index 694922c0d9..c4d5499d3b 100644 --- a/doc/admin/enctypes.rst +++ b/doc/admin/enctypes.rst -@@ -146,7 +146,7 @@ enctype weak? krb5 Windows +@@ -129,7 +129,7 @@ enctype weak? krb5 Windows des-cbc-crc weak <1.18 >=2000 des-cbc-md4 weak <1.18 ? des-cbc-md5 weak <1.18 >=2000 @@ -212,7 +211,7 @@ index dce19ad43e..2b4ed7da0b 100644 arcfour-hmac deprecated >=1.3 >=2000 arcfour-hmac-exp weak >=1.3 >=2000 aes128-cts-hmac-sha1-96 >=1.3 >=Vista -@@ -165,9 +165,11 @@ default. +@@ -148,9 +148,11 @@ default. krb5 releases 1.17 and later flag deprecated encryption types (including ``des3-cbc-sha1`` and ``arcfour-hmac``) in KDC logs and kadmin output. krb5 release 1.19 issues a warning during initial @@ -363,10 +362,10 @@ index dd6430ece8..350bcf86f2 100644 #define CKSUMTYPE_HMAC_SHA1_96_AES128 0x000f /**< RFC 3962. Used with ENCTYPE_AES128_CTS_HMAC_SHA1_96 */ diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c -index e54cc751f9..ea10e23a95 100644 +index 75e04b73db..fe4e48209a 100644 --- a/src/kdc/kdc_util.c +++ b/src/kdc/kdc_util.c -@@ -1164,8 +1164,6 @@ enctype_name(krb5_enctype ktype, char *buf, size_t buflen) +@@ -1154,8 +1154,6 @@ enctype_name(krb5_enctype ktype, char *buf, size_t buflen) name = "rsaEncryption-EnvOID"; else if (ktype == ENCTYPE_RSA_ES_OAEP_ENV) name = "id-RSAES-OAEP-EnvOID"; @@ -375,7 +374,7 @@ index e54cc751f9..ea10e23a95 100644 else return krb5_enctype_to_name(ktype, FALSE, buf, buflen); -@@ -1657,8 +1655,6 @@ krb5_boolean +@@ -1647,8 +1645,6 @@ krb5_boolean enctype_requires_etype_info_2(krb5_enctype enctype) { switch(enctype) { @@ -5593,7 +5592,7 @@ index 84f1949887..32150f5e34 100644 case ENCTYPE_ARCFOUR_HMAC_EXP: /* RFC 4121 accidentally omits RC4-HMAC-EXP as a "not-newer" enctype, diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c -index a6c2bbeb54..18290b764b 100644 +index 87b486c53f..2b5abcd817 100644 --- a/src/lib/krb5/krb/init_ctx.c +++ b/src/lib/krb5/krb/init_ctx.c @@ -59,7 +59,6 @@ @@ -5604,7 +5603,7 @@ index a6c2bbeb54..18290b764b 100644 ENCTYPE_ARCFOUR_HMAC, ENCTYPE_CAMELLIA128_CTS_CMAC, ENCTYPE_CAMELLIA256_CTS_CMAC, 0 -@@ -460,8 +459,6 @@ krb5int_parse_enctype_list(krb5_context context, const char *profkey, +@@ -450,8 +449,6 @@ krb5int_parse_enctype_list(krb5_context context, const char *profkey, /* Set all enctypes in the default list. */ for (i = 0; default_list[i]; i++) mod_list(default_list[i], sel, weak, &list); @@ -5849,10 +5848,10 @@ index 2279202d3a..96b0307d78 100644 /* initial key, w, x, y, T, S, K */ "8846F7EAEE8FB117AD06BDD830B7586C", diff --git a/src/tests/gssapi/t_enctypes.py b/src/tests/gssapi/t_enctypes.py -index f5f11842e2..1bb8c40b6b 100755 +index 7494d7fcdb..2f95d89967 100755 --- a/src/tests/gssapi/t_enctypes.py +++ b/src/tests/gssapi/t_enctypes.py -@@ -1,25 +1,17 @@ +@@ -1,24 +1,17 @@ from k5test import * -# Define some convenience abbreviations for enctypes we will see in @@ -5876,14 +5875,13 @@ index f5f11842e2..1bb8c40b6b 100755 # These tests make assumptions about the default enctype lists, so set # them explicitly rather than relying on the library defaults. -supp='aes256-cts:normal aes128-cts:normal des3-cbc-sha1:normal rc4-hmac:normal' --conf = {'libdefaults': {'permitted_enctypes': 'aes des3 rc4', -- 'allow_des3': 'true', 'allow_rc4': 'true'}, +-conf = {'libdefaults': {'permitted_enctypes': 'aes des3 rc4'}, +supp='aes256-cts:normal aes128-cts:normal rc4-hmac:normal' -+conf = {'libdefaults': {'permitted_enctypes': 'aes rc4', 'allow_rc4': 'true'}, ++conf = {'libdefaults': {'permitted_enctypes': 'aes rc4'}, 'realms': {'$realm': {'supported_enctypes': supp}}} realm = K5Realm(krb5_conf=conf) shutil.copyfile(realm.ccache, os.path.join(realm.testdir, 'save')) -@@ -88,19 +80,12 @@ test('both aes128', 'aes128-cts', 'aes128-cts', +@@ -87,19 +80,12 @@ test('both aes128', 'aes128-cts', 'aes128-cts', test_err('acc aes128', None, 'aes128-cts', 'Encryption type aes256-cts-hmac-sha1-96 not permitted') @@ -5904,7 +5902,7 @@ index f5f11842e2..1bb8c40b6b 100755 # subkey. test('upgrade noargs', None, None, tktenc=aes256, tktsession=d_rc4, -@@ -116,13 +101,6 @@ test('upgrade init aes128+rc4', 'aes128-cts rc4', None, +@@ -115,13 +101,6 @@ test('upgrade init aes128+rc4', 'aes128-cts rc4', None, tktenc=aes256, tktsession=d_rc4, proto='cfx', isubkey=rc4, asubkey=aes128) @@ -6008,20 +6006,21 @@ index bde1c36844..8fcd30db51 100644 realm.run(['./forward']) realm.run([kvno, realm.host_princ]) diff --git a/src/tests/t_etype_info.py b/src/tests/t_etype_info.py -index 38cf96ca8f..e82ff7ff07 100644 +index c982508d8b..a6f538b66d 100644 --- a/src/tests/t_etype_info.py +++ b/src/tests/t_etype_info.py -@@ -1,7 +1,7 @@ +@@ -1,8 +1,7 @@ from k5test import * -supported_enctypes = 'aes128-cts des3-cbc-sha1 rc4-hmac' --conf = {'libdefaults': {'allow_des3': 'true', 'allow_rc4': 'true'}, +-conf = {'libdefaults': {'allow_weak_crypto': 'true'}, +- 'realms': {'$realm': {'supported_enctypes': supported_enctypes}}} +supported_enctypes = 'aes128-cts rc4-hmac' -+conf = {'libdefaults': {'allow_rc4': 'true'}, - 'realms': {'$realm': {'supported_enctypes': supported_enctypes}}} ++conf = {'realms': {'$realm': {'supported_enctypes': supported_enctypes}}} realm = K5Realm(create_host=False, get_creds=False, krb5_conf=conf) -@@ -26,9 +26,9 @@ def test_etinfo(princ, enctypes, expected_lines): + realm.run([kadminl, 'addprinc', '-pw', 'pw', '+requires_preauth', +@@ -26,9 +25,9 @@ def test_etinfo(princ, enctypes, expected_lines): # With no newer enctypes in the request, PA-ETYPE-INFO2, # PA-ETYPE-INFO, and PA-PW-SALT appear in the AS-REP, each listing one # key for the most preferred matching enctype. @@ -6034,7 +6033,7 @@ index 38cf96ca8f..e82ff7ff07 100644 'asrep pw_salt KRBTEST.COMuser']) # With a newer enctype in the request (even if it is not the most -@@ -39,9 +39,9 @@ test_etinfo('user', 'rc4 aes256-cts', +@@ -39,9 +38,9 @@ test_etinfo('user', 'rc4 aes256-cts', # In preauth-required errors, PA-PW-SALT does not appear, but the same # etype-info2 values are expected. @@ -6047,7 +6046,7 @@ index 38cf96ca8f..e82ff7ff07 100644 test_etinfo('preauthuser', 'rc4 aes256-cts', ['error etype_info2 rc4-hmac KRBTEST.COMpreauthuser']) -@@ -50,8 +50,8 @@ test_etinfo('preauthuser', 'rc4 aes256-cts', +@@ -50,8 +49,8 @@ test_etinfo('preauthuser', 'rc4 aes256-cts', # (to allow for preauth mechs which don't depend on long-term keys). # An AS-REP cannot be generated without preauth as there is no reply # key. @@ -6159,34 +6158,8 @@ index 65084bbf35..55ca897459 100755 # Test using different salt types in a principal's key list. # Parameters from one key in the list must not leak over to later ones. -diff --git a/src/tests/t_sesskeynego.py b/src/tests/t_sesskeynego.py -index 5a213617b5..c7dba0ff5b 100755 ---- a/src/tests/t_sesskeynego.py -+++ b/src/tests/t_sesskeynego.py -@@ -26,7 +26,6 @@ conf3 = {'libdefaults': { - 'default_tgs_enctypes': 'rc4-hmac,aes128-cts'}} - conf4 = {'libdefaults': {'permitted_enctypes': 'aes256-cts'}} - conf5 = {'libdefaults': {'allow_rc4': 'true'}} --conf6 = {'libdefaults': {'allow_des3': 'true'}} - # Test with client request and session_enctypes preferring aes128, but - # aes256 long-term key. - realm = K5Realm(krb5_conf=conf1, create_host=False, get_creds=False) -@@ -78,13 +77,6 @@ realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'rc4-hmac']) - test_kvno(realm, 'DEPRECATED:arcfour-hmac', 'aes256-cts-hmac-sha1-96') - realm.stop() - --# 6: allow_des3 permits negotiation of des3-cbc-sha1 session key. --realm = K5Realm(krb5_conf=conf6, create_host=False, get_creds=False) --realm.run([kadminl, 'addprinc', '-randkey', '-e', 'aes256-cts', 'server']) --realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'des3-cbc-sha1']) --test_kvno(realm, 'DEPRECATED:des3-cbc-sha1', 'aes256-cts-hmac-sha1-96') --realm.stop() -- - # 7: default config negotiates aes256-sha1 session key for RC4-only service. - realm = K5Realm(create_host=False, get_creds=False) - realm.run([kadminl, 'addprinc', '-randkey', '-e', 'rc4-hmac', 'server']) diff --git a/src/util/k5test.py b/src/util/k5test.py -index 8e5f5ba8e9..b953827018 100644 +index 2a86c5cdfc..d823653aa0 100644 --- a/src/util/k5test.py +++ b/src/util/k5test.py @@ -1338,13 +1338,6 @@ _passes = [ @@ -6195,14 +6168,14 @@ index 8e5f5ba8e9..b953827018 100644 - # Exercise the DES3 enctype. - ('des3', None, -- {'libdefaults': {'permitted_enctypes': 'des3 aes256-sha1'}}, +- {'libdefaults': {'permitted_enctypes': 'des3'}}, - {'realms': {'$realm': { - 'supported_enctypes': 'des3-cbc-sha1:normal', - 'master_key_type': 'des3-cbc-sha1'}}}), - # Exercise the arcfour enctype. ('arcfour', None, - {'libdefaults': {'permitted_enctypes': 'rc4 aes256-sha1'}}, + {'libdefaults': {'permitted_enctypes': 'rc4'}}, diff --git a/src/windows/leash/htmlhelp/html/Encryption_Types.htm b/src/windows/leash/htmlhelp/html/Encryption_Types.htm index 1aebdd0b4a..c38eefd2bd 100644 --- a/src/windows/leash/htmlhelp/html/Encryption_Types.htm @@ -6228,5 +6201,5 @@ index 1aebdd0b4a..c38eefd2bd 100644 The AES Advanced Encryption Standard family, like 3DES, is a symmetric block cipher and was designed -- -2.40.1 +2.41.0 diff --git a/0005-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch b/0006-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch similarity index 99% rename from 0005-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch rename to 0006-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch index e575b79..d59a5bf 100644 --- a/0005-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch +++ b/0006-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch @@ -1,4 +1,4 @@ -From 53191fd3a1acfeefa8e5c26e7e9d130688daf745 Mon Sep 17 00:00:00 2001 +From dc3fd927ccd5b7b40049145c3fc7c610d72e9502 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 9 Nov 2018 15:12:21 -0500 Subject: [PATCH] [downstream] FIPS with PRNG and RADIUS and MD4 @@ -41,10 +41,10 @@ Last-updated: krb5-1.20 15 files changed, 155 insertions(+), 33 deletions(-) diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst -index ecdf917501..b78a3faf0a 100644 +index f22d5db11b..a33711d918 100644 --- a/doc/admin/conf_files/krb5_conf.rst +++ b/doc/admin/conf_files/krb5_conf.rst -@@ -342,6 +342,12 @@ The libdefaults section may contain any of the following relations: +@@ -330,6 +330,12 @@ The libdefaults section may contain any of the following relations: qualification of shortnames, set this relation to the empty string with ``qualify_shortname = ""``. (New in release 1.18.) @@ -608,5 +608,5 @@ index 1a772d450f..232e78bc05 100644 vt->name = "spake"; vt->pa_type_list = pa_types; -- -2.40.1 +2.41.0 diff --git a/0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch b/0007-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch similarity index 97% rename from 0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch rename to 0007-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch index 68f10a0..2602e7a 100644 --- a/0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch +++ b/0007-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch @@ -1,4 +1,4 @@ -From c19d0bd35cde40172118c67c38a44f164bce1e16 Mon Sep 17 00:00:00 2001 +From 19db7e5b5d13732c2dfd08b35e2ad3f311553d54 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Thu, 5 May 2022 17:15:12 +0200 Subject: [PATCH] [downstream] Allow krad UDP/TCP localhost connection with FIPS @@ -77,5 +77,5 @@ index 929f1cef67..063f17a613 100644 retval = ESOCKTNOSUPPORT; goto error; -- -2.40.1 +2.41.0 diff --git a/0007-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch b/0008-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch similarity index 94% rename from 0007-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch rename to 0008-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch index f1c3ed6..844890e 100644 --- a/0007-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch +++ b/0008-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch @@ -1,4 +1,4 @@ -From 0366e8b5b2f960cb8305fd95839376b6c18aae42 Mon Sep 17 00:00:00 2001 +From 16d3f9a54d4707ae9de18f108a7b61965e83ceaf Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Wed, 7 Dec 2022 13:22:42 +0100 Subject: [PATCH] [downstream] Make tests compatible with @@ -37,5 +37,5 @@ index 87bac17929..26bc95a8dc 100644 fail('URI answers do not match') j += 1 -- -2.40.1 +2.41.0 diff --git a/0008-downstream-Include-missing-OpenSSL-FIPS-header.patch b/0009-downstream-Include-missing-OpenSSL-FIPS-header.patch similarity index 98% rename from 0008-downstream-Include-missing-OpenSSL-FIPS-header.patch rename to 0009-downstream-Include-missing-OpenSSL-FIPS-header.patch index 43648a7..ea123f7 100644 --- a/0008-downstream-Include-missing-OpenSSL-FIPS-header.patch +++ b/0009-downstream-Include-missing-OpenSSL-FIPS-header.patch @@ -1,4 +1,4 @@ -From a567b9de563cd8ad262f77cf97a8bc528a884745 Mon Sep 17 00:00:00 2001 +From 511a6260f0dadc3fe5ebe075f8b548eae026a1cc Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Thu, 5 Jan 2023 20:06:47 +0100 Subject: [PATCH] [downstream] Include missing OpenSSL FIPS header @@ -116,5 +116,5 @@ index 232e78bc05..3394f8a58e 100644 * The SPAKE kdcpreauth module uses a secure cookie containing the following * concatenated fields (all integer fields are big-endian): -- -2.40.1 +2.41.0 diff --git a/0009-downstream-Do-not-set-root-as-ksu-file-owner.patch b/0010-downstream-Do-not-set-root-as-ksu-file-owner.patch similarity index 93% rename from 0009-downstream-Do-not-set-root-as-ksu-file-owner.patch rename to 0010-downstream-Do-not-set-root-as-ksu-file-owner.patch index 0dd8834..46e759e 100644 --- a/0009-downstream-Do-not-set-root-as-ksu-file-owner.patch +++ b/0010-downstream-Do-not-set-root-as-ksu-file-owner.patch @@ -1,4 +1,4 @@ -From 6adfd97a3558aae4ace346685266bac9dae8bba9 Mon Sep 17 00:00:00 2001 +From 1b0bb0c3e5575559ea9135af5b9a1e91fe0f79f3 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Mon, 9 Jan 2023 22:39:52 +0100 Subject: [PATCH] [downstream] Do not set root as ksu file owner @@ -27,5 +27,5 @@ index 7eaa2f351c..e9ae71471e 100644 ## ${prefix}. prefix=@prefix@ -- -2.40.1 +2.41.0 diff --git a/0010-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch b/0011-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch similarity index 98% rename from 0010-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch rename to 0011-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch index a78d09c..2d34be0 100644 --- a/0010-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch +++ b/0011-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch @@ -1,4 +1,4 @@ -From 73640dc4899494d010b83b080b3a65bd3e69177c Mon Sep 17 00:00:00 2001 +From 6e239888cdb938ddda2bf49ec03ad2af3923c381 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Thu, 19 Jan 2023 19:22:27 +0100 Subject: [PATCH] [downstream] Allow KRB5KDF, MD5, and MD4 in FIPS mode @@ -161,5 +161,5 @@ index 5a43c3d9eb..8528ddc4a9 100644 ret = KRB5_CRYPTO_INTERNAL; goto done; -- -2.40.1 +2.41.0 diff --git a/0011-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch b/0012-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch similarity index 98% rename from 0011-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch rename to 0012-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch index 8109a84..00d2d0b 100644 --- a/0011-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch +++ b/0012-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch @@ -1,4 +1,4 @@ -From f47c9eb8618006012600a906367295ed53c558d0 Mon Sep 17 00:00:00 2001 +From 640492ecb4ee42edf33c343c08c01a549ed68a52 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Wed, 15 Mar 2023 15:56:34 +0100 Subject: [PATCH] [downstream] Allow to set PAC ticket signature as optional @@ -124,7 +124,7 @@ index 350bcf86f2..17e1b52266 100644 krb5_error_code KRB5_CALLCONV krb5_pac_sign(krb5_context context, krb5_pac pac, krb5_timestamp authtime, diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c -index ea10e23a95..c7b6e4090d 100644 +index fe4e48209a..93415ba862 100644 --- a/src/kdc/kdc_util.c +++ b/src/kdc/kdc_util.c @@ -560,16 +560,36 @@ cleanup: @@ -258,7 +258,7 @@ index 4c50e935a2..d4b0455c8c 100644 krb5_kt_client_default krb5_kt_close diff --git a/src/man/kadmin.man b/src/man/kadmin.man -index d028dc2975..2c8d10067f 100644 +index 461207021b..e8d78309cb 100644 --- a/src/man/kadmin.man +++ b/src/man/kadmin.man @@ -724,6 +724,12 @@ encryption type. It may be necessary to set this value to @@ -275,5 +275,5 @@ index d028dc2975..2c8d10067f 100644 .sp This command requires the \fBmodify\fP privilege. -- -2.40.1 +2.41.0 diff --git a/0012-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch b/0013-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch similarity index 96% rename from 0012-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch rename to 0013-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch index c40ed12..ba2c6af 100644 --- a/0012-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch +++ b/0013-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch @@ -1,4 +1,4 @@ -From d1322546dca51100759eac318ce554bd301c50c3 Mon Sep 17 00:00:00 2001 +From 1b2f64d66e01c1abeefdb7cbef7b04035c2128c0 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Tue, 23 May 2023 12:19:54 +0200 Subject: [PATCH] [downstream] Make PKINIT CMS SHA-1 signature verification @@ -43,5 +43,5 @@ index f41328763e..263ef7845e 100644 goto cleanup; } -- -2.40.1 +2.41.0 diff --git a/0013-Enable-PKINIT-if-at-least-one-group-is-available.patch b/0014-Enable-PKINIT-if-at-least-one-group-is-available.patch similarity index 99% rename from 0013-Enable-PKINIT-if-at-least-one-group-is-available.patch rename to 0014-Enable-PKINIT-if-at-least-one-group-is-available.patch index ebfa323..717eb43 100644 --- a/0013-Enable-PKINIT-if-at-least-one-group-is-available.patch +++ b/0014-Enable-PKINIT-if-at-least-one-group-is-available.patch @@ -1,4 +1,4 @@ -From a378b1970d92692baeddf6a8681f47efb13e343d Mon Sep 17 00:00:00 2001 +From d2b061bea524012edde2915aa95fc4cb6a6f3ae9 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Tue, 30 May 2023 01:21:48 -0400 Subject: [PATCH] Enable PKINIT if at least one group is available @@ -214,5 +214,5 @@ index 259e95c6c2..5ee39c085c 100644 TRACE(c, "PKINIT OpenSSL error: {str}", msg) -- -2.40.1 +2.41.0 diff --git a/0015-Replace-ssl.wrap_socket-for-tests.patch b/0015-Replace-ssl.wrap_socket-for-tests.patch new file mode 100644 index 0000000..d5eb3f4 --- /dev/null +++ b/0015-Replace-ssl.wrap_socket-for-tests.patch @@ -0,0 +1,64 @@ +From 42e831da09bd196068aeb7fe6bfe380bb46b846c Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Wed, 19 Jul 2023 13:43:17 +0200 +Subject: [PATCH] Replace ssl.wrap_socket() for tests + +The ssl.wrap_socket() function was deprecated in Python 3.7 and is +removed in Python 3.12. The ssl.SSLContext.wrap_socket() method +replaces it. + +Bump the required Python version for tests to 3.4 for +ssl.create_default_context(). + +[ghudson@mit.edu: changed minimum Python version] + +(cherry picked from commit 0ceab6c363e65fb21d3312a663f2b9b569ecc415) +--- + src/configure.ac | 9 ++++----- + src/util/wsgiref-kdcproxy.py | 4 +++- + 2 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/src/configure.ac b/src/configure.ac +index 2561e917a2..487f393146 100644 +--- a/src/configure.ac ++++ b/src/configure.ac +@@ -1157,10 +1157,9 @@ AC_SUBST(PKINIT) + # for lib/apputils + AC_REPLACE_FUNCS(daemon) + +-# For Python tests. Python version 3.2.4 is required as prior +-# versions do not accept string input to subprocess.Popen.communicate +-# when universal_newlines is set. +-PYTHON_MINVERSION=3.2.4 ++# For Python tests. Python version 3.4 is required for ++# ssl.create_default_context(). ++PYTHON_MINVERSION=3.4 + AC_SUBST(PYTHON_MINVERSION) + AC_CHECK_PROG(PYTHON,python3,python3) + if test x"$PYTHON" = x; then +@@ -1168,7 +1167,7 @@ if test x"$PYTHON" = x; then + fi + HAVE_PYTHON=no + if test x"$PYTHON" != x; then +- wantver="(sys.hexversion >= 0x30204F0)" ++ wantver="(sys.hexversion >= 0x30400F0)" + if "$PYTHON" -c "import sys; sys.exit(not $wantver and 1 or 0)"; then + HAVE_PYTHON=yes + fi +diff --git a/src/util/wsgiref-kdcproxy.py b/src/util/wsgiref-kdcproxy.py +index 58759696b6..d1d10d733c 100755 +--- a/src/util/wsgiref-kdcproxy.py ++++ b/src/util/wsgiref-kdcproxy.py +@@ -14,6 +14,8 @@ else: + pem = '*' + + server = make_server('localhost', port, kdcproxy.Application()) +-server.socket = ssl.wrap_socket(server.socket, certfile=pem, server_side=True) ++sslctx = ssl.create_default_context(purpose=ssl.Purpose.CLIENT_AUTH) ++sslctx.load_cert_chain(certfile=pem) ++server.socket = sslctx.wrap_socket(server.socket, server_side=True) + os.write(sys.stdout.fileno(), b'proxy server ready\n') + server.serve_forever() +-- +2.41.0 + diff --git a/krb5.spec b/krb5.spec index 4932c63..03498cb 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 3 +%global baserelease 1 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -24,7 +24,7 @@ %global krb5_version_major 1 %global krb5_version_minor 21 # For a release without a patch number set to %%nil -%global krb5_version_patch %nil +%global krb5_version_patch 2 %global krb5_version_major_minor %{krb5_version_major}.%{krb5_version_minor} %global krb5_version %{krb5_version_major_minor} @@ -59,19 +59,21 @@ Source13: kadmind.logrotate Source14: krb5-krb5kdc.conf Source15: %{name}-tests -Patch0001: 0001-downstream-ksu-pam-integration.patch -Patch0002: 0002-downstream-SELinux-integration.patch -Patch0003: 0003-downstream-fix-debuginfo-with-y.tab.c.patch -Patch0004: 0004-downstream-Remove-3des-support.patch -Patch0005: 0005-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch -Patch0006: 0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch -Patch0007: 0007-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch -Patch0008: 0008-downstream-Include-missing-OpenSSL-FIPS-header.patch -Patch0009: 0009-downstream-Do-not-set-root-as-ksu-file-owner.patch -Patch0010: 0010-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch -Patch0011: 0011-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch -Patch0012: 0012-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch -Patch0013: 0013-Enable-PKINIT-if-at-least-one-group-is-available.patch +Patch0001: 0001-Revert-Don-t-issue-session-keys-with-deprecated-enct.patch +Patch0002: 0002-downstream-ksu-pam-integration.patch +Patch0003: 0003-downstream-SELinux-integration.patch +Patch0004: 0004-downstream-fix-debuginfo-with-y.tab.c.patch +Patch0005: 0005-downstream-Remove-3des-support.patch +Patch0006: 0006-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch +Patch0007: 0007-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch +Patch0008: 0008-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch +Patch0009: 0009-downstream-Include-missing-OpenSSL-FIPS-header.patch +Patch0010: 0010-downstream-Do-not-set-root-as-ksu-file-owner.patch +Patch0011: 0011-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch +Patch0012: 0012-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch +Patch0013: 0013-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch +Patch0014: 0014-Enable-PKINIT-if-at-least-one-group-is-available.patch +Patch0015: 0015-Replace-ssl.wrap_socket-for-tests.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -708,6 +710,13 @@ exit 0 %{_datarootdir}/%{name}-tests/ %changelog +* Wed Aug 16 2023 Julien Rische - 1.21.2-1 +- New upstream version (1.21.2) +- Fix double-free in KDC TGS processing (CVE-2023-39975) + Resolves: rhbz#2229113 +- Make tests compatible with Python 3.12 + Resolves: rhbz#2224013 + * Thu Jul 20 2023 Fedora Release Engineering - 1.21-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild @@ -937,7 +946,7 @@ exit 0 - Fix build of previous * Wed Oct 21 2020 Robbie Harwood - 1.18.2-26 -- Cross-realm s4u fixes for samba (#1836630) +- Cross-realm s4u fixes for samba (rhbz#1836630) * Thu Oct 15 2020 Robbie Harwood - 1.18.2-25 - Unify kvno option documentation @@ -1551,11 +1560,11 @@ exit 0 * Mon Jun 26 2017 Robbie Harwood - 1.15.1-13 - Fix arch name (ppc64le, not ppc64el) -- Related-to: #1464381 +- Related-to: rhbz#1464381 * Mon Jun 26 2017 Robbie Harwood - 1.15.1-12 - Skip test suite on ppc64el -- Related-to: #1464381 +- Related-to: rhbz#1464381 * Fri Jun 23 2017 Robbie Harwood - 1.15.1-11 - Include more test suite changes from upstream @@ -1766,7 +1775,7 @@ exit 0 - Backport patch to fix mechglue for gss_inqure_attrs_for_mech() * Thu Dec 03 2015 Robbie Harwood - 1.14-11 -- Backport interposer fix (#1284985) +- Backport interposer fix (rhbz#1284985) - Drop workaround pwsize initialization patch (gcc has been fixed) * Tue Nov 24 2015 Robbie Harwood - 1.14-10 @@ -1801,7 +1810,7 @@ exit 0 - New upstream beta version * Thu Oct 08 2015 Robbie Harwood - 1.13.2-13 -- Work around KDC client prinicipal in referrals issue (#1259844) +- Work around KDC client prinicipal in referrals issue (rhbz#1259844) * Thu Oct 01 2015 Robbie Harwood - 1.13.2-12 - Enable building with bad system /etc/krb5.conf @@ -1814,7 +1823,7 @@ exit 0 - Nix /usr/share/krb5.conf.d to reduce complexity * Wed Sep 23 2015 Robbie Harwood - 1.13.2-9 -- Depend on crypto-policies which provides /etc/krb5.conf.d (#1225792) +- Depend on crypto-policies which provides /etc/krb5.conf.d (rhbz#1225792) * Thu Sep 10 2015 Robbie Harwood - 1.13.2-8 - Remove dependency on systemd-sysv which is no longer needed for fedora > 20 @@ -1823,7 +1832,7 @@ exit 0 * Thu Sep 10 2015 Robbie Harwood - 1.13.2-7 - Support config snippets in /etc/krb5.conf.d/ and /usr/share/krb5.conf.d/ - (#1225792, #1146370, #1145808) + (rhbz#1225792, rhbz#1146370, rhbz#1145808) * Thu Jun 25 2015 Roland Mainz - 1.13.2-6 - Use system nss_wrapper and socket_wrapper for testing. @@ -1831,8 +1840,8 @@ exit 0 * Thu Jun 25 2015 Roland Mainz - 1.13.2-5 - Remove Zanata test glue and related workarounds - - Bug #1234292 ("IPA server cannot be run in container due to incorrect /usr/sbin/_kadmind") - - Bug #1234326 ("krb5-server introduces new rpm dependency on ksh") + - rhbz#1234292 ("IPA server cannot be run in container due to incorrect /usr/sbin/_kadmind") + - rhbz#1234326 ("krb5-server introduces new rpm dependency on ksh") * Thu Jun 18 2015 Roland Mainz - 1.13.2-4 - Fix dependicy on binfmt.service @@ -1841,12 +1850,12 @@ exit 0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild * Tue Jun 2 2015 Roland Mainz - 1.13.2-2 -- Add patch to fix Redhat Bug #1227542 ("[SELinux] AVC denials may appear +- Add patch to fix Redhat rhbz#1227542 ("[SELinux] AVC denials may appear when kadmind starts"). The issue was caused by an unneeded |htons()| which triggered SELinux AVC denials due to the "random" port usage. * Thu May 21 2015 Roland Mainz - 1.13.2-1 -- Add fix for RedHat Bug #1164304 ("Upstream unit tests loads +- Add fix for RedHat rhbz#1164304 ("Upstream unit tests loads the installed shared libraries instead the ones from the build") * Thu May 14 2015 Roland Mainz - 1.13.2-0 @@ -1857,7 +1866,7 @@ exit 0 - Minor spec cleanup * Mon May 4 2015 Roland Mainz - 1.13.1-4 -- fix for CVE-2015-2694 (#1216133) "requires_preauth bypass +- fix for CVE-2015-2694 (rhbz#1216133) "requires_preauth bypass in PKINIT-enabled KDC". In MIT krb5 1.12 and later, when the KDC is configured with PKINIT support, an unauthenticated remote attacker can @@ -1867,13 +1876,13 @@ exit 0 dictionary attack against the user's password. * Wed Mar 25 2015 Roland Mainz - 1.13.1-3 -- Add temporay workaround for RH bug #1204646 ("krb5-config +- Add temporay workaround for RH rhbz#1204646 ("krb5-config returns wrong -specs path") which modifies krb5-config post build so that development of krb5 dependicies gets unstuck. This MUST be removed before rawhide becomes F23 ... * Thu Mar 19 2015 Roland Mainz - 1.13.1-2 -- fix for CVE-2014-5355 (#1193939) "krb5: unauthenticated +- fix for CVE-2014-5355 (rhbz#1193939) "krb5: unauthenticated denial of service in recvauth_common() and others" * Fri Feb 13 2015 Roland Mainz - 1.13.1-1 @@ -1884,13 +1893,13 @@ exit 0 - Minor spec cleanup * Wed Feb 4 2015 Roland Mainz - 1.13-8 -- fix for CVE-2014-5352 (#1179856) "gss_process_context_token() +- fix for CVE-2014-5352 (rhbz#1179856) "gss_process_context_token() incorrectly frees context (MITKRB5-SA-2015-001)" -- fix for CVE-2014-9421 (#1179857) "kadmind doubly frees partial +- fix for CVE-2014-9421 (rhbz#1179857) "kadmind doubly frees partial deserialization results (MITKRB5-SA-2015-001)" -- fix for CVE-2014-9422 (#1179861) "kadmind incorrectly +- fix for CVE-2014-9422 (rhbz#1179861) "kadmind incorrectly validates server principal name (MITKRB5-SA-2015-001)" -- fix for CVE-2014-9423 (#1179863) "libgssrpc server applications +- fix for CVE-2014-9423 (rhbz#1179863) "libgssrpc server applications leak uninitialized bytes (MITKRB5-SA-2015-001)" * Wed Feb 4 2015 Roland Mainz - 1.13-7 @@ -1902,17 +1911,17 @@ exit 0 - Support KDC_ERR_MORE_PREAUTH_DATA_REQUIRED (RT#8063) * Mon Jan 26 2015 Roland Mainz - 1.13-5 -- fix for kinit -C loops (#1184629, MIT/krb5 issue 243, "Do not +- fix for kinit -C loops (rhbz#1184629, MIT/krb5 issue 243, "Do not loop on principal unknown errors"). - Added "python-sphinx-latex" to the build requirements to fix build failures on F22 machines. * Thu Dec 18 2014 Roland Mainz - 1.13-4 -- fix for CVE-2014-5354 (#1174546) "krb5: NULL pointer +- fix for CVE-2014-5354 (rhbz#1174546) "krb5: NULL pointer dereference when using keyless entries" * Wed Dec 17 2014 Roland Mainz - 1.13-3 -- fix for CVE-2014-5353 (#1174543) "Fix LDAP misused policy +- fix for CVE-2014-5353 (rhbz#1174543) "Fix LDAP misused policy name crash" * Wed Oct 29 2014 Roland Mainz - 1.13-2 @@ -1922,18 +1931,18 @@ exit 0 * Wed Oct 29 2014 Roland Mainz - 1.13-1 - Update from krb5-1.13-alpha1 to final krb5-1.13 -- Removed patch for CVE-2014-5351 (#1145425) "krb5: current +- Removed patch for CVE-2014-5351 (rhbz#1145425) "krb5: current keys returned when randomizing the keys for a service principal" - now part of upstream sources -- Use patch for glibc |eventfd()| prototype mismatch (#1147887) only +- Use patch for glibc |eventfd()| prototype mismatch (rhbz#1147887) only for Fedora > 20 * Tue Sep 30 2014 Roland Mainz - 1.13-0.alpha1.3 - fix build failure caused by change of prototype for glibc - |eventfd()| (#1147887) + |eventfd()| (rhbz#1147887) * Mon Sep 29 2014 Roland Mainz - 1.13-0.alpha1.3 -- fix for CVE-2014-5351 (#1145425) "krb5: current keys returned when +- fix for CVE-2014-5351 (rhbz#1145425) "krb5: current keys returned when randomizing the keys for a service principal" * Mon Sep 8 2014 Nalin Dahyabhai - 1.13-0.alpha1.3 @@ -1949,7 +1958,7 @@ exit 0 * Wed Aug 20 2014 Nalin Dahyabhai - 1.12.2-3 - pull in upstream fix for an incorrect check on the value returned by a - strdup() call (#1132062) + strdup() call (rhbz#1132062) * Sun Aug 17 2014 Fedora Release Engineering - 1.12.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild @@ -1957,7 +1966,7 @@ exit 0 * Fri Aug 15 2014 Nalin Dahyabhai - 1.12.2-1 - update to 1.12.2 - drop patch for RT#7820, fixed in 1.12.2 - - drop patch for #231147, fixed as RT#3277 in 1.12.2 + - drop patch for rhbz#231147, fixed as RT#3277 in 1.12.2 - drop patch for RT#7818, fixed in 1.12.2 - drop patch for RT#7836, fixed in 1.12.2 - drop patch for RT#7858, fixed in 1.12.2 @@ -1968,7 +1977,7 @@ exit 0 - drop patch for CVE-2014-4344, included in 1.12.2 - drop patch for CVE-2014-4345, included in 1.12.2 - replace older proposed changes for ksu with backports of the changes - after review and merging upstream (#1015559, #1026099, #1118347) + after review and merging upstream (rhbz#1015559, rhbz#1026099, rhbz#1118347) * Thu Aug 7 2014 Nalin Dahyabhai - 1.12.1-14 - incorporate fix for MITKRB5-SA-2014-001 (CVE-2014-4345) @@ -1979,21 +1988,21 @@ exit 0 * Wed Jul 16 2014 Nalin Dahyabhai - 1.12.1-12 - gssapi: pull in proposed fix for a double free in initiators (David - Woodhouse, CVE-2014-4343, #1117963) + Woodhouse, CVE-2014-4343, rhbz#1117963) * Sat Jul 12 2014 Tom Callaway - 1.12.1-11 - fix license handling * Mon Jul 7 2014 Nalin Dahyabhai - 1.12.1-10 - pull in fix for denial of service by injection of malformed GSSAPI tokens - (CVE-2014-4341, CVE-2014-4342, #1116181) + (CVE-2014-4341, CVE-2014-4342, rhbz#1116181) * Tue Jun 24 2014 Nalin Dahyabhai - 1.12.1-9 - pull in changes from upstream which add processing of the contents of - /etc/gss/mech.d/*.conf when loading GSS modules (#1102839) + /etc/gss/mech.d/*.conf when loading GSS modules (rhbz#1102839) * Thu Jun 12 2014 Nalin Dahyabhai - 1.12.1-8 -- pull in fix for building against tcl 8.6 (#1107061) +- pull in fix for building against tcl 8.6 (rhbz#1107061) * Sun Jun 08 2014 Fedora Release Engineering - 1.12.1-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild @@ -2005,14 +2014,14 @@ exit 0 - spnego: pull in patch from master to restore preserving the OID of the mechanism the initiator requested when we have multiple OIDs for the same mechanism, so that we reply using the same mechanism OID and the initiator - doesn't get confused (#1066000, RT#7858) + doesn't get confused (rhbz#1066000, RT#7858) * Fri Feb 7 2014 Nalin Dahyabhai - 1.12.1-4 - pull in patch from master to move the default directory which the KDC uses when computing the socket path for a local OTP daemon from the database directory (/var/kerberos/krb5kdc) to the newly-added run directory (/run/krb5kdc), in line with what we're expecting in 1.13 (RT#7859, more - of #1040056 as #1063905) + of rhbz#1040056 as rhbz#1063905) - add a tmpfiles.d configuration file to have /run/krb5kdc created at boot-time - own /var/run/krb5kdc @@ -2022,12 +2031,12 @@ exit 0 * Fri Jan 31 2014 Nalin Dahyabhai - add currently-proposed changes to teach ksu about credential cache - collections and the default_ccache_name setting (#1015559,#1026099) + collections and the default_ccache_name setting (rhbz#1015559,rhbz#1026099) * Tue Jan 21 2014 Nalin Dahyabhai - 1.12.1-2 - pull in multiple changes to allow replay caches to be added to a GSS - credential store as "rcache"-type credentials (RT#7818/#7819/#7836, - #1056078/#1056080) + credential store as "rcache"-type credentials (RT#7818/rhbz#7819/rhbz#7836, + rhbz#1056078/rhbz#1056080) * Fri Jan 17 2014 Nalin Dahyabhai - 1.12.1-1 - update to 1.12.1 @@ -2040,11 +2049,11 @@ exit 0 - drop patches for RT#7813 and RT#7815, included now - add patch to always retrieve the KDC time offsets from keyring caches, so that we don't mistakenly interpret creds as expired before their - time when our clock is ahead of the KDC's (RT#7820, #1030607) + time when our clock is ahead of the KDC's (RT#7820, rhbz#1030607) * Mon Jan 13 2014 Nalin Dahyabhai - 1.12-11 - update the PIC patch for iaesx86.s to not use ELF relocations to the version - that landed upstream (RT#7815, #1045699) + that landed upstream (RT#7815, rhbz#1045699) * Thu Jan 9 2014 Nalin Dahyabhai - pass -Wl,--warn-shared-textrel to the compiler when we're creating shared @@ -2059,16 +2068,16 @@ exit 0 master - make a guess at making the 32-bit AES-NI implementation sufficiently position-independent to not require execmod permissions for libk5crypto - (more of #1045699) + (more of rhbz#1045699) * Thu Jan 2 2014 Nalin Dahyabhai - 1.12-8 - add patch from Dhiru Kholia for the AES-NI implementations to allow libk5crypto to be properly marked as not needing an executable stack - on arches where they're used (#1045699, and so many others) + on arches where they're used (rhbz#1045699, and so many others) * Thu Jan 2 2014 Nalin Dahyabhai - 1.12-7 - revert that last change for a bit while sorting out execstack when we - use AES-NI (#1045699) + use AES-NI (rhbz#1045699) * Thu Dec 19 2013 Nalin Dahyabhai - 1.12-6 - add yasm as a build requirement for AES-NI support, on arches that have @@ -2076,7 +2085,7 @@ exit 0 * Thu Dec 19 2013 Nalin Dahyabhai - 1.12-5 - pull in fix from master to make reporting of errors encountered by - the SPNEGO mechanism work better (RT#7045, part of #1043962) + the SPNEGO mechanism work better (RT#7045, part of rhbz#1043962) * Thu Dec 19 2013 Nalin Dahyabhai - update a test wrapper to properly handle things that the new libkrad does, @@ -2086,19 +2095,19 @@ exit 0 - revise previous patch to initialize one more element * Wed Dec 18 2013 Nalin Dahyabhai - 1.12-3 -- backport fixes to krb5_copy_context (RT#7807, #1044735/#1044739) +- backport fixes to krb5_copy_context (RT#7807, rhbz#1044735/rhbz#1044739) * Wed Dec 18 2013 Nalin Dahyabhai - 1.12-2 - pull in fix from master to return a NULL pointer rather than allocating zero bytes of memory if we read a zero-length input token (RT#7794, part of - #1043962) + rhbz#1043962) - pull in fix from master to ignore an empty token from an acceptor if - we've already finished authenticating (RT#7797, part of #1043962) + we've already finished authenticating (RT#7797, part of rhbz#1043962) - pull in fix from master to avoid a memory leak when a mechanism's - init_sec_context function fails (RT#7803, part of #1043962) + init_sec_context function fails (RT#7803, part of rhbz#1043962) - pull in fix from master to avoid a memory leak in a couple of error cases which could occur while obtaining acceptor credentials (RT#7805, part - of #1043962) + of rhbz#1043962) * Wed Dec 11 2013 Nalin Dahyabhai - 1.12-1 - update to 1.12 final @@ -2115,9 +2124,9 @@ exit 0 * Mon Nov 18 2013 Nalin Dahyabhai - 1.11.4-2 - pull in fix to store KDC time offsets in keyring credential caches (RT#7768, - #1030607) + rhbz#1030607) - pull in fix to set expiration times on credentials stored in keyring - credential caches (RT#7769, #1031724) + credential caches (RT#7769, rhbz#1031724) * Tue Nov 12 2013 Nalin Dahyabhai - 1.11.4-1 - update to 1.11.4 @@ -2126,21 +2135,21 @@ exit 0 - drop patch for CVE-2013-1418/CVE-2013-6800, included in 1.11.4 * Tue Nov 12 2013 Nalin Dahyabhai - 1.11.3-31 -- switch to the simplified version of the patch for #1029110 (RT#7764) +- switch to the simplified version of the patch for rhbz#1029110 (RT#7764) * Mon Nov 11 2013 Nalin Dahyabhai - 1.11.3-30 - check more thoroughly for errors when resolving KEYRING ccache names of type "persistent", which should only have a numeric UID as the next part of the - name (#1029110) + name (rhbz#1029110) * Tue Nov 5 2013 Nalin Dahyabhai - 1.11.3-29 - incorporate upstream patch for remote crash of KDCs which serve multiple realms simultaneously (RT#7756, CVE-2013-1418/CVE-2013-6800, - #1026997/#1031501) + rhbz#1026997/rhbz#1031501) * Mon Nov 4 2013 Nalin Dahyabhai - 1.11.3-28 - drop patch to add additional access() checks to ksu - they add to breakage - when non-FILE: caches are in use (#1026099), shouldn't be resulting in any + when non-FILE: caches are in use (rhbz#1026099), shouldn't be resulting in any benefit, and clash with proposed changes to fix its cache handling * Tue Oct 22 2013 Nalin Dahyabhai - 1.11.3-27 @@ -2169,22 +2178,22 @@ exit 0 - BuildRequires: pkgconfig, since configure uses it * Wed Oct 16 2013 Nalin Dahyabhai - 1.11.3-26 -- create and own /etc/gss (#1019937) +- create and own /etc/gss (rhbz#1019937) * Tue Oct 15 2013 Nalin Dahyabhai - 1.11.3-25 - pull up fix for importing previously-exported credential caches in the - gssapi library (RT# 7706, #1019420) + gssapi library (RT# 7706, rhbz#1019420) * Mon Oct 14 2013 Nalin Dahyabhai - 1.11.3-24 - backport the callback to use the libkrb5 prompter when we can't load PEM - files for PKINIT (RT#7590, includes part of #965721/#1016690) -- extract the rest of the fix #965721/#1016690 from the changes for RT#7680 + files for PKINIT (RT#7590, includes part of rhbz#965721/rhbz#1016690) +- extract the rest of the fix rhbz#965721/rhbz#1016690 from the changes for RT#7680 * Mon Oct 14 2013 Nalin Dahyabhai - 1.11.3-23 -- fix trigger scriptlet's invocation of sed (#1016945) +- fix trigger scriptlet's invocation of sed (rhbz#1016945) * Fri Oct 4 2013 Nalin Dahyabhai - 1.11.3-22 -- rebuild with keyutils 1.5.8 (part of #1012043) +- rebuild with keyutils 1.5.8 (part of rhbz#1012043) * Wed Oct 2 2013 Nalin Dahyabhai - 1.11.3-21 - switch to the version of persistent-keyring that was just merged to @@ -2194,7 +2203,7 @@ exit 0 * Mon Sep 30 2013 Nalin Dahyabhai - 1.11.3-20 - pull up fix for not calling a kdb plugin's check-transited-path method before calling the library's default version, which only knows - how to read what's in the configuration file (RT#7709, #1013664) + how to read what's in the configuration file (RT#7709, rhbz#1013664) * Thu Sep 26 2013 Nalin Dahyabhai - 1.11.3-19 - configure --without-krb5-config so that we don't pull in the old default @@ -2205,7 +2214,7 @@ exit 0 - fix broken dependency on awk (should be gawk, rdieter) * Wed Sep 25 2013 Nalin Dahyabhai - 1.11.3-17 -- add missing dependency on newer keyutils-libs (#1012034) +- add missing dependency on newer keyutils-libs (rhbz#1012034) * Tue Sep 24 2013 Nalin Dahyabhai - 1.11.3-16 - back out setting default_ccache_name to the new default for now, resetting @@ -2213,11 +2222,11 @@ exit 0 * Mon Sep 23 2013 Nalin Dahyabhai - 1.11.3-15 - add explicit build-time dependency on a version of keyutils that's new - enough to include keyctl_get_persistent() (more of #991148) + enough to include keyctl_get_persistent() (more of rhbz#991148) * Thu Sep 19 2013 Nalin Dahyabhai - 1.11.3-14 - incorporate Simo's updated backport of his updated persistent-keyring changes - (more of #991148) + (more of rhbz#991148) * Fri Sep 13 2013 Nalin Dahyabhai - 1.11.3-13 - don't break during %%check when the session keyring is revoked @@ -2231,17 +2240,17 @@ exit 0 * Mon Sep 9 2013 Nalin Dahyabhai 1.11.3-11 - don't let comments intended for one scriptlet become part of the "script" - that gets passed to ldconfig as part of another one (Mattias Ellert, #1005675) + that gets passed to ldconfig as part of another one (Mattias Ellert, rhbz#1005675) * Fri Sep 6 2013 Nalin Dahyabhai 1.11.3-10 -- incorporate Simo's backport of his persistent-keyring changes (#991148) +- incorporate Simo's backport of his persistent-keyring changes (rhbz#991148) - restore build-time default DEFCCNAME on Fedora 21 and later and EL, and instead set default_ccache_name in the default krb5.conf's [libdefaults] - section (#991148) + section (rhbz#991148) - on releases where we expect krb5.conf to be configured with a default_ccache_name, add it whenever we upgrade from an older version of the package that wouldn't have included it in its default configuration - file (#991148) + file (rhbz#991148) * Fri Aug 23 2013 Nalin Dahyabhai 1.11.3-9 - take another stab at accounting for UnversionedDocdirs for the -libs @@ -2256,7 +2265,7 @@ exit 0 of files which dictate particular exit codes before exec'ing the actual binaries, instead of trying to use ConditionPathExists in the unit files to accomplish that, so that we exit with failure properly when what we - expect isn't actually in effect on the system (#800343) + expect isn't actually in effect on the system (rhbz#800343) * Mon Jul 29 2013 Nalin Dahyabhai 1.11.3-7 - attempt to account for UnversionedDocdirs for the -libs subpackage @@ -2268,11 +2277,11 @@ exit 0 * Mon Jul 22 2013 Nalin Dahyabhai 1.11.3-5 - pull up changes to allow GSSAPI modules to provide more functions - (RT#7682, #986564/#986565) + (RT#7682, rhbz#986564/rhbz#986565) * Fri Jul 19 2013 Nalin Dahyabhai 1.11.3-4 - use (a bundled, for now, copy of) nss_wrapper to let us run some of the - self-tests at build-time in more places than we could previously (#978756) + self-tests at build-time in more places than we could previously (rhbz#978756) - cover inconsistencies in whether or not there's a local caching nameserver that's willing to answer when the build environment doesn't have a resolver configuration, so that nss_wrapper's faking of the local @@ -2280,23 +2289,23 @@ exit 0 * Mon Jul 1 2013 Nalin Dahyabhai 1.11.3-3 - specify dependencies on the same arch of krb5-libs by using the %%{?_isa} - suffix, to avoid dragging 32-bit libraries onto 64-bit systems (#980155) + suffix, to avoid dragging 32-bit libraries onto 64-bit systems (rhbz#980155) * Thu Jun 13 2013 Nalin Dahyabhai 1.11.3-2 - special-case /run/user/0, attempting to create it when resolving a directory cache below it fails due to ENOENT and we find that it doesn't already exist, either, before attempting to create the directory cache - (maybe helping, maybe just making things more confusing for #961235) + (maybe helping, maybe just making things more confusing for rhbz#961235) * Tue Jun 4 2013 Nalin Dahyabhai 1.11.3-1 - update to 1.11.3 - drop patch for RT#7605, fixed in this release - drop patch for CVE-2002-2443, fixed in this release - drop patch for RT#7369, fixed in this release -- pull upstream fix for breaking t_skew.py by adding the patch for #961221 +- pull upstream fix for breaking t_skew.py by adding the patch for rhbz#961221 * Fri May 31 2013 Nalin Dahyabhai 1.11.2-10 -- respin with updated version of patch for RT#7650 (#969331) +- respin with updated version of patch for RT#7650 (rhbz#969331) * Thu May 30 2013 Nalin Dahyabhai 1.11.2-9 - don't forget to set the SELinux label when creating the directory for @@ -2312,22 +2321,22 @@ exit 0 * Tue May 28 2013 Nalin Dahyabhai 1.11.2-7 - backport fix for not being able to verify the list of transited realms - in GSS acceptors (RT#7639, #959685) + in GSS acceptors (RT#7639, rhbz#959685) - backport fix for not being able to pass an empty password to the - get-init-creds APIs and have them actually use it (RT#7642, #960001) + get-init-creds APIs and have them actually use it (RT#7642, rhbz#960001) - add backported proposed fix to use the unauthenticated server time as the basis for computing the requested credential expiration times, rather than the client's idea of the current time, which could be - significantly incorrect (#961221) + significantly incorrect (rhbz#961221) * Tue May 21 2013 Nalin Dahyabhai 1.11.2-6 - pull in upstream fix to start treating a KRB5CCNAME value that begins with DIR:: the same as it would a DIR: value with just one ccache file - in it (RT#7172, #965574) + in it (RT#7172, rhbz#965574) * Mon May 13 2013 Nalin Dahyabhai 1.11.2-5 - pull up fix for UDP ping-pong flaw in kpasswd service (CVE-2002-2443, - #962531,#962534) + rhbz#962531,rhbz#962534) * Mon Apr 29 2013 Nathaniel McCallum 1.11.2-4 - Update otp patches @@ -2347,11 +2356,11 @@ exit 0 - drop pulled in patch for RT#7586, included in this release - drop pulled in patch for RT#7592, included in this release - pull in fix for keeping track of the message type when parsing FAST requests - in the KDC (RT#7605, #951843) (also #951965) + in the KDC (RT#7605, rhbz#951843) (also rhbz#951965) * Fri Apr 12 2013 Nalin Dahyabhai 1.11.1-9 - move the compiled-in default ccache location from the previous default of - FILE:/tmp/krb5cc_%%{uid} to DIR:/run/user/%%{uid}/krb5cc (part of #949588) + FILE:/tmp/krb5cc_%%{uid} to DIR:/run/user/%%{uid}/krb5cc (part of rhbz#949588) * Tue Apr 09 2013 Nathaniel McCallum - 1.11.1-8 - Update otp backport patches (libk5radius => libkrad) @@ -2372,8 +2381,8 @@ exit 0 * Tue Mar 26 2013 Nalin Dahyabhai 1.11.1-5 - pull up Simo's patch to mark the correct mechanism on imported GSSAPI contexts (RT#7592) -- go back to using reconf to run autoconf and autoheader (part of #925640) -- add temporary patch to use newer config.guess/config.sub (more of #925640) +- go back to using reconf to run autoconf and autoheader (part of rhbz#925640) +- add temporary patch to use newer config.guess/config.sub (more of rhbz#925640) * Mon Mar 18 2013 Nalin Dahyabhai - fix a version comparison to expect newer texlive build requirements when @@ -2384,12 +2393,12 @@ exit 0 - Add otp support * Thu Feb 28 2013 Nalin Dahyabhai 1.11.1-3 -- fix a memory leak when acquiring credentials using a keytab (RT#7586, #911110) +- fix a memory leak when acquiring credentials using a keytab (RT#7586, rhbz#911110) * Wed Feb 27 2013 Nalin Dahyabhai 1.11.1-2 -- prebuild PDF docs to reduce multilib differences (internal tooling, #884065) +- prebuild PDF docs to reduce multilib differences (internal tooling, rhbz#884065) - drop the kerberos-iv portreserve file, and drop the rest on systemd systems -- escape uses of macros in comments (more of #884065) +- escape uses of macros in comments (more of rhbz#884065) * Mon Feb 25 2013 Nalin Dahyabhai 1.11.1-1 - update to 1.11.1 @@ -2397,7 +2406,7 @@ exit 0 wrapper in the client transmit functions * Fri Feb 8 2013 Nalin Dahyabhai 1.11-2 -- set "rdns = false" in the default krb5.conf (#908323,#908324) +- set "rdns = false" in the default krb5.conf (rhbz#908323,rhbz#908324) * Tue Dec 18 2012 Nalin Dahyabhai 1.11-1 - update to 1.11 release @@ -2407,7 +2416,7 @@ exit 0 * Thu Dec 13 2012 Nalin Dahyabhai - when building with our bundled copy of libverto, package it in with -libs - rather than with -server (#886049) + rather than with -server (rhbz#886049) * Wed Nov 21 2012 Nalin Dahyabhai 1.11-0.beta1.0 - update to 1.11 beta 1 @@ -2429,9 +2438,9 @@ exit 0 * Thu Nov 15 2012 Nalin Dahyabhai - update to 1.11 alpha 1 - - drop backported patch for RT #7406 - - drop backported patch for RT #7407 - - drop backported patch for RT #7408 + - drop backported patch for RT rhbz#7406 + - drop backported patch for RT rhbz#7407 + - drop backported patch for RT rhbz#7408 - the new docs system generates PDFs, so stop including them as sources - drop backported patch to allow deltat.y to build with the usual warning flags and the current gcc @@ -2455,27 +2464,27 @@ exit 0 %%{?_rawbuild} builds (zmraz) * Tue Sep 25 2012 Nalin Dahyabhai 1.10.3-6 -- actually pull up the patch for RT#7063, and not some other ticket (#773496) +- actually pull up the patch for RT#7063, and not some other ticket (rhbz#773496) * Mon Sep 10 2012 Nalin Dahyabhai 1.10.3-5 - add patch based on one from Filip Krska to not call poll() with a negative - timeout when the caller's intent is for us to just stop calling it (#838548) + timeout when the caller's intent is for us to just stop calling it (rhbz#838548) * Fri Sep 7 2012 Nalin Dahyabhai - on EL6, conflict with libsmbclient before 3.5.10-124, which is when it - stopped linking with a symbol which we no longer export (#771687) + stopped linking with a symbol which we no longer export (rhbz#771687) - pull up patch for RT#7063, in which not noticing a prompt for a long time throws the client library's idea of the time difference between it - and the KDC really far out of whack (#773496) + and the KDC really far out of whack (rhbz#773496) - add a backport of more patches to set the client's list of supported enctypes when using a keytab to be the list of types of keys in the keytab, plus the list of other types the client supports but for which it doesn't have keys, in that order, so that KDCs have a better chance of being able to issue - tickets with session keys of types that the client can use (#837855) + tickets with session keys of types that the client can use (rhbz#837855) * Thu Sep 6 2012 Nalin Dahyabhai 1.10.3-4 - cut down the number of times we load SELinux labeling configuration from - a minimum of two times to actually one (more of #845125) + a minimum of two times to actually one (more of rhbz#845125) * Thu Aug 30 2012 Nalin Dahyabhai 1.10.3-3 - backport patch to disable replay detection in krb5_verify_init_creds() @@ -2493,7 +2502,7 @@ exit 0 * Thu Aug 2 2012 Nalin Dahyabhai 1.10.2-7 - selinux: hang on to the list of selinux contexts, freeing and reloading it only when the file we read it from is modified, freeing it when the - shared library is being unloaded (#845125) + shared library is being unloaded (rhbz#845125) * Thu Aug 2 2012 Nalin Dahyabhai 1.10.2-6 - go back to not messing with library file paths on Fedora 17: it breaks @@ -2503,7 +2512,7 @@ exit 0 * Tue Jul 31 2012 Nalin Dahyabhai 1.10.2-5 - add upstream patch to fix freeing an uninitialized pointer and dereferencing another uninitialized pointer in the KDC (MITKRB5-SA-2012-001, CVE-2012-1014 - and CVE-2012-1015, #844779 and #844777) + and CVE-2012-1015, rhbz#844779 and rhbz#844777) - fix a thinko in whether or not we mess around with devel .so symlinks on systems without a separate /usr (sbose) @@ -2529,7 +2538,7 @@ exit 0 - add a backport of Stef's patch to set the client's list of supported enctypes to match the types of keys that we have when we are using a keytab to try to get initial credentials, so that a KDC won't send us - an AS reply that we can't encrypt (RT#2131, #748528) + an AS reply that we can't encrypt (RT#2131, rhbz#748528) - don't shuffle around any shared libraries on releases with no-separate-/usr, since /usr/lib is the same place as /lib - add explicit buildrequires: on 'hostname', for the tests, on systems where @@ -2538,15 +2547,15 @@ exit 0 * Mon May 7 2012 Nalin Dahyabhai - skip the setfscreatecon() if fopen() is passed "rb" as the open mode (part - of #819115) + of rhbz#819115) * Tue May 1 2012 Nalin Dahyabhai 1.10.1-3 - have -server require /usr/share/dict/words, which we set as the default - dict_file in kdc.conf (#817089) + dict_file in kdc.conf (rhbz#817089) * Tue Mar 20 2012 Nalin Dahyabhai 1.10.1-2 -- change back dns_lookup_kdc to the default setting (Stef Walter, #805318) -- comment out example.com examples in default krb5.conf (Stef Walter, #805320) +- change back dns_lookup_kdc to the default setting (Stef Walter, rhbz#805318) +- comment out example.com examples in default krb5.conf (Stef Walter, rhbz#805320) * Fri Mar 9 2012 Nalin Dahyabhai 1.10.1-1 - update to 1.10.1 @@ -2557,7 +2566,7 @@ exit 0 * Wed Mar 7 2012 Nalin Dahyabhai 1.10-5 - when removing -workstation, remove our files from the info index while the file is still there, in %%preun, rather than %%postun, and use the - compressed file's name (#801035) + compressed file's name (rhbz#801035) * Tue Feb 21 2012 Nathaniel McCallum - 1.10-4 - Fix string RPC ACLs (RT#7093); CVE-2012-1012 @@ -2567,7 +2576,7 @@ exit 0 * Mon Jan 30 2012 Nalin Dahyabhai 1.10-2 - add patch to accept keytab entries with vno==0 as matches when we're - searching for an entry with a specific name/kvno (#230382/#782211,RT#3349) + searching for an entry with a specific name/kvno (rhbz#230382/rhbz#782211,RT#3349) * Mon Jan 30 2012 Nalin Dahyabhai 1.10-1 - update to 1.10 final @@ -2592,21 +2601,21 @@ exit 0 * Tue Dec 13 2011 Nalin Dahyabhai 1.10-0.alpha1.3 - pull in patch for RT#7046: tag a ccache containing credentials obtained via - S4U2Proxy with the principal name of the proxying principal (part of #761317) + S4U2Proxy with the principal name of the proxying principal (part of rhbz#761317) so that the default principal name can be set to that of the client for which it is proxying, which results in the ccache looking more normal to consumers of the ccache that don't care that there's proxying going on - pull in patch for RT#7047: allow tickets obtained via S4U2Proxy to be cached - (more of #761317) + (more of rhbz#761317) - pull in patch for RT#7048: allow PAC verification to only bother trying to - verify the signature with keys that it's given (still more of #761317) + verify the signature with keys that it's given (still more of rhbz#761317) * Tue Dec 6 2011 Nalin Dahyabhai 1.10-0.alpha1.2 - apply upstream patch to fix a null pointer dereference when processing - TGS requests (CVE-2011-1530, #753748) + TGS requests (CVE-2011-1530, rhbz#753748) * Wed Nov 30 2011 Nalin Dahyabhai 1.10-0.alpha1.1 -- correct a bug in the fix for #754001 so that the file creation context is +- correct a bug in the fix for rhbz#754001 so that the file creation context is consistently reset * Tue Nov 15 2011 Nalin Dahyabhai 1.10-0.alpha1.0 @@ -2621,27 +2630,27 @@ exit 0 should be able to run inside of the build system without issue * Wed Oct 26 2011 Fedora Release Engineering - 1.9.1-19 -- Rebuilt for glibc bug#747377 +- Rebuilt for glibc rhbz#747377 * Tue Oct 18 2011 Nalin Dahyabhai 1.9.1-18 - apply upstream patch to fix a null pointer dereference with the LDAP kdb - backend (CVE-2011-1527, #744125), an assertion failure with multiple kdb + backend (CVE-2011-1527, rhbz#744125), an assertion failure with multiple kdb backends (CVE-2011-1528), and a null pointer dereference with multiple kdb - backends (CVE-2011-1529) (#737711) + backends (CVE-2011-1529) (rhbz#737711) * Thu Oct 13 2011 Nalin Dahyabhai 1.9.1-17 - pull in patch from trunk to rename krb5int_pac_sign() to krb5_pac_sign() and - make it public (#745533) + make it public (rhbz#745533) * Fri Oct 7 2011 Nalin Dahyabhai 1.9.1-16 -- kadmin.service: fix #723723 again +- kadmin.service: fix rhbz#723723 again - kadmin.service,krb5kdc.service: remove optional use of $KRB5REALM in command lines, because systemd parsing doesn't handle alternate value shell variable syntax - kprop.service: add missing Type=forking so that systemd doesn't assume simple - kprop.service: expect the ACL configuration to be there, not absent - handle a harder-to-trigger assertion failure that starts cropping up when we - exit the transmit loop on time (#739853) + exit the transmit loop on time (rhbz#739853) * Sun Oct 2 2011 Tom Callaway 1.9.1-15 - hardcode pid file as option in krb5kdc.service @@ -2654,50 +2663,50 @@ exit 0 * Tue Sep 6 2011 Nalin Dahyabhai 1.9.1-12 - pull in upstream patch for RT#6952, confusion following referrals for - cross-realm auth (#734341) + cross-realm auth (rhbz#734341) - pull in build-time deps for the tests * Thu Sep 1 2011 Nalin Dahyabhai 1.9.1-11 -- switch to the upstream patch for #727829 +- switch to the upstream patch for rhbz#727829 * Wed Aug 31 2011 Nalin Dahyabhai 1.9.1-10 - handle an assertion failure that starts cropping up when the patch for - using poll (#701446) meets servers that aren't running KDCs or against - which the connection fails for other reasons (#727829, #734172) + using poll (rhbz#701446) meets servers that aren't running KDCs or against + which the connection fails for other reasons (rhbz#727829, rhbz#734172) * Mon Aug 8 2011 Nalin Dahyabhai 1.9.1-9 - override the default build rules to not delete temporary y.tab.c files, so that they can be packaged, allowing debuginfo files which point to them - do so usefully (#729044) + do so usefully (rhbz#729044) * Fri Jul 22 2011 Nalin Dahyabhai 1.9.1-8 -- build shared libraries with partial RELRO support (#723995) +- build shared libraries with partial RELRO support (rhbz#723995) - filter out potentially multiple instances of -Wl,-z,relro from krb5-config output, now that it's in the buildroot's default LDFLAGS - pull in a patch to fix losing track of the replay cache FD, from SVN by way of Kevin Coffman * Wed Jul 20 2011 Nalin Dahyabhai 1.9.1-7 -- kadmind.init: drop the attempt to detect no-database-present errors (#723723), +- kadmind.init: drop the attempt to detect no-database-present errors (rhbz#723723), which is too fragile in cases where the database has been manually moved or is accessed through another kdb plugin * Tue Jul 19 2011 Nalin Dahyabhai 1.9.1-6 - backport fixes to teach libkrb5 to use descriptors higher than FD_SETSIZE - to talk to a KDC by using poll() if it's detected at compile-time (#701446, + to talk to a KDC by using poll() if it's detected at compile-time (rhbz#701446, RT#6905) * Thu Jun 23 2011 Nalin Dahyabhai 1.9.1-5 - pull a fix from SVN to try to avoid triggering a PTR lookup in getaddrinfo() during krb5_sname_to_principal(), and to let getaddrinfo() decide whether or not to ask for an IPv6 address based on the set of configured interfaces - (#717378, RT#6922) + (rhbz#717378, RT#6922) - pull a fix from SVN to use AI_ADDRCONFIG more often (RT#6923) * Mon Jun 20 2011 Nalin Dahyabhai 1.9.1-4 - apply upstream patch by way of Burt Holzman to fall back to a non-referral method in cases where we might be derailed by a KDC that rejects the - canonicalize option (for example, those from the RHEL 2.1 or 3 era) (#715074) + canonicalize option (for example, those from the RHEL 2.1 or 3 era) (rhbz#715074) * Tue Jun 14 2011 Nalin Dahyabhai 1.9.1-3 - pull a fix from SVN to get libgssrpc clients (e.g. kadmin) authenticating @@ -2705,13 +2714,13 @@ exit 0 * Tue Jun 14 2011 Nalin Dahyabhai - incorporate a fix to teach the file labeling bits about when replay caches - are expunged (#576093) + are expunged (rhbz#576093) * Thu May 26 2011 Nalin Dahyabhai -- switch to the upstream patch for #707145 +- switch to the upstream patch for rhbz#707145 * Wed May 25 2011 Nalin Dahyabhai 1.9.1-2 -- klist: don't trip over referral entries when invoked with -s (#707145, +- klist: don't trip over referral entries when invoked with -s (rhbz#707145, RT#6915) * Fri May 6 2011 Nalin Dahyabhai @@ -2724,26 +2733,26 @@ exit 0 CVE-2011-0282, CVE-2011-0283, CVE-2011-0284, CVE-2011-0285 * Wed Apr 13 2011 Nalin Dahyabhai 1.9-9 -- kadmind: add upstream patch to fix free() on an invalid pointer (#696343, +- kadmind: add upstream patch to fix free() on an invalid pointer (rhbz#696343, MITKRB5-SA-2011-004, CVE-2011-0285) * Mon Apr 4 2011 Nalin Dahyabhai - don't discard the error code from an error message received in response - to a change-password request (#658871, RT#6893) + to a change-password request (rhbz#658871, RT#6893) * Fri Apr 1 2011 Nalin Dahyabhai - override INSTALL_SETUID at build-time so that ksu is installed into - the buildroot with the right permissions (part of #225974) + the buildroot with the right permissions (part of rhbz#225974) * Fri Mar 18 2011 Nalin Dahyabhai 1.9-8 - backport change from SVN to fix a computed-value-not-used warning in - kpropd (#684065) + kpropd (rhbz#684065) * Tue Mar 15 2011 Nalin Dahyabhai 1.9-7 - turn off NSS as the backend for libk5crypto for now to work around its - DES string2key not working (#679012) + DES string2key not working (rhbz#679012) - add revised upstream patch to fix double-free in KDC while returning - typed-data with errors (MITKRB5-SA-2011-003, CVE-2011-0284, #674325) + typed-data with errors (MITKRB5-SA-2011-003, CVE-2011-0284, rhbz#674325) * Thu Feb 17 2011 Nalin Dahyabhai - throw in a not-applied-by-default patch to try to make pkinit debugging @@ -2756,14 +2765,14 @@ exit 0 * Wed Feb 9 2011 Nalin Dahyabhai 1.9-5 - krb5kdc init script: prototype some changes to do a quick spot-check of the TGS and kadmind keys and warn if there aren't any non-weak keys - on file for them (to flush out parts of #651466) + on file for them (to flush out parts of rhbz#651466) * Tue Feb 8 2011 Nalin Dahyabhai 1.9-4 - add upstream patches to fix standalone kpropd exiting if the per-client child process exits with an error (MITKRB5-SA-2011-001), a hang or crash in the KDC when using the LDAP kdb backend, and an uninitialized pointer - use in the KDC (MITKRB5-SA-2011-002) (CVE-2010-4022, #664009, - CVE-2011-0281, #668719, CVE-2011-0282, #668726, CVE-2011-0283, #676126) + use in the KDC (MITKRB5-SA-2011-002) (CVE-2010-4022, rhbz#664009, + CVE-2011-0281, rhbz#668719, CVE-2011-0282, rhbz#668726, CVE-2011-0283, rhbz#676126) * Mon Feb 07 2011 Fedora Release Engineering - 1.9-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild @@ -2774,11 +2783,11 @@ exit 0 * Tue Feb 1 2011 Nalin Dahyabhai - properly advertise that the kpropd init script now supports force-reload - (Zbysek Mraz, #630587) + (Zbysek Mraz, rhbz#630587) * Wed Jan 26 2011 Nalin Dahyabhai 1.9-2 - pkinit: when verifying signed data, use the CMS APIs for better - interoperability (#636985, RT#6851) + interoperability (rhbz#636985, RT#6851) * Wed Dec 22 2010 Nalin Dahyabhai 1.9-1 - update to 1.9 final @@ -2798,56 +2807,56 @@ exit 0 * Fri Nov 5 2010 Nalin Dahyabhai 1.9-0.beta1.0 - start moving to 1.9 with beta 1 - drop patches for RT#5755, RT#6762, RT#6774, RT#6775 - - drop no-longer-needed backport patch for #539423 + - drop no-longer-needed backport patch for rhbz#539423 - drop no-longer-needed patch for CVE-2010-1322 - if WITH_NSS is set, built with --with-crypto-impl=nss (requires NSS 3.12.9) * Tue Oct 5 2010 Nalin Dahyabhai 1.8.3-8 - incorporate upstream patch to fix uninitialized pointer crash in the KDC's - authorization data handling (CVE-2010-1322, #636335) + authorization data handling (CVE-2010-1322, rhbz#636335) * Mon Oct 4 2010 Nalin Dahyabhai 1.8.3-7 - rebuild * Mon Oct 4 2010 Nalin Dahyabhai 1.8.3-6 - pull down patches from trunk to implement k5login_authoritative and - k5login_directory settings for krb5.conf (#539423) + k5login_directory settings for krb5.conf (rhbz#539423) * Wed Sep 29 2010 jkeating - 1.8.3-5 -- Rebuilt for gcc bug 634757 +- Rebuilt for gcc rhbz#634757 * Wed Sep 15 2010 Nalin Dahyabhai 1.8.3-4 - fix reading of keyUsage extensions when attempting to select pkinit client - certs (part of #629022, RT#6775) + certs (part of rhbz#629022, RT#6775) - fix selection of pkinit client certs when one or more don't include a - subjectAltName extension (part of #629022, RT#6774) + subjectAltName extension (part of rhbz#629022, RT#6774) * Fri Sep 3 2010 Nalin Dahyabhai 1.8.3-3 - build with -fstack-protector-all instead of the default -fstack-protector, - so that we add checking to more functions (i.e., all of them) (#629950) -- also link binaries with -Wl,-z,relro,-z,now (part of #629950) + so that we add checking to more functions (i.e., all of them) (rhbz#629950) +- also link binaries with -Wl,-z,relro,-z,now (part of rhbz#629950) * Tue Aug 24 2010 Nalin Dahyabhai 1.8.3-2 -- fix a logic bug in computing key expiration times (RT#6762, #627022) +- fix a logic bug in computing key expiration times (RT#6762, rhbz#627022) * Wed Aug 4 2010 Nalin Dahyabhai 1.8.3-1 - update to 1.8.3 - drop backports of fixes for gss context expiration and error table registration/deregistration mismatch - - drop patch for upstream #6750 + - drop patch for upstream rhbz#6750 * Wed Jul 7 2010 Nalin Dahyabhai 1.8.2-3 - tell krb5kdc and kadmind to create pid files, since they can -- add logrotate configuration files for krb5kdc and kadmind (#462658) -- fix parsing of the pidfile option in the KDC (upstream #6750) +- add logrotate configuration files for krb5kdc and kadmind (rhbz#462658) +- fix parsing of the pidfile option in the KDC (upstream rhbz#6750) * Mon Jun 21 2010 Nalin Dahyabhai 1.8.2-2 - libgssapi: pull in patch from svn to stop returning context-expired errors - when the ticket which was used to set up the context expires (#605366, - upstream #6739) + when the ticket which was used to set up the context expires (rhbz#605366, + upstream rhbz#6739) * Mon Jun 21 2010 Nalin Dahyabhai -- pull up fix for upstream #6745, in which the gssapi library would add the +- pull up fix for upstream rhbz#6745, in which the gssapi library would add the wrong error table but subsequently attempt to unload the right one * Thu Jun 10 2010 Nalin Dahyabhai 1.8.2-1 @@ -2859,8 +2868,8 @@ exit 0 * Thu May 27 2010 Nalin Dahyabhai - ksu: move session management calls to before we drop privileges, like - su does (#596887), and don't skip the PAM account check for root or the - same user (more of #540769) + su does (rhbz#596887), and don't skip the PAM account check for root or the + same user (more of rhbz#540769) * Mon May 24 2010 Nalin Dahyabhai 1.8.1-6 - make krb5-server-ldap also depend on the same version-release of krb5-libs, @@ -2873,20 +2882,20 @@ exit 0 * Tue May 18 2010 Nalin Dahyabhai 1.8.1-5 - add patch to correct GSSAPI library null pointer dereference which could be - triggered by malformed client requests (CVE-2010-1321, #582466) + triggered by malformed client requests (CVE-2010-1321, rhbz#582466) * Tue May 4 2010 Nalin Dahyabhai 1.8.1-4 -- fix output of kprop's init script's "status" and "reload" commands (#588222) +- fix output of kprop's init script's "status" and "reload" commands (rhbz#588222) * Tue Apr 20 2010 Nalin Dahyabhai 1.8.1-3 -- incorporate patch to fix double-free in the KDC (CVE-2010-1320, #581922) +- incorporate patch to fix double-free in the KDC (CVE-2010-1320, rhbz#581922) * Wed Apr 14 2010 Nalin Dahyabhai 1.8.1-2 - fix a typo in kerberos.ldif * Fri Apr 9 2010 Nalin Dahyabhai 1.8.1-1 - update to 1.8.1 - - no longer need patches for #555875, #561174, #563431, RT#6661, CVE-2010-0628 + - no longer need patches for rhbz#555875, rhbz#561174, rhbz#563431, RT#6661, CVE-2010-0628 - replace buildrequires on tetex-latex with one on texlive-latex, which is the package that provides it now @@ -2896,21 +2905,21 @@ exit 0 * Thu Apr 8 2010 Nalin Dahyabhai - drop patch to suppress key expiration warnings sent from the KDC in the last-req field, as the KDC is expected to just be configured to either - send them or not as a particular key approaches expiration (#556495) + send them or not as a particular key approaches expiration (rhbz#556495) * Tue Mar 23 2010 Nalin Dahyabhai - 1.8-5 -- add upstream fix for denial-of-service in SPNEGO (CVE-2010-0628, #576325) +- add upstream fix for denial-of-service in SPNEGO (CVE-2010-0628, rhbz#576325) - kdc.conf: no more need to suggest keeping keys with v4-compatible salting * Fri Mar 19 2010 Nalin Dahyabhai - 1.8-4 - remove the krb5-appl bits (the -workstation-clients and -workstation-servers subpackages) now that krb5-appl is its own package -- replace our patch for #563431 (kpasswd doesn't fall back to guessing your +- replace our patch for rhbz#563431 (kpasswd doesn't fall back to guessing your principal name using your user name if you don't have a ccache) with the one upstream uses * Fri Mar 12 2010 Nalin Dahyabhai - 1.8-3 -- add documentation for the ticket_lifetime option (#561174) +- add documentation for the ticket_lifetime option (rhbz#561174) * Mon Mar 8 2010 Nalin Dahyabhai - 1.8-2 - pull up patch to get the client libraries to correctly perform password @@ -2930,10 +2939,10 @@ exit 0 - fix a null pointer dereference and crash introduced in our PAM patch that would happen if ftpd was given the name of a user who wasn't known to the local system, limited to being triggerable by gssapi-authenticated clients by - the default xinetd config (Olivier Fourdan, #569472) + the default xinetd config (Olivier Fourdan, rhbz#569472) * Tue Mar 2 2010 Nalin Dahyabhai - 1.7.1-5 -- fix a regression (not labeling a kdb database lock file correctly, #569902) +- fix a regression (not labeling a kdb database lock file correctly, rhbz#569902) * Thu Feb 25 2010 Nalin Dahyabhai - 1.7.1-4 - move the package changelog to the end to match the usual style (jdennis) @@ -2943,15 +2952,15 @@ exit 0 * Wed Feb 17 2010 Nalin Dahyabhai - 1.7.1-3 - pull up the change to make kpasswd's behavior better match the docs - when there's no ccache (#563431) + when there's no ccache (rhbz#563431) * Tue Feb 16 2010 Nalin Dahyabhai - 1.7.1-2 - apply patch from upstream to fix KDC denial of service (CVE-2010-0283, - #566002) + rhbz#566002) * Wed Feb 3 2010 Nalin Dahyabhai - 1.7.1-1 - update to 1.7.1 - - don't trip AD lockout on wrong password (#542687, #554351) + - don't trip AD lockout on wrong password (rhbz#542687, rhbz#554351) - incorporates fixes for CVE-2009-4212 and CVE-2009-3295 - fixes gss_krb5_copy_ccache() when SPNEGO is used - move sim_client/sim_server, gss-client/gss-server, uuclient/uuserver to @@ -2961,7 +2970,7 @@ exit 0 depends on -workstation which also includes them * Mon Jan 25 2010 Nalin Dahyabhai - 1.7-23 -- tighten up default permissions on kdc.conf and kadm5.acl (#558343) +- tighten up default permissions on kdc.conf and kadm5.acl (rhbz#558343) * Fri Jan 22 2010 Nalin Dahyabhai - 1.7-22 - use portreserve correctly -- portrelease takes the basename of the file @@ -2970,47 +2979,47 @@ exit 0 * Mon Jan 18 2010 Nalin Dahyabhai - 1.7-21 - suppress warnings of impending password expiration if expiration is more than seven days away when the KDC reports it via the last-req field, just as we - already do when it reports expiration via the key-expiration field (#556495) + already do when it reports expiration via the key-expiration field (rhbz#556495) - link with libtinfo rather than libncurses, when we can, in future RHEL * Fri Jan 15 2010 Nalin Dahyabhai - 1.7-20 - krb5_get_init_creds_password: check opte->flags instead of options->flags - when checking whether or not we get to use the prompter callback (#555875) + when checking whether or not we get to use the prompter callback (rhbz#555875) * Thu Jan 14 2010 Nalin Dahyabhai - 1.7-19 - use portreserve to make sure the KDC can always bind to the kerberos-iv port, kpropd can always bind to the krb5_prop port, and that kadmind can - always bind to the kerberos-adm port (#555279) + always bind to the kerberos-adm port (rhbz#555279) - correct inadvertent use of macros in the changelog (rpmlint) * Tue Jan 12 2010 Nalin Dahyabhai - 1.7-18 - add upstream patch for integer underflow during AES and RC4 decryption - (CVE-2009-4212), via Tom Yu (#545015) + (CVE-2009-4212), via Tom Yu (rhbz#545015) * Wed Jan 6 2010 Nalin Dahyabhai - 1.7-17 - put the conditional back for the -devel subpackage -- back down to the earlier version of the patch for #551764; the backported +- back down to the earlier version of the patch for rhbz#551764; the backported alternate version was incomplete * Tue Jan 5 2010 Nalin Dahyabhai - 1.7-16 - use %%global instead of %%define - pull up proposed patch for creating previously-not-there lock files for - kdb databases when 'kdb5_util' is called to 'load' (#551764) + kdb databases when 'kdb5_util' is called to 'load' (rhbz#551764) * Mon Jan 4 2010 Dennis Gregorovic - fix conditional for future RHEL * Mon Jan 4 2010 Nalin Dahyabhai - 1.7-15 - add upstream patch for KDC crash during referral processing (CVE-2009-3295), - via Tom Yu (#545002) + via Tom Yu (rhbz#545002) * Mon Dec 21 2009 Nalin Dahyabhai - 1.7-14 -- refresh patch for #542868 from trunk +- refresh patch for rhbz#542868 from trunk * Thu Dec 10 2009 Nalin Dahyabhai - move man pages that live in the -libs subpackage into the regular %%{_mandir} tree where they'll still be found if that package is the - only one installed (#529319) + only one installed (rhbz#529319) * Wed Dec 9 2009 Nalin Dahyabhai - 1.7-13 - and put it back in @@ -3019,14 +3028,14 @@ exit 0 - back that last change out * Tue Dec 8 2009 Nalin Dahyabhai - 1.7-12 -- try to make gss_krb5_copy_ccache() work correctly for spnego (#542868) +- try to make gss_krb5_copy_ccache() work correctly for spnego (rhbz#542868) * Fri Dec 4 2009 Nalin Dahyabhai -- make krb5-config suppress CFLAGS output when called with --libs (#544391) +- make krb5-config suppress CFLAGS output when called with --libs (rhbz#544391) * Thu Dec 3 2009 Nalin Dahyabhai - 1.7-11 - ksu: move account management checks to before we drop privileges, like - su does (#540769) + su does (rhbz#540769) - selinux: set the user part of file creation contexts to match the current context instead of what we looked up - configure with --enable-dns-for-realm instead of --enable-dns, which isn't @@ -3034,7 +3043,7 @@ exit 0 * Fri Nov 20 2009 Nalin Dahyabhai - 1.7-10 - move /etc/pam.d/ksu from krb5-workstation-servers to krb5-workstation, - where it's actually needed (#538703) + where it's actually needed (rhbz#538703) * Fri Oct 23 2009 Nalin Dahyabhai - 1.7-9 - add some conditional logic to simplify building on older Fedora releases @@ -3045,11 +3054,11 @@ exit 0 * Mon Sep 14 2009 Nalin Dahyabhai - 1.7-8 - specify the location of the subsystem lock when using the status() function in the kadmind and kpropd init scripts, so that we get the right error when - we're dead but have a lock file - requires initscripts 8.99 (#521772) + we're dead but have a lock file - requires initscripts 8.99 (rhbz#521772) * Tue Sep 8 2009 Nalin Dahyabhai - if the init script fails to start krb5kdc/kadmind/kpropd because it's already - running (according to status()), return 0 (part of #521772) + running (according to status()), return 0 (part of rhbz#521772) * Mon Aug 24 2009 Nalin Dahyabhai - 1.7-7 - work around a compile problem with new openssl @@ -3108,7 +3117,7 @@ exit 0 - drop static build logic - drop pam_krb5-specific configuration from the default krb5.conf - drop only-use-v5 flags being passed to various things started by xinetd -- put %%{krb5prefix}/sbin in everyone's path, too (#504525) +- put %%{krb5prefix}/sbin in everyone's path, too (rhbz#504525) * Tue May 19 2009 Nalin Dahyabhai 1.6.3-106 - add an auth stack to ksu's PAM configuration so that pam_setcred() calls @@ -3132,7 +3141,7 @@ exit 0 - add LSB-style init script info * Fri Apr 17 2009 Nalin Dahyabhai -- explicitly run the pdf generation script using sh (part of #225974) +- explicitly run the pdf generation script using sh (part of rhbz#225974) * Tue Apr 7 2009 Nalin Dahyabhai 1.6.3-101 - add patches for read overflow and null pointer dereference in the @@ -3148,14 +3157,14 @@ exit 0 - use triggeruns to properly shut down and disable krb524d when -server and -workstation-servers gets upgraded, because it's gone now - move the libraries to /%%{_lib}, but leave --libdir alone so that plugins - get installed and are searched for in the same locations (#473333) + get installed and are searched for in the same locations (rhbz#473333) - clean up buildprereq/prereqs, explicit mktemp requires, and add the - ldconfig for the -server-ldap subpackage (part of #225974) -- escape possible macros in the changelog (part of #225974) -- fixup summary texts (part of #225974) -- take the execute bit off of the protocol docs (part of #225974) -- unflag init scripts as configuration files (part of #225974) -- make the kpropd init script treat 'reload' as 'restart' (part of #225974) + ldconfig for the -server-ldap subpackage (part of rhbz#225974) +- escape possible macros in the changelog (part of rhbz#225974) +- fixup summary texts (part of rhbz#225974) +- take the execute bit off of the protocol docs (part of rhbz#225974) +- unflag init scripts as configuration files (part of rhbz#225974) +- make the kpropd init script treat 'reload' as 'restart' (part of rhbz#225974) * Tue Mar 17 2009 Nalin Dahyabhai 1.6.3-19 - libgssapi_krb5: backport fix for some errors which can occur when @@ -3170,7 +3179,7 @@ exit 0 * Thu Sep 4 2008 Nalin Dahyabhai - if we successfully change the user's password during an attempt to get initial credentials, but then fail to get initial creds from a non-master - using the new password, retry against the master (#432334) + using the new password, retry against the master (rhbz#432334) * Tue Aug 5 2008 Tom "spot" Callaway 1.6.3-16 - fix license tag @@ -3193,7 +3202,7 @@ exit 0 * Wed Apr 16 2008 Nalin Dahyabhai 1.6.3-13 - ftp: use the correct local filename during mget when the 'case' option is - enabled (#442713) + enabled (rhbz#442713) * Fri Apr 4 2008 Nalin Dahyabhai 1.6.3-12 - stop exporting kadmin keys to a keytab file when kadmind starts -- the @@ -3207,17 +3216,17 @@ exit 0 * Tue Mar 18 2008 Nalin Dahyabhai 1.6.3-10 - add fixes from MITKRB5-SA-2008-001 for use of null or dangling pointer when v4 compatibility is enabled on the KDC (CVE-2008-0062, CVE-2008-0063, - #432620, #432621) + rhbz#432620, rhbz#432621) - add fixes from MITKRB5-SA-2008-002 for array out-of-bounds accesses when - high-numbered descriptors are used (CVE-2008-0947, #433596) + high-numbered descriptors are used (CVE-2008-0947, rhbz#433596) - add backport bug fix for an attempt to free non-heap memory in - libgssapi_krb5 (CVE-2007-5901, #415321) + libgssapi_krb5 (CVE-2007-5901, rhbz#415321) - add backport bug fix for a double-free in out-of-memory situations in - libgssapi_krb5 (CVE-2007-5971, #415351) + libgssapi_krb5 (CVE-2007-5971, rhbz#415351) * Tue Mar 18 2008 Nalin Dahyabhai 1.6.3-9 - rework file labeling patch to not depend on fragile preprocessor trickery, - in another attempt at fixing #428355 and friends + in another attempt at fixing rhbz#428355 and friends * Tue Feb 26 2008 Nalin Dahyabhai 1.6.3-8 - ftp: add patch to fix "runique on" case when globbing fixes applied @@ -3225,12 +3234,12 @@ exit 0 * Mon Feb 25 2008 Nalin Dahyabhai - add patch to suppress double-processing of /etc/krb5.conf when we build - with --sysconfdir=/etc, thereby suppressing double-logging (#231147) + with --sysconfdir=/etc, thereby suppressing double-logging (rhbz#231147) * Mon Feb 25 2008 Nalin Dahyabhai - remove a patch, to fix problems with interfaces which are "up" but which have no address assigned, which conflicted with a different fix for the same - problem in 1.5 (#200979) + problem in 1.5 (rhbz#200979) * Mon Feb 25 2008 Nalin Dahyabhai - ftp: don't lose track of a descriptor on passive get when the server fails to @@ -3254,22 +3263,22 @@ exit 0 * Tue Feb 12 2008 Nalin Dahyabhai 1.6.3-5 - enable patch for key-expiration reporting -- enable patch to make kpasswd fall back to TCP if UDP fails (#251206) +- enable patch to make kpasswd fall back to TCP if UDP fails (rhbz#251206) - enable patch to make kpasswd use the right sequence number on retransmit - enable patch to allow mech-specific creds delegated under spnego to be found when searching for creds * Wed Jan 2 2008 Nalin Dahyabhai 1.6.3-4 - some init script cleanups - - drop unquoted check and silent exit for "$NETWORKING" (#426852, #242502) + - drop unquoted check and silent exit for "$NETWORKING" (rhbz#426852, rhbz#242502) - krb524: don't barf on missing database if it looks like we're using kldap, same as for kadmin - return non-zero status for missing files which cause startup to - fail (#242502) + fail (rhbz#242502) * Tue Dec 18 2007 Nalin Dahyabhai 1.6.3-3 - allocate space for the nul-terminator in the local pathname when looking up - a file context, and properly free a previous context (Jose Plans, #426085) + a file context, and properly free a previous context (Jose Plans, rhbz#426085) * Wed Dec 5 2007 Nalin Dahyabhai 1.6.3-2 - rebuild @@ -3285,7 +3294,7 @@ exit 0 * Fri Oct 12 2007 Nalin Dahyabhai - make krb5.conf %%verify(not md5 size mtime) in addition to - %%config(noreplace), like /etc/nsswitch.conf (#329811) + %%config(noreplace), like /etc/nsswitch.conf (rhbz#329811) * Mon Oct 1 2007 Nalin Dahyabhai 1.6.2-9 - apply the fix for CVE-2007-4000 instead of the experimental patch for @@ -3302,7 +3311,7 @@ exit 0 * Thu Sep 6 2007 Nalin Dahyabhai 1.6.2-6 - incorporate updated fix for CVE-2007-3999 (CVE-2007-4743) -- fix incorrect call to "test" in the kadmin init script (#252322,#287291) +- fix incorrect call to "test" in the kadmin init script (rhbz#252322,rhbz#287291) * Tue Sep 4 2007 Nalin Dahyabhai 1.6.2-5 - incorporate fixes for MITKRB5-SA-2007-006 (CVE-2007-3999, CVE-2007-4000) @@ -3315,7 +3324,7 @@ exit 0 - rebuild * Thu Jul 26 2007 Nalin Dahyabhai 1.6.2-2 -- kdc.conf: default to listening for TCP clients, too (#248415) +- kdc.conf: default to listening for TCP clients, too (rhbz#248415) * Thu Jul 19 2007 Nalin Dahyabhai 1.6.2-1 - update to 1.6.2 @@ -3341,13 +3350,13 @@ exit 0 - rebuild * Sun Jun 24 2007 Nalin Dahyabhai 1.6.1-3 -- label all files at creation-time according to the SELinux policy (#228157) +- label all files at creation-time according to the SELinux policy (rhbz#228157) * Fri Jun 22 2007 Nalin Dahyabhai -- perform PAM account / session management in krshd (#182195,#195922) +- perform PAM account / session management in krshd (rhbz#182195,rhbz#195922) - perform PAM authentication and account / session management in ftpd - perform PAM authentication, account / session management, and password- - changing in login.krb5 (#182195,#195922) + changing in login.krb5 (rhbz#182195,rhbz#195922) * Fri Jun 22 2007 Nalin Dahyabhai - preprocess kerberos.ldif into a format FDS will like better, and include @@ -3357,7 +3366,7 @@ exit 0 - switch man pages to being generated with the right paths in them - drop old, incomplete SELinux patch - add patch from Greg Hudson to make srvtab routines report missing-file errors - at same point that keytab routines do (#241805) + at same point that keytab routines do (rhbz#241805) * Thu May 24 2007 Nalin Dahyabhai 1.6.1-2 - pull patch from svn to undo unintentional chattiness in ftp @@ -3378,7 +3387,7 @@ exit 0 * Wed May 16 2007 Nalin Dahyabhai 1.6-6 - omit dependent libraries from the krb5-config --libs output, as using shared libraries (no more static libraries) makes them unnecessary and - they're not part of the libkrb5 interface (patch by Rex Dieter, #240220) + they're not part of the libkrb5 interface (patch by Rex Dieter, rhbz#240220) (strips out libkeyutils, libresolv, libdl) * Fri May 4 2007 Nalin Dahyabhai 1.6-5 @@ -3393,17 +3402,17 @@ exit 0 * Fri Apr 13 2007 Nalin Dahyabhai - move the default acl_file, dict_file, and admin_keytab settings to the part of the default/example kdc.conf where they'll actually have - an effect (#236417) + an effect (rhbz#236417) * Thu Apr 5 2007 Nalin Dahyabhai 1.5-24 - merge security fixes from RHSA-2007:0095 * Tue Apr 3 2007 Nalin Dahyabhai 1.6-3 - add patch to correct unauthorized access via krb5-aware telnet - daemon (#229782, CVE-2007-0956) + daemon (rhbz#229782, CVE-2007-0956) - add patch to fix buffer overflow in krb5kdc and kadmind - (#231528, CVE-2007-0957) -- add patch to fix double-free in kadmind (#231537, CVE-2007-1216) + (rhbz#231528, CVE-2007-0957) +- add patch to fix double-free in kadmind (rhbz#231537, CVE-2007-1216) * Thu Mar 22 2007 Nalin Dahyabhai - back out buildrequires: keyutils-libs-devel for now @@ -3419,19 +3428,19 @@ exit 0 * Thu Mar 15 2007 Nalin Dahyabhai 1.5-21 - add preliminary patch to fix buffer overflow in krb5kdc and kadmind - (#231528, CVE-2007-0957) -- add preliminary patch to fix double-free in kadmind (#231537, CVE-2007-1216) + (rhbz#231528, CVE-2007-0957) +- add preliminary patch to fix double-free in kadmind (rhbz#231537, CVE-2007-1216) * Wed Feb 28 2007 Nalin Dahyabhai - add patch to build semi-useful static libraries, but don't apply it unless we need them * Tue Feb 27 2007 Nalin Dahyabhai - 1.5-20 -- temporarily back out %%post changes, fix for #143289 for security update +- temporarily back out %%post changes, fix for rhbz#143289 for security update - add preliminary patch to correct unauthorized access via krb5-aware telnet * Mon Feb 19 2007 Nalin Dahyabhai -- make profile.d scriptlets mode 644 instead of 755 (part of #225974) +- make profile.d scriptlets mode 644 instead of 755 (part of rhbz#225974) * Tue Jan 30 2007 Nalin Dahyabhai 1.6-1 - clean up quoting of command-line arguments passed to the krsh/krlogin @@ -3439,22 +3448,22 @@ exit 0 * Mon Jan 22 2007 Nalin Dahyabhai - initial update to 1.6, pre-package-reorg -- move workstation daemons to a new subpackage (#81836, #216356, #217301), and - make the new subpackage require xinetd (#211885) +- move workstation daemons to a new subpackage (rhbz#81836, rhbz#216356, rhbz#217301), and + make the new subpackage require xinetd (rhbz#211885) * Mon Jan 22 2007 Nalin Dahyabhai - 1.5-18 -- make use of install-info more failsafe (Ville Skyttä, #223704) +- make use of install-info more failsafe (Ville Skyttä, rhbz#223704) - preserve timestamps on shell scriptlets at %%install-time * Tue Jan 16 2007 Nalin Dahyabhai - 1.5-17 -- move to using pregenerated PDF docs to cure multilib conflicts (#222721) +- move to using pregenerated PDF docs to cure multilib conflicts (rhbz#222721) * Fri Jan 12 2007 Nalin Dahyabhai - 1.5-16 -- update backport of the preauth module interface (part of #194654) +- update backport of the preauth module interface (part of rhbz#194654) * Tue Jan 9 2007 Nalin Dahyabhai - 1.5-14 -- apply fixes from Tom Yu for MITKRB5-SA-2006-002 (CVE-2006-6143) (#218456) -- apply fixes from Tom Yu for MITKRB5-SA-2006-003 (CVE-2006-6144) (#218456) +- apply fixes from Tom Yu for MITKRB5-SA-2006-002 (CVE-2006-6143) (rhbz#218456) +- apply fixes from Tom Yu for MITKRB5-SA-2006-003 (CVE-2006-6144) (rhbz#218456) * Wed Dec 20 2006 Nalin Dahyabhai - 1.5-12 - update backport of the preauth module interface @@ -3472,21 +3481,21 @@ exit 0 been applicable for a while * Wed Oct 18 2006 Nalin Dahyabhai - 1.5-10 -- rename krb5.sh and krb5.csh so that they don't overlap (#210623) -- way-late application of added error info in kadmind.init (#65853) +- rename krb5.sh and krb5.csh so that they don't overlap (rhbz#210623) +- way-late application of added error info in kadmind.init (rhbz#65853) * Wed Oct 18 2006 Nalin Dahyabhai - 1.5-9.pal_18695 -- add backport of in-development preauth module interface (#208643) +- add backport of in-development preauth module interface (rhbz#208643) * Mon Oct 9 2006 Nalin Dahyabhai - 1.5-9 -- provide docs in PDF format instead of as tex source (Enrico Scholz, #209943) +- provide docs in PDF format instead of as tex source (Enrico Scholz, rhbz#209943) * Wed Oct 4 2006 Nalin Dahyabhai - 1.5-8 -- add missing shebang headers to krsh and krlogin wrapper scripts (#209238) +- add missing shebang headers to krsh and krlogin wrapper scripts (rhbz#209238) * Wed Sep 6 2006 Nalin Dahyabhai - 1.5-7 - set SS_LIB at configure-time so that libss-using apps get working readline - support (#197044) + support (rhbz#197044) * Fri Aug 18 2006 Nalin Dahyabhai - 1.5-6 - switch to the updated patch for MITKRB-SA-2006-001 @@ -3497,7 +3506,7 @@ exit 0 * Mon Aug 7 2006 Nalin Dahyabhai - 1.5-4 - ensure that the gssapi library's been initialized before walking the internal mechanism list in gss_release_oid(), needed if called from - gss_release_name() right after a gss_import_name() (#198092) + gss_release_name() right after a gss_import_name() (rhbz#198092) * Tue Jul 25 2006 Nalin Dahyabhai - 1.5-3 - rebuild @@ -3518,7 +3527,7 @@ exit 0 - update to 1.5 * Fri Jun 23 2006 Nalin Dahyabhai 1.4.3-9 -- mark profile.d config files noreplace (Laurent Rineau, #196447) +- mark profile.d config files noreplace (Laurent Rineau, rhbz#196447) * Thu Jun 8 2006 Nalin Dahyabhai 1.4.3-8 - add buildprereq for autoconf @@ -3526,11 +3535,11 @@ exit 0 * Mon May 22 2006 Nalin Dahyabhai 1.4.3-7 - further munge krb5-config so that 'libdir=/usr/lib' is given even on 64-bit architectures, to avoid multilib conflicts; other changes will conspire to - strip out the -L flag which uses this, so it should be harmless (#192692) + strip out the -L flag which uses this, so it should be harmless (rhbz#192692) * Fri Apr 28 2006 Nalin Dahyabhai 1.4.3-6 - adjust the patch which removes the use of rpath to also produce a - krb5-config which is okay in multilib environments (#190118) + krb5-config which is okay in multilib environments (rhbz#190118) - make the name-of-the-tempfile comment which compile_et adds to error code headers always list the same file to avoid conflicts on multilib installations - strip SIZEOF_LONG out of krb5.h so that it doesn't conflict on multilib boxes @@ -3545,7 +3554,7 @@ exit 0 * Mon Feb 6 2006 Nalin Dahyabhai 1.4.3-4 - give a little bit more information to the user when kinit gets the catch-all - I/O error (#180175) + I/O error (rhbz#180175) * Thu Jan 19 2006 Nalin Dahyabhai 1.4.3-3 - rebuild properly when pthread_mutexattr_setrobust_np() is defined but not @@ -3559,23 +3568,23 @@ exit 0 * Thu Dec 1 2005 Nalin Dahyabhai - login: don't truncate passwords before passing them into crypt(), in - case they're significant (#149476) + case they're significant (rhbz#149476) * Thu Nov 17 2005 Nalin Dahyabhai 1.4.3-1 - update to 1.4.3 -- make ksu setuid again (#137934, others) +- make ksu setuid again (rhbz#137934, others) * Tue Sep 13 2005 Nalin Dahyabhai 1.4.2-4 - mark %%{krb5prefix}/man so that files which are packaged within it are - flagged as %%doc (#168163) + flagged as %%doc (rhbz#168163) * Tue Sep 6 2005 Nalin Dahyabhai 1.4.2-3 - add an xinetd configuration file for encryption-only telnetd, parallelling - the kshell/ekshell pair (#167535) + the kshell/ekshell pair (rhbz#167535) * Wed Aug 31 2005 Nalin Dahyabhai 1.4.2-2 - change the default configured encryption type for KDC databases to the - compiled-in default of des3-hmac-sha1 (#57847) + compiled-in default of des3-hmac-sha1 (rhbz#57847) * Thu Aug 11 2005 Nalin Dahyabhai 1.4.2-1 - update to 1.4.2, incorporating the fixes for MIT-KRB5-SA-2005-002 and @@ -3586,23 +3595,23 @@ exit 0 * Wed Jun 29 2005 Nalin Dahyabhai 1.4.1-5 - fix telnet client environment variable disclosure the same way NetKit's - telnet client did (CAN-2005-0488) (#159305) + telnet client did (CAN-2005-0488) (rhbz#159305) - keep apps which call krb5_principal_compare() or krb5_realm_compare() with malformed or NULL principal structures from crashing outright (Thomas Biege) - (#161475) + (rhbz#161475) * Tue Jun 28 2005 Nalin Dahyabhai - apply fixes from draft of MIT-KRB5-SA-2005-002 (CAN-2005-1174,CAN-2005-1175) - (#157104) -- apply fixes from draft of MIT-KRB5-SA-2005-003 (CAN-2005-1689) (#159755) + (rhbz#157104) +- apply fixes from draft of MIT-KRB5-SA-2005-003 (CAN-2005-1689) (rhbz#159755) * Fri Jun 24 2005 Nalin Dahyabhai 1.4.1-4 - fix double-close in keytab handling -- add port of fixes for CAN-2004-0175 to krb5-aware rcp (#151612) +- add port of fixes for CAN-2004-0175 to krb5-aware rcp (rhbz#151612) * Fri May 13 2005 Nalin Dahyabhai 1.4.1-3 - prevent spurious EBADF in krshd when stdin is closed by the client while - the command is running (#151111) + the command is running (rhbz#151111) * Fri May 13 2005 Martin Stransky 1.4.1-2 - add deadlock patch, removed old patch @@ -3661,18 +3670,18 @@ exit 0 - rebuild * Mon Nov 22 2004 Nalin Dahyabhai 1.3.5-3 -- fix predictable-tempfile-name bug in krb5-send-pr (CAN-2004-0971, #140036) +- fix predictable-tempfile-name bug in krb5-send-pr (CAN-2004-0971, rhbz#140036) * Tue Nov 16 2004 Nalin Dahyabhai - silence compiler warning in kprop by using an in-memory ccache with a fixed name instead of an on-disk ccache with a name generated by tmpnam() * Tue Nov 16 2004 Nalin Dahyabhai 1.3.5-2 -- fix globbing patch port mode (#139075) +- fix globbing patch port mode (rhbz#139075) * Mon Nov 1 2004 Nalin Dahyabhai 1.3.5-1 - fix segfault in telnet due to incorrect checking of gethostbyname_r result - codes (#129059) + codes (rhbz#129059) * Fri Oct 15 2004 Nalin Dahyabhai - remove rc4-hmac:norealm and rc4-hmac:onlyrealm from the default list of @@ -3697,11 +3706,11 @@ exit 0 * Mon Aug 23 2004 Nalin Dahyabhai 1.3.4-3 - incorporate fixes from Tom Yu for CAN-2004-0642, CAN-2004-0772 - (MITKRB5-SA-2004-002, #130732) -- incorporate fixes from Tom Yu for CAN-2004-0644 (MITKRB5-SA-2004-003, #130732) + (MITKRB5-SA-2004-002, rhbz#130732) +- incorporate fixes from Tom Yu for CAN-2004-0644 (MITKRB5-SA-2004-003, rhbz#130732) * Tue Jul 27 2004 Nalin Dahyabhai 1.3.4-2 -- fix indexing error in server sorting patch (#127336) +- fix indexing error in server sorting patch (rhbz#127336) * Tue Jun 15 2004 Elliot Lee - rebuilt @@ -3726,7 +3735,7 @@ exit 0 - rebuild * Tue Jun 1 2004 Nalin Dahyabhai 1.3.3-4 -- apply patch from MITKRB5-SA-2004-001 (#125001) +- apply patch from MITKRB5-SA-2004-001 (rhbz#125001) * Wed May 12 2004 Thomas Woerner 1.3.3-3 - removed rpath @@ -3756,17 +3765,17 @@ exit 0 * Mon Feb 2 2004 Nalin Dahyabhai 1.3.1-9 - remove patch to set TERM in klogind which, combined with the upstream fix in - 1.3.1, actually produces the bug now (#114762) + 1.3.1, actually produces the bug now (rhbz#114762) * Mon Jan 19 2004 Nalin Dahyabhai 1.3.1-8 - when iterating over lists of interfaces which are "up" from getifaddrs(), - skip over those which have no address (#113347) + skip over those which have no address (rhbz#113347) * Mon Jan 12 2004 Nalin Dahyabhai - prefer the kdc which last replied to a request when sending requests to kdcs * Mon Nov 24 2003 Nalin Dahyabhai 1.3.1-7 -- fix combination of --with-netlib and --enable-dns (#82176) +- fix combination of --with-netlib and --enable-dns (rhbz#82176) * Tue Nov 18 2003 Nalin Dahyabhai - remove libdefault ticket_lifetime option from the default krb5.conf, it is @@ -3975,12 +3984,12 @@ exit 0 * Wed Jun 27 2001 Nalin Dahyabhai - add patch to support "ANY" keytab type (i.e., "default_keytab_name = ANY:FILE:/etc/krb5.keytab,SRVTAB:/etc/srvtab" - patch from Gerald Britton, #42551) -- build with -D_FILE_OFFSET_BITS=64 to get large file I/O in ftpd (#30697) + patch from Gerald Britton, rhbz#42551) +- build with -D_FILE_OFFSET_BITS=64 to get large file I/O in ftpd (rhbz#30697) - patch ftpd to use long long and %%lld format specifiers to support the SIZE - command on large files (also #30697) -- don't use LOG_AUTH as an option value when calling openlog() in ksu (#45965) -- implement reload in krb5kdc and kadmind init scripts (#41911) + command on large files (also rhbz#30697) +- don't use LOG_AUTH as an option value when calling openlog() in ksu (rhbz#45965) +- implement reload in krb5kdc and kadmind init scripts (rhbz#41911) - lose the krb5server init script (not using it any more) * Sun Jun 24 2001 Elliot Lee @@ -3993,7 +4002,7 @@ exit 0 - rebuild in new environment * Thu Apr 26 2001 Nalin Dahyabhai -- add patch from Tom Yu to fix ftpd overflows (#37731) +- add patch from Tom Yu to fix ftpd overflows (rhbz#37731) * Wed Apr 18 2001 Than Ngo - disable optimizations on the alpha again @@ -4017,7 +4026,7 @@ exit 0 - own %%{_var}/kerberos * Tue Feb 6 2001 Nalin Dahyabhai -- own the directories which are created for each package (#26342) +- own the directories which are created for each package (rhbz#26342) * Tue Jan 23 2001 Nalin Dahyabhai - gettextize init scripts @@ -4027,7 +4036,7 @@ exit 0 - re-enable optimization on alphas * Mon Jan 15 2001 Nalin Dahyabhai -- fix krb5-send-pr (#18932) and move it from -server to -workstation +- fix krb5-send-pr (rhbz#18932) and move it from -server to -workstation - buildprereq libtermcap-devel - temporariliy disable optimization on alphas - gettextize init scripts @@ -4039,29 +4048,29 @@ exit 0 - rebuild in new environment * Tue Oct 31 2000 Nalin Dahyabhai -- add bison as a BuildPrereq (#20091) +- add bison as a BuildPrereq (rhbz#20091) * Mon Oct 30 2000 Nalin Dahyabhai -- change /usr/dict/words to /usr/share/dict/words in default kdc.conf (#20000) +- change /usr/dict/words to /usr/share/dict/words in default kdc.conf (rhbz#20000) * Thu Oct 5 2000 Nalin Dahyabhai - apply kpasswd bug fixes from David Wragg * Wed Oct 4 2000 Nalin Dahyabhai -- make krb5-libs obsolete the old krb5-configs package (#18351) +- make krb5-libs obsolete the old krb5-configs package (rhbz#18351) - don't quit from the kpropd init script if there's no principal database so that you can propagate the first time without running kpropd manually - don't complain if /etc/ld.so.conf doesn't exist in the -libs %%post * Tue Sep 12 2000 Nalin Dahyabhai - fix credential forwarding problem in klogind (goof in KRB5CCNAME handling) - (#11588) -- fix heap corruption bug in FTP client (#14301) + (rhbz#11588) +- fix heap corruption bug in FTP client (rhbz#14301) * Wed Aug 16 2000 Nalin Dahyabhai - fix summaries and descriptions - switched the default transfer protocol from PORT to PASV as proposed on - bugzilla (#16134), and to match the regular ftp package's behavior + bugzilla (rhbz#16134), and to match the regular ftp package's behavior * Wed Jul 19 2000 Jeff Johnson - rebuild to compress man pages. @@ -4137,7 +4146,7 @@ exit 0 * Sat Jun 3 2000 Nalin Dahyabhai - use %%{_infodir} to better comply with FHS - move .so files to -devel subpackage -- tweak xinetd config files (bugs #11833, #11835, #11836, #11840) +- tweak xinetd config files (bugs rhbz#11833, rhbz#11835, rhbz#11836, rhbz#11840) - fix package descriptions again * Wed May 24 2000 Nalin Dahyabhai @@ -4174,7 +4183,7 @@ exit 0 - fix configure stuff for ia64 * Mon Apr 10 2000 Nalin Dahyabhai -- add LDCOMBINE=-lc to configure invocation to use libc versioning (bug #10653) +- add LDCOMBINE=-lc to configure invocation to use libc versioning (rhbz#10653) - change Requires: for/in subpackages to include %%{version} * Wed Apr 05 2000 Nalin Dahyabhai diff --git a/sources b/sources index d6c0df1..58dc8d0 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (krb5-1.21.tar.gz) = 8ee2366888f6d553a44fc642a89c69a57dbc1ec4c89a36b9ba8b00584a9a32c73a2b0566ba5f21852ad9617046666c276dac402393bf8eb19fbe0c07a838071a -SHA512 (krb5-1.21.tar.gz.asc) = 7147a44a13f4f26c5c1d9aba738b32892b50e351ad149dcaf0b6f2c010e3c51d7d51540d0a51b085450ffa31d5027b5f2e5841109d7af8bdaddbdd3a569582d5 +SHA512 (krb5-1.21.2.tar.gz) = 4e09296b412383d53872661718dbfaa90201e0d85f69db48e57a8d4bd73c95a90c7ec7b6f0f325f6bc967f8d203b256b071c0191facf080aca0e2caec5d0ac49 +SHA512 (krb5-1.21.2.tar.gz.asc) = 1cee1ed77047067d7b6fb3620ffa6f5807d4182ae7cfeec6d5cc847c99f30c6dd2a5c1a160d992a13eb6d84754b202895a982111618711f3c14f4aa33c07d9e9 From 0fe5c327ec4da592663de48b995b58c7796f1c55 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Tue, 10 Oct 2023 17:18:32 +0200 Subject: [PATCH 087/103] Fix memory leaks and use SPDX license expression - Use SPDX expression for license tag - Fix unimportant memory leaks Resolves: rhbz#2223274 Signed-off-by: Julien Rische --- 0016-Fix-unimportant-memory-leaks.patch | 2334 +++++++++++++++++++++++ krb5.spec | 10 +- 2 files changed, 2342 insertions(+), 2 deletions(-) create mode 100644 0016-Fix-unimportant-memory-leaks.patch diff --git a/0016-Fix-unimportant-memory-leaks.patch b/0016-Fix-unimportant-memory-leaks.patch new file mode 100644 index 0000000..3406316 --- /dev/null +++ b/0016-Fix-unimportant-memory-leaks.patch @@ -0,0 +1,2334 @@ +From f0414954d79283075d1f627dbb9fe6e4f43c1aae Mon Sep 17 00:00:00 2001 +From: Steve Grubb +Date: Thu, 13 Jul 2023 16:22:30 -0400 +Subject: [PATCH] Fix unimportant memory leaks + +Eliminate memory leaks detected through static analysis and manual +review. These leaks are unlikely to happen repeatedly in long-running +processes. + +[jrische@redhat.com: fixed many additional leaks] +[ghudson@mit.edu: fixed additional leaks; edited for style; removed +some unused ksu functions; rewrote commit message] + +(cherry picked from commit 6c5471176f5266564fbc8a7e02f03b4b042202f8) +--- + src/appl/gss-sample/gss-client.c | 367 ++++++++---------- + src/appl/gss-sample/gss-server.c | 3 +- + src/clients/klist/klist.c | 59 +-- + src/clients/ksu/authorization.c | 140 +++---- + src/clients/ksu/ccache.c | 289 +++++--------- + src/clients/ksu/heuristic.c | 128 +++--- + src/clients/ksu/krb_auth_su.c | 137 ++----- + src/clients/ksu/ksu.h | 6 - + src/clients/ksu/main.c | 3 +- + src/kadmin/cli/keytab.c | 6 +- + src/kadmin/ktutil/ktutil.c | 1 + + src/kprop/kpropd.c | 21 +- + src/lib/gssapi/krb5/export_cred.c | 4 +- + src/lib/gssapi/krb5/val_cred.c | 6 +- + src/lib/kadm5/srv/server_kdb.c | 7 +- + src/lib/krb5/ccache/cc_kcm.c | 4 + + src/lib/krb5/ccache/ccfns.c | 12 +- + src/lib/krb5/keytab/kt_file.c | 3 +- + src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c | 8 +- + 19 files changed, 520 insertions(+), 684 deletions(-) + +diff --git a/src/appl/gss-sample/gss-client.c b/src/appl/gss-sample/gss-client.c +index 6e2aa33690..cf94623d63 100644 +--- a/src/appl/gss-sample/gss-client.c ++++ b/src/appl/gss-sample/gss-client.c +@@ -182,180 +182,148 @@ client_establish_context(int s, char *service_name, OM_uint32 gss_flags, + char *username, char *password, + gss_ctx_id_t *gss_context, OM_uint32 *ret_flags) + { +- if (auth_flag) { +- gss_buffer_desc send_tok, recv_tok, *token_ptr; +- gss_name_t target_name; +- OM_uint32 maj_stat, min_stat, init_sec_min_stat; +- int token_flags; +- gss_cred_id_t cred = GSS_C_NO_CREDENTIAL; +- gss_name_t gss_username = GSS_C_NO_NAME; +- gss_OID_set_desc mechs, *mechsp = GSS_C_NO_OID_SET; +- +- if (spnego) { +- mechs.elements = &gss_spnego_mechanism_oid_desc; +- mechs.count = 1; +- mechsp = &mechs; +- } else if (oid != GSS_C_NO_OID) { +- mechs.elements = oid; +- mechs.count = 1; +- mechsp = &mechs; +- } else { +- mechs.elements = NULL; +- mechs.count = 0; +- } ++ int result = -1, st; ++ gss_buffer_desc send_tok, recv_tok, pwbuf, *token_ptr; ++ gss_name_t target_name = GSS_C_NO_NAME, gss_username = GSS_C_NO_NAME; ++ OM_uint32 maj_stat, min_stat, init_sec_min_stat; ++ int token_flags; ++ gss_cred_id_t cred = GSS_C_NO_CREDENTIAL; ++ gss_OID_set_desc mechs, neg_mechs, *mechsp = GSS_C_NO_OID_SET; ++ ++ if (!auth_flag) ++ return send_token(s, TOKEN_NOOP, empty_token); ++ ++ if (spnego) { ++ mechs.elements = &gss_spnego_mechanism_oid_desc; ++ mechs.count = 1; ++ mechsp = &mechs; ++ } else if (oid != GSS_C_NO_OID) { ++ mechs.elements = oid; ++ mechs.count = 1; ++ mechsp = &mechs; ++ } else { ++ mechs.elements = NULL; ++ mechs.count = 0; ++ } + +- if (username != NULL) { +- send_tok.value = username; +- send_tok.length = strlen(username); ++ if (username != NULL) { ++ send_tok.value = username; ++ send_tok.length = strlen(username); + +- maj_stat = gss_import_name(&min_stat, &send_tok, +- (gss_OID) gss_nt_user_name, +- &gss_username); +- if (maj_stat != GSS_S_COMPLETE) { +- display_status("parsing client name", maj_stat, min_stat); +- return -1; +- } +- } +- +- if (password != NULL) { +- gss_buffer_desc pwbuf; +- +- pwbuf.value = password; +- pwbuf.length = strlen(password); +- +- maj_stat = gss_acquire_cred_with_password(&min_stat, +- gss_username, +- &pwbuf, 0, +- mechsp, GSS_C_INITIATE, +- &cred, NULL, NULL); +- } else if (gss_username != GSS_C_NO_NAME) { +- maj_stat = gss_acquire_cred(&min_stat, +- gss_username, 0, +- mechsp, GSS_C_INITIATE, +- &cred, NULL, NULL); +- } else +- maj_stat = GSS_S_COMPLETE; ++ maj_stat = gss_import_name(&min_stat, &send_tok, ++ (gss_OID) gss_nt_user_name, &gss_username); + if (maj_stat != GSS_S_COMPLETE) { +- display_status("acquiring creds", maj_stat, min_stat); +- gss_release_name(&min_stat, &gss_username); +- return -1; ++ display_status("parsing client name", maj_stat, min_stat); ++ goto cleanup; + } +- if (spnego && oid != GSS_C_NO_OID) { +- gss_OID_set_desc neg_mechs; +- +- neg_mechs.elements = oid; +- neg_mechs.count = 1; ++ } + +- maj_stat = gss_set_neg_mechs(&min_stat, cred, &neg_mechs); +- if (maj_stat != GSS_S_COMPLETE) { +- display_status("setting neg mechs", maj_stat, min_stat); +- gss_release_name(&min_stat, &gss_username); +- gss_release_cred(&min_stat, &cred); +- return -1; +- } +- } +- gss_release_name(&min_stat, &gss_username); +- +- /* +- * Import the name into target_name. Use send_tok to save +- * local variable space. +- */ +- send_tok.value = service_name; +- send_tok.length = strlen(service_name); +- maj_stat = gss_import_name(&min_stat, &send_tok, +- (gss_OID) gss_nt_service_name, +- &target_name); ++ if (password != NULL) { ++ pwbuf.value = password; ++ pwbuf.length = strlen(password); ++ ++ maj_stat = gss_acquire_cred_with_password(&min_stat, gss_username, ++ &pwbuf, 0, mechsp, ++ GSS_C_INITIATE, &cred, NULL, ++ NULL); ++ } else if (gss_username != GSS_C_NO_NAME) { ++ maj_stat = gss_acquire_cred(&min_stat, gss_username, 0, mechsp, ++ GSS_C_INITIATE, &cred, NULL, NULL); ++ } else { ++ maj_stat = GSS_S_COMPLETE; ++ } ++ if (maj_stat != GSS_S_COMPLETE) { ++ display_status("acquiring creds", maj_stat, min_stat); ++ goto cleanup; ++ } ++ if (spnego && oid != GSS_C_NO_OID) { ++ neg_mechs.elements = oid; ++ neg_mechs.count = 1; ++ maj_stat = gss_set_neg_mechs(&min_stat, cred, &neg_mechs); + if (maj_stat != GSS_S_COMPLETE) { +- display_status("parsing name", maj_stat, min_stat); +- return -1; ++ display_status("setting neg mechs", maj_stat, min_stat); ++ goto cleanup; + } ++ } + +- if (!v1_format) { +- if (send_token(s, TOKEN_NOOP | TOKEN_CONTEXT_NEXT, empty_token) < +- 0) { +- (void) gss_release_name(&min_stat, &target_name); +- return -1; +- } +- } ++ /* Import the name into target_name. Use send_tok to save local variable ++ * space. */ ++ send_tok.value = service_name; ++ send_tok.length = strlen(service_name); ++ maj_stat = gss_import_name(&min_stat, &send_tok, ++ (gss_OID) gss_nt_service_name, &target_name); ++ if (maj_stat != GSS_S_COMPLETE) { ++ display_status("parsing name", maj_stat, min_stat); ++ goto cleanup; ++ } + +- /* +- * Perform the context-establishement loop. +- * +- * On each pass through the loop, token_ptr points to the token +- * to send to the server (or GSS_C_NO_BUFFER on the first pass). +- * Every generated token is stored in send_tok which is then +- * transmitted to the server; every received token is stored in +- * recv_tok, which token_ptr is then set to, to be processed by +- * the next call to gss_init_sec_context. +- * +- * GSS-API guarantees that send_tok's length will be non-zero +- * if and only if the server is expecting another token from us, +- * and that gss_init_sec_context returns GSS_S_CONTINUE_NEEDED if +- * and only if the server has another token to send us. +- */ +- +- token_ptr = GSS_C_NO_BUFFER; +- *gss_context = GSS_C_NO_CONTEXT; +- +- do { +- maj_stat = gss_init_sec_context(&init_sec_min_stat, +- cred, gss_context, +- target_name, mechs.elements, +- gss_flags, 0, +- NULL, /* channel bindings */ +- token_ptr, NULL, /* mech type */ +- &send_tok, ret_flags, +- NULL); /* time_rec */ +- +- if (token_ptr != GSS_C_NO_BUFFER) +- free(recv_tok.value); +- +- if (send_tok.length != 0) { +- if (verbose) +- printf("Sending init_sec_context token (size=%d)...", +- (int) send_tok.length); +- if (send_token(s, v1_format ? 0 : TOKEN_CONTEXT, &send_tok) < +- 0) { +- (void) gss_release_buffer(&min_stat, &send_tok); +- (void) gss_release_name(&min_stat, &target_name); +- return -1; +- } ++ if (!v1_format) { ++ if (send_token(s, TOKEN_NOOP | TOKEN_CONTEXT_NEXT, empty_token) < 0) ++ goto cleanup; ++ } ++ ++ /* ++ * Perform the context-establishment loop. ++ * ++ * On each pass through the loop, token_ptr points to the token to send to ++ * the server (or GSS_C_NO_BUFFER on the first pass). Every generated ++ * token is stored in send_tok which is then transmitted to the server; ++ * every received token is stored in recv_tok, which token_ptr is then set ++ * to, to be processed by the next call to gss_init_sec_context. ++ * ++ * GSS-API guarantees that send_tok's length will be non-zero if and only ++ * if the server is expecting another token from us, and that ++ * gss_init_sec_context returns GSS_S_CONTINUE_NEEDED if and only if the ++ * server has another token to send us. ++ */ ++ ++ token_ptr = GSS_C_NO_BUFFER; ++ *gss_context = GSS_C_NO_CONTEXT; ++ ++ do { ++ maj_stat = gss_init_sec_context(&init_sec_min_stat, cred, gss_context, ++ target_name, mechs.elements, gss_flags, ++ 0, NULL, token_ptr, NULL, &send_tok, ++ ret_flags, NULL); ++ ++ if (token_ptr != GSS_C_NO_BUFFER) ++ free(recv_tok.value); ++ ++ if (send_tok.length > 0) { ++ if (verbose) { ++ printf("Sending init_sec_context token (size=%d)...", ++ (int) send_tok.length); + } ++ st = send_token(s, v1_format ? 0 : TOKEN_CONTEXT, &send_tok); + (void) gss_release_buffer(&min_stat, &send_tok); ++ if (st < 0) ++ goto cleanup; ++ } + +- if (maj_stat != GSS_S_COMPLETE +- && maj_stat != GSS_S_CONTINUE_NEEDED) { +- display_status("initializing context", maj_stat, +- init_sec_min_stat); +- (void) gss_release_name(&min_stat, &target_name); +- (void) gss_release_cred(&min_stat, &cred); +- if (*gss_context != GSS_C_NO_CONTEXT) +- gss_delete_sec_context(&min_stat, gss_context, +- GSS_C_NO_BUFFER); +- return -1; +- } ++ if (maj_stat != GSS_S_COMPLETE && maj_stat != GSS_S_CONTINUE_NEEDED) { ++ display_status("initializing context", maj_stat, ++ init_sec_min_stat); ++ goto cleanup; ++ } + +- if (maj_stat == GSS_S_CONTINUE_NEEDED) { +- if (verbose) +- printf("continue needed..."); +- if (recv_token(s, &token_flags, &recv_tok) < 0) { +- (void) gss_release_name(&min_stat, &target_name); +- return -1; +- } +- token_ptr = &recv_tok; +- } ++ if (maj_stat == GSS_S_CONTINUE_NEEDED) { + if (verbose) +- printf("\n"); +- } while (maj_stat == GSS_S_CONTINUE_NEEDED); ++ printf("continue needed..."); ++ if (recv_token(s, &token_flags, &recv_tok) < 0) ++ goto cleanup; ++ token_ptr = &recv_tok; ++ } ++ if (verbose) ++ printf("\n"); ++ } while (maj_stat == GSS_S_CONTINUE_NEEDED); + +- (void) gss_release_cred(&min_stat, &cred); +- (void) gss_release_name(&min_stat, &target_name); +- } else { +- if (send_token(s, TOKEN_NOOP, empty_token) < 0) +- return -1; +- } ++ result = 0; + +- return 0; ++cleanup: ++ (void) gss_release_name(&min_stat, &gss_username); ++ (void) gss_release_cred(&min_stat, &cred); ++ (void) gss_release_name(&min_stat, &target_name); ++ return result; + } + + static void +@@ -449,11 +417,11 @@ call_server(host, port, oid, service_name, gss_flags, auth_flag, + { + gss_ctx_id_t context = GSS_C_NO_CONTEXT; + gss_buffer_desc in_buf, out_buf; +- int s, state; ++ int s = -1, result = -1, state; + OM_uint32 ret_flags; + OM_uint32 maj_stat, min_stat; +- gss_name_t src_name, targ_name; +- gss_buffer_desc sname, tname; ++ gss_name_t src_name = GSS_C_NO_NAME, targ_name = GSS_C_NO_NAME; ++ gss_buffer_desc sname = GSS_C_EMPTY_BUFFER, tname = GSS_C_EMPTY_BUFFER; + OM_uint32 lifetime; + gss_OID mechanism, name_type; + int is_local; +@@ -467,14 +435,13 @@ call_server(host, port, oid, service_name, gss_flags, auth_flag, + + /* Open connection */ + if ((s = connect_to_server(host, port)) < 0) +- return -1; ++ goto cleanup; + + /* Establish context */ + if (client_establish_context(s, service_name, gss_flags, auth_flag, + v1_format, oid, username, password, + &context, &ret_flags) < 0) { +- (void) closesocket(s); +- return -1; ++ goto cleanup; + } + + if (auth_flag && verbose) { +@@ -488,19 +455,19 @@ call_server(host, port, oid, service_name, gss_flags, auth_flag, + &is_local, &is_open); + if (maj_stat != GSS_S_COMPLETE) { + display_status("inquiring context", maj_stat, min_stat); +- return -1; ++ goto cleanup; + } + + maj_stat = gss_display_name(&min_stat, src_name, &sname, &name_type); + if (maj_stat != GSS_S_COMPLETE) { + display_status("displaying source name", maj_stat, min_stat); +- return -1; ++ goto cleanup; + } + maj_stat = gss_display_name(&min_stat, targ_name, &tname, + (gss_OID *) NULL); + if (maj_stat != GSS_S_COMPLETE) { + display_status("displaying target name", maj_stat, min_stat); +- return -1; ++ goto cleanup; + } + printf("\"%.*s\" to \"%.*s\", lifetime %d, flags %x, %s, %s\n", + (int) sname.length, (char *) sname.value, +@@ -509,15 +476,10 @@ call_server(host, port, oid, service_name, gss_flags, auth_flag, + (is_local) ? "locally initiated" : "remotely initiated", + (is_open) ? "open" : "closed"); + +- (void) gss_release_name(&min_stat, &src_name); +- (void) gss_release_name(&min_stat, &targ_name); +- (void) gss_release_buffer(&min_stat, &sname); +- (void) gss_release_buffer(&min_stat, &tname); +- + maj_stat = gss_oid_to_str(&min_stat, name_type, &oid_name); + if (maj_stat != GSS_S_COMPLETE) { + display_status("converting oid->string", maj_stat, min_stat); +- return -1; ++ goto cleanup; + } + printf("Name type of source name is %.*s.\n", + (int) oid_name.length, (char *) oid_name.value); +@@ -528,13 +490,13 @@ call_server(host, port, oid, service_name, gss_flags, auth_flag, + mechanism, &mech_names); + if (maj_stat != GSS_S_COMPLETE) { + display_status("inquiring mech names", maj_stat, min_stat); +- return -1; ++ goto cleanup; + } + + maj_stat = gss_oid_to_str(&min_stat, mechanism, &oid_name); + if (maj_stat != GSS_S_COMPLETE) { + display_status("converting oid->string", maj_stat, min_stat); +- return -1; ++ goto cleanup; + } + printf("Mechanism %.*s supports %d names\n", + (int) oid_name.length, (char *) oid_name.value, +@@ -546,7 +508,7 @@ call_server(host, port, oid, service_name, gss_flags, auth_flag, + &mech_names->elements[i], &oid_name); + if (maj_stat != GSS_S_COMPLETE) { + display_status("converting oid->string", maj_stat, min_stat); +- return -1; ++ goto cleanup; + } + printf(" %d: %.*s\n", (int) i, + (int) oid_name.length, (char *) oid_name.value); +@@ -571,10 +533,7 @@ call_server(host, port, oid, service_name, gss_flags, auth_flag, + &in_buf, &state, &out_buf); + if (maj_stat != GSS_S_COMPLETE) { + display_status("wrapping message", maj_stat, min_stat); +- (void) closesocket(s); +- (void) gss_delete_sec_context(&min_stat, &context, +- GSS_C_NO_BUFFER); +- return -1; ++ goto cleanup; + } else if (encrypt_flag && !state) { + fprintf(stderr, "Warning! Message not encrypted.\n"); + } +@@ -588,22 +547,15 @@ call_server(host, port, oid, service_name, gss_flags, auth_flag, + (wrap_flag ? TOKEN_WRAPPED : 0) | + (encrypt_flag ? TOKEN_ENCRYPTED : 0) | + (mic_flag ? TOKEN_SEND_MIC : 0))), +- &out_buf) < 0) { +- (void) closesocket(s); +- (void) gss_delete_sec_context(&min_stat, &context, +- GSS_C_NO_BUFFER); +- return -1; +- } ++ &out_buf) < 0) ++ goto cleanup; ++ + if (out_buf.value != in_buf.value) + (void) gss_release_buffer(&min_stat, &out_buf); + + /* Read signature block into out_buf */ +- if (recv_token(s, &token_flags, &out_buf) < 0) { +- (void) closesocket(s); +- (void) gss_delete_sec_context(&min_stat, &context, +- GSS_C_NO_BUFFER); +- return -1; +- } ++ if (recv_token(s, &token_flags, &out_buf) < 0) ++ goto cleanup; + + if (mic_flag) { + /* Verify signature block */ +@@ -611,10 +563,7 @@ call_server(host, port, oid, service_name, gss_flags, auth_flag, + &out_buf, &qop_state); + if (maj_stat != GSS_S_COMPLETE) { + display_status("verifying signature", maj_stat, min_stat); +- (void) closesocket(s); +- (void) gss_delete_sec_context(&min_stat, &context, +- GSS_C_NO_BUFFER); +- return -1; ++ goto cleanup; + } + + if (verbose) +@@ -634,23 +583,17 @@ call_server(host, port, oid, service_name, gss_flags, auth_flag, + if (!v1_format) + (void) send_token(s, TOKEN_NOOP, empty_token); + +- if (auth_flag) { +- /* Delete context */ +- maj_stat = gss_delete_sec_context(&min_stat, &context, &out_buf); +- if (maj_stat != GSS_S_COMPLETE) { +- display_status("deleting context", maj_stat, min_stat); +- (void) closesocket(s); +- (void) gss_delete_sec_context(&min_stat, &context, +- GSS_C_NO_BUFFER); +- return -1; +- } +- +- (void) gss_release_buffer(&min_stat, &out_buf); +- } +- +- (void) closesocket(s); ++ result = 0; + +- return 0; ++cleanup: ++ (void) gss_release_name(&min_stat, &src_name); ++ (void) gss_release_name(&min_stat, &targ_name); ++ (void) gss_release_buffer(&min_stat, &sname); ++ (void) gss_release_buffer(&min_stat, &tname); ++ (void) gss_delete_sec_context(&min_stat, &context, GSS_C_NO_BUFFER); ++ if (s >= 0) ++ (void) closesocket(s); ++ return result; + } + + static void +diff --git a/src/appl/gss-sample/gss-server.c b/src/appl/gss-sample/gss-server.c +index 9b6ce9ffb3..ce25df8b40 100644 +--- a/src/appl/gss-sample/gss-server.c ++++ b/src/appl/gss-sample/gss-server.c +@@ -138,13 +138,12 @@ server_acquire_creds(char *service_name, gss_OID mech, + } + maj_stat = gss_acquire_cred(&min_stat, server_name, 0, mechs, GSS_C_ACCEPT, + server_creds, NULL, NULL); ++ (void) gss_release_name(&min_stat, &server_name); + if (maj_stat != GSS_S_COMPLETE) { + display_status("acquiring credentials", maj_stat, min_stat); + return -1; + } + +- (void) gss_release_name(&min_stat, &server_name); +- + return 0; + } + +diff --git a/src/clients/klist/klist.c b/src/clients/klist/klist.c +index dcdc5a2d59..43392d2337 100644 +--- a/src/clients/klist/klist.c ++++ b/src/clients/klist/klist.c +@@ -469,20 +469,21 @@ do_ccache() + static int + show_ccache(krb5_ccache cache) + { +- krb5_cc_cursor cur; ++ krb5_cc_cursor cur = NULL; + krb5_creds creds; +- krb5_principal princ; ++ krb5_principal princ = NULL; + krb5_error_code ret; ++ int status = 1; + + ret = krb5_cc_get_principal(context, cache, &princ); + if (ret) { + com_err(progname, ret, ""); +- return 1; ++ goto cleanup; + } + ret = krb5_unparse_name(context, princ, &defname); + if (ret) { + com_err(progname, ret, _("while unparsing principal name")); +- return 1; ++ goto cleanup; + } + + printf(_("Ticket cache: %s:%s\nDefault principal: %s\n\n"), +@@ -498,27 +499,33 @@ show_ccache(krb5_ccache cache) + ret = krb5_cc_start_seq_get(context, cache, &cur); + if (ret) { + com_err(progname, ret, _("while starting to retrieve tickets")); +- return 1; ++ goto cleanup; + } + while ((ret = krb5_cc_next_cred(context, cache, &cur, &creds)) == 0) { + if (show_config || !krb5_is_config_principal(context, creds.server)) + show_credential(&creds); + krb5_free_cred_contents(context, &creds); + } +- krb5_free_principal(context, princ); +- krb5_free_unparsed_name(context, defname); +- defname = NULL; + if (ret == KRB5_CC_END) { + ret = krb5_cc_end_seq_get(context, cache, &cur); ++ cur = NULL; + if (ret) { + com_err(progname, ret, _("while finishing ticket retrieval")); +- return 1; ++ goto cleanup; + } +- return 0; + } else { + com_err(progname, ret, _("while retrieving a ticket")); +- return 1; ++ goto cleanup; + } ++ ++ status = 0; ++ ++cleanup: ++ if (cur != NULL) ++ (void)krb5_cc_end_seq_get(context, cache, &cur); ++ krb5_free_principal(context, princ); ++ krb5_free_unparsed_name(context, defname); ++ return status; + } + + /* Return 0 if cache is accessible, present, and unexpired; return 1 if not. */ +@@ -526,15 +533,18 @@ static int + check_ccache(krb5_ccache cache) + { + krb5_error_code ret; +- krb5_cc_cursor cur; ++ krb5_cc_cursor cur = NULL; + krb5_creds creds; +- krb5_principal princ; +- krb5_boolean found_tgt, found_current_tgt, found_current_cred; ++ krb5_principal princ = NULL; ++ krb5_boolean found_tgt = FALSE, found_current_tgt = FALSE; ++ krb5_boolean found_current_cred = FALSE; + +- if (krb5_cc_get_principal(context, cache, &princ) != 0) +- return 1; +- if (krb5_cc_start_seq_get(context, cache, &cur) != 0) +- return 1; ++ ret = krb5_cc_get_principal(context, cache, &princ); ++ if (ret) ++ goto cleanup; ++ ret = krb5_cc_start_seq_get(context, cache, &cur); ++ if (ret) ++ goto cleanup; + found_tgt = found_current_tgt = found_current_cred = FALSE; + while ((ret = krb5_cc_next_cred(context, cache, &cur, &creds)) == 0) { + if (is_local_tgt(creds.server, &princ->realm)) { +@@ -547,12 +557,17 @@ check_ccache(krb5_ccache cache) + } + krb5_free_cred_contents(context, &creds); + } +- krb5_free_principal(context, princ); + if (ret != KRB5_CC_END) +- return 1; +- if (krb5_cc_end_seq_get(context, cache, &cur) != 0) +- return 1; ++ goto cleanup; ++ ret = krb5_cc_end_seq_get(context, cache, &cur); ++ cur = NULL; + ++cleanup: ++ if (cur != NULL) ++ (void)krb5_cc_end_seq_get(context, cache, &cur); ++ krb5_free_principal(context, princ); ++ if (ret) ++ return 1; + /* If the cache contains at least one local TGT, require that it be + * current. Otherwise accept any current cred. */ + if (found_tgt) +diff --git a/src/clients/ksu/authorization.c b/src/clients/ksu/authorization.c +index fb9d5d0942..6c6a2d007e 100644 +--- a/src/clients/ksu/authorization.c ++++ b/src/clients/ksu/authorization.c +@@ -28,7 +28,17 @@ + + #include "ksu.h" + +-static void auth_cleanup (FILE *, FILE *, char *); ++static void ++free_fcmd_list(char **list) ++{ ++ size_t i; ++ ++ if (list == NULL) ++ return; ++ for (i = 0; i < MAX_CMD && list[i] != NULL; i++) ++ free(list[i]); ++ free(list); ++} + + krb5_boolean fowner(fp, uid) + FILE *fp; +@@ -53,10 +63,10 @@ krb5_boolean fowner(fp, uid) + + /* + * Given a Kerberos principal "principal", and a local username "luser", +- * determine whether user is authorized to login according to the +- * authorization files ~luser/.k5login" and ~luser/.k5users. Returns TRUE +- * if authorized, FALSE if not authorized. +- * ++ * determine whether user is authorized to login according to the authorization ++ * files ~luser/.k5login" and ~luser/.k5users. Set *ok to TRUE if authorized, ++ * FALSE if not authorized. Return 0 if the authorization check succeeded ++ * (regardless of its result), non-zero if it encountered an error. + */ + + krb5_error_code krb5_authorization(context, principal, luser, +@@ -71,7 +81,7 @@ krb5_error_code krb5_authorization(context, principal, luser, + char **out_fcmd; + { + struct passwd *pwd; +- char *princname; ++ char *princname = NULL; + int k5login_flag =0; + int k5users_flag =0; + krb5_boolean retbool =FALSE; +@@ -83,7 +93,7 @@ krb5_error_code krb5_authorization(context, principal, luser, + + /* no account => no access */ + if ((pwd = getpwnam(luser)) == NULL) +- return 0; ++ goto cleanup; + + retval = krb5_unparse_name(context, principal, &princname); + if (retval) +@@ -100,22 +110,19 @@ krb5_error_code krb5_authorization(context, principal, luser, + + /* k5login and k5users must be owned by target user or root */ + if (!k5login_flag){ +- if ((login_fp = fopen(k5login_path, "r")) == NULL) +- return 0; +- if ( fowner(login_fp, pwd->pw_uid) == FALSE) { +- fclose(login_fp); +- return 0; +- } ++ login_fp = fopen(k5login_path, "r"); ++ if (login_fp == NULL) ++ goto cleanup; ++ if (fowner(login_fp, pwd->pw_uid) == FALSE) ++ goto cleanup; + } + + if (!k5users_flag){ +- if ((users_fp = fopen(k5users_path, "r")) == NULL) { +- return 0; +- } +- if ( fowner(users_fp, pwd->pw_uid) == FALSE){ +- fclose(users_fp); +- return 0; +- } ++ users_fp = fopen(k5users_path, "r"); ++ if (users_fp == NULL) ++ goto cleanup; ++ if (fowner(users_fp, pwd->pw_uid) == FALSE) ++ goto cleanup; + } + + if (auth_debug){ +@@ -134,10 +141,8 @@ krb5_error_code krb5_authorization(context, principal, luser, + princname); + + retval = k5login_lookup(login_fp, princname, &retbool); +- if (retval) { +- auth_cleanup(users_fp, login_fp, princname); +- return retval; +- } ++ if (retval) ++ goto cleanup; + if (retbool) { + if (cmd) + *out_fcmd = xstrdup(cmd); +@@ -147,10 +152,8 @@ krb5_error_code krb5_authorization(context, principal, luser, + if ((!k5users_flag) && (retbool == FALSE) ){ + retval = k5users_lookup (users_fp, princname, + cmd, &retbool, out_fcmd); +- if(retval) { +- auth_cleanup(users_fp, login_fp, princname); +- return retval; +- } ++ if (retval) ++ goto cleanup; + } + + if (k5login_flag && k5users_flag){ +@@ -166,8 +169,14 @@ krb5_error_code krb5_authorization(context, principal, luser, + } + + *ok =retbool; +- auth_cleanup(users_fp, login_fp, princname); +- return 0; ++ ++cleanup: ++ if (users_fp != NULL) ++ fclose(users_fp); ++ if (login_fp != NULL) ++ fclose(login_fp); ++ free(princname); ++ return retval; + } + + /*********************************************************** +@@ -334,10 +343,11 @@ krb5_boolean fcmd_resolve(fcmd, out_fcmd, out_err) + char **out_err; + { + char * err; +- char ** tmp_fcmd; ++ char ** tmp_fcmd = NULL; + char * path_ptr, *path; + char * lp, * tc; + int i=0; ++ krb5_boolean ok = FALSE; + + tmp_fcmd = (char **) xcalloc (MAX_CMD, sizeof(char *)); + +@@ -345,7 +355,7 @@ krb5_boolean fcmd_resolve(fcmd, out_fcmd, out_err) + tmp_fcmd[0] = xstrdup(fcmd); + tmp_fcmd[1] = NULL; + *out_fcmd = tmp_fcmd; +- return TRUE; ++ tmp_fcmd = NULL; + }else{ + /* must be either full path or just the cmd name */ + if (strchr(fcmd, '/')){ +@@ -353,7 +363,7 @@ krb5_boolean fcmd_resolve(fcmd, out_fcmd, out_err) + "either full path or just the cmd name\n"), + fcmd, KRB5_USERS_NAME); + *out_err = err; +- return FALSE; ++ goto cleanup; + } + + #ifndef CMD_PATH +@@ -361,7 +371,7 @@ krb5_boolean fcmd_resolve(fcmd, out_fcmd, out_err) + "the cmd name, CMD_PATH must be defined \n"), + fcmd, KRB5_USERS_NAME, fcmd); + *out_err = err; +- return FALSE; ++ goto cleanup; + #else + + path = xstrdup (CMD_PATH); +@@ -375,7 +385,7 @@ krb5_boolean fcmd_resolve(fcmd, out_fcmd, out_err) + asprintf(&err, _("Error: bad entry - %s in %s file, CMD_PATH " + "contains no paths \n"), fcmd, KRB5_USERS_NAME); + *out_err = err; +- return FALSE; ++ goto cleanup; + } + + i=0; +@@ -384,7 +394,7 @@ krb5_boolean fcmd_resolve(fcmd, out_fcmd, out_err) + asprintf(&err, _("Error: bad path %s in CMD_PATH for %s must " + "start with '/' \n"), tc, KRB5_USERS_NAME ); + *out_err = err; +- return FALSE; ++ goto cleanup; + } + + tmp_fcmd[i] = xasprintf("%s/%s", tc, fcmd); +@@ -395,10 +405,15 @@ krb5_boolean fcmd_resolve(fcmd, out_fcmd, out_err) + + tmp_fcmd[i] = NULL; + *out_fcmd = tmp_fcmd; +- return TRUE; +- ++ tmp_fcmd = NULL; + #endif /* CMD_PATH */ + } ++ ++ ok = TRUE; ++ ++cleanup: ++ free_fcmd_list(tmp_fcmd); ++ return ok; + } + + /******************************************** +@@ -524,41 +539,42 @@ int match_commands (fcmd, cmd, match, cmd_out, err_out) + char **cmd_out; + char **err_out; + { +- char ** fcmd_arr; ++ char ** fcmd_arr = NULL; + char * err; + char * cmd_temp; ++ int result = 1; + + if(fcmd_resolve(fcmd, &fcmd_arr, &err )== FALSE ){ + *err_out = err; +- return 1; ++ goto cleanup; + } + + if (cmd_single( cmd ) == TRUE){ + if (!cmd_arr_cmp_postfix(fcmd_arr, cmd)){ /* found */ +- +- if(find_first_cmd_that_exists( fcmd_arr,&cmd_temp,&err)== TRUE){ +- *match = TRUE; +- *cmd_out = cmd_temp; +- return 0; +- }else{ ++ if (!find_first_cmd_that_exists(fcmd_arr, &cmd_temp, &err)) { + *err_out = err; +- return 1; ++ goto cleanup; + } +- }else{ ++ ++ *match = TRUE; ++ *cmd_out = cmd_temp; ++ } else { + *match = FALSE; +- return 0; + } + }else{ + if (!cmd_arr_cmp(fcmd_arr, cmd)){ /* found */ + *match = TRUE; + *cmd_out = xstrdup(cmd); +- return 0; + } else{ + *match = FALSE; +- return 0; + } + } + ++ result = 0; ++ ++cleanup: ++ free_fcmd_list(fcmd_arr); ++ return result; + } + + /********************************************************* +@@ -587,10 +603,7 @@ krb5_error_code get_line (fp, out_line) + } + else { + chunk_count ++; +- if(!( line = (char *) realloc( line, +- chunk_count * sizeof(char) * BUFSIZ))){ +- return ENOMEM; +- } ++ line = xrealloc(line, chunk_count * BUFSIZ); + + line_ptr = line + (BUFSIZ -1) *( chunk_count -1) ; + } +@@ -677,21 +690,8 @@ char * get_next_token (lnext) + return out_ptr; + } + +-static void auth_cleanup(users_fp, login_fp, princname) +- FILE *users_fp; +- FILE *login_fp; +- char *princname; +-{ +- +- free (princname); +- if (users_fp) +- fclose(users_fp); +- if (login_fp) +- fclose(login_fp); +-} +- +-void init_auth_names(pw_dir) +- char *pw_dir; ++void ++init_auth_names(char *pw_dir) + { + const char *sep; + int r1, r2; +diff --git a/src/clients/ksu/ccache.c b/src/clients/ksu/ccache.c +index cbb9aa2b85..45667dd24a 100644 +--- a/src/clients/ksu/ccache.c ++++ b/src/clients/ksu/ccache.c +@@ -40,7 +40,19 @@ copies the default cache into the secondary cache, + + ************************************************************************/ + +-void show_credential(); ++static void ++free_creds_list(krb5_context context, krb5_creds **list) ++{ ++ size_t i; ++ ++ if (list == NULL) ++ return; ++ for (i = 0; list[i]; i++) ++ krb5_free_creds(context, list[i]); ++ free(list); ++} ++ ++void show_credential(krb5_context, krb5_creds *, krb5_ccache); + + /* modifies only the cc_other, the algorithm may look a bit funny, + but I had to do it this way, since remove function did not come +@@ -59,20 +71,19 @@ krb5_error_code krb5_ccache_copy(context, cc_def, target_principal, cc_target, + /* OUT */ + krb5_boolean *stored; + { +- int i=0; + krb5_error_code retval=0; + krb5_creds ** cc_def_creds_arr = NULL; + krb5_creds ** cc_other_creds_arr = NULL; + + if (ks_ccache_is_initialized(context, cc_def)) { +- if((retval = krb5_get_nonexp_tkts(context,cc_def,&cc_def_creds_arr))){ +- return retval; +- } ++ retval = krb5_get_nonexp_tkts(context, cc_def, &cc_def_creds_arr); ++ if (retval) ++ goto cleanup; + } + + retval = krb5_cc_initialize(context, cc_target, target_principal); + if (retval) +- return retval; ++ goto cleanup; + + if (restrict_creds) { + retval = krb5_store_some_creds(context, cc_target, cc_def_creds_arr, +@@ -85,22 +96,9 @@ krb5_error_code krb5_ccache_copy(context, cc_def, target_principal, cc_target, + cc_other_creds_arr); + } + +- if (cc_def_creds_arr){ +- while (cc_def_creds_arr[i]){ +- krb5_free_creds(context, cc_def_creds_arr[i]); +- i++; +- } +- } +- +- i=0; +- +- if(cc_other_creds_arr){ +- while (cc_other_creds_arr[i]){ +- krb5_free_creds(context, cc_other_creds_arr[i]); +- i++; +- } +- } +- ++cleanup: ++ free_creds_list(context, cc_def_creds_arr); ++ free_creds_list(context, cc_other_creds_arr); + return retval; + } + +@@ -198,32 +196,29 @@ krb5_error_code krb5_get_nonexp_tkts(context, cc, creds_array) + { + + krb5_creds creds, temp_tktq, temp_tkt; +- krb5_creds **temp_creds; ++ krb5_creds **temp_creds = NULL; + krb5_error_code retval=0; + krb5_cc_cursor cur; + int count = 0; + int chunk_count = 1; + +- if ( ! ( temp_creds = (krb5_creds **) malloc( CHUNK * sizeof(krb5_creds *)))){ +- return ENOMEM; +- } +- +- ++ temp_creds = xcalloc(CHUNK, sizeof(*temp_creds)); + memset(&temp_tktq, 0, sizeof(temp_tktq)); + memset(&temp_tkt, 0, sizeof(temp_tkt)); + memset(&creds, 0, sizeof(creds)); + + /* initialize the cursor */ +- if ((retval = krb5_cc_start_seq_get(context, cc, &cur))) { +- return retval; +- } ++ retval = krb5_cc_start_seq_get(context, cc, &cur); ++ if (retval) ++ goto cleanup; + + while (!(retval = krb5_cc_next_cred(context, cc, &cur, &creds))){ + + if (!krb5_is_config_principal(context, creds.server) && + (retval = krb5_check_exp(context, creds.times))){ ++ krb5_free_cred_contents(context, &creds); + if (retval != KRB5KRB_AP_ERR_TKT_EXPIRED){ +- return retval; ++ goto cleanup; + } + if (auth_debug){ + fprintf(stderr,"krb5_ccache_copy: CREDS EXPIRED:\n"); +@@ -233,19 +228,19 @@ krb5_error_code krb5_get_nonexp_tkts(context, cc, creds_array) + } + } + else { /* these credentials didn't expire */ +- +- if ((retval = krb5_copy_creds(context, &creds, +- &temp_creds[count]))){ +- return retval; +- } ++ retval = krb5_copy_creds(context, &creds, &temp_creds[count]); ++ krb5_free_cred_contents(context, &creds); ++ temp_creds[count+1] = NULL; ++ if (retval) ++ goto cleanup; + count ++; + + if (count == (chunk_count * CHUNK -1)){ + chunk_count ++; +- if (!(temp_creds = (krb5_creds **) realloc(temp_creds, +- chunk_count * CHUNK * sizeof(krb5_creds *)))){ +- return ENOMEM; +- } ++ ++ temp_creds = xrealloc(temp_creds, ++ chunk_count * CHUNK * ++ sizeof(*temp_creds)); + } + } + +@@ -253,13 +248,15 @@ krb5_error_code krb5_get_nonexp_tkts(context, cc, creds_array) + + temp_creds[count] = NULL; + *creds_array = temp_creds; ++ temp_creds = NULL; + + if (retval == KRB5_CC_END) { + retval = krb5_cc_end_seq_get(context, cc, &cur); + } + ++cleanup: ++ free_creds_list(context, temp_creds); + return retval; +- + } + + +@@ -331,97 +328,6 @@ void printtime(krb5_timestamp ts) + printf("%s", fmtbuf); + } + +- +-krb5_error_code +-krb5_get_login_princ(luser, princ_list) +- const char *luser; +- char ***princ_list; +-{ +- struct stat sbuf; +- struct passwd *pwd; +- char pbuf[MAXPATHLEN]; +- FILE *fp; +- char * linebuf; +- char *newline; +- int gobble, result; +- char ** buf_out; +- struct stat st_temp; +- int count = 0, chunk_count = 1; +- +- /* no account => no access */ +- +- if ((pwd = getpwnam(luser)) == NULL) { +- return 0; +- } +- result = snprintf(pbuf, sizeof(pbuf), "%s/.k5login", pwd->pw_dir); +- if (SNPRINTF_OVERFLOW(result, sizeof(pbuf))) { +- fprintf(stderr, _("home directory path for %s too long\n"), luser); +- exit (1); +- } +- +- if (stat(pbuf, &st_temp)) { /* not accessible */ +- return 0; +- } +- +- +- /* open ~/.k5login */ +- if ((fp = fopen(pbuf, "r")) == NULL) { +- return 0; +- } +- /* +- * For security reasons, the .k5login file must be owned either by +- * the user himself, or by root. Otherwise, don't grant access. +- */ +- if (fstat(fileno(fp), &sbuf)) { +- fclose(fp); +- return 0; +- } +- if ((sbuf.st_uid != pwd->pw_uid) && sbuf.st_uid) { +- fclose(fp); +- return 0; +- } +- +- /* check each line */ +- +- +- if( !(linebuf = (char *) calloc (BUFSIZ, sizeof(char)))) return ENOMEM; +- +- if (!(buf_out = (char **) malloc( CHUNK * sizeof(char *)))) return ENOMEM; +- +- while ( fgets(linebuf, BUFSIZ, fp) != NULL) { +- /* null-terminate the input string */ +- linebuf[BUFSIZ-1] = '\0'; +- newline = NULL; +- /* nuke the newline if it exists */ +- if ((newline = strchr(linebuf, '\n'))) +- *newline = '\0'; +- +- buf_out[count] = linebuf; +- count ++; +- +- if (count == (chunk_count * CHUNK -1)){ +- chunk_count ++; +- if (!(buf_out = (char **) realloc(buf_out, +- chunk_count * CHUNK * sizeof(char *)))){ +- return ENOMEM; +- } +- } +- +- /* clean up the rest of the line if necessary */ +- if (!newline) +- while (((gobble = getc(fp)) != EOF) && gobble != '\n'); +- +- if( !(linebuf = (char *) calloc (BUFSIZ, sizeof(char)))) return ENOMEM; +- } +- +- buf_out[count] = NULL; +- *princ_list = buf_out; +- fclose(fp); +- return 0; +-} +- +- +- + void + show_credential(context, cred, cc) + krb5_context context; +@@ -429,31 +335,29 @@ show_credential(context, cred, cc) + krb5_ccache cc; + { + krb5_error_code retval; +- char *name, *sname, *flags; ++ char *name = NULL, *sname = NULL, *defname = NULL, *flags; + int first = 1; +- krb5_principal princ; +- char * defname; ++ krb5_principal princ = NULL; + int show_flags =1; + + retval = krb5_unparse_name(context, cred->client, &name); + if (retval) { + com_err(prog_name, retval, _("while unparsing client name")); +- return; ++ goto cleanup; + } + retval = krb5_unparse_name(context, cred->server, &sname); + if (retval) { + com_err(prog_name, retval, _("while unparsing server name")); +- free(name); +- return; ++ goto cleanup; + } + + if ((retval = krb5_cc_get_principal(context, cc, &princ))) { + com_err(prog_name, retval, _("while retrieving principal name")); +- return; ++ goto cleanup; + } + if ((retval = krb5_unparse_name(context, princ, &defname))) { + com_err(prog_name, retval, _("while unparsing principal name")); +- return; ++ goto cleanup; + } + + if (!cred->times.starttime) +@@ -491,8 +395,12 @@ show_credential(context, cred, cc) + } + } + putchar('\n'); ++ ++cleanup: + free(name); + free(sname); ++ free(defname); ++ krb5_free_principal(context, princ); + } + + /* Create a random string suitable for a filename extension. */ +@@ -526,37 +434,26 @@ krb5_error_code krb5_ccache_overwrite(context, ccs, cct, primary_principal) + krb5_principal primary_principal; + { + krb5_error_code retval=0; +- krb5_principal temp_principal; ++ krb5_principal defprinc = NULL, princ; + krb5_creds ** ccs_creds_arr = NULL; +- int i=0; + + if (ks_ccache_is_initialized(context, ccs)) { +- if ((retval = krb5_get_nonexp_tkts(context, ccs, &ccs_creds_arr))){ +- return retval; +- } ++ retval = krb5_get_nonexp_tkts(context, ccs, &ccs_creds_arr); ++ if (retval) ++ goto cleanup; + } + +- if (ks_ccache_is_initialized(context, cct)) { +- if ((retval = krb5_cc_get_principal(context, cct, &temp_principal))){ +- return retval; +- } +- }else{ +- temp_principal = primary_principal; +- } +- +- if ((retval = krb5_cc_initialize(context, cct, temp_principal))){ +- return retval; +- } ++ retval = krb5_cc_get_principal(context, cct, &defprinc); ++ princ = (retval == 0) ? defprinc : primary_principal; ++ retval = krb5_cc_initialize(context, cct, princ); ++ if (retval) ++ goto cleanup; + + retval = krb5_store_all_creds(context, cct, ccs_creds_arr, NULL); + +- if (ccs_creds_arr){ +- while (ccs_creds_arr[i]){ +- krb5_free_creds(context, ccs_creds_arr[i]); +- i++; +- } +- } +- ++cleanup: ++ free_creds_list(context, ccs_creds_arr); ++ krb5_free_principal(context, defprinc); + return retval; + } + +@@ -616,45 +513,40 @@ krb5_error_code krb5_ccache_filter (context, cc, prst) + krb5_principal prst; + { + +- int i=0; + krb5_error_code retval=0; +- krb5_principal temp_principal; ++ krb5_principal temp_principal = NULL; + krb5_creds ** cc_creds_arr = NULL; + const char * cc_name; + krb5_boolean stored; + +- cc_name = krb5_cc_get_name(context, cc); ++ if (!ks_ccache_is_initialized(context, cc)) ++ return 0; + +- if (ks_ccache_is_initialized(context, cc)) { +- if (auth_debug) { +- fprintf(stderr,"putting cache %s through a filter for -z option\n", cc_name); +- } ++ if (auth_debug) { ++ cc_name = krb5_cc_get_name(context, cc); ++ fprintf(stderr, "putting cache %s through a filter for -z option\n", ++ cc_name); ++ } + +- if ((retval = krb5_get_nonexp_tkts(context, cc, &cc_creds_arr))){ +- return retval; +- } ++ retval = krb5_get_nonexp_tkts(context, cc, &cc_creds_arr); ++ if (retval) ++ goto cleanup; + +- if ((retval = krb5_cc_get_principal(context, cc, &temp_principal))){ +- return retval; +- } ++ retval = krb5_cc_get_principal(context, cc, &temp_principal); ++ if (retval) ++ goto cleanup; + +- if ((retval = krb5_cc_initialize(context, cc, temp_principal))){ +- return retval; +- } ++ retval = krb5_cc_initialize(context, cc, temp_principal); ++ if (retval) ++ goto cleanup; + +- if ((retval = krb5_store_some_creds(context, cc, cc_creds_arr, +- NULL, prst, &stored))){ +- return retval; +- } ++ retval = krb5_store_some_creds(context, cc, cc_creds_arr, NULL, prst, ++ &stored); + +- if (cc_creds_arr){ +- while (cc_creds_arr[i]){ +- krb5_free_creds(context, cc_creds_arr[i]); +- i++; +- } +- } +- } +- return 0; ++cleanup: ++ free_creds_list(context, cc_creds_arr); ++ krb5_free_principal(context, temp_principal); ++ return retval; + } + + krb5_boolean krb5_find_princ_in_cred_list (context, creds_list, princ) +@@ -688,17 +580,20 @@ krb5_error_code krb5_find_princ_in_cache (context, cc, princ, found) + krb5_principal princ; + krb5_boolean *found; + { +- krb5_error_code retval; ++ krb5_error_code retval = 0; + krb5_creds ** creds_list = NULL; + + if (ks_ccache_is_initialized(context, cc)) { +- if ((retval = krb5_get_nonexp_tkts(context, cc, &creds_list))){ +- return retval; +- } ++ retval = krb5_get_nonexp_tkts(context, cc, &creds_list); ++ if (retval) ++ goto cleanup; + } + + *found = krb5_find_princ_in_cred_list(context, creds_list, princ); +- return 0; ++ ++cleanup: ++ free_creds_list(context, creds_list); ++ return retval; + } + + krb5_boolean +diff --git a/src/clients/ksu/heuristic.c b/src/clients/ksu/heuristic.c +index 4f7280f4cb..47baa785e5 100644 +--- a/src/clients/ksu/heuristic.c ++++ b/src/clients/ksu/heuristic.c +@@ -156,28 +156,31 @@ filter(fp, cmd, k5users_list, k5users_filt_list) + + *k5users_filt_list = NULL; + +- if (! k5users_list){ ++ if (k5users_list == NULL) + return 0; +- } + + while(k5users_list[i]){ ++ free(out_cmd); ++ out_cmd = NULL; + + retval= k5users_lookup(fp, k5users_list[i], cmd, &found, &out_cmd); + if (retval) +- return retval; ++ goto cleanup; + + if (found == FALSE){ + free (k5users_list[i]); + k5users_list[i] = NULL; +- if (out_cmd) gb_err = out_cmd; ++ if (out_cmd) { ++ gb_err = out_cmd; ++ out_cmd = NULL; ++ } + } else + found_count ++; + + i++; + } + +- if (! (temp_filt_list = (char **) calloc(found_count +1, sizeof (char*)))) +- return ENOMEM; ++ temp_filt_list = xcalloc(found_count + 1, sizeof(*temp_filt_list)); + + for(j= 0, k=0; j < i; j++ ) { + if (k5users_list[j]){ +@@ -191,7 +194,10 @@ filter(fp, cmd, k5users_list, k5users_filt_list) + free (k5users_list); + + *k5users_filt_list = temp_filt_list; +- return 0; ++ ++cleanup: ++ free(out_cmd); ++ return retval; + } + + krb5_error_code +@@ -335,7 +341,7 @@ krb5_error_code get_closest_principal(context, plist, client, found) + + retval = krb5_parse_name(context, plist[i], &temp_client); + if (retval) +- return retval; ++ goto cleanup; + + pnelem = krb5_princ_size(context, temp_client); + +@@ -363,6 +369,7 @@ krb5_error_code get_closest_principal(context, plist, client, found) + if(best_client){ + if(krb5_princ_size(context, best_client) > + krb5_princ_size(context, temp_client)){ ++ krb5_free_principal(context, best_client); + best_client = temp_client; + } + }else +@@ -375,9 +382,12 @@ krb5_error_code get_closest_principal(context, plist, client, found) + if (best_client) { + *found = TRUE; + *client = best_client; ++ best_client = NULL; + } + +- return 0; ++cleanup: ++ krb5_free_principal(context, best_client); ++ return retval; + } + + /**************************************************************** +@@ -499,6 +509,7 @@ krb5_error_code find_princ_in_list (context, princ, plist, found) + i++; + } + ++ free(princname); + return 0; + + } +@@ -534,11 +545,9 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, + { + + princ_info princ_trials[10]; +- krb5_principal cc_def_princ = NULL; +- krb5_principal temp_client; +- krb5_principal target_client; +- krb5_principal source_client; +- krb5_principal end_server; ++ krb5_principal cc_def_princ = NULL, temp_client = NULL; ++ krb5_principal target_client = NULL, source_client = NULL; ++ krb5_principal end_server = NULL; + krb5_error_code retval; + char ** aplist =NULL; + krb5_boolean found = FALSE; +@@ -555,54 +564,59 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, + if (ks_ccache_is_initialized(context, cc_source)) { + retval = krb5_cc_get_principal(context, cc_source, &cc_def_princ); + if (retval) +- return retval; ++ goto cleanup; + } + + retval=krb5_parse_name(context, target_user, &target_client); + if (retval) +- return retval; ++ goto cleanup; + + retval=krb5_parse_name(context, source_user, &source_client); + if (retval) +- return retval; ++ goto cleanup; + +- if (source_uid == 0){ +- if (target_uid != 0) +- *client = target_client; /* this will be used to restrict +- the cache copty */ +- else { +- if(cc_def_princ) +- *client = cc_def_princ; +- else +- *client = target_client; ++ if (source_uid == 0) { ++ if (target_uid != 0) { ++ /* This will be used to restrict the cache copy. */ ++ *client = target_client; ++ target_client = NULL; ++ } else if (cc_def_princ != NULL) { ++ *client = cc_def_princ; ++ cc_def_princ = NULL; ++ } else { ++ *client = target_client; ++ target_client = NULL; + } +- + if (auth_debug) + printf(" GET_best_princ_for_target: via source_uid == 0\n"); +- +- return 0; ++ goto cleanup; + } + + /* from here on, the code is for source_uid != 0 */ + + if (source_uid && (source_uid == target_uid)){ +- if(cc_def_princ) ++ if (cc_def_princ != NULL) { + *client = cc_def_princ; +- else ++ cc_def_princ = NULL; ++ } else { + *client = target_client; ++ target_client = NULL; ++ } + if (auth_debug) + printf("GET_best_princ_for_target: via source_uid == target_uid\n"); +- return 0; ++ goto cleanup; + } + + /* Become root, then target for looking at .k5login.*/ + if (krb5_seteuid(0) || krb5_seteuid(target_uid) ) { +- return errno; ++ retval = errno; ++ goto cleanup; + } + + /* if .k5users and .k5login do not exist */ + if (stat(k5login_path, &tb) && stat(k5users_path, &tb) ){ + *client = target_client; ++ target_client = NULL; + + if (cmd) + *path_out = NOT_AUTHORIZED; +@@ -610,26 +624,25 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, + if (auth_debug) + printf(" GET_best_princ_for_target: via no auth files path\n"); + +- return 0; ++ goto cleanup; + }else{ + retval = get_authorized_princ_names(target_user, cmd, &aplist); + if (retval) +- return retval; ++ goto cleanup; + + /* .k5users or .k5login exist, but no authorization */ + if ((!aplist) || (!aplist[0])) { + *path_out = NOT_AUTHORIZED; + if (auth_debug) + printf("GET_best_princ_for_target: via empty auth files path\n"); +- return 0; ++ goto cleanup; + } + } + + retval = krb5_sname_to_principal(context, hostname, NULL, + KRB5_NT_SRV_HST, &end_server); + if (retval) +- return retval; +- ++ goto cleanup; + + /* first see if default principal of the source cache + * can get us in, then the target_user@realm, then the +@@ -652,7 +665,7 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, + retval= find_princ_in_list(context, princ_trials[i].p, aplist, + &found); + if (retval) +- return retval; ++ goto cleanup; + + if (found == TRUE){ + princ_trials[i].found = TRUE; +@@ -661,12 +674,13 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, + princ_trials[i].p, + end_server, &found); + if (retval) +- return retval; ++ goto cleanup; + if (found == TRUE){ +- *client = princ_trials[i].p; ++ retval = krb5_copy_principal(context, princ_trials[i].p, ++ client); + if (auth_debug) + printf("GET_best_princ_for_target: via ticket file, choice #%d\n", i); +- return 0; ++ goto cleanup; + } + } + } +@@ -679,21 +693,23 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, + while (aplist[i]){ + retval = krb5_parse_name(context, aplist[i], &temp_client); + if (retval) +- return retval; ++ goto cleanup; + + retval = find_either_ticket (context, cc_source, temp_client, + end_server, &found); + if (retval) +- return retval; ++ goto cleanup; + + if (found == TRUE){ + if (auth_debug) + printf("GET_best_princ_for_target: via ticket file, choice: any ok ticket \n" ); + *client = temp_client; +- return 0; ++ temp_client = NULL; ++ goto cleanup; + } + + krb5_free_principal(context, temp_client); ++ temp_client = NULL; + + i++; + } +@@ -704,11 +720,11 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, + + for (i=0; i < count; i ++){ + if (princ_trials[i].found == TRUE){ +- *client = princ_trials[i].p; ++ retval = krb5_copy_principal(context, princ_trials[i].p, client); + + if (auth_debug) + printf("GET_best_princ_for_target: via prompt passwd list choice #%d \n",i); +- return 0; ++ goto cleanup; + } + } + +@@ -718,7 +734,7 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, + retval=krb5_copy_principal(context, princ_trials[i].p, + &temp_client); + if(retval) +- return retval; ++ goto cleanup; + + /* get the client name that is the closest + to the three princ in trials */ +@@ -726,15 +742,15 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, + retval=get_closest_principal(context, aplist, &temp_client, + &found); + if(retval) +- return retval; ++ goto cleanup; + + if (found == TRUE){ + *client = temp_client; ++ temp_client = NULL; + if (auth_debug) + printf("GET_best_princ_for_target: via prompt passwd list choice: approximation of princ in trials # %d \n",i); +- return 0; ++ goto cleanup; + } +- krb5_free_principal(context, temp_client); + } + } + +@@ -745,5 +761,13 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, + printf( "GET_best_princ_for_target: out of luck, can't get appropriate default principal\n"); + + *path_out = NOT_AUTHORIZED; +- return 0; ++ retval = 0; ++ ++cleanup: ++ krb5_free_principal(context, cc_def_princ); ++ krb5_free_principal(context, target_client); ++ krb5_free_principal(context, source_client); ++ krb5_free_principal(context, temp_client); ++ krb5_free_principal(context, end_server); ++ return retval; + } +diff --git a/src/clients/ksu/krb_auth_su.c b/src/clients/ksu/krb_auth_su.c +index fb848dcab1..a99c4c826c 100644 +--- a/src/clients/ksu/krb_auth_su.c ++++ b/src/clients/ksu/krb_auth_su.c +@@ -42,33 +42,31 @@ krb5_boolean krb5_auth_check(context, client_pname, hostname, options, + krb5_ccache cc; + int *path_passwd; + { +- krb5_principal client; ++ krb5_principal client = NULL; + krb5_verify_init_creds_opt vfy_opts; +- krb5_creds tgt, tgtq; ++ krb5_creds tgt = { 0 }, tgtq = { 0 }; + krb5_error_code retval =0; + int got_it = 0; + krb5_boolean zero_password; ++ krb5_boolean ok = FALSE; + + *path_passwd = 0; +- memset(&tgtq, 0, sizeof(tgtq)); +- memset(&tgt, 0, sizeof(tgt)); + + if ((retval= krb5_copy_principal(context, client_pname, &client))){ + com_err(prog_name, retval, _("while copying client principal")); +- return (FALSE) ; ++ goto cleanup; + } + + if ((retval= krb5_copy_principal(context, client, &tgtq.client))){ + com_err(prog_name, retval, _("while copying client principal")); +- return (FALSE) ; ++ goto cleanup; + } + + if ((retval = ksu_tgtname(context, krb5_princ_realm(context, client), + krb5_princ_realm(context, client), + &tgtq.server))){ + com_err(prog_name, retval, _("while creating tgt for local realm")); +- krb5_free_principal(context, client); +- return (FALSE) ; ++ goto cleanup; + } + + if (auth_debug){ dump_principal(context, "local tgt principal name", tgtq.server ); } +@@ -82,7 +80,7 @@ krb5_boolean krb5_auth_check(context, client_pname, hostname, options, + if ((retval != KRB5_CC_NOTFOUND) && + (retval != KRB5KRB_AP_ERR_TKT_EXPIRED)){ + com_err(prog_name, retval, _("while retrieving creds from cache")); +- return (FALSE) ; ++ goto cleanup; + } + } else{ + got_it = 1; +@@ -93,7 +91,7 @@ krb5_boolean krb5_auth_check(context, client_pname, hostname, options, + #ifdef GET_TGT_VIA_PASSWD + if (krb5_seteuid(0)||krb5_seteuid(target_uid)) { + com_err("ksu", errno, _("while switching to target uid")); +- return FALSE; ++ goto cleanup; + } + + +@@ -107,19 +105,19 @@ krb5_boolean krb5_auth_check(context, client_pname, hostname, options, + &tgt) == FALSE) { + krb5_seteuid(0); + +- return FALSE; ++ goto cleanup; + } + *path_passwd = 1; + if (krb5_seteuid(0)) { + com_err("ksu", errno, _("while reclaiming root uid")); +- return FALSE; ++ goto cleanup; + } + + #else + plain_dump_principal (context, client); + fprintf(stderr, + _("does not have any appropriate tickets in the cache.\n")); +- return FALSE; ++ goto cleanup; + + #endif /* GET_TGT_VIA_PASSWD */ + +@@ -131,10 +129,16 @@ krb5_boolean krb5_auth_check(context, client_pname, hostname, options, + &vfy_opts); + if (retval) { + com_err(prog_name, retval, _("while verifying ticket for server")); +- return (FALSE); ++ goto cleanup; + } + +- return (TRUE); ++ ok = TRUE; ++ ++cleanup: ++ krb5_free_principal(context, client); ++ krb5_free_cred_contents(context, &tgt); ++ krb5_free_cred_contents(context, &tgtq); ++ return ok; + } + + krb5_boolean ksu_get_tgt_via_passwd(context, client, options, zero_password, +@@ -145,11 +149,12 @@ krb5_boolean ksu_get_tgt_via_passwd(context, client, options, zero_password, + krb5_boolean *zero_password; + krb5_creds *creds_out; + { ++ krb5_boolean ok = FALSE; + krb5_error_code code; +- krb5_creds creds; ++ krb5_creds creds = { 0 }; + krb5_timestamp now; + unsigned int pwsize; +- char password[255], *client_name, prompt[255]; ++ char password[255], prompt[255], *client_name = NULL; + int result; + + *zero_password = FALSE; +@@ -158,14 +163,14 @@ krb5_boolean ksu_get_tgt_via_passwd(context, client, options, zero_password, + + if ((code = krb5_unparse_name(context, client, &client_name))) { + com_err (prog_name, code, _("when unparsing name")); +- return (FALSE); ++ goto cleanup; + } + + memset(&creds, 0, sizeof(creds)); + + if ((code = krb5_timeofday(context, &now))) { + com_err(prog_name, code, _("while getting time of day")); +- return (FALSE); ++ goto cleanup; + } + + result = snprintf(prompt, sizeof(prompt), _("Kerberos password for %s: "), +@@ -174,7 +179,7 @@ krb5_boolean ksu_get_tgt_via_passwd(context, client, options, zero_password, + fprintf(stderr, + _("principal name %s too long for internal buffer space\n"), + client_name); +- return FALSE; ++ goto cleanup; + } + + pwsize = sizeof(password); +@@ -183,13 +188,13 @@ krb5_boolean ksu_get_tgt_via_passwd(context, client, options, zero_password, + if (code ) { + com_err(prog_name, code, _("while reading password for '%s'\n"), + client_name); +- return (FALSE); ++ goto cleanup; + } + + if ( pwsize == 0) { + fprintf(stderr, _("No password given\n")); + *zero_password = TRUE; +- return (FALSE); ++ goto cleanup; + } + + code = krb5_get_init_creds_password(context, &creds, client, password, +@@ -203,13 +208,19 @@ krb5_boolean ksu_get_tgt_via_passwd(context, client, options, zero_password, + fprintf(stderr, _("%s: Password incorrect\n"), prog_name); + else + com_err(prog_name, code, _("while getting initial credentials")); +- return (FALSE); ++ goto cleanup; + } +- if (creds_out != NULL) ++ if (creds_out != NULL) { + *creds_out = creds; +- else +- krb5_free_cred_contents(context, &creds); +- return (TRUE); ++ memset(&creds, 0, sizeof(creds)); ++ } ++ ++ ok = TRUE; ++ ++cleanup: ++ krb5_free_cred_contents(context, &creds); ++ free(client_name); ++ return ok; + } + + +@@ -224,8 +235,10 @@ void dump_principal (context, str, p) + if ((retval = krb5_unparse_name(context, p, &stname))) { + fprintf(stderr, _(" %s while unparsing name\n"), + error_message(retval)); ++ return; + } + fprintf(stderr, " %s: %s\n", str, stname); ++ free(stname); + } + + void plain_dump_principal (context, p) +@@ -238,74 +251,8 @@ void plain_dump_principal (context, p) + if ((retval = krb5_unparse_name(context, p, &stname))) { + fprintf(stderr, _(" %s while unparsing name\n"), + error_message(retval)); ++ return; + } + fprintf(stderr, "%s ", stname); +-} +- +- +-/********************************************************************** +-returns the principal that is closest to client. plist contains +-a principal list obtained from .k5login and parhaps .k5users file. +-This routine gets called before getting the password for a tgt. +-A principal is picked that has the best chance of getting in. +- +-**********************************************************************/ +- +- +-krb5_error_code get_best_principal(context, plist, client) +- krb5_context context; +- char **plist; +- krb5_principal *client; +-{ +- krb5_error_code retval =0; +- krb5_principal temp_client, best_client = NULL; +- +- int i = 0, nelem; +- +- if (! plist ) return 0; +- +- nelem = krb5_princ_size(context, *client); +- +- while(plist[i]){ +- +- if ((retval = krb5_parse_name(context, plist[i], &temp_client))){ +- return retval; +- } +- +- if (data_eq(*krb5_princ_realm(context, *client), +- *krb5_princ_realm(context, temp_client))) { +- +- if (nelem && +- krb5_princ_size(context, *client) > 0 && +- krb5_princ_size(context, temp_client) > 0) { +- krb5_data *p1 = +- krb5_princ_component(context, *client, 0); +- krb5_data *p2 = +- krb5_princ_component(context, temp_client, 0); +- +- if (data_eq(*p1, *p2)) { +- +- if (auth_debug){ +- fprintf(stderr, +- "get_best_principal: compare with %s\n", +- plist[i]); +- } +- +- if(best_client){ +- if(krb5_princ_size(context, best_client) > +- krb5_princ_size(context, temp_client)){ +- best_client = temp_client; +- } +- }else{ +- best_client = temp_client; +- } +- } +- } +- +- } +- i++; +- } +- +- if (best_client) *client = best_client; +- return 0; ++ free(stname); + } +diff --git a/src/clients/ksu/ksu.h b/src/clients/ksu/ksu.h +index 66fb4bcc6a..32ce11cb85 100644 +--- a/src/clients/ksu/ksu.h ++++ b/src/clients/ksu/ksu.h +@@ -92,9 +92,6 @@ extern void plain_dump_principal + extern krb5_error_code krb5_parse_lifetime + (char *, long *); + +-extern krb5_error_code get_best_principal +-(krb5_context, char **, krb5_principal *); +- + /* ccache.c */ + extern krb5_error_code krb5_ccache_copy + (krb5_context, krb5_ccache, krb5_principal, krb5_ccache, +@@ -117,9 +114,6 @@ extern krb5_error_code krb5_check_exp + + extern char *flags_string (krb5_creds *); + +-extern krb5_error_code krb5_get_login_princ +-(const char *, char ***); +- + extern void show_credential + (krb5_context, krb5_creds *, krb5_ccache); + +diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c +index 931f054041..a7cb7ed3be 100644 +--- a/src/clients/ksu/main.c ++++ b/src/clients/ksu/main.c +@@ -1003,7 +1003,7 @@ resolve_target_cache(krb5_context context, krb5_principal princ, + if (retval) { + com_err(prog_name, retval, + _("while generating part of the target ccache name")); +- return retval; ++ goto cleanup; + } + if (asprintf(&ccname, "%s.%s", target, sym) < 0) { + retval = ENOMEM; +@@ -1015,6 +1015,7 @@ resolve_target_cache(krb5_context context, krb5_principal princ, + free(sym); + } while (ks_ccache_name_is_initialized(context, ccname)); + retval = krb5_cc_resolve(context, ccname, &ccache); ++ free(ccname); + } else { + /* Look for a cache in the collection that we can reuse. */ + retval = krb5_cc_cache_match(context, princ, &ccache); +diff --git a/src/kadmin/cli/keytab.c b/src/kadmin/cli/keytab.c +index b0c8378b40..8a59188216 100644 +--- a/src/kadmin/cli/keytab.c ++++ b/src/kadmin/cli/keytab.c +@@ -363,7 +363,7 @@ remove_principal(char *keytab_str, krb5_keytab keytab, + { + krb5_principal princ = NULL; + krb5_keytab_entry entry; +- krb5_kt_cursor cursor; ++ krb5_kt_cursor cursor = NULL; + enum { UNDEF, SPEC, HIGH, ALL, OLD } mode; + int code, did_something; + krb5_kvno kvno; +@@ -443,6 +443,7 @@ remove_principal(char *keytab_str, krb5_keytab keytab, + _("while temporarily ending keytab scan")); + goto cleanup; + } ++ cursor = NULL; + code = krb5_kt_remove_entry(context, keytab, &entry); + if (code != 0) { + com_err(whoami, code, _("while deleting entry from keytab")); +@@ -471,6 +472,7 @@ remove_principal(char *keytab_str, krb5_keytab keytab, + com_err(whoami, code, _("while ending keytab scan")); + goto cleanup; + } ++ cursor = NULL; + + /* + * If !did_someting then mode must be OLD or we would have +@@ -483,6 +485,8 @@ remove_principal(char *keytab_str, krb5_keytab keytab, + } + + cleanup: ++ if (cursor != NULL) ++ (void)krb5_kt_end_seq_get(context, keytab, &cursor); + krb5_free_principal(context, princ); + } + +diff --git a/src/kadmin/ktutil/ktutil.c b/src/kadmin/ktutil/ktutil.c +index 92d7023a4f..782c7289c5 100644 +--- a/src/kadmin/ktutil/ktutil.c ++++ b/src/kadmin/ktutil/ktutil.c +@@ -263,6 +263,7 @@ void ktutil_list(argc, argv) + buf, sizeof(buf)))) { + com_err(argv[0], retval, + _("While converting enctype to string")); ++ free(pname); + return; + } + printf(" (%s) ", buf); +diff --git a/src/kprop/kpropd.c b/src/kprop/kpropd.c +index cb9785aaeb..286b3a655e 100644 +--- a/src/kprop/kpropd.c ++++ b/src/kprop/kpropd.c +@@ -1300,19 +1300,20 @@ static krb5_boolean + authorized_principal(krb5_context context, krb5_principal p, + krb5_enctype auth_etype) + { +- char *name, *ptr, buf[1024]; ++ krb5_boolean ok = FALSE; ++ char *name = NULL, *ptr, buf[1024]; + krb5_error_code retval; +- FILE *acl_file; ++ FILE *acl_file = NULL; + int end; + krb5_enctype acl_etype; + + retval = krb5_unparse_name(context, p, &name); + if (retval) +- return FALSE; ++ goto cleanup; + + acl_file = fopen(acl_file_name, "r"); + if (acl_file == NULL) +- return FALSE; ++ goto cleanup; + + while (!feof(acl_file)) { + if (!fgets(buf, sizeof(buf), acl_file)) +@@ -1342,14 +1343,16 @@ authorized_principal(krb5_context context, krb5_principal p, + (acl_etype != auth_etype))) + continue; + +- free(name); +- fclose(acl_file); +- return TRUE; ++ ok = TRUE; ++ goto cleanup; + } + } ++ ++cleanup: + free(name); +- fclose(acl_file); +- return FALSE; ++ if (acl_file != NULL) ++ fclose(acl_file); ++ return ok; + } + + static void +diff --git a/src/lib/gssapi/krb5/export_cred.c b/src/lib/gssapi/krb5/export_cred.c +index 96a408c237..bf5cede54a 100644 +--- a/src/lib/gssapi/krb5/export_cred.c ++++ b/src/lib/gssapi/krb5/export_cred.c +@@ -447,8 +447,10 @@ krb5_gss_export_cred(OM_uint32 *minor_status, gss_cred_id_t cred_handle, + + /* Validate and lock cred_handle. */ + status = krb5_gss_validate_cred_1(minor_status, cred_handle, context); +- if (status != GSS_S_COMPLETE) ++ if (status != GSS_S_COMPLETE) { ++ krb5_free_context(context); + return status; ++ } + cred = (krb5_gss_cred_id_t)cred_handle; + + if (json_kgcred(context, cred, &jcred)) +diff --git a/src/lib/gssapi/krb5/val_cred.c b/src/lib/gssapi/krb5/val_cred.c +index cb1cb9393a..87a46cd533 100644 +--- a/src/lib/gssapi/krb5/val_cred.c ++++ b/src/lib/gssapi/krb5/val_cred.c +@@ -35,6 +35,7 @@ krb5_gss_validate_cred_1(OM_uint32 *minor_status, gss_cred_id_t cred_handle, + krb5_gss_cred_id_t cred; + krb5_error_code code; + krb5_principal princ; ++ krb5_boolean same; + + cred = (krb5_gss_cred_id_t) cred_handle; + k5_mutex_lock(&cred->lock); +@@ -45,12 +46,13 @@ krb5_gss_validate_cred_1(OM_uint32 *minor_status, gss_cred_id_t cred_handle, + *minor_status = code; + return(GSS_S_DEFECTIVE_CREDENTIAL); + } +- if (!krb5_principal_compare(context, princ, cred->name->princ)) { ++ same = krb5_principal_compare(context, princ, cred->name->princ); ++ (void)krb5_free_principal(context, princ); ++ if (!same) { + k5_mutex_unlock(&cred->lock); + *minor_status = KG_CCACHE_NOMATCH; + return(GSS_S_DEFECTIVE_CREDENTIAL); + } +- (void)krb5_free_principal(context, princ); + } + *minor_status = 0; + return GSS_S_COMPLETE; +diff --git a/src/lib/kadm5/srv/server_kdb.c b/src/lib/kadm5/srv/server_kdb.c +index 2ec80a0f2b..4efcaf9941 100644 +--- a/src/lib/kadm5/srv/server_kdb.c ++++ b/src/lib/kadm5/srv/server_kdb.c +@@ -67,11 +67,10 @@ krb5_error_code kdb_init_master(kadm5_server_handle_t handle, + if (ret) + goto done; + +- if ((ret = krb5_db_fetch_mkey_list(handle->context, master_princ, +- &master_keyblock))) { ++ ret = krb5_db_fetch_mkey_list(handle->context, master_princ, ++ &master_keyblock); ++ if (ret) + krb5_db_fini(handle->context); +- return (ret); +- } + + done: + if (r == NULL) +diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c +index c93e7c78e5..1f917d49bb 100644 +--- a/src/lib/krb5/ccache/cc_kcm.c ++++ b/src/lib/krb5/ccache/cc_kcm.c +@@ -992,10 +992,14 @@ kcm_start_seq_get(krb5_context context, krb5_ccache cache, + if (cursor == NULL) + goto cleanup; + cursor->uuids = uuids; ++ uuids = NULL; + cursor->creds = creds; ++ creds = NULL; + *cursor_out = (krb5_cc_cursor)cursor; + + cleanup: ++ free_cred_list(creds); ++ free_uuid_list(uuids); + kcmreq_free(&req); + return ret; + } +diff --git a/src/lib/krb5/ccache/ccfns.c b/src/lib/krb5/ccache/ccfns.c +index e0eb39a612..9b755f0e36 100644 +--- a/src/lib/krb5/ccache/ccfns.c ++++ b/src/lib/krb5/ccache/ccfns.c +@@ -198,18 +198,18 @@ k5_build_conf_principals(krb5_context context, krb5_ccache id, + if (principal) { + ret = krb5_unparse_name(context, principal, &pname); + if (ret) +- return ret; ++ goto cleanup; + } + + ret = krb5_build_principal(context, &cred->server, + sizeof(conf_realm) - 1, conf_realm, + conf_name, name, pname, (char *)NULL); +- krb5_free_unparsed_name(context, pname); +- if (ret) { +- krb5_free_principal(context, client); +- return ret; +- } ++ if (ret) ++ goto cleanup; + ret = krb5_copy_principal(context, client, &cred->client); ++ ++cleanup: ++ krb5_free_unparsed_name(context, pname); + krb5_free_principal(context, client); + return ret; + } +diff --git a/src/lib/krb5/keytab/kt_file.c b/src/lib/krb5/keytab/kt_file.c +index f3ea28c8ec..8fd1505115 100644 +--- a/src/lib/krb5/keytab/kt_file.c ++++ b/src/lib/krb5/keytab/kt_file.c +@@ -456,15 +456,16 @@ krb5_ktfile_start_seq_get(krb5_context context, krb5_keytab id, krb5_kt_cursor * + return ENOMEM; + } + *fileoff = KTSTARTOFF(id); +- *cursorp = (krb5_kt_cursor)fileoff; + KTITERS(id)++; + if (KTITERS(id) == 0) { + /* Wrapped?! */ + KTITERS(id)--; + KTUNLOCK(id); ++ free(fileoff); + k5_setmsg(context, KRB5_KT_IOERR, "Too many keytab iterators active"); + return KRB5_KT_IOERR; /* XXX */ + } ++ *cursorp = (krb5_kt_cursor)fileoff; + KTUNLOCK(id); + + return 0; +diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c +index 753929b06d..f7fad27867 100644 +--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c ++++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c +@@ -271,16 +271,18 @@ krb5_ldap_delete_realm (krb5_context context, char *lrealm) + for (ent = ldap_first_entry (ld, result); ent != NULL; + ent = ldap_next_entry (ld, ent)) { + if ((values = ldap_get_values(ld, ent, "krbPrincipalName")) != NULL) { +- for (i = 0; values[i] != NULL; ++i) { ++ for (i = 0; values[i] != NULL && !st; ++i) { + krb5_parse_name(context, values[i], &principal); + if (principal_in_realm_2(principal, lrealm) == 0) { + st=krb5_ldap_delete_principal(context, principal); +- if (st && st != KRB5_KDB_NOENTRY) +- goto cleanup; ++ if (st == KRB5_KDB_NOENTRY) ++ st = 0; + } + krb5_free_principal(context, principal); + } + ldap_value_free(values); ++ if (st) ++ goto cleanup; + } + } + } +-- +2.41.0 + diff --git a/krb5.spec b/krb5.spec index 03498cb..f86039c 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 1 +%global baserelease 2 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -74,8 +74,9 @@ Patch0012: 0012-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch Patch0013: 0013-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch Patch0014: 0014-Enable-PKINIT-if-at-least-one-group-is-available.patch Patch0015: 0015-Replace-ssl.wrap_socket-for-tests.patch +Patch0016: 0016-Fix-unimportant-memory-leaks.patch -License: MIT +License: BSD-2-Clause AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-3-Clause AND BSD-4-Clause AND FSFULLRWD AND HPND-export-US AND HPND-export-US-modify AND ISC AND MIT AND MIT-CMU AND OLDAP-2.8 AND RSA-MD URL: https://web.mit.edu/kerberos/www/ BuildRequires: autoconf, bison, make, flex, gawk, gettext, pkgconfig, sed BuildRequires: gcc, gcc-c++ @@ -710,6 +711,11 @@ exit 0 %{_datarootdir}/%{name}-tests/ %changelog +* Tue Oct 10 2023 Julien Rische - 1.21.2-2 +- Use SPDX expression for license tag +- Fix unimportant memory leaks + Resolves: rhbz#2223274 + * Wed Aug 16 2023 Julien Rische - 1.21.2-1 - New upstream version (1.21.2) - Fix double-free in KDC TGS processing (CVE-2023-39975) From 1ed0e3a2d8c572e54bb3068ddc116a3d56034a99 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Wed, 17 Jan 2024 11:32:17 +0100 Subject: [PATCH 088/103] krb5 1.21.2-3 - Fix double free in klist's show_ccache() Resolves: rhbz#2257301 - Store krb5-tests files in architecture-specific directories Resolves: rhbz#2244601 Signed-off-by: Julien Rische --- ...move-klist-s-defname-global-variable.patch | 69 +++++++++++++++++++ krb5-tests | 7 +- krb5.spec | 36 ++++++---- tests/upstream/test.sh | 7 +- 4 files changed, 100 insertions(+), 19 deletions(-) create mode 100644 0017-Remove-klist-s-defname-global-variable.patch diff --git a/0017-Remove-klist-s-defname-global-variable.patch b/0017-Remove-klist-s-defname-global-variable.patch new file mode 100644 index 0000000..56beacc --- /dev/null +++ b/0017-Remove-klist-s-defname-global-variable.patch @@ -0,0 +1,69 @@ +From c5cdf6f71621569c6c389be720937ac97ace988f Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Mon, 8 Jan 2024 16:52:27 +0100 +Subject: [PATCH] Remove klist's defname global variable + +Addition of a "cleanup" section in kinit's show_ccache() function as +part of commit 6c5471176f5266564fbc8a7e02f03b4b042202f8 introduced a +double-free bug, because defname is a global variable. After the +first call, successive calls may take place with a dangling pointer in +defname, which will be freed if krb5_cc_get_principal() fails. + +Convert "defname" to a local variable initialized at the beginning of +show_ccache(). + +[ghudson@mit.edu: edited commit message] +--- + src/clients/klist/klist.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/src/clients/klist/klist.c b/src/clients/klist/klist.c +index 43392d2337..394c75b6b7 100644 +--- a/src/clients/klist/klist.c ++++ b/src/clients/klist/klist.c +@@ -53,7 +53,6 @@ int show_flags = 0, show_time = 0, status_only = 0, show_keys = 0; + int show_etype = 0, show_addresses = 0, no_resolve = 0, print_version = 0; + int show_adtype = 0, show_all = 0, list_all = 0, use_client_keytab = 0; + int show_config = 0; +-char *defname; + char *progname; + krb5_timestamp now; + unsigned int timestamp_width; +@@ -62,7 +61,7 @@ krb5_context context; + + static krb5_boolean is_local_tgt(krb5_principal princ, krb5_data *realm); + static char *etype_string(krb5_enctype ); +-static void show_credential(krb5_creds *); ++static void show_credential(krb5_creds *, const char *); + + static void list_all_ccaches(void); + static int list_ccache(krb5_ccache); +@@ -473,6 +472,7 @@ show_ccache(krb5_ccache cache) + krb5_creds creds; + krb5_principal princ = NULL; + krb5_error_code ret; ++ char *defname = NULL; + int status = 1; + + ret = krb5_cc_get_principal(context, cache, &princ); +@@ -503,7 +503,7 @@ show_ccache(krb5_ccache cache) + } + while ((ret = krb5_cc_next_cred(context, cache, &cur, &creds)) == 0) { + if (show_config || !krb5_is_config_principal(context, creds.server)) +- show_credential(&creds); ++ show_credential(&creds, defname); + krb5_free_cred_contents(context, &creds); + } + if (ret == KRB5_CC_END) { +@@ -676,7 +676,7 @@ print_config_data(int col, krb5_data *data) + } + + static void +-show_credential(krb5_creds *cred) ++show_credential(krb5_creds *cred, const char *defname) + { + krb5_error_code ret; + krb5_ticket *tkt = NULL; +-- +2.41.0 + diff --git a/krb5-tests b/krb5-tests index beaeb2b..6754f3f 100644 --- a/krb5-tests +++ b/krb5-tests @@ -12,6 +12,7 @@ trap "rm -rf ${testdir}" EXIT build_flags="$(eval "echo $(rpm --eval '%{_smp_mflags}')")" -cp -rp /usr/share/{{ name }}-tests "${testdir}/" -make -C "${testdir}/{{ name }}-tests" $build_flags -keyctl session - make -C "${testdir}/{{ name }}-tests" check +mkdir "${testdir}/{{ name }}-tests" +cp -rp /usr/share/{{ name }}-tests/{{ arch }} "${testdir}/{{ name }}-tests/" +make -C "${testdir}/{{ name }}-tests/{{ arch }}/" $build_flags +keyctl session - make -C "${testdir}/{{ name }}-tests/{{ arch }}/" check diff --git a/krb5.spec b/krb5.spec index f86039c..555ded5 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 2 +%global baserelease 3 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -489,37 +489,37 @@ rm -- "$RPM_BUILD_ROOT/%{_docdir}/krb5-libs/examples/services.append" rm -- "$RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/preauth/test.so" # Generate tests launching script -sed -e 's/{{ name }}/%{name}/' \ - -e 's/{{ version }}/%{krb5_version}/' \ - -e 's/{{ release }}/%{krb5_release}/' \ - -e 's/{{ arch }}/%{_arch}/' \ +sed -e 's/{{ name }}/%{name}/g' \ + -e 's/{{ version }}/%{krb5_version}/g' \ + -e 's/{{ release }}/%{krb5_release}/g' \ + -e 's/{{ arch }}/%{_arch}/g' \ -i %{SOURCE15} mkdir -p $RPM_BUILD_ROOT%{_libexecdir} -install -pm 755 %{SOURCE15} $RPM_BUILD_ROOT%{_libexecdir}/ +install -pm 755 %{SOURCE15} $RPM_BUILD_ROOT%{_libexecdir}/%{name}-tests-%{_arch} # Copy source files from build folder to system data folder -install -pdm 755 $RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests +install -pdm 755 $RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch} pushd src -cp -p --parents -t "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/" \ +cp -p --parents -t "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}/" \ $(find . -type f -exec file -i "{}" + \ | sed -ne 's|^\./\([^:]\+\): \+text/.\+$|\1|p') popd # Copy binary test files install -pm 644 src/tests/pkinit-certs/*.p12 \ - "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/tests/pkinit-certs/" + "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}/tests/pkinit-certs/" install -pm 644 src/tests/au_dict.json \ - "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/tests/" + "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}/tests/" # Unset executable bit if no shebang in script -for f in $(find "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/" -type f -executable) +for f in $(find "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}/" -type f -executable) do head -n1 "$f" | grep -Eq '^#!' || chmod a-x "$f" done # Remove broken shebang Perl scripts -rm -- "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/config/wconfig.pl" -rm -- "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/kadmin/kdbkeys/do-test.pl" +rm -- "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}/config/wconfig.pl" +rm -- "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}/kadmin/kdbkeys/do-test.pl" %find_lang %{gettext_domain} @@ -707,10 +707,16 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %files tests -%{_libexecdir}/%{name}-tests -%{_datarootdir}/%{name}-tests/ +%{_libexecdir}/%{name}-tests-%{_arch} +%{_datarootdir}/%{name}-tests/%{_arch} %changelog +* Wed Jan 17 2024 Julien Rische - 1.21.2-3 +- Fix double free in klist's show_ccache() + Resolves: rhbz#2257301 +- Store krb5-tests files in architecture-specific directories + Resolves: rhbz#2244601 + * Tue Oct 10 2023 Julien Rische - 1.21.2-2 - Use SPDX expression for license tag - Fix unimportant memory leaks diff --git a/tests/upstream/test.sh b/tests/upstream/test.sh index 9c5abc5..fd4aeeb 100755 --- a/tests/upstream/test.sh +++ b/tests/upstream/test.sh @@ -1,2 +1,7 @@ #!/bin/sh -eux -/usr/libexec/krb5-tests +rc=0 +for test_exec in /usr/libexec/krb5-tests-* +do + "$test_exec" || rc=1 +done +exit $rc From 87d784ddd75cd1858aad341c6fd22eb6f33673f9 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 21 Jan 2024 02:56:15 +0000 Subject: [PATCH 089/103] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- krb5.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/krb5.spec b/krb5.spec index 555ded5..908eaf5 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 3 +%global baserelease 4 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -711,6 +711,9 @@ exit 0 %{_datarootdir}/%{name}-tests/%{_arch} %changelog +* Sun Jan 21 2024 Fedora Release Engineering - 1.21.2-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Wed Jan 17 2024 Julien Rische - 1.21.2-3 - Fix double free in klist's show_ccache() Resolves: rhbz#2257301 From 5cc4a0d8bccc9092bb25007ca50b599b145df970 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 25 Jan 2024 00:53:41 +0000 Subject: [PATCH 090/103] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- krb5.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/krb5.spec b/krb5.spec index 908eaf5..eb35a3b 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 4 +%global baserelease 5 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -711,6 +711,9 @@ exit 0 %{_datarootdir}/%{name}-tests/%{_arch} %changelog +* Thu Jan 25 2024 Fedora Release Engineering - 1.21.2-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sun Jan 21 2024 Fedora Release Engineering - 1.21.2-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From b45374269bfb01262d8551dc212c0b88c6f556ce Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Wed, 3 Jul 2024 15:44:17 +0200 Subject: [PATCH 091/103] krb5 1.21.2-6 - CVE-2024-37370 CVE-2024-37371: GSS message token handling Resolves: rhbz#2294678 rhbz#2294680 - Fix double free in klist's show_ccache() Resolves: rhbz#2257301 - Do not include files with "~" termination in krb5-tests Signed-off-by: Julien Rische --- ...lities-in-GSS-message-token-handling.patch | 535 ++++++++++++++++++ krb5.spec | 13 +- 2 files changed, 546 insertions(+), 2 deletions(-) create mode 100644 0018-Fix-vulnerabilities-in-GSS-message-token-handling.patch diff --git a/0018-Fix-vulnerabilities-in-GSS-message-token-handling.patch b/0018-Fix-vulnerabilities-in-GSS-message-token-handling.patch new file mode 100644 index 0000000..4934355 --- /dev/null +++ b/0018-Fix-vulnerabilities-in-GSS-message-token-handling.patch @@ -0,0 +1,535 @@ +From 7b0e4a36b82b4ab388b520eaba396de365574774 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Fri, 14 Jun 2024 10:56:12 -0400 +Subject: [PATCH] Fix vulnerabilities in GSS message token handling + +In gss_krb5int_unseal_token_v3() and gss_krb5int_unseal_v3_iov(), +verify the Extra Count field of CFX wrap tokens against the encrypted +header. Reported by Jacob Champion. + +In gss_krb5int_unseal_token_v3(), check for a decrypted plaintext +length too short to contain the encrypted header and extra count +bytes. Reported by Jacob Champion. + +In kg_unseal_iov_token(), separately track the header IOV length and +complete token length when parsing the token's ASN.1 wrapper. This +fix contains modified versions of functions from k5-der.h and +util_token.c; this duplication will be cleaned up in a future commit. + +CVE-2024-37370: + +In MIT krb5 release 1.3 and later, an attacker can modify the +plaintext Extra Count field of a confidential GSS krb5 wrap token, +causing the unwrapped token to appear truncated to the application. + +CVE-2024-37371: + +In MIT krb5 release 1.3 and later, an attacker can cause invalid +memory reads by sending message tokens with invalid length fields. + +ticket: 9128 (new) +tags: pullup +target_version: 1.21-next + +(cherry picked from commit b0a2f8a5365f2eec3e27d78907de9f9d2c80505a) +--- + src/lib/gssapi/krb5/k5sealv3.c | 5 + + src/lib/gssapi/krb5/k5sealv3iov.c | 3 +- + src/lib/gssapi/krb5/k5unsealiov.c | 80 +++++++++- + src/tests/gssapi/t_invalid.c | 233 +++++++++++++++++++++++++----- + 4 files changed, 275 insertions(+), 46 deletions(-) + +diff --git a/src/lib/gssapi/krb5/k5sealv3.c b/src/lib/gssapi/krb5/k5sealv3.c +index 3b4f8cb837..1fcbdfbb87 100644 +--- a/src/lib/gssapi/krb5/k5sealv3.c ++++ b/src/lib/gssapi/krb5/k5sealv3.c +@@ -408,10 +408,15 @@ gss_krb5int_unseal_token_v3(krb5_context *contextptr, + /* Don't use bodysize here! Use the fact that + cipher.ciphertext.length has been adjusted to the + correct length. */ ++ if (plain.length < 16 + ec) { ++ free(plain.data); ++ goto defective; ++ } + althdr = (unsigned char *)plain.data + plain.length - 16; + if (load_16_be(althdr) != KG2_TOK_WRAP_MSG + || althdr[2] != ptr[2] + || althdr[3] != ptr[3] ++ || load_16_be(althdr+4) != ec + || memcmp(althdr+8, ptr+8, 8)) { + free(plain.data); + goto defective; +diff --git a/src/lib/gssapi/krb5/k5sealv3iov.c b/src/lib/gssapi/krb5/k5sealv3iov.c +index 333ee124dd..f8e90c35b4 100644 +--- a/src/lib/gssapi/krb5/k5sealv3iov.c ++++ b/src/lib/gssapi/krb5/k5sealv3iov.c +@@ -402,9 +402,10 @@ gss_krb5int_unseal_v3_iov(krb5_context context, + if (load_16_be(althdr) != KG2_TOK_WRAP_MSG + || althdr[2] != ptr[2] + || althdr[3] != ptr[3] ++ || load_16_be(althdr + 4) != ec + || memcmp(althdr + 8, ptr + 8, 8) != 0) { + *minor_status = 0; +- return GSS_S_BAD_SIG; ++ return GSS_S_DEFECTIVE_TOKEN; + } + } else { + /* Verify checksum: note EC is checksum size here, not padding */ +diff --git a/src/lib/gssapi/krb5/k5unsealiov.c b/src/lib/gssapi/krb5/k5unsealiov.c +index 3ce2a90ce9..6a6585d9af 100644 +--- a/src/lib/gssapi/krb5/k5unsealiov.c ++++ b/src/lib/gssapi/krb5/k5unsealiov.c +@@ -25,6 +25,7 @@ + */ + + #include "k5-int.h" ++#include "k5-der.h" + #include "gssapiP_krb5.h" + + static OM_uint32 +@@ -247,6 +248,73 @@ cleanup: + return retval; + } + ++/* Similar to k5_der_get_value(), but output an unchecked content length ++ * instead of a k5input containing the contents. */ ++static inline bool ++get_der_tag(struct k5input *in, uint8_t idbyte, size_t *len_out) ++{ ++ uint8_t lenbyte, i; ++ size_t len; ++ ++ /* Do nothing if in is empty or the next byte doesn't match idbyte. */ ++ if (in->status || in->len == 0 || *in->ptr != idbyte) ++ return false; ++ ++ /* Advance past the identifier byte and decode the length. */ ++ (void)k5_input_get_byte(in); ++ lenbyte = k5_input_get_byte(in); ++ if (lenbyte < 128) { ++ len = lenbyte; ++ } else { ++ len = 0; ++ for (i = 0; i < (lenbyte & 0x7F); i++) { ++ if (len > (SIZE_MAX >> 8)) { ++ k5_input_set_status(in, EOVERFLOW); ++ return false; ++ } ++ len = (len << 8) | k5_input_get_byte(in); ++ } ++ } ++ ++ if (in->status) ++ return false; ++ ++ *len_out = len; ++ return true; ++} ++ ++/* ++ * Similar to g_verify_token_header() without toktype or flags, but do not read ++ * more than *header_len bytes of ASN.1 wrapper, and on output set *header_len ++ * to the remaining number of header bytes. Verify the outer DER tag's length ++ * against token_len, which may be larger (but not smaller) than *header_len. ++ */ ++static gss_int32 ++verify_detached_wrapper(const gss_OID_desc *mech, size_t *header_len, ++ uint8_t **header_in, size_t token_len) ++{ ++ struct k5input in, mech_der; ++ gss_OID_desc toid; ++ size_t len; ++ ++ k5_input_init(&in, *header_in, *header_len); ++ ++ if (get_der_tag(&in, 0x60, &len)) { ++ if (len != token_len - (in.ptr - *header_in)) ++ return G_BAD_TOK_HEADER; ++ if (!k5_der_get_value(&in, 0x06, &mech_der)) ++ return G_BAD_TOK_HEADER; ++ toid.elements = (uint8_t *)mech_der.ptr; ++ toid.length = mech_der.len; ++ if (!g_OID_equal(&toid, mech)) ++ return G_WRONG_MECH; ++ } ++ ++ *header_in = (uint8_t *)in.ptr; ++ *header_len = in.len; ++ return 0; ++} ++ + /* + * Caller must provide TOKEN | DATA | PADDING | TRAILER, except + * for DCE in which case it can just provide TOKEN | DATA (must +@@ -267,8 +335,7 @@ kg_unseal_iov_token(OM_uint32 *minor_status, + gss_iov_buffer_t header; + gss_iov_buffer_t padding; + gss_iov_buffer_t trailer; +- size_t input_length; +- unsigned int bodysize; ++ size_t input_length, hlen; + int toktype2; + + header = kg_locate_header_iov(iov, iov_count, toktype); +@@ -298,15 +365,14 @@ kg_unseal_iov_token(OM_uint32 *minor_status, + input_length += trailer->buffer.length; + } + +- code = g_verify_token_header(ctx->mech_used, +- &bodysize, &ptr, -1, +- input_length, 0); ++ hlen = header->buffer.length; ++ code = verify_detached_wrapper(ctx->mech_used, &hlen, &ptr, input_length); + if (code != 0) { + *minor_status = code; + return GSS_S_DEFECTIVE_TOKEN; + } + +- if (bodysize < 2) { ++ if (hlen < 2) { + *minor_status = (OM_uint32)G_BAD_TOK_HEADER; + return GSS_S_DEFECTIVE_TOKEN; + } +@@ -314,7 +380,7 @@ kg_unseal_iov_token(OM_uint32 *minor_status, + toktype2 = load_16_be(ptr); + + ptr += 2; +- bodysize -= 2; ++ hlen -= 2; + + switch (toktype2) { + case KG2_TOK_MIC_MSG: +diff --git a/src/tests/gssapi/t_invalid.c b/src/tests/gssapi/t_invalid.c +index fb8fe55111..8192935099 100644 +--- a/src/tests/gssapi/t_invalid.c ++++ b/src/tests/gssapi/t_invalid.c +@@ -36,31 +36,41 @@ + * + * 1. A pre-CFX wrap or MIC token processed with a CFX-only context causes a + * null pointer dereference. (The token must use SEAL_ALG_NONE or it will +- * be rejected.) ++ * be rejected.) This vulnerability also applies to IOV unwrap. + * +- * 2. A pre-CFX wrap or MIC token with fewer than 24 bytes after the ASN.1 ++ * 2. A CFX wrap token with a different value of EC between the plaintext and ++ * encrypted copies will be erroneously accepted, which allows a message ++ * truncation attack. This vulnerability also applies to IOV unwrap. ++ * ++ * 3. A CFX wrap token with a plaintext length fewer than 16 bytes causes an ++ * access before the beginning of the input buffer, possibly leading to a ++ * crash. ++ * ++ * 4. A CFX wrap token with a plaintext EC value greater than the plaintext ++ * length - 16 causes an integer underflow when computing the result length, ++ * likely causing a crash. ++ * ++ * 5. An IOV unwrap operation will overrun the header buffer if an ASN.1 ++ * wrapper longer than the header buffer is present. ++ * ++ * 6. A pre-CFX wrap or MIC token with fewer than 24 bytes after the ASN.1 + * header causes an input buffer overrun, usually leading to either a segv + * or a GSS_S_DEFECTIVE_TOKEN error due to garbage algorithm, filler, or +- * sequence number values. ++ * sequence number values. This vulnerability also applies to IOV unwrap. + * +- * 3. A pre-CFX wrap token with fewer than 16 + cksumlen bytes after the ASN.1 ++ * 7. A pre-CFX wrap token with fewer than 16 + cksumlen bytes after the ASN.1 + * header causes an integer underflow when computing the ciphertext length, + * leading to an allocation error on 32-bit platforms or a segv on 64-bit + * platforms. A pre-CFX MIC token of this size causes an input buffer + * overrun when comparing the checksum, perhaps leading to a segv. + * +- * 4. A pre-CFX wrap token with fewer than conflen + padlen bytes in the ++ * 8. A pre-CFX wrap token with fewer than conflen + padlen bytes in the + * ciphertext (where padlen is the last byte of the decrypted ciphertext) + * causes an integer underflow when computing the original message length, + * leading to an allocation error. + * +- * 5. In the mechglue, truncated encapsulation in the initial context token can ++ * 9. In the mechglue, truncated encapsulation in the initial context token can + * cause input buffer overruns in gss_accept_sec_context(). +- * +- * Vulnerabilities #1 and #2 also apply to IOV unwrap, although tokens with +- * fewer than 16 bytes after the ASN.1 header will be rejected. +- * Vulnerabilities #2 and #5 can only be robustly detected using a +- * memory-checking environment such as valgrind. + */ + + #include "k5-int.h" +@@ -97,17 +107,25 @@ struct test { + } + }; + +-/* Fake up enough of a CFX GSS context for gss_unwrap, using an AES key. */ ++static void * ++ealloc(size_t len) ++{ ++ void *ptr = calloc(len, 1); ++ ++ if (ptr == NULL) ++ abort(); ++ return ptr; ++} ++ ++/* Fake up enough of a CFX GSS context for gss_unwrap, using an AES key. ++ * The context takes ownership of subkey. */ + static gss_ctx_id_t +-make_fake_cfx_context() ++make_fake_cfx_context(krb5_key subkey) + { + gss_union_ctx_id_t uctx; + krb5_gss_ctx_id_t kgctx; +- krb5_keyblock kb; + +- kgctx = calloc(1, sizeof(*kgctx)); +- if (kgctx == NULL) +- abort(); ++ kgctx = ealloc(sizeof(*kgctx)); + kgctx->established = 1; + kgctx->proto = 1; + if (g_seqstate_init(&kgctx->seqstate, 0, 0, 0, 0) != 0) +@@ -116,15 +134,10 @@ make_fake_cfx_context() + kgctx->sealalg = -1; + kgctx->signalg = -1; + +- kb.enctype = ENCTYPE_AES128_CTS_HMAC_SHA1_96; +- kb.length = 16; +- kb.contents = (unsigned char *)"1234567887654321"; +- if (krb5_k_create_key(NULL, &kb, &kgctx->subkey) != 0) +- abort(); ++ kgctx->subkey = subkey; ++ kgctx->cksumtype = CKSUMTYPE_HMAC_SHA1_96_AES128; + +- uctx = calloc(1, sizeof(*uctx)); +- if (uctx == NULL) +- abort(); ++ uctx = ealloc(sizeof(*uctx)); + uctx->mech_type = &mech_krb5; + uctx->internal_ctx_id = (gss_ctx_id_t)kgctx; + return (gss_ctx_id_t)uctx; +@@ -138,9 +151,7 @@ make_fake_context(const struct test *test) + krb5_gss_ctx_id_t kgctx; + krb5_keyblock kb; + +- kgctx = calloc(1, sizeof(*kgctx)); +- if (kgctx == NULL) +- abort(); ++ kgctx = ealloc(sizeof(*kgctx)); + kgctx->established = 1; + if (g_seqstate_init(&kgctx->seqstate, 0, 0, 0, 0) != 0) + abort(); +@@ -162,9 +173,7 @@ make_fake_context(const struct test *test) + if (krb5_k_create_key(NULL, &kb, &kgctx->enc) != 0) + abort(); + +- uctx = calloc(1, sizeof(*uctx)); +- if (uctx == NULL) +- abort(); ++ uctx = ealloc(sizeof(*uctx)); + uctx->mech_type = &mech_krb5; + uctx->internal_ctx_id = (gss_ctx_id_t)kgctx; + return (gss_ctx_id_t)uctx; +@@ -194,9 +203,7 @@ make_token(unsigned char *token, size_t len, gss_buffer_t out) + + assert(mech_krb5.length == 9); + assert(len + 11 < 128); +- wrapped = malloc(len + 13); +- if (wrapped == NULL) +- abort(); ++ wrapped = ealloc(len + 13); + wrapped[0] = 0x60; + wrapped[1] = len + 11; + wrapped[2] = 0x06; +@@ -207,6 +214,18 @@ make_token(unsigned char *token, size_t len, gss_buffer_t out) + out->value = wrapped; + } + ++/* Create a 16-byte header for a CFX confidential wrap token to be processed by ++ * the fake CFX context. */ ++static void ++write_cfx_header(uint16_t ec, uint8_t *out) ++{ ++ memset(out, 0, 16); ++ store_16_be(KG2_TOK_WRAP_MSG, out); ++ out[2] = FLAG_WRAP_CONFIDENTIAL; ++ out[3] = 0xFF; ++ store_16_be(ec, out + 4); ++} ++ + /* Unwrap a superficially valid RFC 1964 token with a CFX-only context, with + * regular and IOV unwrap. */ + static void +@@ -238,6 +257,134 @@ test_bogus_1964_token(gss_ctx_id_t ctx) + free(in.value); + } + ++static void ++test_cfx_altered_ec(gss_ctx_id_t ctx, krb5_key subkey) ++{ ++ OM_uint32 major, minor; ++ uint8_t tokbuf[128], plainbuf[24]; ++ krb5_data plain; ++ krb5_enc_data cipher; ++ gss_buffer_desc in, out; ++ gss_iov_buffer_desc iov[2]; ++ ++ /* Construct a header with a plaintext EC value of 3. */ ++ write_cfx_header(3, tokbuf); ++ ++ /* Encrypt a plaintext and a copy of the header with the EC value 0. */ ++ memcpy(plainbuf, "truncate", 8); ++ memcpy(plainbuf + 8, tokbuf, 16); ++ store_16_be(0, plainbuf + 12); ++ plain = make_data(plainbuf, 24); ++ cipher.ciphertext.data = (char *)tokbuf + 16; ++ cipher.ciphertext.length = sizeof(tokbuf) - 16; ++ cipher.enctype = subkey->keyblock.enctype; ++ if (krb5_k_encrypt(NULL, subkey, KG_USAGE_INITIATOR_SEAL, NULL, ++ &plain, &cipher) != 0) ++ abort(); ++ ++ /* Verify that the token is rejected by gss_unwrap(). */ ++ in.value = tokbuf; ++ in.length = 16 + cipher.ciphertext.length; ++ major = gss_unwrap(&minor, ctx, &in, &out, NULL, NULL); ++ if (major != GSS_S_DEFECTIVE_TOKEN) ++ abort(); ++ (void)gss_release_buffer(&minor, &out); ++ ++ /* Verify that the token is rejected by gss_unwrap_iov(). */ ++ iov[0].type = GSS_IOV_BUFFER_TYPE_STREAM; ++ iov[0].buffer = in; ++ iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; ++ major = gss_unwrap_iov(&minor, ctx, NULL, NULL, iov, 2); ++ if (major != GSS_S_DEFECTIVE_TOKEN) ++ abort(); ++} ++ ++static void ++test_cfx_short_plaintext(gss_ctx_id_t ctx, krb5_key subkey) ++{ ++ OM_uint32 major, minor; ++ uint8_t tokbuf[128], zerobyte = 0; ++ krb5_data plain; ++ krb5_enc_data cipher; ++ gss_buffer_desc in, out; ++ ++ write_cfx_header(0, tokbuf); ++ ++ /* Encrypt a single byte, with no copy of the header. */ ++ plain = make_data(&zerobyte, 1); ++ cipher.ciphertext.data = (char *)tokbuf + 16; ++ cipher.ciphertext.length = sizeof(tokbuf) - 16; ++ cipher.enctype = subkey->keyblock.enctype; ++ if (krb5_k_encrypt(NULL, subkey, KG_USAGE_INITIATOR_SEAL, NULL, ++ &plain, &cipher) != 0) ++ abort(); ++ ++ /* Verify that the token is rejected by gss_unwrap(). */ ++ in.value = tokbuf; ++ in.length = 16 + cipher.ciphertext.length; ++ major = gss_unwrap(&minor, ctx, &in, &out, NULL, NULL); ++ if (major != GSS_S_DEFECTIVE_TOKEN) ++ abort(); ++ (void)gss_release_buffer(&minor, &out); ++} ++ ++static void ++test_cfx_large_ec(gss_ctx_id_t ctx, krb5_key subkey) ++{ ++ OM_uint32 major, minor; ++ uint8_t tokbuf[128] = { 0 }, plainbuf[20]; ++ krb5_data plain; ++ krb5_enc_data cipher; ++ gss_buffer_desc in, out; ++ ++ /* Construct a header with an EC value of 5. */ ++ write_cfx_header(5, tokbuf); ++ ++ /* Encrypt a 4-byte plaintext plus the header. */ ++ memcpy(plainbuf, "abcd", 4); ++ memcpy(plainbuf + 4, tokbuf, 16); ++ plain = make_data(plainbuf, 20); ++ cipher.ciphertext.data = (char *)tokbuf + 16; ++ cipher.ciphertext.length = sizeof(tokbuf) - 16; ++ cipher.enctype = subkey->keyblock.enctype; ++ if (krb5_k_encrypt(NULL, subkey, KG_USAGE_INITIATOR_SEAL, NULL, ++ &plain, &cipher) != 0) ++ abort(); ++ ++ /* Verify that the token is rejected by gss_unwrap(). */ ++ in.value = tokbuf; ++ in.length = 16 + cipher.ciphertext.length; ++ major = gss_unwrap(&minor, ctx, &in, &out, NULL, NULL); ++ if (major != GSS_S_DEFECTIVE_TOKEN) ++ abort(); ++ (void)gss_release_buffer(&minor, &out); ++} ++ ++static void ++test_iov_large_asn1_wrapper(gss_ctx_id_t ctx) ++{ ++ OM_uint32 minor, major; ++ uint8_t databuf[10] = { 0 }; ++ gss_iov_buffer_desc iov[2]; ++ ++ /* ++ * In this IOV array, the header contains a DER tag with a dangling eight ++ * bytes of length field. The data IOV indicates a total token length ++ * sufficient to contain the length bytes. ++ */ ++ iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER; ++ iov[0].buffer.value = ealloc(2); ++ iov[0].buffer.length = 2; ++ memcpy(iov[0].buffer.value, "\x60\x88", 2); ++ iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; ++ iov[1].buffer.value = databuf; ++ iov[1].buffer.length = 10; ++ major = gss_unwrap_iov(&minor, ctx, NULL, NULL, iov, 2); ++ if (major != GSS_S_DEFECTIVE_TOKEN) ++ abort(); ++ free(iov[0].buffer.value); ++} ++ + /* Process wrap and MIC tokens with incomplete headers. */ + static void + test_short_header(gss_ctx_id_t ctx) +@@ -387,9 +534,7 @@ try_accept(void *value, size_t len) + gss_ctx_id_t ctx = GSS_C_NO_CONTEXT; + + /* Copy the provided value to make input overruns more obvious. */ +- in.value = malloc(len); +- if (in.value == NULL) +- abort(); ++ in.value = ealloc(len); + memcpy(in.value, value, len); + in.length = len; + (void)gss_accept_sec_context(&minor, &ctx, GSS_C_NO_CREDENTIAL, &in, +@@ -424,11 +569,23 @@ test_short_encapsulation() + int + main(int argc, char **argv) + { ++ krb5_keyblock kb; ++ krb5_key cfx_subkey; + gss_ctx_id_t ctx; + size_t i; + +- ctx = make_fake_cfx_context(); ++ kb.enctype = ENCTYPE_AES128_CTS_HMAC_SHA1_96; ++ kb.length = 16; ++ kb.contents = (unsigned char *)"1234567887654321"; ++ if (krb5_k_create_key(NULL, &kb, &cfx_subkey) != 0) ++ abort(); ++ ++ ctx = make_fake_cfx_context(cfx_subkey); + test_bogus_1964_token(ctx); ++ test_cfx_altered_ec(ctx, cfx_subkey); ++ test_cfx_short_plaintext(ctx, cfx_subkey); ++ test_cfx_large_ec(ctx, cfx_subkey); ++ test_iov_large_asn1_wrapper(ctx); + free_fake_context(ctx); + + for (i = 0; i < sizeof(tests) / sizeof(*tests); i++) { +-- +2.45.1 + diff --git a/krb5.spec b/krb5.spec index eb35a3b..cc17078 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 5 +%global baserelease 6 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -75,6 +75,8 @@ Patch0013: 0013-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch Patch0014: 0014-Enable-PKINIT-if-at-least-one-group-is-available.patch Patch0015: 0015-Replace-ssl.wrap_socket-for-tests.patch Patch0016: 0016-Fix-unimportant-memory-leaks.patch +Patch0017: 0017-Remove-klist-s-defname-global-variable.patch +Patch0018: 0018-Fix-vulnerabilities-in-GSS-message-token-handling.patch License: BSD-2-Clause AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-3-Clause AND BSD-4-Clause AND FSFULLRWD AND HPND-export-US AND HPND-export-US-modify AND ISC AND MIT AND MIT-CMU AND OLDAP-2.8 AND RSA-MD URL: https://web.mit.edu/kerberos/www/ @@ -502,7 +504,7 @@ install -pdm 755 $RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch} pushd src cp -p --parents -t "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}/" \ $(find . -type f -exec file -i "{}" + \ - | sed -ne 's|^\./\([^:]\+\): \+text/.\+$|\1|p') + | sed -ne 's|^\./\([^:]\+\): \+text/.\+$|\1|p' | grep -Ev '~$') popd # Copy binary test files @@ -711,6 +713,13 @@ exit 0 %{_datarootdir}/%{name}-tests/%{_arch} %changelog +* Mon Jul 08 2024 Julien Rische - 1.21.2-6 +- CVE-2024-37370 CVE-2024-37371: GSS message token handling + Resolves: rhbz#2294678 rhbz#2294680 +- Fix double free in klist's show_ccache() + Resolves: rhbz#2257301 +- Do not include files with "~" termination in krb5-tests + * Thu Jan 25 2024 Fedora Release Engineering - 1.21.2-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From d71494ca6c6bb9949a5cb7bb966c1f7809994c37 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Tue, 9 Jul 2024 12:08:41 +0200 Subject: [PATCH 092/103] krb5 1.21.3-1 - New upstream version (1.21.3) - CVE-2024-26458: Memory leak in src/lib/rpc/pmap_rmt.c Resolves: rhbz#2266732 - CVE-2024-26461: Memory leak in src/lib/gssapi/krb5/k5sealv3.c Resolves: rhbz#2266741 - CVE-2024-26462: Memory leak in src/kdc/ndr.c Resolves: rhbz#2266743 - Add missing SPDX license identifiers Resolves: rhbz#2265333 Signed-off-by: Julien Rische --- .gitignore | 2 + ...t-Don-t-issue-session-keys-with-depr.patch | 9 +- 0002-downstream-ksu-pam-integration.patch | 4 +- 0003-downstream-SELinux-integration.patch | 8 +- ...ownstream-fix-debuginfo-with-y.tab.c.patch | 4 +- 0005-downstream-Remove-3des-support.patch | 26 +- ...am-FIPS-with-PRNG-and-RADIUS-and-MD4.patch | 4 +- ...-krad-UDP-TCP-localhost-connection-w.patch | 7 +- ...tests-compatible-with-sssd_krb5_loca.patch | 4 +- ...-Include-missing-OpenSSL-FIPS-header.patch | 4 +- ...am-Do-not-set-root-as-ksu-file-owner.patch | 4 +- ...low-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch | 4 +- ...-to-set-PAC-ticket-signature-as-opti.patch | 13 +- ...PKINIT-CMS-SHA-1-signature-verificat.patch | 10 +- ...T-if-at-least-one-group-is-available.patch | 10 +- 0015-Replace-ssl.wrap_socket-for-tests.patch | 4 +- ...nate-old-style-function-declarations.patch | 10685 ++++++++++++++++ 0017-Fix-two-unlikely-memory-leaks.patch | 206 + ...=> 0018-Fix-unimportant-memory-leaks.patch | 254 +- ...lities-in-GSS-message-token-handling.patch | 535 - ...move-klist-s-defname-global-variable.patch | 8 +- krb5.spec | 26 +- sources | 4 +- 23 files changed, 11096 insertions(+), 739 deletions(-) rename 0001-Revert-Don-t-issue-session-keys-with-deprecated-enct.patch => 0001-downstream-Revert-Don-t-issue-session-keys-with-depr.patch (98%) create mode 100644 0016-Eliminate-old-style-function-declarations.patch create mode 100644 0017-Fix-two-unlikely-memory-leaks.patch rename 0016-Fix-unimportant-memory-leaks.patch => 0018-Fix-unimportant-memory-leaks.patch (90%) delete mode 100644 0018-Fix-vulnerabilities-in-GSS-message-token-handling.patch rename 0017-Remove-klist-s-defname-global-variable.patch => 0019-Remove-klist-s-defname-global-variable.patch (93%) diff --git a/.gitignore b/.gitignore index 7057bf9..40603ef 100644 --- a/.gitignore +++ b/.gitignore @@ -206,3 +206,5 @@ /krb5-1.21.tar.gz.asc /krb5-1.21.2.tar.gz /krb5-1.21.2.tar.gz.asc +/krb5-1.21.3.tar.gz +/krb5-1.21.3.tar.gz.asc diff --git a/0001-Revert-Don-t-issue-session-keys-with-deprecated-enct.patch b/0001-downstream-Revert-Don-t-issue-session-keys-with-depr.patch similarity index 98% rename from 0001-Revert-Don-t-issue-session-keys-with-deprecated-enct.patch rename to 0001-downstream-Revert-Don-t-issue-session-keys-with-depr.patch index cc457ae..84d04bf 100644 --- a/0001-Revert-Don-t-issue-session-keys-with-deprecated-enct.patch +++ b/0001-downstream-Revert-Don-t-issue-session-keys-with-depr.patch @@ -1,7 +1,8 @@ -From 087d150e4afe47a8d269d5e80dcef2204b007ceb Mon Sep 17 00:00:00 2001 +From 6f7fd964539dfe4a885068f43a91db9738661870 Mon Sep 17 00:00:00 2001 From: Julien Rische -Date: Wed, 16 Aug 2023 10:00:30 +0200 -Subject: [PATCH] Revert "Don't issue session keys with deprecated enctypes" +Date: Tue, 9 Jul 2024 11:15:33 +0200 +Subject: [PATCH] [downstream] Revert "Don't issue session keys with + deprecated enctypes" This reverts commit 1b57a4d134bbd0e7c52d5885a92eccc815726463. --- @@ -305,5 +306,5 @@ index 8e5f5ba8e9..2a86c5cdfc 100644 'supported_enctypes': 'arcfour-hmac:normal', 'master_key_type': 'arcfour-hmac'}}}), -- -2.41.0 +2.45.1 diff --git a/0002-downstream-ksu-pam-integration.patch b/0002-downstream-ksu-pam-integration.patch index 08bfeab..9afd094 100644 --- a/0002-downstream-ksu-pam-integration.patch +++ b/0002-downstream-ksu-pam-integration.patch @@ -1,4 +1,4 @@ -From 2080ff4c57d29e74466987d673aaf25273160534 Mon Sep 17 00:00:00 2001 +From de4205c45e310ceaaa7cd7958af7293322fa43a6 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:29:58 -0400 Subject: [PATCH] [downstream] ksu pam integration @@ -773,5 +773,5 @@ index 77be7a2025..587221936e 100644 if test "${localedir+set}" != set; then localedir='$(datadir)/locale' -- -2.41.0 +2.45.1 diff --git a/0003-downstream-SELinux-integration.patch b/0003-downstream-SELinux-integration.patch index cac0604..a3b32c3 100644 --- a/0003-downstream-SELinux-integration.patch +++ b/0003-downstream-SELinux-integration.patch @@ -1,4 +1,4 @@ -From 3efc0e3ce4ccc8a89700f35bef041794982d95ca Mon Sep 17 00:00:00 2001 +From 30ff501e4b519396f5aea25e24919be817863e7c Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:30:53 -0400 Subject: [PATCH] [downstream] SELinux integration @@ -238,10 +238,10 @@ index 0000000000..dfaaa847cb +#endif +#endif diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin -index 9c76780181..dd6430ece8 100644 +index 4e09ed345d..09f800be52 100644 --- a/src/include/krb5/krb5.hin +++ b/src/include/krb5/krb5.hin -@@ -87,6 +87,12 @@ +@@ -83,6 +83,12 @@ #define THREEPARAMOPEN(x,y,z) open(x,y,z) #endif @@ -1034,5 +1034,5 @@ index 0000000000..807d039da3 + +#endif /* USE_SELINUX */ -- -2.41.0 +2.45.1 diff --git a/0004-downstream-fix-debuginfo-with-y.tab.c.patch b/0004-downstream-fix-debuginfo-with-y.tab.c.patch index 9368aa6..c21b269 100644 --- a/0004-downstream-fix-debuginfo-with-y.tab.c.patch +++ b/0004-downstream-fix-debuginfo-with-y.tab.c.patch @@ -1,4 +1,4 @@ -From 28677b932c200eba07576358b4e5df2ae22c8ecd Mon Sep 17 00:00:00 2001 +From 393830d96000ed692aa9a99ef87187d6f2863931 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 23 Aug 2016 16:49:25 -0400 Subject: [PATCH] [downstream] fix debuginfo with y.tab.c @@ -40,5 +40,5 @@ index 8669c2436c..a22f23c02c 100644 install: $(INSTALL_PROGRAM) $(PROG) ${DESTDIR}$(ADMIN_BINDIR)/$(PROG) -- -2.41.0 +2.45.1 diff --git a/0005-downstream-Remove-3des-support.patch b/0005-downstream-Remove-3des-support.patch index 6c8ce3b..fcdb136 100644 --- a/0005-downstream-Remove-3des-support.patch +++ b/0005-downstream-Remove-3des-support.patch @@ -1,4 +1,4 @@ -From 6734a067c600ea6ad81d08fcc481609c2bad9fbb Mon Sep 17 00:00:00 2001 +From 7d697742abb370cfc7241c1faa78ba08d7650f6a Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 26 Mar 2019 18:51:10 -0400 Subject: [PATCH] [downstream] Remove 3des support @@ -259,7 +259,7 @@ index 45fe160d7f..b4b1f3bd93 100644 CKSUMTYPE_NIST_SHA.rst CKSUMTYPE_RSA_MD4.rst diff --git a/doc/conf.py b/doc/conf.py -index cd76f5999f..1e1cfce80c 100644 +index ecf9020a72..db7fa377ef 100644 --- a/doc/conf.py +++ b/doc/conf.py @@ -281,7 +281,7 @@ else: @@ -326,10 +326,10 @@ index 69be9030f8..2561e917a2 100644 lib/krb5 lib/krb5/error_tables lib/krb5/asn.1 lib/krb5/ccache diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin -index dd6430ece8..350bcf86f2 100644 +index 09f800be52..c5a625db8f 100644 --- a/src/include/krb5/krb5.hin +++ b/src/include/krb5/krb5.hin -@@ -426,8 +426,8 @@ typedef struct _krb5_crypto_iov { +@@ -422,8 +422,8 @@ typedef struct _krb5_crypto_iov { #define ENCTYPE_DES_CBC_MD4 0x0002 /**< @deprecated no longer supported */ #define ENCTYPE_DES_CBC_MD5 0x0003 /**< @deprecated no longer supported */ #define ENCTYPE_DES_CBC_RAW 0x0004 /**< @deprecated no longer supported */ @@ -340,7 +340,7 @@ index dd6430ece8..350bcf86f2 100644 #define ENCTYPE_DES_HMAC_SHA1 0x0008 /**< @deprecated no longer supported */ /* PKINIT */ #define ENCTYPE_DSA_SHA1_CMS 0x0009 /**< DSA with SHA1, CMS signature */ -@@ -436,9 +436,9 @@ typedef struct _krb5_crypto_iov { +@@ -432,9 +432,9 @@ typedef struct _krb5_crypto_iov { #define ENCTYPE_RC2_CBC_ENV 0x000c /**< RC2 cbc mode, CMS enveloped data */ #define ENCTYPE_RSA_ENV 0x000d /**< RSA encryption, CMS enveloped data */ #define ENCTYPE_RSA_ES_OAEP_ENV 0x000e /**< RSA w/OEAP encryption, CMS enveloped data */ @@ -352,7 +352,7 @@ index dd6430ece8..350bcf86f2 100644 #define ENCTYPE_AES128_CTS_HMAC_SHA1_96 0x0011 /**< RFC 3962 */ #define ENCTYPE_AES256_CTS_HMAC_SHA1_96 0x0012 /**< RFC 3962 */ #define ENCTYPE_AES128_CTS_HMAC_SHA256_128 0x0013 /**< RFC 8009 */ -@@ -463,7 +463,7 @@ typedef struct _krb5_crypto_iov { +@@ -459,7 +459,7 @@ typedef struct _krb5_crypto_iov { #define CKSUMTYPE_RSA_MD5 0x0007 #define CKSUMTYPE_RSA_MD5_DES 0x0008 #define CKSUMTYPE_NIST_SHA 0x0009 @@ -5491,10 +5491,10 @@ index 9b183bc337..f0cc4a6809 100644 if (sealalg != 0xffff) xfree(plain); diff --git a/src/lib/gssapi/krb5/k5unsealiov.c b/src/lib/gssapi/krb5/k5unsealiov.c -index 85a9574f36..3ce2a90ce9 100644 +index 21b501731e..6a6585d9af 100644 --- a/src/lib/gssapi/krb5/k5unsealiov.c +++ b/src/lib/gssapi/krb5/k5unsealiov.c -@@ -102,28 +102,21 @@ kg_unseal_v1_iov(krb5_context context, +@@ -103,28 +103,21 @@ kg_unseal_v1_iov(krb5_context context, } if ((ctx->sealalg == SEAL_ALG_NONE && signalg > 1) || @@ -5528,7 +5528,7 @@ index 85a9574f36..3ce2a90ce9 100644 /* get the token parameters */ code = kg_get_seq_num(context, ctx->seq, ptr + 14, ptr + 6, &direction, &seqnum); -@@ -181,16 +174,10 @@ kg_unseal_v1_iov(krb5_context context, +@@ -182,16 +175,10 @@ kg_unseal_v1_iov(krb5_context context, /* initialize the checksum */ @@ -5548,7 +5548,7 @@ index 85a9574f36..3ce2a90ce9 100644 code = krb5_c_checksum_length(context, md5cksum.checksum_type, &sumlen); if (code != 0) { -@@ -209,18 +196,13 @@ kg_unseal_v1_iov(krb5_context context, +@@ -210,18 +197,13 @@ kg_unseal_v1_iov(krb5_context context, goto cleanup; } @@ -5917,10 +5917,10 @@ index 7494d7fcdb..2f95d89967 100755 # because the ticket session key and initiator subkey are # non-permitted. (This is unfortunate if the acceptor's restriction diff --git a/src/tests/gssapi/t_invalid.c b/src/tests/gssapi/t_invalid.c -index 9876a11e67..fb8fe55111 100644 +index 882e163634..8192935099 100644 --- a/src/tests/gssapi/t_invalid.c +++ b/src/tests/gssapi/t_invalid.c -@@ -84,18 +84,6 @@ struct test { +@@ -94,18 +94,6 @@ struct test { size_t toklen; const char *token; } tests[] = { @@ -6201,5 +6201,5 @@ index 1aebdd0b4a..c38eefd2bd 100644 The AES Advanced Encryption Standard family, like 3DES, is a symmetric block cipher and was designed -- -2.41.0 +2.45.1 diff --git a/0006-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch b/0006-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch index d59a5bf..989b501 100644 --- a/0006-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch +++ b/0006-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch @@ -1,4 +1,4 @@ -From dc3fd927ccd5b7b40049145c3fc7c610d72e9502 Mon Sep 17 00:00:00 2001 +From 7b6453903c248a761d3ceb538dfacebbf3d3a9ff Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Fri, 9 Nov 2018 15:12:21 -0500 Subject: [PATCH] [downstream] FIPS with PRNG and RADIUS and MD4 @@ -608,5 +608,5 @@ index 1a772d450f..232e78bc05 100644 vt->name = "spake"; vt->pa_type_list = pa_types; -- -2.41.0 +2.45.1 diff --git a/0007-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch b/0007-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch index 2602e7a..b339700 100644 --- a/0007-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch +++ b/0007-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch @@ -1,7 +1,8 @@ -From 19db7e5b5d13732c2dfd08b35e2ad3f311553d54 Mon Sep 17 00:00:00 2001 +From 707fa7bd2be6327343dc8fc5c20dc77645524518 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Thu, 5 May 2022 17:15:12 +0200 -Subject: [PATCH] [downstream] Allow krad UDP/TCP localhost connection with FIPS +Subject: [PATCH] [downstream] Allow krad UDP/TCP localhost connection + with FIPS libkrad allows to establish connections only to UNIX socket in FIPS mode, because MD5 digest is not considered safe enough to be used for @@ -77,5 +78,5 @@ index 929f1cef67..063f17a613 100644 retval = ESOCKTNOSUPPORT; goto error; -- -2.41.0 +2.45.1 diff --git a/0008-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch b/0008-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch index 844890e..ceb9595 100644 --- a/0008-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch +++ b/0008-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch @@ -1,4 +1,4 @@ -From 16d3f9a54d4707ae9de18f108a7b61965e83ceaf Mon Sep 17 00:00:00 2001 +From 1da88bea558348be2974470774aa688f8be634c0 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Wed, 7 Dec 2022 13:22:42 +0100 Subject: [PATCH] [downstream] Make tests compatible with @@ -37,5 +37,5 @@ index 87bac17929..26bc95a8dc 100644 fail('URI answers do not match') j += 1 -- -2.41.0 +2.45.1 diff --git a/0009-downstream-Include-missing-OpenSSL-FIPS-header.patch b/0009-downstream-Include-missing-OpenSSL-FIPS-header.patch index ea123f7..ef6f825 100644 --- a/0009-downstream-Include-missing-OpenSSL-FIPS-header.patch +++ b/0009-downstream-Include-missing-OpenSSL-FIPS-header.patch @@ -1,4 +1,4 @@ -From 511a6260f0dadc3fe5ebe075f8b548eae026a1cc Mon Sep 17 00:00:00 2001 +From 775ed8588cc21385fb16a4cec4a861f0d578ce04 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Thu, 5 Jan 2023 20:06:47 +0100 Subject: [PATCH] [downstream] Include missing OpenSSL FIPS header @@ -116,5 +116,5 @@ index 232e78bc05..3394f8a58e 100644 * The SPAKE kdcpreauth module uses a secure cookie containing the following * concatenated fields (all integer fields are big-endian): -- -2.41.0 +2.45.1 diff --git a/0010-downstream-Do-not-set-root-as-ksu-file-owner.patch b/0010-downstream-Do-not-set-root-as-ksu-file-owner.patch index 46e759e..bd4ab77 100644 --- a/0010-downstream-Do-not-set-root-as-ksu-file-owner.patch +++ b/0010-downstream-Do-not-set-root-as-ksu-file-owner.patch @@ -1,4 +1,4 @@ -From 1b0bb0c3e5575559ea9135af5b9a1e91fe0f79f3 Mon Sep 17 00:00:00 2001 +From 4fd20741afcf76085ea62eb015cd589bb9392a7b Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Mon, 9 Jan 2023 22:39:52 +0100 Subject: [PATCH] [downstream] Do not set root as ksu file owner @@ -27,5 +27,5 @@ index 7eaa2f351c..e9ae71471e 100644 ## ${prefix}. prefix=@prefix@ -- -2.41.0 +2.45.1 diff --git a/0011-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch b/0011-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch index 2d34be0..5e45141 100644 --- a/0011-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch +++ b/0011-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch @@ -1,4 +1,4 @@ -From 6e239888cdb938ddda2bf49ec03ad2af3923c381 Mon Sep 17 00:00:00 2001 +From 16f90c007036789d8d9343e8a0cbabfd21853b5a Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Thu, 19 Jan 2023 19:22:27 +0100 Subject: [PATCH] [downstream] Allow KRB5KDF, MD5, and MD4 in FIPS mode @@ -161,5 +161,5 @@ index 5a43c3d9eb..8528ddc4a9 100644 ret = KRB5_CRYPTO_INTERNAL; goto done; -- -2.41.0 +2.45.1 diff --git a/0012-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch b/0012-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch index 00d2d0b..57b4a76 100644 --- a/0012-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch +++ b/0012-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch @@ -1,7 +1,8 @@ -From 640492ecb4ee42edf33c343c08c01a549ed68a52 Mon Sep 17 00:00:00 2001 +From 23b58199db429603802e338db530677b61561335 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Wed, 15 Mar 2023 15:56:34 +0100 -Subject: [PATCH] [downstream] Allow to set PAC ticket signature as optional +Subject: [PATCH] [downstream] Allow to set PAC ticket signature as + optional MS-PAC states that "The ticket signature SHOULD be included in tickets that are not encrypted to the krbtgt account". However, the @@ -73,10 +74,10 @@ index 745b24f351..6075349e5e 100644 #if !defined(_WIN32) diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin -index 350bcf86f2..17e1b52266 100644 +index c5a625db8f..2d9b64dc85 100644 --- a/src/include/krb5/krb5.hin +++ b/src/include/krb5/krb5.hin -@@ -8356,6 +8356,46 @@ krb5_kdc_verify_ticket(krb5_context context, const krb5_enc_tkt_part *enc_tkt, +@@ -8329,6 +8329,46 @@ krb5_kdc_verify_ticket(krb5_context context, const krb5_enc_tkt_part *enc_tkt, const krb5_keyblock *server, const krb5_keyblock *privsvr, krb5_pac *pac_out); @@ -258,7 +259,7 @@ index 4c50e935a2..d4b0455c8c 100644 krb5_kt_client_default krb5_kt_close diff --git a/src/man/kadmin.man b/src/man/kadmin.man -index 461207021b..e8d78309cb 100644 +index 8413e70ccd..f68eb0569d 100644 --- a/src/man/kadmin.man +++ b/src/man/kadmin.man @@ -724,6 +724,12 @@ encryption type. It may be necessary to set this value to @@ -275,5 +276,5 @@ index 461207021b..e8d78309cb 100644 .sp This command requires the \fBmodify\fP privilege. -- -2.41.0 +2.45.1 diff --git a/0013-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch b/0013-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch index ba2c6af..68a2a6d 100644 --- a/0013-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch +++ b/0013-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch @@ -1,8 +1,8 @@ -From 1b2f64d66e01c1abeefdb7cbef7b04035c2128c0 Mon Sep 17 00:00:00 2001 +From 31b9debcf2cbd558f8f315fefb69fc8206b115b4 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Tue, 23 May 2023 12:19:54 +0200 -Subject: [PATCH] [downstream] Make PKINIT CMS SHA-1 signature verification - available in FIPS mode +Subject: [PATCH] [downstream] Make PKINIT CMS SHA-1 signature + verification available in FIPS mode We recommend using the SHA1 crypto-module in order to allow the verification of SHA-1 signature for CMS messages. However, this module @@ -20,7 +20,7 @@ curve cryptography is implemented for PKINIT in MIT krb5. 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -index f41328763e..263ef7845e 100644 +index cb9c79626c..17dd18e37d 100644 --- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c @@ -1844,8 +1844,17 @@ cms_signeddata_verify(krb5_context context, @@ -43,5 +43,5 @@ index f41328763e..263ef7845e 100644 goto cleanup; } -- -2.41.0 +2.45.1 diff --git a/0014-Enable-PKINIT-if-at-least-one-group-is-available.patch b/0014-Enable-PKINIT-if-at-least-one-group-is-available.patch index 717eb43..30646aa 100644 --- a/0014-Enable-PKINIT-if-at-least-one-group-is-available.patch +++ b/0014-Enable-PKINIT-if-at-least-one-group-is-available.patch @@ -1,4 +1,4 @@ -From d2b061bea524012edde2915aa95fc4cb6a6f3ae9 Mon Sep 17 00:00:00 2001 +From c24c9faf859ddc04910a6bc591d8ddb2ada93e80 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Tue, 30 May 2023 01:21:48 -0400 Subject: [PATCH] Enable PKINIT if at least one group is available @@ -52,7 +52,7 @@ index 9fa315d7a0..8bdbea8e95 100644 krb5_error_code pkinit_init_req_crypto(pkinit_req_crypto_context *); diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -index 263ef7845e..d646073d55 100644 +index 17dd18e37d..8cdc40bfb4 100644 --- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c @@ -47,7 +47,8 @@ @@ -139,7 +139,7 @@ index 263ef7845e..d646073d55 100644 } static void -@@ -2910,11 +2918,11 @@ client_create_dh(krb5_context context, +@@ -2912,11 +2920,11 @@ client_create_dh(krb5_context context, if (cryptoctx->received_params != NULL) params = cryptoctx->received_params; @@ -154,7 +154,7 @@ index 263ef7845e..d646073d55 100644 params = plg_cryptoctx->dh_4096; else goto cleanup; -@@ -3210,19 +3218,23 @@ pkinit_create_td_dh_parameters(krb5_context context, +@@ -3212,19 +3220,23 @@ pkinit_create_td_dh_parameters(krb5_context context, krb5_algorithm_identifier alg_4096 = { dh_oid, oakley_4096 }; krb5_algorithm_identifier *alglist[4]; @@ -214,5 +214,5 @@ index 259e95c6c2..5ee39c085c 100644 TRACE(c, "PKINIT OpenSSL error: {str}", msg) -- -2.41.0 +2.45.1 diff --git a/0015-Replace-ssl.wrap_socket-for-tests.patch b/0015-Replace-ssl.wrap_socket-for-tests.patch index d5eb3f4..34cef96 100644 --- a/0015-Replace-ssl.wrap_socket-for-tests.patch +++ b/0015-Replace-ssl.wrap_socket-for-tests.patch @@ -1,4 +1,4 @@ -From 42e831da09bd196068aeb7fe6bfe380bb46b846c Mon Sep 17 00:00:00 2001 +From e92365b510a2407eaceaec90836f5c713403d75f Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Wed, 19 Jul 2023 13:43:17 +0200 Subject: [PATCH] Replace ssl.wrap_socket() for tests @@ -60,5 +60,5 @@ index 58759696b6..d1d10d733c 100755 os.write(sys.stdout.fileno(), b'proxy server ready\n') server.serve_forever() -- -2.41.0 +2.45.1 diff --git a/0016-Eliminate-old-style-function-declarations.patch b/0016-Eliminate-old-style-function-declarations.patch new file mode 100644 index 0000000..2b07a72 --- /dev/null +++ b/0016-Eliminate-old-style-function-declarations.patch @@ -0,0 +1,10685 @@ +From 1ad0abf12b212d19ac7b3903deeaf7fff4e2c3cf Mon Sep 17 00:00:00 2001 +From: Ken Hornstein +Date: Fri, 9 Jun 2023 23:53:53 -0400 +Subject: [PATCH] Eliminate old-style function declarations + +The C2x standard removes support for non-prototype function +declarations, and clang 15 issues warnings for them +(https://reviews.llvm.org/D122895). Add -Werror=strict-prototypes to +the build and fix all of the non-prototype declarations and +definitions. + +For RPC code, try to be consistent with libtirpc and recent *BSD +versions of rpcgen. This includes casting each time a concrete +function is used as an xdrproc_t value, since each XDR per-type +function accepts a different object pointer type. A few invocations +of xdrproc_t values pass a third argument with value LASTUNSIGNED, +even though XDR per-type functions accept only two parameters. +libtirpc has removed these third arguments; do so here as well. + +[ghudson@mit.edu: added -Werror=strict-prototypes and fixed +declarations it breaks under gcc and clang; added xdrproc_t changes; +rewrote commit message; style changes] + +(cherry picked from commit 4b9d7f7c107f01a61600fddcd8cde3812d0366a2) +--- + src/aclocal.m4 | 2 +- + src/appl/gss-sample/gss-client.c | 29 +--- + src/appl/gss-sample/gss-misc.c | 26 +-- + src/appl/gss-sample/gss-server.c | 2 +- + src/appl/user_user/server.c | 5 +- + src/clients/kdestroy/kdestroy.c | 2 +- + src/clients/kinit/kinit.c | 4 +- + src/clients/klist/klist.c | 2 +- + src/clients/ksu/authorization.c | 95 ++++------ + src/clients/ksu/ccache.c | 108 ++++-------- + src/clients/ksu/heuristic.c | 94 ++++------ + src/clients/ksu/krb_auth_su.c | 49 ++---- + src/clients/ksu/main.c | 40 ++--- + src/clients/kvno/kvno.c | 2 +- + src/include/gssrpc/auth_gssapi.h | 10 +- + src/include/gssrpc/xdr.h | 3 +- + src/include/k5-int.h | 2 +- + src/include/k5-plugin.h | 2 +- + src/include/net-server.h | 6 +- + src/kadmin/cli/getdate.y | 3 - + src/kadmin/cli/kadmin.c | 6 +- + src/kadmin/cli/keytab.c | 4 +- + src/kadmin/dbutil/kdb5_create.c | 16 +- + src/kadmin/dbutil/kdb5_destroy.c | 4 +- + src/kadmin/dbutil/kdb5_stash.c | 4 +- + src/kadmin/dbutil/kdb5_util.c | 24 +-- + src/kadmin/dbutil/ovload.c | 14 +- + src/kadmin/dbutil/strtok.c | 4 +- + src/kadmin/ktutil/ktutil.c | 45 ++--- + src/kadmin/ktutil/ktutil_funcs.c | 37 ++-- + src/kadmin/server/ipropd_svc.c | 24 +-- + src/kadmin/server/kadm_rpc_svc.c | 162 +++++++++--------- + src/kadmin/server/ovsec_kadmd.c | 4 +- + src/kdc/t_ndr.c | 2 +- + src/kdc/t_replay.c | 6 +- + src/kprop/kpropd.c | 2 +- + src/kprop/kproplog.c | 4 +- + src/lib/apputils/net-server.c | 7 +- + src/lib/crypto/builtin/aes/aes-gen.c | 18 +- + .../crypto/builtin/camellia/camellia-gen.c | 18 +- + src/lib/crypto/builtin/sha1/t_shs.c | 7 +- + src/lib/crypto/builtin/sha1/t_shs3.c | 7 +- + src/lib/crypto/crypto_tests/aes-test.c | 8 +- + src/lib/crypto/crypto_tests/camellia-test.c | 8 +- + src/lib/crypto/crypto_tests/t_cf2.c | 4 +- + src/lib/crypto/crypto_tests/t_cts.c | 2 +- + src/lib/crypto/crypto_tests/t_encrypt.c | 2 +- + src/lib/crypto/crypto_tests/t_fork.c | 2 +- + src/lib/crypto/crypto_tests/t_hmac.c | 3 +- + src/lib/crypto/crypto_tests/t_mddriver.c | 25 ++- + src/lib/crypto/crypto_tests/t_nfold.c | 16 +- + src/lib/crypto/crypto_tests/t_prf.c | 2 +- + src/lib/crypto/crypto_tests/t_sha2.c | 2 +- + src/lib/gssapi/generic/t_seqstate.c | 2 +- + src/lib/gssapi/krb5/accept_sec_context.c | 76 +++----- + src/lib/gssapi/krb5/compare_name.c | 7 +- + src/lib/gssapi/krb5/context_time.c | 6 +- + src/lib/gssapi/krb5/delete_sec_context.c | 7 +- + src/lib/gssapi/krb5/disp_name.c | 9 +- + src/lib/gssapi/krb5/disp_status.c | 11 +- + src/lib/gssapi/krb5/export_sec_context.c | 7 +- + src/lib/gssapi/krb5/gssapi_krb5.c | 4 +- + src/lib/gssapi/krb5/import_name.c | 8 +- + src/lib/gssapi/krb5/import_sec_context.c | 10 +- + src/lib/gssapi/krb5/indicate_mechs.c | 4 +- + src/lib/gssapi/krb5/init_sec_context.c | 55 ++---- + src/lib/gssapi/krb5/inq_context.c | 17 +- + src/lib/gssapi/krb5/inq_cred.c | 26 +-- + src/lib/gssapi/krb5/inq_names.c | 6 +- + src/lib/gssapi/krb5/k5seal.c | 38 ++-- + src/lib/gssapi/krb5/k5unseal.c | 51 ++---- + src/lib/gssapi/krb5/process_context_token.c | 8 +- + src/lib/gssapi/krb5/rel_cred.c | 4 +- + src/lib/gssapi/krb5/rel_name.c | 4 +- + src/lib/gssapi/krb5/rel_oid.c | 8 +- + src/lib/gssapi/krb5/ser_sctx.c | 16 +- + src/lib/gssapi/krb5/util_cksum.c | 6 +- + src/lib/gssapi/krb5/util_seed.c | 5 +- + src/lib/gssapi/krb5/util_seqnum.c | 19 +- + src/lib/gssapi/krb5/val_cred.c | 4 +- + src/lib/gssapi/krb5/wrap_size_limit.c | 11 +- + .../gssapi/mechglue/g_accept_sec_context.c | 31 +--- + src/lib/gssapi/mechglue/g_acquire_cred.c | 95 +++------- + .../gssapi/mechglue/g_acquire_cred_with_pw.c | 56 ++---- + src/lib/gssapi/mechglue/g_canon_name.c | 10 +- + src/lib/gssapi/mechglue/g_compare_name.c | 12 +- + src/lib/gssapi/mechglue/g_context_time.c | 10 +- + .../gssapi/mechglue/g_delete_sec_context.c | 10 +- + src/lib/gssapi/mechglue/g_dsp_name.c | 12 +- + src/lib/gssapi/mechglue/g_dsp_status.c | 22 +-- + src/lib/gssapi/mechglue/g_dup_name.c | 8 +- + src/lib/gssapi/mechglue/g_exp_sec_context.c | 10 +- + src/lib/gssapi/mechglue/g_export_name.c | 8 +- + src/lib/gssapi/mechglue/g_glue.c | 75 +++----- + src/lib/gssapi/mechglue/g_imp_name.c | 18 +- + src/lib/gssapi/mechglue/g_imp_sec_context.c | 11 +- + src/lib/gssapi/mechglue/g_init_sec_context.c | 37 +--- + src/lib/gssapi/mechglue/g_initialize.c | 22 +-- + src/lib/gssapi/mechglue/g_inq_cred.c | 31 +--- + src/lib/gssapi/mechglue/g_inq_names.c | 8 +- + src/lib/gssapi/mechglue/g_mechname.c | 14 +- + src/lib/gssapi/mechglue/g_oid_ops.c | 27 +-- + src/lib/gssapi/mechglue/g_process_context.c | 10 +- + src/lib/gssapi/mechglue/g_rel_buffer.c | 6 +- + src/lib/gssapi/mechglue/g_rel_cred.c | 7 +- + src/lib/gssapi/mechglue/g_rel_name.c | 7 +- + src/lib/gssapi/mechglue/g_rel_oid_set.c | 6 +- + src/lib/gssapi/mechglue/g_sign.c | 29 +--- + src/lib/gssapi/mechglue/g_store_cred.c | 48 ++---- + src/lib/gssapi/mechglue/g_unseal.c | 35 +--- + src/lib/gssapi/mechglue/g_unwrap_aead.c | 19 +- + src/lib/gssapi/mechglue/g_unwrap_iov.c | 15 +- + src/lib/gssapi/mechglue/g_verify.c | 30 +--- + src/lib/gssapi/mechglue/g_wrap_aead.c | 39 ++--- + src/lib/gssapi/mechglue/g_wrap_iov.c | 43 +---- + src/lib/kadm5/clnt/client_rpc.c | 1 + + src/lib/kadm5/kadm_rpc.h | 45 ----- + src/lib/kadm5/kadm_rpc_xdr.c | 37 ++-- + src/lib/kadm5/misc_free.c | 5 +- + src/lib/kadm5/srv/adb_xdr.c | 6 +- + src/lib/kadm5/srv/svr_principal.c | 12 +- + src/lib/kadm5/str_conv.c | 18 +- + src/lib/kadm5/t_kadm5.c | 22 +-- + src/lib/kdb/kdb5.c | 8 +- + src/lib/kdb/kdb_cpw.c | 32 +--- + src/lib/kdb/keytab.c | 19 +- + src/lib/kdb/t_stringattr.c | 2 +- + src/lib/krad/packet.c | 2 +- + src/lib/krad/t_attr.c | 2 +- + src/lib/krad/t_attrset.c | 2 +- + src/lib/krad/t_code.c | 2 +- + src/lib/krb5/ccache/cc_keyring.c | 2 +- + src/lib/krb5/krb/plugin.c | 2 +- + src/lib/krb5/krb/t_authdata.c | 2 +- + src/lib/krb5/krb/t_response_items.c | 2 +- + src/lib/krb5/krb/t_ser.c | 8 +- + src/lib/krb5/krb/t_sname_match.c | 2 +- + src/lib/krb5/krb/t_valid_times.c | 2 +- + src/lib/krb5/rcache/t_memrcache.c | 2 +- + src/lib/rpc/auth_gss.c | 4 +- + src/lib/rpc/auth_gssapi.c | 14 +- + src/lib/rpc/auth_gssapi_misc.c | 4 +- + src/lib/rpc/authunix_prot.c | 3 +- + src/lib/rpc/clnt_perror.c | 1 - + src/lib/rpc/clnt_raw.c | 2 +- + src/lib/rpc/dyn.c | 85 ++++----- + src/lib/rpc/pmap_clnt.c | 9 +- + src/lib/rpc/pmap_getmaps.c | 5 +- + src/lib/rpc/pmap_getport.c | 6 +- + src/lib/rpc/pmap_prot2.c | 3 +- + src/lib/rpc/pmap_rmt.c | 10 +- + src/lib/rpc/rpc_prot.c | 4 +- + src/lib/rpc/svc.c | 4 +- + src/lib/rpc/svc_auth_gss.c | 10 +- + src/lib/rpc/svc_auth_gssapi.c | 28 +-- + src/lib/rpc/svc_simple.c | 4 +- + src/lib/rpc/unit-test/client.c | 18 +- + src/lib/rpc/unit-test/rpc_test_clnt.c | 4 +- + src/lib/rpc/unit-test/rpc_test_svc.c | 16 +- + src/lib/rpc/unit-test/server.c | 2 +- + src/lib/rpc/xdr.c | 4 +- + src/lib/rpc/xdr_array.c | 4 +- + src/lib/rpc/xdr_rec.c | 13 +- + src/lib/rpc/xdr_reference.c | 4 +- + src/lib/rpc/xdr_sizeof.c | 29 +--- + src/plugins/kdb/db2/db2_exp.c | 4 +- + src/plugins/kdb/db2/libdb2/btree/bt_close.c | 10 +- + src/plugins/kdb/db2/libdb2/btree/bt_conv.c | 13 +- + src/plugins/kdb/db2/libdb2/btree/bt_delete.c | 34 +--- + src/plugins/kdb/db2/libdb2/btree/bt_get.c | 6 +- + src/plugins/kdb/db2/libdb2/btree/bt_open.c | 12 +- + .../kdb/db2/libdb2/btree/bt_overflow.c | 16 +- + src/plugins/kdb/db2/libdb2/btree/bt_page.c | 8 +- + src/plugins/kdb/db2/libdb2/btree/bt_put.c | 11 +- + src/plugins/kdb/db2/libdb2/btree/bt_search.c | 17 +- + src/plugins/kdb/db2/libdb2/btree/bt_seq.c | 27 +-- + src/plugins/kdb/db2/libdb2/btree/bt_split.c | 42 +---- + src/plugins/kdb/db2/libdb2/btree/bt_utils.c | 18 +- + src/plugins/kdb/db2/libdb2/db/db.c | 26 ++- + src/plugins/kdb/db2/libdb2/hash/dbm.c | 50 ++---- + src/plugins/kdb/db2/libdb2/hash/hash.c | 94 +++------- + src/plugins/kdb/db2/libdb2/hash/hash_bigkey.c | 35 +--- + src/plugins/kdb/db2/libdb2/hash/hash_func.c | 16 +- + src/plugins/kdb/db2/libdb2/hash/hash_log2.c | 3 +- + src/plugins/kdb/db2/libdb2/hash/hash_page.c | 121 ++++--------- + src/plugins/kdb/db2/libdb2/hash/hsearch.c | 9 +- + src/plugins/kdb/db2/libdb2/mpool/mpool.c | 54 ++---- + src/plugins/kdb/db2/libdb2/recno/rec_close.c | 7 +- + src/plugins/kdb/db2/libdb2/recno/rec_delete.c | 14 +- + src/plugins/kdb/db2/libdb2/recno/rec_get.c | 22 +-- + src/plugins/kdb/db2/libdb2/recno/rec_open.c | 9 +- + src/plugins/kdb/db2/libdb2/recno/rec_put.c | 12 +- + src/plugins/kdb/db2/libdb2/recno/rec_search.c | 5 +- + src/plugins/kdb/db2/libdb2/recno/rec_seq.c | 5 +- + src/plugins/kdb/db2/libdb2/recno/rec_utils.c | 6 +- + src/plugins/kdb/db2/libdb2/test/dbtest.c | 59 ++----- + src/plugins/kdb/db2/pol_xdr.c | 2 +- + .../kdb/ldap/ldap_util/kdb5_ldap_util.c | 4 +- + src/plugins/kdb/lmdb/kdb_lmdb.c | 4 +- + src/plugins/kdb/test/kdb_test.c | 4 +- + .../preauth/pkinit/pkinit_crypto_openssl.c | 4 +- + src/plugins/preauth/spake/t_vectors.c | 2 +- + src/tests/asn.1/krb5_decode_test.c | 5 +- + src/tests/asn.1/krb5_encode_test.c | 13 +- + src/tests/asn.1/t_trval.c | 14 +- + src/tests/asn.1/trval.c | 73 +++----- + src/tests/conccache.c | 4 +- + src/tests/create/kdb5_mkdums.c | 16 +- + src/tests/forward.c | 2 +- + src/tests/gss-threads/gss-client.c | 4 +- + src/tests/gss-threads/gss-server.c | 2 +- + src/tests/gssapi/reload.c | 2 +- + src/tests/gssapi/t_add_cred.c | 2 +- + src/tests/gssapi/t_enctypes.c | 2 +- + src/tests/gssapi/t_invalid.c | 2 +- + src/tests/gssapi/t_oid.c | 2 +- + src/tests/gssapi/t_spnego.c | 2 +- + src/tests/hammer/kdc5_hammer.c | 36 ++-- + src/tests/kdbtest.c | 2 +- + src/tests/misc/test_getpw.c | 2 +- + src/tests/plugorder.c | 2 +- + src/tests/shlib/t_loader.c | 2 +- + src/tests/softpkcs11/main.c | 2 +- + src/tests/t_inetd.c | 7 +- + src/tests/test1.c | 4 +- + src/tests/verify/kdb5_verify.c | 17 +- + src/util/et/error_message.c | 2 +- + src/util/et/test_et.c | 3 +- + src/util/profile/prof_init.c | 2 +- + src/util/profile/t_profile.c | 22 +-- + src/util/profile/test_load.c | 2 +- + src/util/profile/test_parse.c | 5 +- + src/util/profile/test_profile.c | 10 +- + src/util/profile/test_vtable.c | 3 +- + src/util/ss/error.c | 13 +- + src/util/ss/execute_cmd.c | 23 +-- + src/util/ss/help.c | 115 ++++++------- + src/util/ss/invocation.c | 13 +- + src/util/ss/list_rqs.c | 11 +- + src/util/ss/listen.c | 32 ++-- + src/util/ss/pager.c | 10 +- + src/util/ss/parse.c | 6 +- + src/util/ss/prompt.c | 7 +- + src/util/ss/request_tbl.c | 11 +- + src/util/ss/requests.c | 2 +- + src/util/ss/ss.h | 1 - + src/util/ss/ss_internal.h | 3 +- + src/util/support/plugins.c | 10 +- + src/util/support/t_hashtab.c | 6 +- + src/util/support/t_hex.c | 3 +- + src/util/support/t_json.c | 2 +- + src/util/support/t_k5buf.c | 16 +- + src/util/support/t_unal.c | 3 +- + 253 files changed, 1379 insertions(+), 2717 deletions(-) + +diff --git a/src/aclocal.m4 b/src/aclocal.m4 +index 3331970930..040d5bdd0c 100644 +--- a/src/aclocal.m4 ++++ b/src/aclocal.m4 +@@ -546,7 +546,7 @@ if test "$GCC" = yes ; then + TRY_WARN_CC_FLAG(-Wno-format-zero-length) + # Other flags here may not be supported on some versions of + # gcc that people want to use. +- for flag in overflow strict-overflow missing-format-attribute missing-prototypes return-type missing-braces parentheses switch unused-function unused-label unused-variable unused-value unknown-pragmas sign-compare newline-eof error=uninitialized no-maybe-uninitialized error=pointer-arith error=int-conversion error=incompatible-pointer-types error=discarded-qualifiers error=implicit-int ; do ++ for flag in overflow strict-overflow missing-format-attribute missing-prototypes return-type missing-braces parentheses switch unused-function unused-label unused-variable unused-value unknown-pragmas sign-compare newline-eof error=uninitialized no-maybe-uninitialized error=pointer-arith error=int-conversion error=incompatible-pointer-types error=discarded-qualifiers error=implicit-int error=strict-prototypes; do + TRY_WARN_CC_FLAG(-W$flag) + done + # old-style-definition? generates many, many warnings +diff --git a/src/appl/gss-sample/gss-client.c b/src/appl/gss-sample/gss-client.c +index 6e2aa33690..0722ae196f 100644 +--- a/src/appl/gss-sample/gss-client.c ++++ b/src/appl/gss-sample/gss-client.c +@@ -75,7 +75,7 @@ static gss_OID_desc gss_spnego_mechanism_oid_desc = + {6, (void *)"\x2b\x06\x01\x05\x05\x02"}; + + static void +-usage() ++usage(void) + { + fprintf(stderr, "Usage: gss-client [-port port] [-mech mechanism] " + "[-spnego] [-d]\n"); +@@ -359,9 +359,7 @@ client_establish_context(int s, char *service_name, OM_uint32 gss_flags, + } + + static void +-read_file(file_name, in_buf) +- char *file_name; +- gss_buffer_t in_buf; ++read_file(char *file_name, gss_buffer_t in_buf) + { + int fd, count; + struct stat stat_buf; +@@ -431,21 +429,10 @@ read_file(file_name, in_buf) + * verifies it with gss_verify. -1 is returned if any step fails, + * otherwise 0 is returned. */ + static int +-call_server(host, port, oid, service_name, gss_flags, auth_flag, +- wrap_flag, encrypt_flag, mic_flag, v1_format, msg, use_file, +- mcount, username, password) +- char *host; +- u_short port; +- gss_OID oid; +- char *service_name; +- OM_uint32 gss_flags; +- int auth_flag, wrap_flag, encrypt_flag, mic_flag; +- int v1_format; +- char *msg; +- int use_file; +- int mcount; +- char *username; +- char *password; ++call_server(char *host, u_short port, gss_OID oid, char *service_name, ++ OM_uint32 gss_flags, int auth_flag, int wrap_flag, ++ int encrypt_flag, int mic_flag, int v1_format, char *msg, ++ int use_file, int mcount, char *username, char *password) + { + gss_ctx_id_t context = GSS_C_NO_CONTEXT; + gss_buffer_desc in_buf, out_buf; +@@ -774,9 +761,7 @@ worker_bee(void *unused) + } + + int +-main(argc, argv) +- int argc; +- char **argv; ++main(int argc, char **argv) + { + int i; + +diff --git a/src/appl/gss-sample/gss-misc.c b/src/appl/gss-sample/gss-misc.c +index 1d051edf1e..7eb4c7971d 100644 +--- a/src/appl/gss-sample/gss-misc.c ++++ b/src/appl/gss-sample/gss-misc.c +@@ -157,10 +157,7 @@ read_all(int fildes, void *data, unsigned int nbyte) + * if an error occurs or if it could not write all the data. + */ + int +-send_token(s, flags, tok) +- int s; +- int flags; +- gss_buffer_t tok; ++send_token(int s, int flags, gss_buffer_t tok) + { + int ret; + unsigned char char_flags = (unsigned char) flags; +@@ -230,10 +227,7 @@ send_token(s, flags, tok) + * and -1 if an error occurs or if it could not read all the data. + */ + int +-recv_token(s, flags, tok) +- int s; +- int *flags; +- gss_buffer_t tok; ++recv_token(int s, int *flags, gss_buffer_t tok) + { + int ret; + unsigned char char_flags; +@@ -303,10 +297,7 @@ recv_token(s, flags, tok) + } + + static void +-display_status_1(m, code, type) +- char *m; +- OM_uint32 code; +- int type; ++display_status_1(char *m, OM_uint32 code, int type) + { + OM_uint32 min_stat; + gss_buffer_desc msg; +@@ -344,10 +335,7 @@ display_status_1(m, code, type) + * followed by a newline. + */ + void +-display_status(msg, maj_stat, min_stat) +- char *msg; +- OM_uint32 maj_stat; +- OM_uint32 min_stat; ++display_status(char *msg, OM_uint32 maj_stat, OM_uint32 min_stat) + { + display_status_1(msg, maj_stat, GSS_C_GSS_CODE); + display_status_1(msg, min_stat, GSS_C_MECH_CODE); +@@ -370,8 +358,7 @@ display_status(msg, maj_stat, min_stat) + */ + + void +-display_ctx_flags(flags) +- OM_uint32 flags; ++display_ctx_flags(OM_uint32 flags) + { + if (flags & GSS_C_DELEG_FLAG) + fprintf(display_file, "context flag: GSS_C_DELEG_FLAG\n"); +@@ -388,8 +375,7 @@ display_ctx_flags(flags) + } + + void +-print_token(tok) +- gss_buffer_t tok; ++print_token(gss_buffer_t tok) + { + unsigned int i; + unsigned char *p = tok->value; +diff --git a/src/appl/gss-sample/gss-server.c b/src/appl/gss-sample/gss-server.c +index 9b6ce9ffb3..0e9c857e56 100644 +--- a/src/appl/gss-sample/gss-server.c ++++ b/src/appl/gss-sample/gss-server.c +@@ -73,7 +73,7 @@ static OM_uint32 + showLocalIdentity(OM_uint32 *minor, gss_name_t name); + + static void +-usage() ++usage(void) + { + fprintf(stderr, "Usage: gss-server [-port port] [-verbose] [-once]"); + #ifdef _WIN32 +diff --git a/src/appl/user_user/server.c b/src/appl/user_user/server.c +index f2b5b614e3..afb3d2bcba 100644 +--- a/src/appl/user_user/server.c ++++ b/src/appl/user_user/server.c +@@ -39,9 +39,8 @@ + + /* fd 0 is a tcp socket used to talk to the client */ + +-int main(argc, argv) +- int argc; +- char *argv[]; ++int ++main(int argc, char *argv[]) + { + krb5_data pname_data, tkt_data; + int sock = 0; +diff --git a/src/clients/kdestroy/kdestroy.c b/src/clients/kdestroy/kdestroy.c +index 774b729fdb..48f672a1e8 100644 +--- a/src/clients/kdestroy/kdestroy.c ++++ b/src/clients/kdestroy/kdestroy.c +@@ -47,7 +47,7 @@ char *progname; + + + static void +-usage() ++usage(void) + { + fprintf(stderr, _("Usage: %s [-A] [-q] [-c cache_name] [-p princ_name]\n"), + progname); +diff --git a/src/clients/kinit/kinit.c b/src/clients/kinit/kinit.c +index f4c7b2b842..7a33ffae59 100644 +--- a/src/clients/kinit/kinit.c ++++ b/src/clients/kinit/kinit.c +@@ -45,7 +45,7 @@ + #ifdef HAVE_PWD_H + #include + static char * +-get_name_from_os() ++get_name_from_os(void) + { + struct passwd *pw; + +@@ -137,7 +137,7 @@ const char *shopts = "r:fpFPn54aAVl:s:c:kit:T:RS:vX:CEI:"; + #define USAGE_BREAK "\n\t" + + static void +-usage() ++usage(void) + { + fprintf(stderr, + _("Usage: %s [-V] [-l lifetime] [-s start_time] " +diff --git a/src/clients/klist/klist.c b/src/clients/klist/klist.c +index dcdc5a2d59..c797b1698f 100644 +--- a/src/clients/klist/klist.c ++++ b/src/clients/klist/klist.c +@@ -80,7 +80,7 @@ static void fillit(FILE *, unsigned int, int); + #define KEYTAB 2 + + static void +-usage() ++usage(void) + { + fprintf(stderr, _("Usage: %s [-e] [-V] [[-c] [-l] [-A] [-d] [-f] [-s] " + "[-a [-n]]] [-k [-i] [-t] [-K]] [-C] [name]\n"), +diff --git a/src/clients/ksu/authorization.c b/src/clients/ksu/authorization.c +index fb9d5d0942..17a8a8f2f0 100644 +--- a/src/clients/ksu/authorization.c ++++ b/src/clients/ksu/authorization.c +@@ -30,9 +30,8 @@ + + static void auth_cleanup (FILE *, FILE *, char *); + +-krb5_boolean fowner(fp, uid) +- FILE *fp; +- uid_t uid; ++krb5_boolean ++fowner(FILE *fp, uid_t uid) + { + struct stat sbuf; + +@@ -59,16 +58,10 @@ krb5_boolean fowner(fp, uid) + * + */ + +-krb5_error_code krb5_authorization(context, principal, luser, +- cmd, ok, out_fcmd) +-/* IN */ +- krb5_context context; +- krb5_principal principal; +- const char *luser; +- char *cmd; +- /* OUT */ +- krb5_boolean *ok; +- char **out_fcmd; ++krb5_error_code ++krb5_authorization(krb5_context context, krb5_principal principal, ++ const char *luser, char *cmd, krb5_boolean *ok, ++ char **out_fcmd) + { + struct passwd *pwd; + char *princname; +@@ -178,10 +171,8 @@ any tokens after the principal name FALSE is returned. + + ***********************************************************/ + +-krb5_error_code k5login_lookup (fp, princname, found) +- FILE *fp; +- char *princname; +- krb5_boolean *found; ++krb5_error_code ++k5login_lookup(FILE *fp, char *princname, krb5_boolean *found) + { + + krb5_error_code retval; +@@ -240,12 +231,9 @@ if princname is found{ + + + ***********************************************************/ +-krb5_error_code k5users_lookup (fp, princname, cmd, found, out_fcmd) +- FILE *fp; +- char *princname; +- char *cmd; +- krb5_boolean *found; +- char **out_fcmd; ++krb5_error_code ++k5users_lookup(FILE *fp, char *princname, char *cmd, ++ krb5_boolean *found, char **out_fcmd) + { + krb5_error_code retval; + char * line; +@@ -328,10 +316,8 @@ resolves it into a full path name. + + ************************************************/ + +-krb5_boolean fcmd_resolve(fcmd, out_fcmd, out_err) +- char *fcmd; +- char ***out_fcmd; +- char **out_err; ++krb5_boolean ++fcmd_resolve(char *fcmd, char ***out_fcmd, char **out_err) + { + char * err; + char ** tmp_fcmd; +@@ -407,8 +393,8 @@ cmd_single - checks if cmd consists of a path + + ********************************************/ + +-krb5_boolean cmd_single(cmd) +- char * cmd; ++krb5_boolean ++cmd_single(char *cmd) + { + + if ( ( strrchr( cmd, '/')) == NULL){ +@@ -423,9 +409,8 @@ cmd_arr_cmp_postfix - compares a command with the postfix + of fcmd + ********************************************/ + +-int cmd_arr_cmp_postfix(fcmd_arr, cmd) +- char **fcmd_arr; +- char *cmd; ++int ++cmd_arr_cmp_postfix(char **fcmd_arr, char *cmd) + { + char * temp_fcmd; + char *ptr; +@@ -457,9 +442,8 @@ cmd_arr_cmp - checks if cmd matches any + + **********************************************/ + +-int cmd_arr_cmp (fcmd_arr, cmd) +- char **fcmd_arr; +- char *cmd; ++int ++cmd_arr_cmp(char **fcmd_arr, char *cmd) + { + int result =1; + int i = 0; +@@ -475,10 +459,8 @@ int cmd_arr_cmp (fcmd_arr, cmd) + } + + +-krb5_boolean find_first_cmd_that_exists(fcmd_arr, cmd_out, err_out) +- char **fcmd_arr; +- char **cmd_out; +- char **err_out; ++krb5_boolean ++find_first_cmd_that_exists(char **fcmd_arr, char **cmd_out, char **err_out) + { + struct stat st_temp; + int i = 0; +@@ -517,12 +499,9 @@ returns 1 if there is an error, 0 if no error. + + ***************************************************************/ + +-int match_commands (fcmd, cmd, match, cmd_out, err_out) +- char *fcmd; +- char *cmd; +- krb5_boolean *match; +- char **cmd_out; +- char **err_out; ++int ++match_commands(char *fcmd, char *cmd, krb5_boolean *match, ++ char **cmd_out, char **err_out) + { + char ** fcmd_arr; + char * err; +@@ -566,11 +545,8 @@ int match_commands (fcmd, cmd, match, cmd_out, err_out) + is set to null if eof. + *********************************************************/ + +-krb5_error_code get_line (fp, out_line) +-/* IN */ +- FILE *fp; +- /* OUT */ +- char **out_line; ++krb5_error_code ++get_line(FILE *fp, char **out_line) + { + char * line, *r, *newline , *line_ptr; + int chunk_count = 1; +@@ -615,9 +591,8 @@ will be returned as part of the first token. + Note: this routine reuses the space pointed to by line + ******************************************************/ + +-char * get_first_token (line, lnext) +- char *line; +- char **lnext; ++char * ++get_first_token(char *line, char **lnext) + { + + char * lptr, * out_ptr; +@@ -651,8 +626,8 @@ Note: that this function modifies the stream + lnext to the next tocken. + **********************************************************/ + +-char * get_next_token (lnext) +- char **lnext; ++char * ++get_next_token (char **lnext) + { + char * lptr, * out_ptr; + +@@ -677,10 +652,8 @@ char * get_next_token (lnext) + return out_ptr; + } + +-static void auth_cleanup(users_fp, login_fp, princname) +- FILE *users_fp; +- FILE *login_fp; +- char *princname; ++static void ++auth_cleanup(FILE *users_fp, FILE *login_fp, char *princname) + { + + free (princname); +@@ -690,8 +663,8 @@ static void auth_cleanup(users_fp, login_fp, princname) + fclose(login_fp); + } + +-void init_auth_names(pw_dir) +- char *pw_dir; ++void ++init_auth_names(char *pw_dir) + { + const char *sep; + int r1, r2; +diff --git a/src/clients/ksu/ccache.c b/src/clients/ksu/ccache.c +index cbb9aa2b85..cca9ce2dfc 100644 +--- a/src/clients/ksu/ccache.c ++++ b/src/clients/ksu/ccache.c +@@ -40,24 +40,18 @@ copies the default cache into the secondary cache, + + ************************************************************************/ + +-void show_credential(); ++void show_credential(krb5_context, krb5_creds *, krb5_ccache); + + /* modifies only the cc_other, the algorithm may look a bit funny, + but I had to do it this way, since remove function did not come + with k5 beta 3 release. + */ + +-krb5_error_code krb5_ccache_copy(context, cc_def, target_principal, cc_target, +- restrict_creds, primary_principal, stored) +-/* IN */ +- krb5_context context; +- krb5_ccache cc_def; +- krb5_principal target_principal; +- krb5_ccache cc_target; +- krb5_boolean restrict_creds; +- krb5_principal primary_principal; +- /* OUT */ +- krb5_boolean *stored; ++krb5_error_code ++krb5_ccache_copy(krb5_context context, krb5_ccache cc_def, ++ krb5_principal target_principal, krb5_ccache cc_target, ++ krb5_boolean restrict_creds, krb5_principal primary_principal, ++ krb5_boolean *stored) + { + int i=0; + krb5_error_code retval=0; +@@ -105,11 +99,9 @@ krb5_error_code krb5_ccache_copy(context, cc_def, target_principal, cc_target, + } + + +-krb5_error_code krb5_store_all_creds(context, cc, creds_def, creds_other) +- krb5_context context; +- krb5_ccache cc; +- krb5_creds **creds_def; +- krb5_creds **creds_other; ++krb5_error_code ++krb5_store_all_creds(krb5_context context, krb5_ccache cc, ++ krb5_creds **creds_def, krb5_creds **creds_other) + { + + int i = 0; +@@ -173,10 +165,8 @@ krb5_error_code krb5_store_all_creds(context, cc, creds_def, creds_other) + return 0; + } + +-krb5_boolean compare_creds(context, cred1, cred2) +- krb5_context context; +- krb5_creds *cred1; +- krb5_creds *cred2; ++krb5_boolean ++compare_creds(krb5_context context, krb5_creds *cred1, krb5_creds *cred2) + { + krb5_boolean retval; + +@@ -188,13 +178,9 @@ krb5_boolean compare_creds(context, cred1, cred2) + return retval; + } + +- +- +- +-krb5_error_code krb5_get_nonexp_tkts(context, cc, creds_array) +- krb5_context context; +- krb5_ccache cc; +- krb5_creds ***creds_array; ++krb5_error_code ++krb5_get_nonexp_tkts(krb5_context context, krb5_ccache cc, ++ krb5_creds ***creds_array) + { + + krb5_creds creds, temp_tktq, temp_tkt; +@@ -262,10 +248,8 @@ krb5_error_code krb5_get_nonexp_tkts(context, cc, creds_array) + + } + +- +-krb5_error_code krb5_check_exp(context, tkt_time) +- krb5_context context; +- krb5_ticket_times tkt_time; ++krb5_error_code ++krb5_check_exp(krb5_context context, krb5_ticket_times tkt_time) + { + krb5_error_code retval =0; + krb5_timestamp currenttime; +@@ -290,9 +274,8 @@ krb5_error_code krb5_check_exp(context, tkt_time) + return 0; + } + +- +-char *flags_string(cred) +- krb5_creds *cred; ++char * ++flags_string(krb5_creds *cred) + { + static char buf[32]; + int i = 0; +@@ -323,7 +306,8 @@ char *flags_string(cred) + return(buf); + } + +-void printtime(krb5_timestamp ts) ++void ++printtime(krb5_timestamp ts) + { + char fmtbuf[18], fill = ' '; + +@@ -333,9 +317,7 @@ void printtime(krb5_timestamp ts) + + + krb5_error_code +-krb5_get_login_princ(luser, princ_list) +- const char *luser; +- char ***princ_list; ++krb5_get_login_princ(const char *luser, char ***princ_list) + { + struct stat sbuf; + struct passwd *pwd; +@@ -420,13 +402,8 @@ krb5_get_login_princ(luser, princ_list) + return 0; + } + +- +- + void +-show_credential(context, cred, cc) +- krb5_context context; +- krb5_creds *cred; +- krb5_ccache cc; ++show_credential(krb5_context context, krb5_creds *cred, krb5_ccache cc) + { + krb5_error_code retval; + char *name, *sname, *flags; +@@ -519,11 +496,9 @@ gen_sym(krb5_context context, char **sym_out) + return 0; + } + +-krb5_error_code krb5_ccache_overwrite(context, ccs, cct, primary_principal) +- krb5_context context; +- krb5_ccache ccs; +- krb5_ccache cct; +- krb5_principal primary_principal; ++krb5_error_code ++krb5_ccache_overwrite(krb5_context context, krb5_ccache ccs, krb5_ccache cct, ++ krb5_principal primary_principal) + { + krb5_error_code retval=0; + krb5_principal temp_principal; +@@ -560,14 +535,10 @@ krb5_error_code krb5_ccache_overwrite(context, ccs, cct, primary_principal) + return retval; + } + +-krb5_error_code krb5_store_some_creds(context, cc, creds_def, creds_other, prst, +- stored) +- krb5_context context; +- krb5_ccache cc; +- krb5_creds **creds_def; +- krb5_creds **creds_other; +- krb5_principal prst; +- krb5_boolean *stored; ++krb5_error_code ++krb5_store_some_creds(krb5_context context, krb5_ccache cc, ++ krb5_creds **creds_def, krb5_creds **creds_other, ++ krb5_principal prst, krb5_boolean *stored) + { + + int i = 0; +@@ -610,10 +581,8 @@ krb5_error_code krb5_store_some_creds(context, cc, creds_def, creds_other, prst, + return 0; + } + +-krb5_error_code krb5_ccache_filter (context, cc, prst) +- krb5_context context; +- krb5_ccache cc; +- krb5_principal prst; ++krb5_error_code ++krb5_ccache_filter(krb5_context context, krb5_ccache cc, krb5_principal prst) + { + + int i=0; +@@ -657,10 +626,9 @@ krb5_error_code krb5_ccache_filter (context, cc, prst) + return 0; + } + +-krb5_boolean krb5_find_princ_in_cred_list (context, creds_list, princ) +- krb5_context context; +- krb5_creds **creds_list; +- krb5_principal princ; ++krb5_boolean ++krb5_find_princ_in_cred_list(krb5_context context, krb5_creds **creds_list, ++ krb5_principal princ) + { + + int i = 0; +@@ -682,11 +650,9 @@ krb5_boolean krb5_find_princ_in_cred_list (context, creds_list, princ) + return temp_stored; + } + +-krb5_error_code krb5_find_princ_in_cache (context, cc, princ, found) +- krb5_context context; +- krb5_ccache cc; +- krb5_principal princ; +- krb5_boolean *found; ++krb5_error_code ++krb5_find_princ_in_cache(krb5_context context, krb5_ccache cc, ++ krb5_principal princ, krb5_boolean *found) + { + krb5_error_code retval; + krb5_creds ** creds_list = NULL; +diff --git a/src/clients/ksu/heuristic.c b/src/clients/ksu/heuristic.c +index 4f7280f4cb..e906de8ef0 100644 +--- a/src/clients/ksu/heuristic.c ++++ b/src/clients/ksu/heuristic.c +@@ -41,9 +41,8 @@ get_all_princ_from_file - retrieves all principal names + static void close_time (int, FILE *, int, FILE *); + static krb5_boolean find_str_in_list (char **, char *); + +-krb5_error_code get_all_princ_from_file (fp, plist) +- FILE *fp; +- char ***plist; ++krb5_error_code ++get_all_princ_from_file(FILE *fp, char ***plist) + { + + krb5_error_code retval; +@@ -92,10 +91,8 @@ list_union - combines list1 and list2 into combined_list. + or used by combined_list. + **************************************************************/ + +-krb5_error_code list_union(list1, list2, combined_list) +- char **list1; +- char **list2; +- char ***combined_list; ++krb5_error_code ++list_union(char **list1, char **list2, char ***combined_list) + { + + unsigned int c1 =0, c2 = 0, i=0, j=0; +@@ -141,11 +138,7 @@ krb5_error_code list_union(list1, list2, combined_list) + } + + krb5_error_code +-filter(fp, cmd, k5users_list, k5users_filt_list) +- FILE *fp; +- char *cmd; +- char **k5users_list; +- char ***k5users_filt_list; ++filter(FILE *fp, char *cmd, char **k5users_list, char ***k5users_filt_list) + { + + krb5_error_code retval =0; +@@ -195,10 +188,7 @@ filter(fp, cmd, k5users_list, k5users_filt_list) + } + + krb5_error_code +-get_authorized_princ_names(luser, cmd, princ_list) +- const char *luser; +- char *cmd; +- char ***princ_list; ++get_authorized_princ_names(const char *luser, char *cmd, char ***princ_list) + { + + struct passwd *pwd; +@@ -272,11 +262,8 @@ get_authorized_princ_names(luser, cmd, princ_list) + return 0; + } + +-static void close_time(k5users_flag, users_fp, k5login_flag, login_fp) +- int k5users_flag; +- FILE *users_fp; +- int k5login_flag; +- FILE *login_fp; ++static void ++close_time(int k5users_flag, FILE *users_fp, int k5login_flag, FILE *login_fp) + { + + if (!k5users_flag) fclose(users_fp); +@@ -284,9 +271,8 @@ static void close_time(k5users_flag, users_fp, k5login_flag, login_fp) + + } + +-static krb5_boolean find_str_in_list(list , elm) +- char **list; +- char *elm; ++static krb5_boolean ++find_str_in_list(char **list, char *elm) + { + + int i=0; +@@ -313,12 +299,9 @@ A principal is picked that has the best chance of getting in. + + **********************************************************************/ + +- +-krb5_error_code get_closest_principal(context, plist, client, found) +- krb5_context context; +- char **plist; +- krb5_principal *client; +- krb5_boolean *found; ++krb5_error_code ++get_closest_principal(krb5_context context, char **plist, ++ krb5_principal *client, krb5_boolean *found) + { + krb5_error_code retval =0; + krb5_principal temp_client, best_client = NULL; +@@ -385,12 +368,9 @@ find_either_ticket checks to see whether there is a ticket for the + end server or tgt, if neither is there the return FALSE, + *****************************************************************/ + +-krb5_error_code find_either_ticket (context, cc, client, end_server, found) +- krb5_context context; +- krb5_ccache cc; +- krb5_principal client; +- krb5_principal end_server; +- krb5_boolean *found; ++krb5_error_code ++find_either_ticket(krb5_context context, krb5_ccache cc, krb5_principal client, ++ krb5_principal end_server, krb5_boolean *found) + { + + krb5_principal kdc_server; +@@ -424,13 +404,9 @@ krb5_error_code find_either_ticket (context, cc, client, end_server, found) + return 0; + } + +- +-krb5_error_code find_ticket (context, cc, client, server, found) +- krb5_context context; +- krb5_ccache cc; +- krb5_principal client; +- krb5_principal server; +- krb5_boolean *found; ++krb5_error_code ++find_ticket(krb5_context context, krb5_ccache cc, krb5_principal client, ++ krb5_principal server, krb5_boolean *found) + { + + krb5_creds tgt, tgtq; +@@ -470,13 +446,9 @@ krb5_error_code find_ticket (context, cc, client, server, found) + return 0; + } + +- +- +-krb5_error_code find_princ_in_list (context, princ, plist, found) +- krb5_context context; +- krb5_principal princ; +- char **plist; +- krb5_boolean *found; ++krb5_error_code ++find_princ_in_list(krb5_context context, krb5_principal princ, char **plist, ++ krb5_boolean *found) + { + + int i=0; +@@ -516,21 +488,13 @@ path_out gets set to ... + + ***********************************************************************/ + +-krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, +- source_user, target_user, +- cc_source, options, cmd, +- hostname, client, path_out) +- krb5_context context; +- uid_t source_uid; +- uid_t target_uid; +- char *source_user; +- char *target_user; +- krb5_ccache cc_source; +- krb5_get_init_creds_opt *options; +- char *cmd; +- char *hostname; +- krb5_principal *client; +- int *path_out; ++krb5_error_code ++get_best_princ_for_target(krb5_context context, uid_t source_uid, ++ uid_t target_uid, char *source_user, ++ char *target_user, krb5_ccache cc_source, ++ krb5_get_init_creds_opt *options, char *cmd, ++ char *hostname, krb5_principal *client, ++ int *path_out) + { + + princ_info princ_trials[10]; +diff --git a/src/clients/ksu/krb_auth_su.c b/src/clients/ksu/krb_auth_su.c +index fb848dcab1..db10251f95 100644 +--- a/src/clients/ksu/krb_auth_su.c ++++ b/src/clients/ksu/krb_auth_su.c +@@ -29,18 +29,13 @@ + #include "ksu.h" + + +-void plain_dump_principal (); +- +-krb5_boolean krb5_auth_check(context, client_pname, hostname, options, +- target_user, cc, path_passwd, target_uid) +- krb5_context context; +- krb5_principal client_pname; +- char *hostname; +- krb5_get_init_creds_opt *options; +- char *target_user; +- uid_t target_uid; +- krb5_ccache cc; +- int *path_passwd; ++void plain_dump_principal(krb5_context, krb5_principal); ++ ++krb5_boolean ++krb5_auth_check(krb5_context context, krb5_principal client_pname, ++ char *hostname, krb5_get_init_creds_opt *options, ++ char *target_user, krb5_ccache cc, int *path_passwd, ++ uid_t target_uid) + { + krb5_principal client; + krb5_verify_init_creds_opt vfy_opts; +@@ -137,13 +132,10 @@ krb5_boolean krb5_auth_check(context, client_pname, hostname, options, + return (TRUE); + } + +-krb5_boolean ksu_get_tgt_via_passwd(context, client, options, zero_password, +- creds_out) +- krb5_context context; +- krb5_principal client; +- krb5_get_init_creds_opt *options; +- krb5_boolean *zero_password; +- krb5_creds *creds_out; ++krb5_boolean ++ksu_get_tgt_via_passwd(krb5_context context, krb5_principal client, ++ krb5_get_init_creds_opt *options, ++ krb5_boolean *zero_password, krb5_creds *creds_out) + { + krb5_error_code code; + krb5_creds creds; +@@ -212,11 +204,8 @@ krb5_boolean ksu_get_tgt_via_passwd(context, client, options, zero_password, + return (TRUE); + } + +- +-void dump_principal (context, str, p) +- krb5_context context; +- char *str; +- krb5_principal p; ++void ++dump_principal(krb5_context context, char *str, krb5_principal p) + { + char * stname; + krb5_error_code retval; +@@ -228,9 +217,8 @@ void dump_principal (context, str, p) + fprintf(stderr, " %s: %s\n", str, stname); + } + +-void plain_dump_principal (context, p) +- krb5_context context; +- krb5_principal p; ++void ++plain_dump_principal (krb5_context context, krb5_principal p) + { + char * stname; + krb5_error_code retval; +@@ -251,11 +239,8 @@ A principal is picked that has the best chance of getting in. + + **********************************************************************/ + +- +-krb5_error_code get_best_principal(context, plist, client) +- krb5_context context; +- char **plist; +- krb5_principal *client; ++krb5_error_code ++get_best_principal(krb5_context context, char **plist, krb5_principal *client) + { + krb5_error_code retval =0; + krb5_principal temp_client, best_client = NULL; +diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c +index 931f054041..2a351662c8 100644 +--- a/src/clients/ksu/main.c ++++ b/src/clients/ksu/main.c +@@ -70,7 +70,9 @@ static krb5_error_code resolve_target_cache(krb5_context ksu_context, + /* insure the proper specification of target user as well as catching + ill specified arguments to commands */ + +-void usage (){ ++void ++usage(void) ++{ + fprintf(stderr, + _("Usage: %s [target user] [-n principal] [-c source cachename] " + "[-k] [-r time] [-p|-P] [-f|-F] [-l lifetime] [-zZ] [-q] " +@@ -86,9 +88,7 @@ void usage (){ + static uid_t source_uid, target_uid; + + int +-main (argc, argv) +- int argc; +- char ** argv; ++main(int argc, char ** argv) + { + int hp =0; + int some_rest_copy = 0; +@@ -120,7 +120,6 @@ main (argc, argv) + char ** params; + int keep_target_cache = 0; + int child_pid, child_pgrp, ret_pid; +- extern char * getpass(), *crypt(); + int pargc; + char ** pargv; + krb5_boolean stored = FALSE, cc_reused = FALSE, given_princ = FALSE; +@@ -1049,11 +1048,10 @@ cleanup: + + #ifdef HAVE_GETUSERSHELL + +-int standard_shell(sh) +- char *sh; ++int ++standard_shell(char *sh) + { + char *cp; +- char *getusershell(); + + while ((cp = getusershell()) != NULL) + if (!strcmp(cp, sh)) +@@ -1063,7 +1061,8 @@ int standard_shell(sh) + + #endif /* HAVE_GETUSERSHELL */ + +-static char * ontty() ++static char * ++ontty(void) + { + char *p; + static char buf[MAXPATHLEN + 5]; +@@ -1080,10 +1079,8 @@ static char * ontty() + return (buf); + } + +- +-static int set_env_var(name, value) +- char *name; +- char *value; ++static int ++set_env_var(char *name, char *value) + { + char * env_var_buf; + +@@ -1092,9 +1089,8 @@ static int set_env_var(name, value) + + } + +-static void sweep_up(context, cc) +- krb5_context context; +- krb5_ccache cc; ++static void ++sweep_up(krb5_context context, krb5_ccache cc) + { + krb5_error_code retval; + +@@ -1122,11 +1118,7 @@ get_params is to be called for the -a option or -e option to + *****************************************************************/ + + krb5_error_code +-get_params(optindex, pargc, pargv, params) +- int *optindex; +- int pargc; +- char **pargv; +- char ***params; ++get_params(int *optindex, int pargc, char **pargv, char ***params) + { + + int i,j; +@@ -1159,10 +1151,8 @@ void print_status(const char *fmt, ...) + } + + krb5_error_code +-ksu_tgtname(context, server, client, tgtprinc) +- krb5_context context; +- const krb5_data *server, *client; +- krb5_principal *tgtprinc; ++ksu_tgtname(krb5_context context, const krb5_data *server, ++ const krb5_data *client, krb5_principal *tgtprinc) + { + return krb5_build_principal_ext(context, tgtprinc, client->length, client->data, + KRB5_TGS_NAME_SIZE, KRB5_TGS_NAME, +diff --git a/src/clients/kvno/kvno.c b/src/clients/kvno/kvno.c +index 03f72f596d..ac77a7d524 100644 +--- a/src/clients/kvno/kvno.c ++++ b/src/clients/kvno/kvno.c +@@ -39,7 +39,7 @@ static char *prog; + static int quiet = 0; + + static void +-xusage() ++xusage(void) + { + fprintf(stderr, _("usage: %s [-c ccache] [-e etype] [-k keytab] [-q] " + "[-u | -S sname]\n" +diff --git a/src/include/gssrpc/auth_gssapi.h b/src/include/gssrpc/auth_gssapi.h +index 9d94853228..63436a698a 100644 +--- a/src/include/gssrpc/auth_gssapi.h ++++ b/src/include/gssrpc/auth_gssapi.h +@@ -82,14 +82,12 @@ bool_t xdr_authgssapi_init_res(XDR *, auth_gssapi_init_res *); + + bool_t auth_gssapi_wrap_data + (OM_uint32 *major, OM_uint32 *minor, +- gss_ctx_id_t context, uint32_t seq_num, XDR +- *out_xdrs, bool_t (*xdr_func)(), caddr_t +- xdr_ptr); ++ gss_ctx_id_t context, uint32_t seq_num, ++ XDR *out_xdrs, xdrproc_t xdr_func, caddr_t xdr_ptr); + bool_t auth_gssapi_unwrap_data + (OM_uint32 *major, OM_uint32 *minor, +- gss_ctx_id_t context, uint32_t seq_num, XDR +- *in_xdrs, bool_t (*xdr_func)(), caddr_t +- xdr_ptr); ++ gss_ctx_id_t context, uint32_t seq_num, ++ XDR *in_xdrs, xdrproc_t xdr_func, caddr_t xdr_ptr); + + AUTH *auth_gssapi_create + (CLIENT *clnt, +diff --git a/src/include/gssrpc/xdr.h b/src/include/gssrpc/xdr.h +index da9e173782..4e5c29bdc2 100644 +--- a/src/include/gssrpc/xdr.h ++++ b/src/include/gssrpc/xdr.h +@@ -102,7 +102,6 @@ enum xdr_op { + * + * XXX can't actually prototype it, because some take three args!!! + */ +-typedef bool_t (*xdrproc_t)(); + + /* + * The XDR handle. +@@ -143,6 +142,8 @@ typedef struct XDR { + int x_handy; /* extra private word */ + } XDR; + ++typedef bool_t (*xdrproc_t)(XDR *, void *); ++ + /* + * Operations defined on a XDR handle + * +diff --git a/src/include/k5-int.h b/src/include/k5-int.h +index 768110e5ef..b3e07945c1 100644 +--- a/src/include/k5-int.h ++++ b/src/include/k5-int.h +@@ -2236,7 +2236,7 @@ make_data(void *data, unsigned int len) + } + + static inline krb5_data +-empty_data() ++empty_data(void) + { + return make_data(NULL, 0); + } +diff --git a/src/include/k5-plugin.h b/src/include/k5-plugin.h +index 90809e168e..5c5af586c5 100644 +--- a/src/include/k5-plugin.h ++++ b/src/include/k5-plugin.h +@@ -97,7 +97,7 @@ krb5int_get_plugin_data (struct plugin_file_handle *, const char *, void **, + + long KRB5_CALLCONV + krb5int_get_plugin_func (struct plugin_file_handle *, const char *, +- void (**)(), struct errinfo *); ++ void (**)(void), struct errinfo *); + + + long KRB5_CALLCONV +diff --git a/src/include/net-server.h b/src/include/net-server.h +index a30749d851..29b235eeb8 100644 +--- a/src/include/net-server.h ++++ b/src/include/net-server.h +@@ -30,6 +30,7 @@ + #define NET_SERVER_H + + #include ++#include + + /* The delimiter characters supported by the addresses string. */ + #define ADDRESSES_DELIM ",; " +@@ -64,13 +65,14 @@ krb5_error_code loop_add_udp_address(int default_port, const char *addresses); + krb5_error_code loop_add_tcp_address(int default_port, const char *addresses); + krb5_error_code loop_add_rpc_service(int default_port, const char *addresses, + u_long prognum, u_long versnum, +- void (*dispatchfn)()); ++ void (*dispatchfn)(struct svc_req *, ++ SVCXPRT *)); + + krb5_error_code loop_setup_network(verto_ctx *ctx, void *handle, + const char *progname, + int tcp_listen_backlog); + krb5_error_code loop_setup_signals(verto_ctx *ctx, void *handle, +- void (*reset)()); ++ void (*reset)(void *)); + void loop_free(verto_ctx *ctx); + + /* to be supplied by the server application */ +diff --git a/src/kadmin/cli/getdate.y b/src/kadmin/cli/getdate.y +index d14cf963c5..3d69f0b8a4 100644 +--- a/src/kadmin/cli/getdate.y ++++ b/src/kadmin/cli/getdate.y +@@ -100,9 +100,6 @@ struct my_timeb { + #define bcopy(from, to, len) memcpy ((to), (from), (len)) + #endif + +-extern struct tm *gmtime(); +-extern struct tm *localtime(); +- + #define yyparse getdate_yyparse + #define yylex getdate_yylex + #define yyerror getdate_yyerror +diff --git a/src/kadmin/cli/kadmin.c b/src/kadmin/cli/kadmin.c +index f3ea6fae17..23b64b0f58 100644 +--- a/src/kadmin/cli/kadmin.c ++++ b/src/kadmin/cli/kadmin.c +@@ -98,7 +98,7 @@ error(const char *fmt, ...) + } + + static void +-usage() ++usage(void) + { + error(_("Usage: %s [-r realm] [-p principal] [-q query] " + "[clnt|local args]\n" +@@ -1130,7 +1130,7 @@ kadmin_parse_princ_args(int argc, char *argv[], kadm5_principal_ent_t oprinc, + } + + static void +-kadmin_addprinc_usage() ++kadmin_addprinc_usage(void) + { + error(_("usage: add_principal [options] principal\n")); + error(_("\toptions are:\n")); +@@ -1154,7 +1154,7 @@ kadmin_addprinc_usage() + } + + static void +-kadmin_modprinc_usage() ++kadmin_modprinc_usage(void) + { + error(_("usage: modify_principal [options] principal\n")); + error(_("\toptions are:\n")); +diff --git a/src/kadmin/cli/keytab.c b/src/kadmin/cli/keytab.c +index b0c8378b40..26f340af31 100644 +--- a/src/kadmin/cli/keytab.c ++++ b/src/kadmin/cli/keytab.c +@@ -50,14 +50,14 @@ static int quiet; + static int norandkey; + + static void +-add_usage() ++add_usage(void) + { + fprintf(stderr, _("Usage: ktadd [-k[eytab] keytab] [-q] [-e keysaltlist] " + "[-norandkey] [principal | -glob princ-exp] [...]\n")); + } + + static void +-rem_usage() ++rem_usage(void) + { + fprintf(stderr, _("Usage: ktremove [-k[eytab] keytab] [-q] principal " + "[kvno|\"all\"|\"old\"]\n")); +diff --git a/src/kadmin/dbutil/kdb5_create.c b/src/kadmin/dbutil/kdb5_create.c +index 038a0b2190..9178fca6da 100644 +--- a/src/kadmin/dbutil/kdb5_create.c ++++ b/src/kadmin/dbutil/kdb5_create.c +@@ -139,9 +139,8 @@ extern int exit_status; + extern kadm5_config_params global_params; + extern krb5_context util_context; + +-void kdb5_create(argc, argv) +- int argc; +- char *argv[]; ++void ++kdb5_create(int argc, char *argv[]) + { + int optchar; + +@@ -337,9 +336,7 @@ void kdb5_create(argc, argv) + } + + static krb5_error_code +-tgt_keysalt_iterate(ksent, ptr) +- krb5_key_salt_tuple *ksent; +- krb5_pointer ptr; ++tgt_keysalt_iterate(krb5_key_salt_tuple *ksent, krb5_pointer ptr) + { + krb5_context context; + krb5_error_code kret; +@@ -378,11 +375,8 @@ tgt_keysalt_iterate(ksent, ptr) + } + + static krb5_error_code +-add_principal(context, princ, op, pblock) +- krb5_context context; +- krb5_principal princ; +- enum ap_op op; +- struct realm_info *pblock; ++add_principal(krb5_context context, krb5_principal princ, enum ap_op op, ++ struct realm_info *pblock) + { + krb5_error_code retval; + krb5_db_entry *entry = NULL; +diff --git a/src/kadmin/dbutil/kdb5_destroy.c b/src/kadmin/dbutil/kdb5_destroy.c +index fffce74296..556cf0b6bb 100644 +--- a/src/kadmin/dbutil/kdb5_destroy.c ++++ b/src/kadmin/dbutil/kdb5_destroy.c +@@ -39,9 +39,7 @@ char *yes = "yes\n"; /* \n to compare against result of + fgets */ + + void +-kdb5_destroy(argc, argv) +- int argc; +- char *argv[]; ++kdb5_destroy(int argc, char *argv[]) + { + extern int optind; + int optchar; +diff --git a/src/kadmin/dbutil/kdb5_stash.c b/src/kadmin/dbutil/kdb5_stash.c +index e05944f290..eaba6cd353 100644 +--- a/src/kadmin/dbutil/kdb5_stash.c ++++ b/src/kadmin/dbutil/kdb5_stash.c +@@ -63,9 +63,7 @@ extern int exit_status; + extern int close_policy_db; + + void +-kdb5_stash(argc, argv) +- int argc; +- char *argv[]; ++kdb5_stash(int argc, char *argv[]) + { + extern char *optarg; + extern int optind; +diff --git a/src/kadmin/dbutil/kdb5_util.c b/src/kadmin/dbutil/kdb5_util.c +index 19a59250ee..55d529fa4c 100644 +--- a/src/kadmin/dbutil/kdb5_util.c ++++ b/src/kadmin/dbutil/kdb5_util.c +@@ -143,8 +143,8 @@ struct _cmd_table { + {NULL, NULL, 0}, + }; + +-static struct _cmd_table *cmd_lookup(name) +- char *name; ++static struct _cmd_table * ++cmd_lookup(char *name) + { + struct _cmd_table *cmd = cmd_table; + while (cmd->name) { +@@ -162,8 +162,9 @@ static struct _cmd_table *cmd_lookup(name) + char **db5util_db_args = NULL; + int db5util_db_args_size = 0; + +-static void extended_com_err_fn (const char *myprog, errcode_t code, +- const char *fmt, va_list args) ++static void ++extended_com_err_fn(const char *myprog, errcode_t code, const char *fmt, ++ va_list args) + { + const char *emsg; + if (code) { +@@ -177,7 +178,8 @@ static void extended_com_err_fn (const char *myprog, errcode_t code, + fprintf (stderr, "\n"); + } + +-int add_db_arg(char *arg) ++int ++add_db_arg(char *arg) + { + char **temp; + db5util_db_args_size++; +@@ -191,9 +193,8 @@ int add_db_arg(char *arg) + return 1; + } + +-int main(argc, argv) +- int argc; +- char *argv[]; ++int ++main(int argc, char *argv[]) + { + struct _cmd_table *cmd = NULL; + char *koptarg, **cmd_argv; +@@ -365,7 +366,8 @@ int main(argc, argv) + * cannot be fetched (the master key stash file may not exist when the + * program is run). + */ +-static int open_db_and_mkey() ++static int ++open_db_and_mkey() + { + krb5_error_code retval; + krb5_data scratch, pwd, seed; +@@ -508,9 +510,7 @@ quit() + } + + static void +-add_random_key(argc, argv) +- int argc; +- char **argv; ++add_random_key(int argc, char **argv) + { + krb5_error_code ret; + krb5_principal princ; +diff --git a/src/kadmin/dbutil/ovload.c b/src/kadmin/dbutil/ovload.c +index 15a5ab3005..b2e6c00eac 100644 +--- a/src/kadmin/dbutil/ovload.c ++++ b/src/kadmin/dbutil/ovload.c +@@ -11,9 +11,8 @@ + + #define LINESIZE 32768 /* XXX */ + +-static int parse_pw_hist_ent(current, hist) +- char *current; +- osa_pw_hist_ent *hist; ++static int ++parse_pw_hist_ent(char *current, osa_pw_hist_ent *hist) + { + int tmp, i, j, ret; + char *cp; +@@ -90,12 +89,9 @@ done: + * [modifies] + * + */ +-int process_ov_principal(kcontext, fname, filep, verbose, linenop) +- krb5_context kcontext; +- const char *fname; +- FILE *filep; +- krb5_boolean verbose; +- int *linenop; ++int ++process_ov_principal(krb5_context kcontext, const char *fname, FILE *filep, ++ krb5_boolean verbose, int *linenop) + { + XDR xdrs; + osa_princ_ent_t rec; +diff --git a/src/kadmin/dbutil/strtok.c b/src/kadmin/dbutil/strtok.c +index dee466aea1..93f3e85a51 100644 +--- a/src/kadmin/dbutil/strtok.c ++++ b/src/kadmin/dbutil/strtok.c +@@ -50,9 +50,7 @@ + */ + + char * +-nstrtok(s, delim) +- char *s; +- const char *delim; ++nstrtok(char *s, const char *delim) + { + const char *spanp; + int c, sc; +diff --git a/src/kadmin/ktutil/ktutil.c b/src/kadmin/ktutil/ktutil.c +index 92d7023a4f..87a69ca145 100644 +--- a/src/kadmin/ktutil/ktutil.c ++++ b/src/kadmin/ktutil/ktutil.c +@@ -39,9 +39,8 @@ extern ss_request_table ktutil_cmds; + krb5_context kcontext; + krb5_kt_list ktlist = NULL; + +-int main(argc, argv) +- int argc; +- char *argv[]; ++int ++main(int argc, char *argv[]) + { + krb5_error_code retval; + int sci_idx; +@@ -63,9 +62,8 @@ int main(argc, argv) + exit(0); + } + +-void ktutil_clear_list(argc, argv) +- int argc; +- char *argv[]; ++void ++ktutil_clear_list(int argc, char *argv[]) + { + krb5_error_code retval; + +@@ -79,9 +77,8 @@ void ktutil_clear_list(argc, argv) + ktlist = NULL; + } + +-void ktutil_read_v5(argc, argv) +- int argc; +- char *argv[]; ++void ++ktutil_read_v5(int argc, char *argv[]) + { + krb5_error_code retval; + +@@ -94,17 +91,15 @@ void ktutil_read_v5(argc, argv) + com_err(argv[0], retval, _("while reading keytab \"%s\""), argv[1]); + } + +-void ktutil_read_v4(argc, argv) +- int argc; +- char *argv[]; ++void ++ktutil_read_v4(int argc, char *argv[]) + { + fprintf(stderr, _("%s: reading srvtabs is no longer supported\n"), + argv[0]); + } + +-void ktutil_write_v5(argc, argv) +- int argc; +- char *argv[]; ++void ++ktutil_write_v5(int argc, char *argv[]) + { + krb5_error_code retval; + +@@ -117,17 +112,15 @@ void ktutil_write_v5(argc, argv) + com_err(argv[0], retval, _("while writing keytab \"%s\""), argv[1]); + } + +-void ktutil_write_v4(argc, argv) +- int argc; +- char *argv[]; ++void ++ktutil_write_v4(int argc, char *argv[]) + { + fprintf(stderr, _("%s: writing srvtabs is no longer supported\n"), + argv[0]); + } + +-void ktutil_add_entry(argc, argv) +- int argc; +- char *argv[]; ++void ++ktutil_add_entry(int argc, char *argv[]) + { + krb5_error_code retval; + char *princ = NULL; +@@ -183,9 +176,8 @@ void ktutil_add_entry(argc, argv) + com_err(argv[0], retval, _("while adding new entry")); + } + +-void ktutil_delete_entry(argc, argv) +- int argc; +- char *argv[]; ++void ++ktutil_delete_entry(int argc, char *argv[]) + { + krb5_error_code retval; + +@@ -198,9 +190,8 @@ void ktutil_delete_entry(argc, argv) + com_err(argv[0], retval, _("while deleting entry %d"), atoi(argv[1])); + } + +-void ktutil_list(argc, argv) +- int argc; +- char *argv[]; ++void ++ktutil_list(int argc, char *argv[]) + { + krb5_error_code retval; + krb5_kt_list lp; +diff --git a/src/kadmin/ktutil/ktutil_funcs.c b/src/kadmin/ktutil/ktutil_funcs.c +index 56bed1bbcc..e489b5b57a 100644 +--- a/src/kadmin/ktutil/ktutil_funcs.c ++++ b/src/kadmin/ktutil/ktutil_funcs.c +@@ -37,9 +37,8 @@ + /* + * Free a kt_list + */ +-krb5_error_code ktutil_free_kt_list(context, list) +- krb5_context context; +- krb5_kt_list list; ++krb5_error_code ++ktutil_free_kt_list(krb5_context context, krb5_kt_list list) + { + krb5_kt_list lp, prev; + krb5_error_code retval = 0; +@@ -60,10 +59,8 @@ krb5_error_code ktutil_free_kt_list(context, list) + * Delete a numbered entry in a kt_list. Takes a pointer to a kt_list + * in case head gets deleted. + */ +-krb5_error_code ktutil_delete(context, list, idx) +- krb5_context context; +- krb5_kt_list *list; +- int idx; ++krb5_error_code ++ktutil_delete(krb5_context context, krb5_kt_list *list, int idx) + { + krb5_kt_list lp, prev; + int i; +@@ -138,16 +135,10 @@ get_etype_info(krb5_context context, krb5_principal princ, int fetch, + * password or key. If the keytab list is NULL, allocate a new + * one first. + */ +-krb5_error_code ktutil_add(context, list, princ_str, fetch, kvno, +- enctype_str, use_pass, salt_str) +- krb5_context context; +- krb5_kt_list *list; +- char *princ_str; +- int fetch; +- krb5_kvno kvno; +- char *enctype_str; +- int use_pass; +- char *salt_str; ++krb5_error_code ++ktutil_add(krb5_context context, krb5_kt_list *list, char *princ_str, ++ int fetch, krb5_kvno kvno, char *enctype_str, int use_pass, ++ char *salt_str) + { + krb5_keytab_entry *entry = NULL; + krb5_kt_list lp, *last; +@@ -269,10 +260,8 @@ cleanup: + * Read in a keytab and append it to list. If list starts as NULL, + * allocate a new one if necessary. + */ +-krb5_error_code ktutil_read_keytab(context, name, list) +- krb5_context context; +- char *name; +- krb5_kt_list *list; ++krb5_error_code ++ktutil_read_keytab(krb5_context context, char *name, krb5_kt_list *list) + { + krb5_kt_list lp = NULL, tail = NULL, back = NULL; + krb5_keytab kt; +@@ -344,10 +333,8 @@ close_kt: + /* + * Takes a kt_list and writes it to the named keytab. + */ +-krb5_error_code ktutil_write_keytab(context, list, name) +- krb5_context context; +- krb5_kt_list list; +- char *name; ++krb5_error_code ++ktutil_write_keytab(krb5_context context, krb5_kt_list list, char *name) + { + krb5_kt_list lp; + krb5_keytab kt; +diff --git a/src/kadmin/server/ipropd_svc.c b/src/kadmin/server/ipropd_svc.c +index 56e9b90b20..e5dd233e81 100644 +--- a/src/kadmin/server/ipropd_svc.c ++++ b/src/kadmin/server/ipropd_svc.c +@@ -535,8 +535,8 @@ krb5_iprop_prog_1(struct svc_req *rqstp, + kdb_last_t iprop_get_updates_1_arg; + } argument; + void *result; +- bool_t (*_xdr_argument)(), (*_xdr_result)(); +- void *(*local)(/* union XXX *, struct svc_req * */); ++ xdrproc_t _xdr_argument, _xdr_result; ++ void *(*local)(char *, struct svc_req *); + char *whoami = "krb5_iprop_prog_1"; + + if (!check_iprop_rpcsec_auth(rqstp)) { +@@ -555,21 +555,21 @@ krb5_iprop_prog_1(struct svc_req *rqstp, + return; + + case IPROP_GET_UPDATES: +- _xdr_argument = xdr_kdb_last_t; +- _xdr_result = xdr_kdb_incr_result_t; +- local = (void *(*)()) iprop_get_updates_1_svc; ++ _xdr_argument = (xdrproc_t)xdr_kdb_last_t; ++ _xdr_result = (xdrproc_t)xdr_kdb_incr_result_t; ++ local = (void *(*)(char *, struct svc_req *))iprop_get_updates_1_svc; + break; + + case IPROP_FULL_RESYNC: +- _xdr_argument = xdr_void; +- _xdr_result = xdr_kdb_fullresync_result_t; +- local = (void *(*)()) iprop_full_resync_1_svc; ++ _xdr_argument = (xdrproc_t)xdr_void; ++ _xdr_result = (xdrproc_t)xdr_kdb_fullresync_result_t; ++ local = (void *(*)(char *, struct svc_req *))iprop_full_resync_1_svc; + break; + + case IPROP_FULL_RESYNC_EXT: +- _xdr_argument = xdr_u_int32; +- _xdr_result = xdr_kdb_fullresync_result_t; +- local = (void *(*)()) iprop_full_resync_ext_1_svc; ++ _xdr_argument = (xdrproc_t)xdr_u_int32; ++ _xdr_result = (xdrproc_t)xdr_kdb_fullresync_result_t; ++ local = (void *(*)(char *, struct svc_req *))iprop_full_resync_ext_1_svc; + break; + + default: +@@ -587,7 +587,7 @@ krb5_iprop_prog_1(struct svc_req *rqstp, + svcerr_decode(transp); + return; + } +- result = (*local)(&argument, rqstp); ++ result = (*local)((char *)&argument, rqstp); + + if (_xdr_result && result != NULL && + !svc_sendreply(transp, _xdr_result, result)) { +diff --git a/src/kadmin/server/kadm_rpc_svc.c b/src/kadmin/server/kadm_rpc_svc.c +index 8371fa76ca..f0e43d9aea 100644 +--- a/src/kadmin/server/kadm_rpc_svc.c ++++ b/src/kadmin/server/kadm_rpc_svc.c +@@ -9,6 +9,7 @@ + #include /* for gss_nt_krb5_name */ + #include + #include ++#include + #include + #include + #include +@@ -36,9 +37,8 @@ static int check_rpcsec_auth(struct svc_req *); + * Modifies: + */ + +-void kadm_1(rqstp, transp) +- struct svc_req *rqstp; +- SVCXPRT *transp; ++void ++kadm_1(struct svc_req *rqstp, SVCXPRT *transp) + { + union { + cprinc_arg create_principal_2_arg; +@@ -73,8 +73,8 @@ void kadm_1(rqstp, transp) + getpkeys_ret get_principal_keys_ret; + } result; + bool_t retval; +- bool_t (*xdr_argument)(), (*xdr_result)(); +- bool_t (*local)(); ++ xdrproc_t xdr_argument, xdr_result; ++ bool_t (*local)(char *, void *, struct svc_req *); + + if (rqstp->rq_cred.oa_flavor != AUTH_GSSAPI && + !check_rpcsec_auth(rqstp)) { +@@ -92,153 +92,153 @@ void kadm_1(rqstp, transp) + return; + + case CREATE_PRINCIPAL: +- xdr_argument = xdr_cprinc_arg; +- xdr_result = xdr_generic_ret; +- local = (bool_t (*)()) create_principal_2_svc; ++ xdr_argument = (xdrproc_t)xdr_cprinc_arg; ++ xdr_result = (xdrproc_t)xdr_generic_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))create_principal_2_svc; + break; + + case DELETE_PRINCIPAL: +- xdr_argument = xdr_dprinc_arg; +- xdr_result = xdr_generic_ret; +- local = (bool_t (*)()) delete_principal_2_svc; ++ xdr_argument = (xdrproc_t)xdr_dprinc_arg; ++ xdr_result = (xdrproc_t)xdr_generic_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))delete_principal_2_svc; + break; + + case MODIFY_PRINCIPAL: +- xdr_argument = xdr_mprinc_arg; +- xdr_result = xdr_generic_ret; +- local = (bool_t (*)()) modify_principal_2_svc; ++ xdr_argument = (xdrproc_t)xdr_mprinc_arg; ++ xdr_result = (xdrproc_t)xdr_generic_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))modify_principal_2_svc; + break; + + case RENAME_PRINCIPAL: +- xdr_argument = xdr_rprinc_arg; +- xdr_result = xdr_generic_ret; +- local = (bool_t (*)()) rename_principal_2_svc; ++ xdr_argument = (xdrproc_t)xdr_rprinc_arg; ++ xdr_result = (xdrproc_t)xdr_generic_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))rename_principal_2_svc; + break; + + case GET_PRINCIPAL: +- xdr_argument = xdr_gprinc_arg; +- xdr_result = xdr_gprinc_ret; +- local = (bool_t (*)()) get_principal_2_svc; ++ xdr_argument = (xdrproc_t)xdr_gprinc_arg; ++ xdr_result = (xdrproc_t)xdr_gprinc_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))get_principal_2_svc; + break; + + case GET_PRINCS: +- xdr_argument = xdr_gprincs_arg; +- xdr_result = xdr_gprincs_ret; +- local = (bool_t (*)()) get_princs_2_svc; ++ xdr_argument = (xdrproc_t)xdr_gprincs_arg; ++ xdr_result = (xdrproc_t)xdr_gprincs_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))get_princs_2_svc; + break; + + case CHPASS_PRINCIPAL: +- xdr_argument = xdr_chpass_arg; +- xdr_result = xdr_generic_ret; +- local = (bool_t (*)()) chpass_principal_2_svc; ++ xdr_argument = (xdrproc_t)xdr_chpass_arg; ++ xdr_result = (xdrproc_t)xdr_generic_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))chpass_principal_2_svc; + break; + + case SETKEY_PRINCIPAL: +- xdr_argument = xdr_setkey_arg; +- xdr_result = xdr_generic_ret; +- local = (bool_t (*)()) setkey_principal_2_svc; ++ xdr_argument = (xdrproc_t)xdr_setkey_arg; ++ xdr_result = (xdrproc_t)xdr_generic_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))setkey_principal_2_svc; + break; + + case CHRAND_PRINCIPAL: +- xdr_argument = xdr_chrand_arg; +- xdr_result = xdr_chrand_ret; +- local = (bool_t (*)()) chrand_principal_2_svc; ++ xdr_argument = (xdrproc_t)xdr_chrand_arg; ++ xdr_result = (xdrproc_t)xdr_chrand_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))chrand_principal_2_svc; + break; + + case CREATE_POLICY: +- xdr_argument = xdr_cpol_arg; +- xdr_result = xdr_generic_ret; +- local = (bool_t (*)()) create_policy_2_svc; ++ xdr_argument = (xdrproc_t)xdr_cpol_arg; ++ xdr_result = (xdrproc_t)xdr_generic_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))create_policy_2_svc; + break; + + case DELETE_POLICY: +- xdr_argument = xdr_dpol_arg; +- xdr_result = xdr_generic_ret; +- local = (bool_t (*)()) delete_policy_2_svc; ++ xdr_argument = (xdrproc_t)xdr_dpol_arg; ++ xdr_result = (xdrproc_t)xdr_generic_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))delete_policy_2_svc; + break; + + case MODIFY_POLICY: +- xdr_argument = xdr_mpol_arg; +- xdr_result = xdr_generic_ret; +- local = (bool_t (*)()) modify_policy_2_svc; ++ xdr_argument = (xdrproc_t)xdr_mpol_arg; ++ xdr_result = (xdrproc_t)xdr_generic_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))modify_policy_2_svc; + break; + + case GET_POLICY: +- xdr_argument = xdr_gpol_arg; +- xdr_result = xdr_gpol_ret; +- local = (bool_t (*)()) get_policy_2_svc; ++ xdr_argument = (xdrproc_t)xdr_gpol_arg; ++ xdr_result = (xdrproc_t)xdr_gpol_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))get_policy_2_svc; + break; + + case GET_POLS: +- xdr_argument = xdr_gpols_arg; +- xdr_result = xdr_gpols_ret; +- local = (bool_t (*)()) get_pols_2_svc; ++ xdr_argument = (xdrproc_t)xdr_gpols_arg; ++ xdr_result = (xdrproc_t)xdr_gpols_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))get_pols_2_svc; + break; + + case GET_PRIVS: +- xdr_argument = xdr_u_int32; +- xdr_result = xdr_getprivs_ret; +- local = (bool_t (*)()) get_privs_2_svc; ++ xdr_argument = (xdrproc_t)xdr_u_int32; ++ xdr_result = (xdrproc_t)xdr_getprivs_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))get_privs_2_svc; + break; + + case INIT: +- xdr_argument = xdr_u_int32; +- xdr_result = xdr_generic_ret; +- local = (bool_t (*)()) init_2_svc; ++ xdr_argument = (xdrproc_t)xdr_u_int32; ++ xdr_result = (xdrproc_t)xdr_generic_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))init_2_svc; + break; + + case CREATE_PRINCIPAL3: +- xdr_argument = xdr_cprinc3_arg; +- xdr_result = xdr_generic_ret; +- local = (bool_t (*)()) create_principal3_2_svc; ++ xdr_argument = (xdrproc_t)xdr_cprinc3_arg; ++ xdr_result = (xdrproc_t)xdr_generic_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))create_principal3_2_svc; + break; + + case CHPASS_PRINCIPAL3: +- xdr_argument = xdr_chpass3_arg; +- xdr_result = xdr_generic_ret; +- local = (bool_t (*)()) chpass_principal3_2_svc; ++ xdr_argument = (xdrproc_t)xdr_chpass3_arg; ++ xdr_result = (xdrproc_t)xdr_generic_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))chpass_principal3_2_svc; + break; + + case CHRAND_PRINCIPAL3: +- xdr_argument = xdr_chrand3_arg; +- xdr_result = xdr_chrand_ret; +- local = (bool_t (*)()) chrand_principal3_2_svc; ++ xdr_argument = (xdrproc_t)xdr_chrand3_arg; ++ xdr_result = (xdrproc_t)xdr_chrand_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))chrand_principal3_2_svc; + break; + + case SETKEY_PRINCIPAL3: +- xdr_argument = xdr_setkey3_arg; +- xdr_result = xdr_generic_ret; +- local = (bool_t (*)()) setkey_principal3_2_svc; ++ xdr_argument = (xdrproc_t)xdr_setkey3_arg; ++ xdr_result = (xdrproc_t)xdr_generic_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))setkey_principal3_2_svc; + break; + + case PURGEKEYS: +- xdr_argument = xdr_purgekeys_arg; +- xdr_result = xdr_generic_ret; +- local = (bool_t (*)()) purgekeys_2_svc; ++ xdr_argument = (xdrproc_t)xdr_purgekeys_arg; ++ xdr_result = (xdrproc_t)xdr_generic_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))purgekeys_2_svc; + break; + + case GET_STRINGS: +- xdr_argument = xdr_gstrings_arg; +- xdr_result = xdr_gstrings_ret; +- local = (bool_t (*)()) get_strings_2_svc; ++ xdr_argument = (xdrproc_t)xdr_gstrings_arg; ++ xdr_result = (xdrproc_t)xdr_gstrings_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))get_strings_2_svc; + break; + + case SET_STRING: +- xdr_argument = xdr_sstring_arg; +- xdr_result = xdr_generic_ret; +- local = (bool_t (*)()) set_string_2_svc; ++ xdr_argument = (xdrproc_t)xdr_sstring_arg; ++ xdr_result = (xdrproc_t)xdr_generic_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))set_string_2_svc; + break; + + case SETKEY_PRINCIPAL4: +- xdr_argument = xdr_setkey4_arg; +- xdr_result = xdr_generic_ret; +- local = (bool_t (*)()) setkey_principal4_2_svc; ++ xdr_argument = (xdrproc_t)xdr_setkey4_arg; ++ xdr_result = (xdrproc_t)xdr_generic_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))setkey_principal4_2_svc; + break; + + case EXTRACT_KEYS: +- xdr_argument = xdr_getpkeys_arg; +- xdr_result = xdr_getpkeys_ret; +- local = (bool_t (*)()) get_principal_keys_2_svc; ++ xdr_argument = (xdrproc_t)xdr_getpkeys_arg; ++ xdr_result = (xdrproc_t)xdr_getpkeys_ret; ++ local = (bool_t (*)(char *, void *, struct svc_req *))get_principal_keys_2_svc; + break; + + default: +@@ -253,7 +253,7 @@ void kadm_1(rqstp, transp) + return; + } + memset(&result, 0, sizeof(result)); +- retval = (*local)(&argument, &result, rqstp); ++ retval = (*local)((char *)&argument, &result, rqstp); + if (retval && !svc_sendreply(transp, xdr_result, (void *)&result)) { + krb5_klog_syslog(LOG_ERR, "WARNING! Unable to send function results, " + "continuing."); +diff --git a/src/kadmin/server/ovsec_kadmd.c b/src/kadmin/server/ovsec_kadmd.c +index b29a0f5b63..a9508af120 100644 +--- a/src/kadmin/server/ovsec_kadmd.c ++++ b/src/kadmin/server/ovsec_kadmd.c +@@ -77,7 +77,7 @@ static krb5_context context; + static char *progname; + + static void +-usage() ++usage(void) + { + fprintf(stderr, _("Usage: kadmind [-x db_args]* [-r realm] [-m] [-nofork] " + "[-port port-number]\n" +@@ -173,7 +173,7 @@ setup_loop(kadm5_config_params *params, int proponly, verto_ctx **ctx_out) + + /* Point GSSAPI at the KDB keytab so we don't need an actual file keytab. */ + static krb5_error_code +-setup_kdb_keytab() ++setup_kdb_keytab(void) + { + krb5_error_code ret; + +diff --git a/src/kdc/t_ndr.c b/src/kdc/t_ndr.c +index a3ac661bd0..c2a2414313 100644 +--- a/src/kdc/t_ndr.c ++++ b/src/kdc/t_ndr.c +@@ -173,7 +173,7 @@ test_dec_enc(uint8_t *blob, size_t len, char *name, int fail) + #define RUN_TEST_FAIL(blob) test_dec_enc(blob, sizeof(blob), #blob, 1) + + int +-main() ++main(void) + { + printf("Running NDR tests...\n"); + +diff --git a/src/kdc/t_replay.c b/src/kdc/t_replay.c +index 57aad886cd..c9c9d65946 100644 +--- a/src/kdc/t_replay.c ++++ b/src/kdc/t_replay.c +@@ -570,7 +570,8 @@ test_kdc_insert_lookaside_cache_expire(void **state) + assert_int_equal(total_size, e2_size); + } + +-int main() ++int ++main(void) + { + int ret; + +@@ -611,7 +612,8 @@ int main() + + #else /* NOCACHE */ + +-int main() ++int ++main(void) + { + return 0; + } +diff --git a/src/kprop/kpropd.c b/src/kprop/kpropd.c +index cb9785aaeb..f883ae2df8 100644 +--- a/src/kprop/kpropd.c ++++ b/src/kprop/kpropd.c +@@ -165,7 +165,7 @@ static kadm5_ret_t kadm5_get_kiprop_host_srv_name(krb5_context context, + char **host_service_name); + + static void +-usage() ++usage(void) + { + fprintf(stderr, + _("\nUsage: %s [-r realm] [-s keytab] [-d] [-D] [-S]\n" +diff --git a/src/kprop/kproplog.c b/src/kprop/kproplog.c +index 06af2a1d60..1f10aa6dc7 100644 +--- a/src/kprop/kproplog.c ++++ b/src/kprop/kproplog.c +@@ -24,7 +24,7 @@ + static char *progname; + + static void +-usage() ++usage(void) + { + fprintf(stderr, _("\nUsage: %s [-h] [-v] [-v] [-e num]\n\t%s -R\n\n"), + progname, progname); +@@ -393,7 +393,7 @@ print_update(kdb_hlog_t *ulog, uint32_t entry, uint32_t ulogentries, + print_attr(&upd.kdb_update.kdbe_t_val[j], verbose > 1 ? 1 : 0); + } + +- xdr_free(xdr_kdb_incr_update_t, (char *)&upd); ++ xdr_free((xdrproc_t)xdr_kdb_incr_update_t, (char *)&upd); + free(dbprinc); + } + } +diff --git a/src/lib/apputils/net-server.c b/src/lib/apputils/net-server.c +index 1bdc7932b6..75372d8940 100644 +--- a/src/lib/apputils/net-server.c ++++ b/src/lib/apputils/net-server.c +@@ -203,7 +203,7 @@ struct connection { + struct rpc_svc_data { + u_long prognum; + u_long versnum; +- void (*dispatch)(); ++ void (*dispatch)(struct svc_req *, SVCXPRT *); + }; + + struct bind_address { +@@ -255,7 +255,7 @@ free_sighup_context(verto_ctx *ctx, verto_ev *ev) + } + + krb5_error_code +-loop_setup_signals(verto_ctx *ctx, void *handle, void (*reset)()) ++loop_setup_signals(verto_ctx *ctx, void *handle, void (*reset)(void *)) + { + struct sighup_context *sc; + verto_ev *ev; +@@ -434,7 +434,8 @@ loop_add_tcp_address(int default_port, const char *addresses) + + krb5_error_code + loop_add_rpc_service(int default_port, const char *addresses, u_long prognum, +- u_long versnum, void (*dispatchfn)()) ++ u_long versnum, ++ void (*dispatchfn)(struct svc_req *, SVCXPRT *)) + { + struct rpc_svc_data svc; + +diff --git a/src/lib/crypto/builtin/aes/aes-gen.c b/src/lib/crypto/builtin/aes/aes-gen.c +index b528d3796d..4d7a16ee9a 100644 +--- a/src/lib/crypto/builtin/aes/aes-gen.c ++++ b/src/lib/crypto/builtin/aes/aes-gen.c +@@ -54,7 +54,8 @@ uint8_t test_case[NTESTS][4 * B] = { + aes_encrypt_ctx ctx; + aes_decrypt_ctx dctx; + +-static void init () ++static void ++init (void) + { + AES_RETURN r; + +@@ -71,7 +72,8 @@ static void hexdump(const unsigned char *ptr, size_t len) + printf ("%s%02X", (i % 16 == 0) ? "\n " : " ", ptr[i]); + } + +-static void fips_test () ++static void ++fips_test (void) + { + static const unsigned char fipskey[16] = { + 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, +@@ -254,7 +256,8 @@ cts_dec (unsigned char *out, unsigned char *in, unsigned char *iv, + memcpy(out+B, pn, len-B); + } + +-static void ecb_test () ++static void ++ecb_test (void) + { + unsigned int testno; + uint8_t output[4 * B], tmp[4 * B]; +@@ -285,7 +288,8 @@ static void ecb_test () + + unsigned char ivec[16] = { 0 }; + +-static void cbc_test () ++static void ++cbc_test (void) + { + unsigned int testno; + uint8_t output[4 * B], tmp[4 * B]; +@@ -314,7 +318,8 @@ static void cbc_test () + printf ("\n"); + } + +-static void cts_test () ++static void ++cts_test (void) + { + unsigned int testno; + uint8_t output[4 * B], tmp[4 * B]; +@@ -339,7 +344,8 @@ static void cts_test () + printf ("\n"); + } + +-int main () ++int ++main (void) + { + init (); + fips_test (); +diff --git a/src/lib/crypto/builtin/camellia/camellia-gen.c b/src/lib/crypto/builtin/camellia/camellia-gen.c +index 23b69c1741..6eca0e0525 100644 +--- a/src/lib/crypto/builtin/camellia/camellia-gen.c ++++ b/src/lib/crypto/builtin/camellia/camellia-gen.c +@@ -19,7 +19,8 @@ struct { + } test_case[NTESTS]; + camellia_ctx ctx, dctx; + +-static void init () ++static void ++init (void) + { + size_t i, j; + cam_rval r; +@@ -46,7 +47,8 @@ static void hexdump(const unsigned char *ptr, size_t len) + printf ("%s%02X", (i % 16 == 0) ? "\n " : " ", ptr[i]); + } + +-static void fips_test () ++static void ++fips_test (void) + { + static const unsigned char fipskey[16] = { + 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef, +@@ -234,7 +236,8 @@ cts_dec (unsigned char *out, unsigned char *in, unsigned char *iv, + memcpy(out+B, pn, len-B); + } + +-static void ecb_test () ++static void ++ecb_test (void) + { + size_t testno; + unsigned char tmp[4*B]; +@@ -265,7 +268,8 @@ static void ecb_test () + + unsigned char ivec[16] = { 0 }; + +-static void cbc_test () ++static void ++cbc_test (void) + { + size_t testno; + unsigned char tmp[4*B]; +@@ -294,7 +298,8 @@ static void cbc_test () + printf ("\n"); + } + +-static void cts_test () ++static void ++cts_test (void) + { + size_t testno; + unsigned char tmp[4*B]; +@@ -319,7 +324,8 @@ static void cts_test () + printf ("\n"); + } + +-int main () ++int ++main (void) + { + init (); + fips_test (); +diff --git a/src/lib/crypto/builtin/sha1/t_shs.c b/src/lib/crypto/builtin/sha1/t_shs.c +index c1d18f5571..a668cb0c06 100644 +--- a/src/lib/crypto/builtin/sha1/t_shs.c ++++ b/src/lib/crypto/builtin/sha1/t_shs.c +@@ -29,9 +29,8 @@ static SHS_LONG shsTestResults[][ 5 ] = { + }; + #endif /* NEW_SHS */ + +-static int compareSHSresults(shsInfo, shsTestLevel) +- SHS_INFO *shsInfo; +- int shsTestLevel; ++static int ++compareSHSresults(SHS_INFO *shsInfo, int shsTestLevel) + { + int i, fail = 0; + +@@ -55,7 +54,7 @@ static int compareSHSresults(shsInfo, shsTestLevel) + } + + int +-main() ++main(int argc, char *argv[]) + { + SHS_INFO shsInfo; + unsigned int i; +diff --git a/src/lib/crypto/builtin/sha1/t_shs3.c b/src/lib/crypto/builtin/sha1/t_shs3.c +index 7aa0bbdee3..87caf7fa37 100644 +--- a/src/lib/crypto/builtin/sha1/t_shs3.c ++++ b/src/lib/crypto/builtin/sha1/t_shs3.c +@@ -55,9 +55,7 @@ int mode; + int Dflag; + + int +-main(argc,argv) +- int argc; +- char **argv; ++main(int argc, char **argv) + { + char *argp; + +@@ -131,8 +129,7 @@ static void process(void) + + #ifndef shsDigest + static unsigned char * +-shsDigest(si) +- SHS_INFO *si; ++shsDigest(SHS_INFO *si) + { + longReverse(si->digest, SHS_DIGESTSIZE); + return (unsigned char*) si->digest; +diff --git a/src/lib/crypto/crypto_tests/aes-test.c b/src/lib/crypto/crypto_tests/aes-test.c +index a7382a48ad..d26f711b8d 100644 +--- a/src/lib/crypto/crypto_tests/aes-test.c ++++ b/src/lib/crypto/crypto_tests/aes-test.c +@@ -37,14 +37,14 @@ static char plain[16], cipher[16], zero[16]; + + static krb5_keyblock enc_key; + static krb5_data ivec; +-static void init() ++static void init(void) + { + enc_key.contents = (krb5_octet *)key; + enc_key.length = 16; + ivec.data = zero; + ivec.length = 16; + } +-static void enc() ++static void enc(void) + { + krb5_key k; + krb5_crypto_iov iov; +@@ -93,7 +93,7 @@ static void vk_test_1(int len, krb5_enctype etype) + } + printf("\n==========\n"); + } +-static void vk_test() ++static void vk_test(void) + { + vk_test_1(16, ENCTYPE_AES128_CTS_HMAC_SHA1_96); + vk_test_1(32, ENCTYPE_AES256_CTS_HMAC_SHA1_96); +@@ -119,7 +119,7 @@ static void vt_test_1(int len, krb5_enctype etype) + } + printf("\n==========\n"); + } +-static void vt_test() ++static void vt_test(void) + { + vt_test_1(16, ENCTYPE_AES128_CTS_HMAC_SHA1_96); + vt_test_1(32, ENCTYPE_AES256_CTS_HMAC_SHA1_96); +diff --git a/src/lib/crypto/crypto_tests/camellia-test.c b/src/lib/crypto/crypto_tests/camellia-test.c +index 23d14667e1..ca6579f7d1 100644 +--- a/src/lib/crypto/crypto_tests/camellia-test.c ++++ b/src/lib/crypto/crypto_tests/camellia-test.c +@@ -35,14 +35,14 @@ static char plain[16], cipher[16], zero[16]; + + static krb5_keyblock enc_key; + static krb5_data ivec; +-static void init() ++static void init(void) + { + enc_key.contents = (unsigned char *)key; + enc_key.length = 16; + ivec.data = zero; + ivec.length = 16; + } +-static void enc() ++static void enc(void) + { + krb5_key k; + krb5_crypto_iov iov; +@@ -91,7 +91,7 @@ static void vk_test_1(int len) + } + printf("\n==========\n"); + } +-static void vk_test() ++static void vk_test(void) + { + vk_test_1(16); + vk_test_1(32); +@@ -117,7 +117,7 @@ static void vt_test_1(int len, krb5_enctype etype) + } + printf("\n==========\n"); + } +-static void vt_test() ++static void vt_test(void) + { + vt_test_1(16, ENCTYPE_CAMELLIA128_CTS_CMAC); + vt_test_1(32, ENCTYPE_CAMELLIA256_CTS_CMAC); +diff --git a/src/lib/crypto/crypto_tests/t_cf2.c b/src/lib/crypto/crypto_tests/t_cf2.c +index 67c9dcdee2..4c894ad09c 100644 +--- a/src/lib/crypto/crypto_tests/t_cf2.c ++++ b/src/lib/crypto/crypto_tests/t_cf2.c +@@ -46,7 +46,9 @@ + #include + #include + +-int main () { ++int ++main(void) ++{ + krb5_error_code ret; + char pepper1[1025], pepper2[1025]; + krb5_keyblock *k1 = NULL, *k2 = NULL, *out = NULL; +diff --git a/src/lib/crypto/crypto_tests/t_cts.c b/src/lib/crypto/crypto_tests/t_cts.c +index fe505169f3..f8a5a534b2 100644 +--- a/src/lib/crypto/crypto_tests/t_cts.c ++++ b/src/lib/crypto/crypto_tests/t_cts.c +@@ -77,7 +77,7 @@ static void printk(const char *descr, krb5_keyblock *k) { + printd(descr, &d); + } + +-static void test_cts() ++static void test_cts(void) + { + static const char input[4*16] = + "I would like the General Gau's Chicken, please, and wonton soup."; +diff --git a/src/lib/crypto/crypto_tests/t_encrypt.c b/src/lib/crypto/crypto_tests/t_encrypt.c +index 290a72e1e0..83bc98a2f1 100644 +--- a/src/lib/crypto/crypto_tests/t_encrypt.c ++++ b/src/lib/crypto/crypto_tests/t_encrypt.c +@@ -87,7 +87,7 @@ display(const char *msg, const krb5_data *d) + } + + int +-main () ++main(void) + { + krb5_context context = 0; + krb5_data in, in2, out, out2, check, check2, state, signdata; +diff --git a/src/lib/crypto/crypto_tests/t_fork.c b/src/lib/crypto/crypto_tests/t_fork.c +index 428fc8a6a1..8be7474227 100644 +--- a/src/lib/crypto/crypto_tests/t_fork.c ++++ b/src/lib/crypto/crypto_tests/t_fork.c +@@ -55,7 +55,7 @@ prepare_enc_data(krb5_key key, size_t in_len, krb5_enc_data *enc_data) + } + + int +-main() ++main(void) + { + krb5_keyblock kb_aes, kb_rc4; + krb5_key key_aes, key_rc4; +diff --git a/src/lib/crypto/crypto_tests/t_hmac.c b/src/lib/crypto/crypto_tests/t_hmac.c +index da359cb494..e40136bff0 100644 +--- a/src/lib/crypto/crypto_tests/t_hmac.c ++++ b/src/lib/crypto/crypto_tests/t_hmac.c +@@ -122,7 +122,8 @@ static krb5_error_code hmac1(const struct krb5_hash_provider *h, + return err; + } + +-static void test_hmac() ++static void ++test_hmac(void) + { + krb5_keyblock key; + krb5_data in, out; +diff --git a/src/lib/crypto/crypto_tests/t_mddriver.c b/src/lib/crypto/crypto_tests/t_mddriver.c +index ad65d03156..035f825bbc 100644 +--- a/src/lib/crypto/crypto_tests/t_mddriver.c ++++ b/src/lib/crypto/crypto_tests/t_mddriver.c +@@ -111,9 +111,8 @@ struct md_test_entry md_test_suite[] = { + -t - runs time trial + -x - runs test script + */ +-int main (argc, argv) +- int argc; +- char *argv[]; ++int ++main(int argc, char *argv[]) + { + int i; + +@@ -128,10 +127,8 @@ int main (argc, argv) + return (0); + } + +-static void MDHash (bytes, len, count, out) +- char *bytes; +- size_t len, count; +- unsigned char *out; ++static void ++MDHash(char *bytes, size_t len, size_t count, unsigned char *out) + { + krb5_crypto_iov *iov; + krb5_data outdata = make_data (out, MDProvider.hashsize); +@@ -150,8 +147,8 @@ static void MDHash (bytes, len, count, out) + + /* Digests a string and prints the result. + */ +-static void MDString (string) +- char *string; ++static void ++MDString(char *string) + { + unsigned char digest[16]; + +@@ -164,7 +161,8 @@ static void MDString (string) + /* Measures the time to digest TEST_BLOCK_COUNT TEST_BLOCK_LEN-byte + blocks. + */ +-static void MDTimeTrial () ++static void ++MDTimeTrial(void) + { + time_t endTime, startTime; + unsigned char block[TEST_BLOCK_LEN], digest[16]; +@@ -197,7 +195,8 @@ static void MDTimeTrial () + + /* Digests a reference suite of strings and prints the results. + */ +-static void MDTestSuite () ++static void ++MDTestSuite(void) + { + #ifdef HAVE_TEST_SUITE + struct md_test_entry *entry; +@@ -246,8 +245,8 @@ static void MDTestSuite () + + /* Prints a message digest in hexadecimal. + */ +-static void MDPrint (digest) +- unsigned char digest[16]; ++static void ++MDPrint(unsigned char digest[16]) + { + unsigned int i; + +diff --git a/src/lib/crypto/crypto_tests/t_nfold.c b/src/lib/crypto/crypto_tests/t_nfold.c +index b94353c221..a741b61e0c 100644 +--- a/src/lib/crypto/crypto_tests/t_nfold.c ++++ b/src/lib/crypto/crypto_tests/t_nfold.c +@@ -33,17 +33,20 @@ + + #define ASIZE(ARRAY) (sizeof(ARRAY)/sizeof(ARRAY[0])) + +-static void printhex (size_t len, const unsigned char *p) ++static void ++printhex(size_t len, const unsigned char *p) + { + while (len--) + printf ("%02x", 0xff & *p++); + } + +-static void printstringhex (const unsigned char *p) { ++static void ++printstringhex(const unsigned char *p) { + printhex (strlen ((const char *) p), p); + } + +-static void rfc_tests () ++static void ++rfc_tests(void) + { + unsigned i; + struct { +@@ -92,7 +95,8 @@ static void rfc_tests () + } + } + +-static void fold_kerberos(unsigned int nbytes) ++static void ++fold_kerberos(unsigned int nbytes) + { + unsigned char cipher_text[300]; + unsigned int j; +@@ -125,9 +129,7 @@ unsigned char nfold_192[4][24] = { + }; + + int +-main(argc, argv) +- int argc; +- char *argv[]; ++main(int argc, char *argv[]) + { + unsigned char cipher_text[64]; + unsigned int i, j; +diff --git a/src/lib/crypto/crypto_tests/t_prf.c b/src/lib/crypto/crypto_tests/t_prf.c +index d9877bd1f7..6fa0afb183 100644 +--- a/src/lib/crypto/crypto_tests/t_prf.c ++++ b/src/lib/crypto/crypto_tests/t_prf.c +@@ -116,7 +116,7 @@ struct test { + }; + + int +-main() ++main(void) + { + krb5_error_code ret; + krb5_data output; +diff --git a/src/lib/crypto/crypto_tests/t_sha2.c b/src/lib/crypto/crypto_tests/t_sha2.c +index e6fa584982..776c4e964f 100644 +--- a/src/lib/crypto/crypto_tests/t_sha2.c ++++ b/src/lib/crypto/crypto_tests/t_sha2.c +@@ -137,7 +137,7 @@ hash_test(const struct krb5_hash_provider *hash, struct test *tests) + } + + int +-main() ++main(void) + { + hash_test(&krb5int_hash_sha256, sha256_tests); + hash_test(&krb5int_hash_sha384, sha384_tests); +diff --git a/src/lib/gssapi/generic/t_seqstate.c b/src/lib/gssapi/generic/t_seqstate.c +index 8f44fcf3ed..4df1ed6b9c 100644 +--- a/src/lib/gssapi/generic/t_seqstate.c ++++ b/src/lib/gssapi/generic/t_seqstate.c +@@ -164,7 +164,7 @@ struct test { + }; + + int +-main() ++main(void) + { + size_t i, j; + enum width w; +diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c +index d7c2ad321e..90a9ad2d9d 100644 +--- a/src/lib/gssapi/krb5/accept_sec_context.c ++++ b/src/lib/gssapi/krb5/accept_sec_context.c +@@ -160,11 +160,8 @@ create_constrained_deleg_creds(OM_uint32 *minor_status, + + /* Decode, decrypt and store the forwarded creds in the local ccache. */ + static krb5_error_code +-rd_and_store_for_creds(context, auth_context, inbuf, out_cred) +- krb5_context context; +- krb5_auth_context auth_context; +- krb5_data *inbuf; +- krb5_gss_cred_id_t *out_cred; ++rd_and_store_for_creds(krb5_context context, krb5_auth_context auth_context, ++ krb5_data *inbuf, krb5_gss_cred_id_t *out_cred) + { + krb5_creds ** creds = NULL; + krb5_error_code retval; +@@ -286,20 +283,12 @@ cleanup: + * Performs third leg of DCE authentication + */ + static OM_uint32 +-kg_accept_dce(minor_status, context_handle, verifier_cred_handle, +- input_token, input_chan_bindings, src_name, mech_type, +- output_token, ret_flags, time_rec, delegated_cred_handle) +- OM_uint32 *minor_status; +- gss_ctx_id_t *context_handle; +- gss_cred_id_t verifier_cred_handle; +- gss_buffer_t input_token; +- gss_channel_bindings_t input_chan_bindings; +- gss_name_t *src_name; +- gss_OID *mech_type; +- gss_buffer_t output_token; +- OM_uint32 *ret_flags; +- OM_uint32 *time_rec; +- gss_cred_id_t *delegated_cred_handle; ++kg_accept_dce(OM_uint32 *minor_status, gss_ctx_id_t *context_handle, ++ gss_cred_id_t verifier_cred_handle, gss_buffer_t input_token, ++ gss_channel_bindings_t input_chan_bindings, gss_name_t *src_name, ++ gss_OID *mech_type, gss_buffer_t output_token, ++ OM_uint32 *ret_flags, OM_uint32 *time_rec, ++ gss_cred_id_t *delegated_cred_handle) + { + krb5_error_code code; + krb5_gss_ctx_id_rec *ctx = 0; +@@ -637,23 +626,13 @@ fail: + } + + static OM_uint32 +-kg_accept_krb5(minor_status, context_handle, +- verifier_cred_handle, input_token, +- input_chan_bindings, src_name, mech_type, +- output_token, ret_flags, time_rec, +- delegated_cred_handle, exts) +- OM_uint32 *minor_status; +- gss_ctx_id_t *context_handle; +- gss_cred_id_t verifier_cred_handle; +- gss_buffer_t input_token; +- gss_channel_bindings_t input_chan_bindings; +- gss_name_t *src_name; +- gss_OID *mech_type; +- gss_buffer_t output_token; +- OM_uint32 *ret_flags; +- OM_uint32 *time_rec; +- gss_cred_id_t *delegated_cred_handle; +- krb5_gss_ctx_ext_t exts; ++kg_accept_krb5(OM_uint32 *minor_status, gss_ctx_id_t *context_handle, ++ gss_cred_id_t verifier_cred_handle, gss_buffer_t input_token, ++ gss_channel_bindings_t input_chan_bindings, ++ gss_name_t *src_name, gss_OID *mech_type, ++ gss_buffer_t output_token, OM_uint32 *ret_flags, ++ OM_uint32 *time_rec, gss_cred_id_t *delegated_cred_handle, ++ krb5_gss_ctx_ext_t exts) + { + krb5_context context; + unsigned char *ptr; +@@ -1309,22 +1288,15 @@ krb5_gss_accept_sec_context_ext( + } + + OM_uint32 KRB5_CALLCONV +-krb5_gss_accept_sec_context(minor_status, context_handle, +- verifier_cred_handle, input_token, +- input_chan_bindings, src_name, mech_type, +- output_token, ret_flags, time_rec, +- delegated_cred_handle) +- OM_uint32 *minor_status; +- gss_ctx_id_t *context_handle; +- gss_cred_id_t verifier_cred_handle; +- gss_buffer_t input_token; +- gss_channel_bindings_t input_chan_bindings; +- gss_name_t *src_name; +- gss_OID *mech_type; +- gss_buffer_t output_token; +- OM_uint32 *ret_flags; +- OM_uint32 *time_rec; +- gss_cred_id_t *delegated_cred_handle; ++krb5_gss_accept_sec_context(OM_uint32 *minor_status, ++ gss_ctx_id_t *context_handle, ++ gss_cred_id_t verifier_cred_handle, ++ gss_buffer_t input_token, ++ gss_channel_bindings_t input_chan_bindings, ++ gss_name_t *src_name, gss_OID *mech_type, ++ gss_buffer_t output_token, OM_uint32 *ret_flags, ++ OM_uint32 *time_rec, ++ gss_cred_id_t *delegated_cred_handle) + { + krb5_gss_ctx_ext_rec exts; + +diff --git a/src/lib/gssapi/krb5/compare_name.c b/src/lib/gssapi/krb5/compare_name.c +index 3f3788d2bf..3aa5a0d79f 100644 +--- a/src/lib/gssapi/krb5/compare_name.c ++++ b/src/lib/gssapi/krb5/compare_name.c +@@ -28,11 +28,8 @@ + #include "gssapiP_krb5.h" + + OM_uint32 KRB5_CALLCONV +-krb5_gss_compare_name(minor_status, name1, name2, name_equal) +- OM_uint32 *minor_status; +- gss_name_t name1; +- gss_name_t name2; +- int *name_equal; ++krb5_gss_compare_name(OM_uint32 *minor_status, gss_name_t name1, ++ gss_name_t name2, int *name_equal) + { + krb5_context context; + krb5_error_code code; +diff --git a/src/lib/gssapi/krb5/context_time.c b/src/lib/gssapi/krb5/context_time.c +index 226de05f51..0ab885deca 100644 +--- a/src/lib/gssapi/krb5/context_time.c ++++ b/src/lib/gssapi/krb5/context_time.c +@@ -28,10 +28,8 @@ + */ + + OM_uint32 KRB5_CALLCONV +-krb5_gss_context_time(minor_status, context_handle, time_rec) +- OM_uint32 *minor_status; +- gss_ctx_id_t context_handle; +- OM_uint32 *time_rec; ++krb5_gss_context_time(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ OM_uint32 *time_rec) + { + krb5_error_code code; + krb5_gss_ctx_id_rec *ctx; +diff --git a/src/lib/gssapi/krb5/delete_sec_context.c b/src/lib/gssapi/krb5/delete_sec_context.c +index 4b9dfae0d5..92e84b79c5 100644 +--- a/src/lib/gssapi/krb5/delete_sec_context.c ++++ b/src/lib/gssapi/krb5/delete_sec_context.c +@@ -28,10 +28,9 @@ + */ + + OM_uint32 KRB5_CALLCONV +-krb5_gss_delete_sec_context(minor_status, context_handle, output_token) +- OM_uint32 *minor_status; +- gss_ctx_id_t *context_handle; +- gss_buffer_t output_token; ++krb5_gss_delete_sec_context(OM_uint32 *minor_status, ++ gss_ctx_id_t *context_handle, ++ gss_buffer_t output_token) + { + krb5_context context; + krb5_gss_ctx_id_rec *ctx; +diff --git a/src/lib/gssapi/krb5/disp_name.c b/src/lib/gssapi/krb5/disp_name.c +index b097bf0e21..75fef01238 100644 +--- a/src/lib/gssapi/krb5/disp_name.c ++++ b/src/lib/gssapi/krb5/disp_name.c +@@ -24,12 +24,9 @@ + #include "gssapiP_krb5.h" + + OM_uint32 KRB5_CALLCONV +-krb5_gss_display_name(minor_status, input_name, output_name_buffer, +- output_name_type) +- OM_uint32 *minor_status; +- gss_name_t input_name; +- gss_buffer_t output_name_buffer; +- gss_OID *output_name_type; ++krb5_gss_display_name(OM_uint32 *minor_status, gss_name_t input_name, ++ gss_buffer_t output_name_buffer, ++ gss_OID *output_name_type) + { + krb5_context context; + krb5_error_code code; +diff --git a/src/lib/gssapi/krb5/disp_status.c b/src/lib/gssapi/krb5/disp_status.c +index 6ff62a9d84..71000b7a45 100644 +--- a/src/lib/gssapi/krb5/disp_status.c ++++ b/src/lib/gssapi/krb5/disp_status.c +@@ -154,14 +154,9 @@ void krb5_gss_delete_error_info(void *p) + /**/ + + OM_uint32 KRB5_CALLCONV +-krb5_gss_display_status(minor_status, status_value, status_type, +- mech_type, message_context, status_string) +- OM_uint32 *minor_status; +- OM_uint32 status_value; +- int status_type; +- gss_OID mech_type; +- OM_uint32 *message_context; +- gss_buffer_t status_string; ++krb5_gss_display_status(OM_uint32 *minor_status, OM_uint32 status_value, ++ int status_type, gss_OID mech_type, ++ OM_uint32 *message_context, gss_buffer_t status_string) + { + status_string->length = 0; + status_string->value = NULL; +diff --git a/src/lib/gssapi/krb5/export_sec_context.c b/src/lib/gssapi/krb5/export_sec_context.c +index 44e50080ab..9730e0597f 100644 +--- a/src/lib/gssapi/krb5/export_sec_context.c ++++ b/src/lib/gssapi/krb5/export_sec_context.c +@@ -27,10 +27,9 @@ + #include "gssapiP_krb5.h" + #ifndef LEAN_CLIENT + OM_uint32 KRB5_CALLCONV +-krb5_gss_export_sec_context(minor_status, context_handle, interprocess_token) +- OM_uint32 *minor_status; +- gss_ctx_id_t *context_handle; +- gss_buffer_t interprocess_token; ++krb5_gss_export_sec_context(OM_uint32 *minor_status, ++ gss_ctx_id_t *context_handle, ++ gss_buffer_t interprocess_token) + { + krb5_context context = NULL; + krb5_error_code kret; +diff --git a/src/lib/gssapi/krb5/gssapi_krb5.c b/src/lib/gssapi/krb5/gssapi_krb5.c +index 1e62b07cde..370b7d152a 100644 +--- a/src/lib/gssapi/krb5/gssapi_krb5.c ++++ b/src/lib/gssapi/krb5/gssapi_krb5.c +@@ -197,9 +197,7 @@ g_set kg_vdb = G_SET_INIT; + * so handling the expiration/invalidation condition here isn't needed. + */ + OM_uint32 +-kg_get_defcred(minor_status, cred) +- OM_uint32 *minor_status; +- gss_cred_id_t *cred; ++kg_get_defcred(OM_uint32 *minor_status, gss_cred_id_t *cred) + { + OM_uint32 major; + +diff --git a/src/lib/gssapi/krb5/import_name.c b/src/lib/gssapi/krb5/import_name.c +index f64635a202..cc6883b5fe 100644 +--- a/src/lib/gssapi/krb5/import_name.c ++++ b/src/lib/gssapi/krb5/import_name.c +@@ -120,12 +120,8 @@ parse_hostbased(const char *str, size_t len, + } + + OM_uint32 KRB5_CALLCONV +-krb5_gss_import_name(minor_status, input_name_buffer, +- input_name_type, output_name) +- OM_uint32 *minor_status; +- gss_buffer_t input_name_buffer; +- gss_OID input_name_type; +- gss_name_t *output_name; ++krb5_gss_import_name(OM_uint32 *minor_status, gss_buffer_t input_name_buffer, ++ gss_OID input_name_type, gss_name_t *output_name) + { + krb5_context context; + krb5_principal princ = NULL; +diff --git a/src/lib/gssapi/krb5/import_sec_context.c b/src/lib/gssapi/krb5/import_sec_context.c +index 7d26f4df87..e39c036b80 100644 +--- a/src/lib/gssapi/krb5/import_sec_context.c ++++ b/src/lib/gssapi/krb5/import_sec_context.c +@@ -32,8 +32,7 @@ + * Fix up the OID of the mechanism so that uses the static version of + * the OID if possible. + */ +-gss_OID krb5_gss_convert_static_mech_oid(oid) +- gss_OID oid; ++gss_OID krb5_gss_convert_static_mech_oid(gss_OID oid) + { + const gss_OID_desc *p; + OM_uint32 minor_status; +@@ -49,10 +48,9 @@ gss_OID krb5_gss_convert_static_mech_oid(oid) + } + + OM_uint32 KRB5_CALLCONV +-krb5_gss_import_sec_context(minor_status, interprocess_token, context_handle) +- OM_uint32 *minor_status; +- gss_buffer_t interprocess_token; +- gss_ctx_id_t *context_handle; ++krb5_gss_import_sec_context(OM_uint32 *minor_status, ++ gss_buffer_t interprocess_token, ++ gss_ctx_id_t *context_handle) + { + krb5_context context; + krb5_error_code kret = 0; +diff --git a/src/lib/gssapi/krb5/indicate_mechs.c b/src/lib/gssapi/krb5/indicate_mechs.c +index 45538cb779..49d55e6217 100644 +--- a/src/lib/gssapi/krb5/indicate_mechs.c ++++ b/src/lib/gssapi/krb5/indicate_mechs.c +@@ -29,9 +29,7 @@ + #include "mglueP.h" + + OM_uint32 KRB5_CALLCONV +-krb5_gss_indicate_mechs(minor_status, mech_set) +- OM_uint32 *minor_status; +- gss_OID_set *mech_set; ++krb5_gss_indicate_mechs(OM_uint32 *minor_status, gss_OID_set *mech_set) + { + return generic_gss_copy_oid_set(minor_status, kg_all_mechs, mech_set); + } +diff --git a/src/lib/gssapi/krb5/init_sec_context.c b/src/lib/gssapi/krb5/init_sec_context.c +index 5748b8434c..0397fe1dfd 100644 +--- a/src/lib/gssapi/krb5/init_sec_context.c ++++ b/src/lib/gssapi/krb5/init_sec_context.c +@@ -117,14 +117,10 @@ int krb5_gss_dbg_client_expcreds = 0; + * Common code which fetches the correct krb5 credentials from the + * ccache. + */ +-static krb5_error_code get_credentials(context, cred, server, now, +- endtime, out_creds) +- krb5_context context; +- krb5_gss_cred_id_t cred; +- krb5_gss_name_t server; +- krb5_timestamp now; +- krb5_timestamp endtime; +- krb5_creds **out_creds; ++static krb5_error_code ++get_credentials(krb5_context context, krb5_gss_cred_id_t cred, ++ krb5_gss_name_t server, krb5_timestamp now, ++ krb5_timestamp endtime, krb5_creds **out_creds) + { + krb5_error_code code; + krb5_creds in_creds, evidence_creds, mcreds, *result_creds = NULL; +@@ -365,17 +361,11 @@ cleanup: + } + + static krb5_error_code +-make_ap_req_v1(context, ctx, cred, k_cred, ad_context, +- chan_bindings, mech_type, token, exts) +- krb5_context context; +- krb5_gss_ctx_id_rec *ctx; +- krb5_gss_cred_id_t cred; +- krb5_creds *k_cred; +- krb5_authdata_context ad_context; +- gss_channel_bindings_t chan_bindings; +- gss_OID mech_type; +- gss_buffer_t token; +- krb5_gss_ctx_ext_t exts; ++make_ap_req_v1(krb5_context context, krb5_gss_ctx_id_rec *ctx, ++ krb5_gss_cred_id_t cred, krb5_creds *k_cred, ++ krb5_authdata_context ad_context, ++ gss_channel_bindings_t chan_bindings, gss_OID mech_type, ++ gss_buffer_t token, krb5_gss_ctx_ext_t exts) + { + krb5_flags mk_req_flags = 0; + krb5_error_code code; +@@ -1048,24 +1038,15 @@ krb5int_gss_use_kdc_context(OM_uint32 *minor_status, + #endif + + OM_uint32 KRB5_CALLCONV +-krb5_gss_init_sec_context(minor_status, claimant_cred_handle, +- context_handle, target_name, mech_type, +- req_flags, time_req, input_chan_bindings, +- input_token, actual_mech_type, output_token, +- ret_flags, time_rec) +- OM_uint32 *minor_status; +- gss_cred_id_t claimant_cred_handle; +- gss_ctx_id_t *context_handle; +- gss_name_t target_name; +- gss_OID mech_type; +- OM_uint32 req_flags; +- OM_uint32 time_req; +- gss_channel_bindings_t input_chan_bindings; +- gss_buffer_t input_token; +- gss_OID *actual_mech_type; +- gss_buffer_t output_token; +- OM_uint32 *ret_flags; +- OM_uint32 *time_rec; ++krb5_gss_init_sec_context(OM_uint32 *minor_status, ++ gss_cred_id_t claimant_cred_handle, ++ gss_ctx_id_t *context_handle, ++ gss_name_t target_name, gss_OID mech_type, ++ OM_uint32 req_flags, OM_uint32 time_req, ++ gss_channel_bindings_t input_chan_bindings, ++ gss_buffer_t input_token, gss_OID *actual_mech_type, ++ gss_buffer_t output_token, OM_uint32 *ret_flags, ++ OM_uint32 *time_rec) + { + krb5_gss_ctx_ext_rec exts; + +diff --git a/src/lib/gssapi/krb5/inq_context.c b/src/lib/gssapi/krb5/inq_context.c +index 97678e3ec5..f8229f9750 100644 +--- a/src/lib/gssapi/krb5/inq_context.c ++++ b/src/lib/gssapi/krb5/inq_context.c +@@ -78,18 +78,11 @@ + #include "gssapiP_krb5.h" + + OM_uint32 KRB5_CALLCONV +-krb5_gss_inquire_context(minor_status, context_handle, initiator_name, +- acceptor_name, lifetime_rec, mech_type, ret_flags, +- locally_initiated, opened) +- OM_uint32 *minor_status; +- gss_ctx_id_t context_handle; +- gss_name_t *initiator_name; +- gss_name_t *acceptor_name; +- OM_uint32 *lifetime_rec; +- gss_OID *mech_type; +- OM_uint32 *ret_flags; +- int *locally_initiated; +- int *opened; ++krb5_gss_inquire_context(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ gss_name_t *initiator_name, gss_name_t *acceptor_name, ++ OM_uint32 *lifetime_rec, gss_OID *mech_type, ++ OM_uint32 *ret_flags, int *locally_initiated, ++ int *opened) + { + krb5_context context; + krb5_error_code code; +diff --git a/src/lib/gssapi/krb5/inq_cred.c b/src/lib/gssapi/krb5/inq_cred.c +index 0e675959a3..e968f8ad32 100644 +--- a/src/lib/gssapi/krb5/inq_cred.c ++++ b/src/lib/gssapi/krb5/inq_cred.c +@@ -73,14 +73,9 @@ + #include "gssapiP_krb5.h" + + OM_uint32 KRB5_CALLCONV +-krb5_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret, +- cred_usage, mechanisms) +- OM_uint32 *minor_status; +- gss_cred_id_t cred_handle; +- gss_name_t *name; +- OM_uint32 *lifetime_ret; +- gss_cred_usage_t *cred_usage; +- gss_OID_set *mechanisms; ++krb5_gss_inquire_cred(OM_uint32 *minor_status, gss_cred_id_t cred_handle, ++ gss_name_t *name, OM_uint32 *lifetime_ret, ++ gss_cred_usage_t *cred_usage, gss_OID_set *mechanisms) + { + krb5_context context; + gss_cred_id_t defcred = GSS_C_NO_CREDENTIAL; +@@ -209,16 +204,11 @@ cleanup: + + /* V2 interface */ + OM_uint32 KRB5_CALLCONV +-krb5_gss_inquire_cred_by_mech(minor_status, cred_handle, +- mech_type, name, initiator_lifetime, +- acceptor_lifetime, cred_usage) +- OM_uint32 *minor_status; +- gss_cred_id_t cred_handle; +- gss_OID mech_type; +- gss_name_t *name; +- OM_uint32 *initiator_lifetime; +- OM_uint32 *acceptor_lifetime; +- gss_cred_usage_t *cred_usage; ++krb5_gss_inquire_cred_by_mech(OM_uint32 *minor_status, ++ gss_cred_id_t cred_handle, gss_OID mech_type, ++ gss_name_t *name, OM_uint32 *initiator_lifetime, ++ OM_uint32 *acceptor_lifetime, ++ gss_cred_usage_t *cred_usage) + { + krb5_gss_cred_id_t cred; + OM_uint32 lifetime; +diff --git a/src/lib/gssapi/krb5/inq_names.c b/src/lib/gssapi/krb5/inq_names.c +index b326adbb5f..4a3709be4b 100644 +--- a/src/lib/gssapi/krb5/inq_names.c ++++ b/src/lib/gssapi/krb5/inq_names.c +@@ -27,10 +27,8 @@ + #include "gssapiP_krb5.h" + + OM_uint32 KRB5_CALLCONV +-krb5_gss_inquire_names_for_mech(minor_status, mechanism, name_types) +- OM_uint32 *minor_status; +- gss_OID mechanism; +- gss_OID_set *name_types; ++krb5_gss_inquire_names_for_mech(OM_uint32 *minor_status, gss_OID mechanism, ++ gss_OID_set *name_types) + { + OM_uint32 major, minor; + +diff --git a/src/lib/gssapi/krb5/k5seal.c b/src/lib/gssapi/krb5/k5seal.c +index 0e5d10b115..1148f6929b 100644 +--- a/src/lib/gssapi/krb5/k5seal.c ++++ b/src/lib/gssapi/krb5/k5seal.c +@@ -271,16 +271,10 @@ make_seal_token_v1 (krb5_context context, + and do not encode the ENC_TYPE, MSG_LENGTH, or MSG_TEXT fields */ + + OM_uint32 +-kg_seal(minor_status, context_handle, conf_req_flag, qop_req, +- input_message_buffer, conf_state, output_message_buffer, toktype) +- OM_uint32 *minor_status; +- gss_ctx_id_t context_handle; +- int conf_req_flag; +- gss_qop_t qop_req; +- gss_buffer_t input_message_buffer; +- int *conf_state; +- gss_buffer_t output_message_buffer; +- int toktype; ++kg_seal(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ int conf_req_flag, gss_qop_t qop_req, ++ gss_buffer_t input_message_buffer, int *conf_state, ++ gss_buffer_t output_message_buffer, int toktype) + { + krb5_gss_ctx_id_rec *ctx; + krb5_error_code code; +@@ -342,16 +336,10 @@ kg_seal(minor_status, context_handle, conf_req_flag, qop_req, + } + + OM_uint32 KRB5_CALLCONV +-krb5_gss_wrap(minor_status, context_handle, conf_req_flag, +- qop_req, input_message_buffer, conf_state, +- output_message_buffer) +- OM_uint32 *minor_status; +- gss_ctx_id_t context_handle; +- int conf_req_flag; +- gss_qop_t qop_req; +- gss_buffer_t input_message_buffer; +- int *conf_state; +- gss_buffer_t output_message_buffer; ++krb5_gss_wrap(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ int conf_req_flag, gss_qop_t qop_req, ++ gss_buffer_t input_message_buffer, int *conf_state, ++ gss_buffer_t output_message_buffer) + { + return(kg_seal(minor_status, context_handle, conf_req_flag, + qop_req, input_message_buffer, conf_state, +@@ -359,13 +347,9 @@ krb5_gss_wrap(minor_status, context_handle, conf_req_flag, + } + + OM_uint32 KRB5_CALLCONV +-krb5_gss_get_mic(minor_status, context_handle, qop_req, +- message_buffer, message_token) +- OM_uint32 *minor_status; +- gss_ctx_id_t context_handle; +- gss_qop_t qop_req; +- gss_buffer_t message_buffer; +- gss_buffer_t message_token; ++krb5_gss_get_mic(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ gss_qop_t qop_req, gss_buffer_t message_buffer, ++ gss_buffer_t message_token) + { + return(kg_seal(minor_status, context_handle, 0, + qop_req, message_buffer, NULL, +diff --git a/src/lib/gssapi/krb5/k5unseal.c b/src/lib/gssapi/krb5/k5unseal.c +index f0cc4a6809..e246365804 100644 +--- a/src/lib/gssapi/krb5/k5unseal.c ++++ b/src/lib/gssapi/krb5/k5unseal.c +@@ -58,17 +58,10 @@ + conf_state is only valid if SEAL. */ + + static OM_uint32 +-kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer, +- conf_state, qop_state, toktype) +- krb5_context context; +- OM_uint32 *minor_status; +- krb5_gss_ctx_id_rec *ctx; +- unsigned char *ptr; +- int bodysize; +- gss_buffer_t message_buffer; +- int *conf_state; +- gss_qop_t *qop_state; +- int toktype; ++kg_unseal_v1(krb5_context context, OM_uint32 *minor_status, ++ krb5_gss_ctx_id_rec *ctx, unsigned char *ptr, int bodysize, ++ gss_buffer_t message_buffer, int *conf_state, ++ gss_qop_t *qop_state, int toktype) + { + krb5_error_code code; + int conflen = 0; +@@ -342,15 +335,9 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer, + conf_state is only valid if SEAL. */ + + OM_uint32 +-kg_unseal(minor_status, context_handle, input_token_buffer, +- message_buffer, conf_state, qop_state, toktype) +- OM_uint32 *minor_status; +- gss_ctx_id_t context_handle; +- gss_buffer_t input_token_buffer; +- gss_buffer_t message_buffer; +- int *conf_state; +- gss_qop_t *qop_state; +- int toktype; ++kg_unseal(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ gss_buffer_t input_token_buffer, gss_buffer_t message_buffer, ++ int *conf_state, gss_qop_t *qop_state, int toktype) + { + krb5_gss_ctx_id_rec *ctx; + unsigned char *ptr; +@@ -421,15 +408,10 @@ kg_unseal(minor_status, context_handle, input_token_buffer, + } + + OM_uint32 KRB5_CALLCONV +-krb5_gss_unwrap(minor_status, context_handle, +- input_message_buffer, output_message_buffer, +- conf_state, qop_state) +- OM_uint32 *minor_status; +- gss_ctx_id_t context_handle; +- gss_buffer_t input_message_buffer; +- gss_buffer_t output_message_buffer; +- int *conf_state; +- gss_qop_t *qop_state; ++krb5_gss_unwrap(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ gss_buffer_t input_message_buffer, ++ gss_buffer_t output_message_buffer, int *conf_state, ++ gss_qop_t *qop_state) + { + OM_uint32 rstat; + +@@ -440,14 +422,9 @@ krb5_gss_unwrap(minor_status, context_handle, + } + + OM_uint32 KRB5_CALLCONV +-krb5_gss_verify_mic(minor_status, context_handle, +- message_buffer, token_buffer, +- qop_state) +- OM_uint32 *minor_status; +- gss_ctx_id_t context_handle; +- gss_buffer_t message_buffer; +- gss_buffer_t token_buffer; +- gss_qop_t *qop_state; ++krb5_gss_verify_mic(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ gss_buffer_t message_buffer, gss_buffer_t token_buffer, ++ gss_qop_t *qop_state) + { + OM_uint32 rstat; + +diff --git a/src/lib/gssapi/krb5/process_context_token.c b/src/lib/gssapi/krb5/process_context_token.c +index a672f48c85..67805fba78 100644 +--- a/src/lib/gssapi/krb5/process_context_token.c ++++ b/src/lib/gssapi/krb5/process_context_token.c +@@ -28,11 +28,9 @@ + */ + + OM_uint32 KRB5_CALLCONV +-krb5_gss_process_context_token(minor_status, context_handle, +- token_buffer) +- OM_uint32 *minor_status; +- gss_ctx_id_t context_handle; +- gss_buffer_t token_buffer; ++krb5_gss_process_context_token(OM_uint32 *minor_status, ++ gss_ctx_id_t context_handle, ++ gss_buffer_t token_buffer) + { + krb5_gss_ctx_id_rec *ctx; + OM_uint32 majerr; +diff --git a/src/lib/gssapi/krb5/rel_cred.c b/src/lib/gssapi/krb5/rel_cred.c +index 0da6c1b950..9e04e2fa81 100644 +--- a/src/lib/gssapi/krb5/rel_cred.c ++++ b/src/lib/gssapi/krb5/rel_cred.c +@@ -24,9 +24,7 @@ + #include "gssapiP_krb5.h" + + OM_uint32 KRB5_CALLCONV +-krb5_gss_release_cred(minor_status, cred_handle) +- OM_uint32 *minor_status; +- gss_cred_id_t *cred_handle; ++krb5_gss_release_cred(OM_uint32 *minor_status, gss_cred_id_t *cred_handle) + { + krb5_context context; + krb5_gss_cred_id_t cred; +diff --git a/src/lib/gssapi/krb5/rel_name.c b/src/lib/gssapi/krb5/rel_name.c +index 3dabe32f33..558bb6dbc5 100644 +--- a/src/lib/gssapi/krb5/rel_name.c ++++ b/src/lib/gssapi/krb5/rel_name.c +@@ -24,9 +24,7 @@ + #include "gssapiP_krb5.h" + + OM_uint32 KRB5_CALLCONV +-krb5_gss_release_name(minor_status, input_name) +- OM_uint32 *minor_status; +- gss_name_t *input_name; ++krb5_gss_release_name(OM_uint32 *minor_status, gss_name_t *input_name) + { + krb5_context context; + krb5_error_code code; +diff --git a/src/lib/gssapi/krb5/rel_oid.c b/src/lib/gssapi/krb5/rel_oid.c +index 739efe4680..900c4105f9 100644 +--- a/src/lib/gssapi/krb5/rel_oid.c ++++ b/src/lib/gssapi/krb5/rel_oid.c +@@ -27,9 +27,7 @@ + #include "gssapiP_krb5.h" + + OM_uint32 +-krb5_gss_release_oid(minor_status, oid) +- OM_uint32 *minor_status; +- gss_OID *oid; ++krb5_gss_release_oid(OM_uint32 *minor_status, gss_OID *oid) + { + /* + * The V2 API says the following! +@@ -52,9 +50,7 @@ krb5_gss_release_oid(minor_status, oid) + } + + OM_uint32 KRB5_CALLCONV +-krb5_gss_internal_release_oid(minor_status, oid) +- OM_uint32 *minor_status; +- gss_OID *oid; ++krb5_gss_internal_release_oid(OM_uint32 *minor_status, gss_OID *oid) + { + /* + * This function only knows how to release internal OIDs. It will +diff --git a/src/lib/gssapi/krb5/ser_sctx.c b/src/lib/gssapi/krb5/ser_sctx.c +index 9e2d32e98d..1129b6a1aa 100644 +--- a/src/lib/gssapi/krb5/ser_sctx.c ++++ b/src/lib/gssapi/krb5/ser_sctx.c +@@ -137,10 +137,8 @@ kg_oid_size(gss_OID oid, size_t *sizep) + } + + static krb5_error_code +-kg_seqstate_externalize(arg, buffer, lenremain) +- g_seqnum_state arg; +- krb5_octet **buffer; +- size_t *lenremain; ++kg_seqstate_externalize(g_seqnum_state arg, krb5_octet **buffer, ++ size_t *lenremain) + { + krb5_error_code err; + err = krb5_ser_pack_int32(KV5M_GSS_QUEUE, buffer, lenremain); +@@ -152,10 +150,8 @@ kg_seqstate_externalize(arg, buffer, lenremain) + } + + static krb5_error_code +-kg_seqstate_internalize(argp, buffer, lenremain) +- g_seqnum_state *argp; +- krb5_octet **buffer; +- size_t *lenremain; ++kg_seqstate_internalize(g_seqnum_state *argp, krb5_octet **buffer, ++ size_t *lenremain) + { + krb5_int32 ibuf; + krb5_octet *bp; +@@ -193,9 +189,7 @@ kg_seqstate_internalize(argp, buffer, lenremain) + } + + static krb5_error_code +-kg_seqstate_size(arg, sizep) +- g_seqnum_state arg; +- size_t *sizep; ++kg_seqstate_size(g_seqnum_state arg, size_t *sizep) + { + krb5_error_code kret; + size_t required; +diff --git a/src/lib/gssapi/krb5/util_cksum.c b/src/lib/gssapi/krb5/util_cksum.c +index 5b87956393..5f7694f5e6 100644 +--- a/src/lib/gssapi/krb5/util_cksum.c ++++ b/src/lib/gssapi/krb5/util_cksum.c +@@ -28,10 +28,8 @@ + + /* Checksumming the channel bindings always uses plain MD5. */ + krb5_error_code +-kg_checksum_channel_bindings(context, cb, cksum) +- krb5_context context; +- gss_channel_bindings_t cb; +- krb5_checksum *cksum; ++kg_checksum_channel_bindings(krb5_context context, gss_channel_bindings_t cb, ++ krb5_checksum *cksum) + { + struct k5buf buf; + size_t sumlen; +diff --git a/src/lib/gssapi/krb5/util_seed.c b/src/lib/gssapi/krb5/util_seed.c +index 6e1c9ac8ae..685736314c 100644 +--- a/src/lib/gssapi/krb5/util_seed.c ++++ b/src/lib/gssapi/krb5/util_seed.c +@@ -29,10 +29,7 @@ + static const unsigned char zeros[16] = {0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0}; + + krb5_error_code +-kg_make_seed(context, key, seed) +- krb5_context context; +- krb5_key key; +- unsigned char *seed; ++kg_make_seed(krb5_context context, krb5_key key, unsigned char *seed) + { + krb5_error_code code; + krb5_key rkey = NULL; +diff --git a/src/lib/gssapi/krb5/util_seqnum.c b/src/lib/gssapi/krb5/util_seqnum.c +index bef631da9d..a5a4d5cf80 100644 +--- a/src/lib/gssapi/krb5/util_seqnum.c ++++ b/src/lib/gssapi/krb5/util_seqnum.c +@@ -30,13 +30,8 @@ + */ + + krb5_error_code +-kg_make_seq_num(context, key, direction, seqnum, cksum, buf) +- krb5_context context; +- krb5_key key; +- int direction; +- krb5_ui_4 seqnum; +- unsigned char *cksum; +- unsigned char *buf; ++kg_make_seq_num(krb5_context context, krb5_key key, int direction, ++ krb5_ui_4 seqnum, unsigned char *cksum, unsigned char *buf) + { + unsigned char plain[8]; + +@@ -59,13 +54,9 @@ kg_make_seq_num(context, key, direction, seqnum, cksum, buf) + return(kg_encrypt(context, key, KG_USAGE_SEQ, cksum, plain, buf, 8)); + } + +-krb5_error_code kg_get_seq_num(context, key, cksum, buf, direction, seqnum) +- krb5_context context; +- krb5_key key; +- unsigned char *cksum; +- unsigned char *buf; +- int *direction; +- krb5_ui_4 *seqnum; ++krb5_error_code ++kg_get_seq_num(krb5_context context, krb5_key key, unsigned char *cksum, ++ unsigned char *buf, int *direction, krb5_ui_4 *seqnum) + { + krb5_error_code code; + unsigned char plain[8]; +diff --git a/src/lib/gssapi/krb5/val_cred.c b/src/lib/gssapi/krb5/val_cred.c +index cb1cb9393a..83e7634106 100644 +--- a/src/lib/gssapi/krb5/val_cred.c ++++ b/src/lib/gssapi/krb5/val_cred.c +@@ -57,9 +57,7 @@ krb5_gss_validate_cred_1(OM_uint32 *minor_status, gss_cred_id_t cred_handle, + } + + OM_uint32 +-krb5_gss_validate_cred(minor_status, cred_handle) +- OM_uint32 *minor_status; +- gss_cred_id_t cred_handle; ++krb5_gss_validate_cred(OM_uint32 *minor_status, gss_cred_id_t cred_handle) + { + krb5_context context; + krb5_error_code code; +diff --git a/src/lib/gssapi/krb5/wrap_size_limit.c b/src/lib/gssapi/krb5/wrap_size_limit.c +index 7959f424ec..8ea6ce1ad3 100644 +--- a/src/lib/gssapi/krb5/wrap_size_limit.c ++++ b/src/lib/gssapi/krb5/wrap_size_limit.c +@@ -74,14 +74,9 @@ + + /* V2 interface */ + OM_uint32 KRB5_CALLCONV +-krb5_gss_wrap_size_limit(minor_status, context_handle, conf_req_flag, +- qop_req, req_output_size, max_input_size) +- OM_uint32 *minor_status; +- gss_ctx_id_t context_handle; +- int conf_req_flag; +- gss_qop_t qop_req; +- OM_uint32 req_output_size; +- OM_uint32 *max_input_size; ++krb5_gss_wrap_size_limit(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ int conf_req_flag, gss_qop_t qop_req, ++ OM_uint32 req_output_size, OM_uint32 *max_input_size) + { + krb5_gss_ctx_id_rec *ctx; + OM_uint32 data_size, conflen; +diff --git a/src/lib/gssapi/mechglue/g_accept_sec_context.c b/src/lib/gssapi/mechglue/g_accept_sec_context.c +index 4f2a66e26a..e4eff1f52c 100644 +--- a/src/lib/gssapi/mechglue/g_accept_sec_context.c ++++ b/src/lib/gssapi/mechglue/g_accept_sec_context.c +@@ -128,30 +128,13 @@ allow_mech_by_default(gss_OID mech) + } + + OM_uint32 KRB5_CALLCONV +-gss_accept_sec_context (minor_status, +- context_handle, +- verifier_cred_handle, +- input_token_buffer, +- input_chan_bindings, +- src_name, +- mech_type, +- output_token, +- ret_flags, +- time_rec, +- d_cred) +- +-OM_uint32 * minor_status; +-gss_ctx_id_t * context_handle; +-gss_cred_id_t verifier_cred_handle; +-gss_buffer_t input_token_buffer; +-gss_channel_bindings_t input_chan_bindings; +-gss_name_t * src_name; +-gss_OID * mech_type; +-gss_buffer_t output_token; +-OM_uint32 * ret_flags; +-OM_uint32 * time_rec; +-gss_cred_id_t * d_cred; +- ++gss_accept_sec_context(OM_uint32 *minor_status, gss_ctx_id_t *context_handle, ++ gss_cred_id_t verifier_cred_handle, ++ gss_buffer_t input_token_buffer, ++ gss_channel_bindings_t input_chan_bindings, ++ gss_name_t *src_name, gss_OID *mech_type, ++ gss_buffer_t output_token, OM_uint32 *ret_flags, ++ OM_uint32 *time_rec, gss_cred_id_t *d_cred) + { + OM_uint32 status, temp_status, temp_minor_status; + OM_uint32 temp_ret_flags = 0; +diff --git a/src/lib/gssapi/mechglue/g_acquire_cred.c b/src/lib/gssapi/mechglue/g_acquire_cred.c +index c885f56279..2fc9c5c786 100644 +--- a/src/lib/gssapi/mechglue/g_acquire_cred.c ++++ b/src/lib/gssapi/mechglue/g_acquire_cred.c +@@ -85,24 +85,10 @@ val_acq_cred_args( + + + OM_uint32 KRB5_CALLCONV +-gss_acquire_cred(minor_status, +- desired_name, +- time_req, +- desired_mechs, +- cred_usage, +- output_cred_handle, +- actual_mechs, +- time_rec) +- +-OM_uint32 * minor_status; +-gss_name_t desired_name; +-OM_uint32 time_req; +-gss_OID_set desired_mechs; +-int cred_usage; +-gss_cred_id_t * output_cred_handle; +-gss_OID_set * actual_mechs; +-OM_uint32 * time_rec; +- ++gss_acquire_cred(OM_uint32 *minor_status, gss_name_t desired_name, ++ OM_uint32 time_req, gss_OID_set desired_mechs, ++ int cred_usage, gss_cred_id_t *output_cred_handle, ++ gss_OID_set *actual_mechs, OM_uint32 *time_rec) + { + return gss_acquire_cred_from(minor_status, desired_name, time_req, + desired_mechs, cred_usage, NULL, +@@ -110,26 +96,11 @@ OM_uint32 * time_rec; + } + + OM_uint32 KRB5_CALLCONV +-gss_acquire_cred_from(minor_status, +- desired_name, +- time_req, +- desired_mechs, +- cred_usage, +- cred_store, +- output_cred_handle, +- actual_mechs, +- time_rec) +- +-OM_uint32 * minor_status; +-gss_name_t desired_name; +-OM_uint32 time_req; +-gss_OID_set desired_mechs; +-int cred_usage; +-gss_const_key_value_set_t cred_store; +-gss_cred_id_t * output_cred_handle; +-gss_OID_set * actual_mechs; +-OM_uint32 * time_rec; +- ++gss_acquire_cred_from(OM_uint32 * minor_status, gss_name_t desired_name, ++ OM_uint32 time_req, gss_OID_set desired_mechs, ++ int cred_usage, gss_const_key_value_set_t cred_store, ++ gss_cred_id_t *output_cred_handle, ++ gss_OID_set *actual_mechs, OM_uint32 *time_rec) + { + OM_uint32 major = GSS_S_FAILURE, tmpMinor; + OM_uint32 first_major = GSS_S_COMPLETE, first_minor = 0; +@@ -397,22 +368,12 @@ error: + + /* V2 KRB5_CALLCONV */ + OM_uint32 KRB5_CALLCONV +-gss_add_cred(minor_status, input_cred_handle, +- desired_name, desired_mech, cred_usage, +- initiator_time_req, acceptor_time_req, +- output_cred_handle, actual_mechs, +- initiator_time_rec, acceptor_time_rec) +- OM_uint32 *minor_status; +- gss_cred_id_t input_cred_handle; +- gss_name_t desired_name; +- gss_OID desired_mech; +- gss_cred_usage_t cred_usage; +- OM_uint32 initiator_time_req; +- OM_uint32 acceptor_time_req; +- gss_cred_id_t *output_cred_handle; +- gss_OID_set *actual_mechs; +- OM_uint32 *initiator_time_rec; +- OM_uint32 *acceptor_time_rec; ++gss_add_cred(OM_uint32 *minor_status, gss_cred_id_t input_cred_handle, ++ gss_name_t desired_name, gss_OID desired_mech, ++ gss_cred_usage_t cred_usage, OM_uint32 initiator_time_req, ++ OM_uint32 acceptor_time_req, gss_cred_id_t *output_cred_handle, ++ gss_OID_set *actual_mechs, OM_uint32 *initiator_time_rec, ++ OM_uint32 *acceptor_time_rec) + { + return gss_add_cred_from(minor_status, input_cred_handle, desired_name, + desired_mech, cred_usage, initiator_time_req, +@@ -422,25 +383,13 @@ gss_add_cred(minor_status, input_cred_handle, + } + + OM_uint32 KRB5_CALLCONV +-gss_add_cred_from(minor_status, input_cred_handle, +- desired_name, desired_mech, +- cred_usage, +- initiator_time_req, acceptor_time_req, +- cred_store, +- output_cred_handle, actual_mechs, +- initiator_time_rec, acceptor_time_rec) +- OM_uint32 *minor_status; +- gss_cred_id_t input_cred_handle; +- gss_name_t desired_name; +- gss_OID desired_mech; +- gss_cred_usage_t cred_usage; +- OM_uint32 initiator_time_req; +- OM_uint32 acceptor_time_req; +- gss_const_key_value_set_t cred_store; +- gss_cred_id_t *output_cred_handle; +- gss_OID_set *actual_mechs; +- OM_uint32 *initiator_time_rec; +- OM_uint32 *acceptor_time_rec; ++gss_add_cred_from(OM_uint32 *minor_status, gss_cred_id_t input_cred_handle, ++ gss_name_t desired_name, gss_OID desired_mech, ++ gss_cred_usage_t cred_usage, OM_uint32 initiator_time_req, ++ OM_uint32 acceptor_time_req, ++ gss_const_key_value_set_t cred_store, ++ gss_cred_id_t *output_cred_handle, gss_OID_set *actual_mechs, ++ OM_uint32 *initiator_time_rec, OM_uint32 *acceptor_time_rec) + { + OM_uint32 status, temp_minor_status; + OM_uint32 time_req, time_rec = 0, *time_recp = NULL; +diff --git a/src/lib/gssapi/mechglue/g_acquire_cred_with_pw.c b/src/lib/gssapi/mechglue/g_acquire_cred_with_pw.c +index cc34acc2bf..86abf984dc 100644 +--- a/src/lib/gssapi/mechglue/g_acquire_cred_with_pw.c ++++ b/src/lib/gssapi/mechglue/g_acquire_cred_with_pw.c +@@ -98,26 +98,12 @@ val_acq_cred_pw_args( + + + OM_uint32 KRB5_CALLCONV +-gss_acquire_cred_with_password( +- minor_status, +- desired_name, +- password, +- time_req, +- desired_mechs, +- cred_usage, +- output_cred_handle, +- actual_mechs, +- time_rec) +- +-OM_uint32 * minor_status; +-const gss_name_t desired_name; +-const gss_buffer_t password; +-OM_uint32 time_req; +-const gss_OID_set desired_mechs; +-int cred_usage; +-gss_cred_id_t * output_cred_handle; +-gss_OID_set * actual_mechs; +-OM_uint32 * time_rec; ++gss_acquire_cred_with_password(OM_uint32 *minor_status, ++ const gss_name_t desired_name, ++ const gss_buffer_t password, OM_uint32 time_req, ++ const gss_OID_set desired_mechs, int cred_usage, ++ gss_cred_id_t *output_cred_handle, ++ gss_OID_set *actual_mechs, OM_uint32 *time_rec) + { + OM_uint32 major = GSS_S_FAILURE; + OM_uint32 initTimeOut, acceptTimeOut, outTime = GSS_C_INDEFINITE; +@@ -306,23 +292,19 @@ val_add_cred_pw_args( + + /* V2 KRB5_CALLCONV */ + OM_uint32 KRB5_CALLCONV +-gss_add_cred_with_password(minor_status, input_cred_handle, +- desired_name, desired_mech, password, cred_usage, +- initiator_time_req, acceptor_time_req, +- output_cred_handle, actual_mechs, +- initiator_time_rec, acceptor_time_rec) +- OM_uint32 *minor_status; +- const gss_cred_id_t input_cred_handle; +- const gss_name_t desired_name; +- const gss_OID desired_mech; +- const gss_buffer_t password; +- gss_cred_usage_t cred_usage; +- OM_uint32 initiator_time_req; +- OM_uint32 acceptor_time_req; +- gss_cred_id_t *output_cred_handle; +- gss_OID_set *actual_mechs; +- OM_uint32 *initiator_time_rec; +- OM_uint32 *acceptor_time_rec; ++gss_add_cred_with_password( ++ OM_uint32 *minor_status, ++ const gss_cred_id_t input_cred_handle, ++ const gss_name_t desired_name, ++ const gss_OID desired_mech, ++ const gss_buffer_t password, ++ gss_cred_usage_t cred_usage, ++ OM_uint32 initiator_time_req, ++ OM_uint32 acceptor_time_req, ++ gss_cred_id_t *output_cred_handle, ++ gss_OID_set *actual_mechs, ++ OM_uint32 *initiator_time_rec, ++ OM_uint32 *acceptor_time_rec) + { + OM_uint32 status, temp_minor_status; + OM_uint32 time_req, time_rec; +diff --git a/src/lib/gssapi/mechglue/g_canon_name.c b/src/lib/gssapi/mechglue/g_canon_name.c +index 61f657f91f..c5214db80a 100644 +--- a/src/lib/gssapi/mechglue/g_canon_name.c ++++ b/src/lib/gssapi/mechglue/g_canon_name.c +@@ -54,14 +54,8 @@ val_canon_name_args( + + + OM_uint32 KRB5_CALLCONV +-gss_canonicalize_name(minor_status, +- input_name, +- mech_type, +- output_name) +-OM_uint32 *minor_status; +-const gss_name_t input_name; +-const gss_OID mech_type; +-gss_name_t *output_name; ++gss_canonicalize_name(OM_uint32 *minor_status, const gss_name_t input_name, ++ const gss_OID mech_type, gss_name_t *output_name) + { + gss_union_name_t in_union, out_union = NULL, dest_union = NULL; + OM_uint32 major_status = GSS_S_FAILURE, tmpmin; +diff --git a/src/lib/gssapi/mechglue/g_compare_name.c b/src/lib/gssapi/mechglue/g_compare_name.c +index af2e76bbda..74a9529a35 100644 +--- a/src/lib/gssapi/mechglue/g_compare_name.c ++++ b/src/lib/gssapi/mechglue/g_compare_name.c +@@ -59,16 +59,8 @@ val_comp_name_args( + + + OM_uint32 KRB5_CALLCONV +-gss_compare_name (minor_status, +- name1, +- name2, +- name_equal) +- +-OM_uint32 * minor_status; +-gss_name_t name1; +-gss_name_t name2; +-int * name_equal; +- ++gss_compare_name(OM_uint32 * minor_status, gss_name_t name1, gss_name_t name2, ++ int * name_equal) + { + OM_uint32 major_status, temp_minor; + gss_union_name_t union_name1, union_name2; +diff --git a/src/lib/gssapi/mechglue/g_context_time.c b/src/lib/gssapi/mechglue/g_context_time.c +index c947e7646c..b11b32d6bb 100644 +--- a/src/lib/gssapi/mechglue/g_context_time.c ++++ b/src/lib/gssapi/mechglue/g_context_time.c +@@ -29,14 +29,8 @@ + #include "mglueP.h" + + OM_uint32 KRB5_CALLCONV +-gss_context_time (minor_status, +- context_handle, +- time_rec) +- +-OM_uint32 * minor_status; +-gss_ctx_id_t context_handle; +-OM_uint32 * time_rec; +- ++gss_context_time(OM_uint32 * minor_status, gss_ctx_id_t context_handle, ++ OM_uint32 * time_rec) + { + OM_uint32 status; + gss_union_ctx_id_t ctx; +diff --git a/src/lib/gssapi/mechglue/g_delete_sec_context.c b/src/lib/gssapi/mechglue/g_delete_sec_context.c +index 574ff02944..dc86cce3d3 100644 +--- a/src/lib/gssapi/mechglue/g_delete_sec_context.c ++++ b/src/lib/gssapi/mechglue/g_delete_sec_context.c +@@ -62,14 +62,8 @@ val_del_sec_ctx_args( + + + OM_uint32 KRB5_CALLCONV +-gss_delete_sec_context (minor_status, +- context_handle, +- output_token) +- +-OM_uint32 * minor_status; +-gss_ctx_id_t * context_handle; +-gss_buffer_t output_token; +- ++gss_delete_sec_context(OM_uint32 *minor_status, gss_ctx_id_t *context_handle, ++ gss_buffer_t output_token) + { + OM_uint32 status; + gss_union_ctx_id_t ctx; +diff --git a/src/lib/gssapi/mechglue/g_dsp_name.c b/src/lib/gssapi/mechglue/g_dsp_name.c +index 21867c814e..fae64f712e 100644 +--- a/src/lib/gssapi/mechglue/g_dsp_name.c ++++ b/src/lib/gssapi/mechglue/g_dsp_name.c +@@ -70,16 +70,8 @@ val_dsp_name_args( + + + OM_uint32 KRB5_CALLCONV +-gss_display_name (minor_status, +- input_name, +- output_name_buffer, +- output_name_type) +- +-OM_uint32 * minor_status; +-gss_name_t input_name; +-gss_buffer_t output_name_buffer; +-gss_OID * output_name_type; +- ++gss_display_name(OM_uint32 *minor_status, gss_name_t input_name, ++ gss_buffer_t output_name_buffer, gss_OID *output_name_type) + { + OM_uint32 major_status; + gss_union_name_t union_name; +diff --git a/src/lib/gssapi/mechglue/g_dsp_status.c b/src/lib/gssapi/mechglue/g_dsp_status.c +index 70e8492636..14a7a8200c 100644 +--- a/src/lib/gssapi/mechglue/g_dsp_status.c ++++ b/src/lib/gssapi/mechglue/g_dsp_status.c +@@ -36,20 +36,9 @@ + static OM_uint32 displayMajor(OM_uint32, OM_uint32 *, gss_buffer_t); + + OM_uint32 KRB5_CALLCONV +-gss_display_status (minor_status, +- status_value, +- status_type, +- req_mech_type, +- message_context, +- status_string) +- +-OM_uint32 * minor_status; +-OM_uint32 status_value; +-int status_type; +-gss_OID req_mech_type; +-OM_uint32 * message_context; +-gss_buffer_t status_string; +- ++gss_display_status(OM_uint32 *minor_status, OM_uint32 status_value, ++ int status_type, gss_OID req_mech_type, ++ OM_uint32 *message_context, gss_buffer_t status_string) + { + gss_OID mech_type = (gss_OID) req_mech_type; + gss_mechanism mech; +@@ -147,10 +136,7 @@ gss_buffer_t status_string; + * >= 2 - the supplementary error code bit shifted by 1 + */ + static OM_uint32 +-displayMajor(status, msgCtxt, outStr) +-OM_uint32 status; +-OM_uint32 *msgCtxt; +-gss_buffer_t outStr; ++displayMajor(OM_uint32 status, OM_uint32 *msgCtxt, gss_buffer_t outStr) + { + OM_uint32 oneVal, mask = 0x1, currErr; + char *errStr = NULL; +diff --git a/src/lib/gssapi/mechglue/g_dup_name.c b/src/lib/gssapi/mechglue/g_dup_name.c +index ff01db27dc..bf6eb602ea 100644 +--- a/src/lib/gssapi/mechglue/g_dup_name.c ++++ b/src/lib/gssapi/mechglue/g_dup_name.c +@@ -51,12 +51,8 @@ val_dup_name_args( + + + OM_uint32 KRB5_CALLCONV +-gss_duplicate_name(minor_status, +- src_name, +- dest_name) +-OM_uint32 *minor_status; +-const gss_name_t src_name; +-gss_name_t *dest_name; ++gss_duplicate_name(OM_uint32 *minor_status, const gss_name_t src_name, ++ gss_name_t *dest_name) + { + gss_union_name_t src_union, dest_union; + OM_uint32 major_status = GSS_S_FAILURE; +diff --git a/src/lib/gssapi/mechglue/g_exp_sec_context.c b/src/lib/gssapi/mechglue/g_exp_sec_context.c +index a04afe3d1e..68a3267cf0 100644 +--- a/src/lib/gssapi/mechglue/g_exp_sec_context.c ++++ b/src/lib/gssapi/mechglue/g_exp_sec_context.c +@@ -68,14 +68,8 @@ val_exp_sec_ctx_args( + + + OM_uint32 KRB5_CALLCONV +-gss_export_sec_context(minor_status, +- context_handle, +- interprocess_token) +- +-OM_uint32 * minor_status; +-gss_ctx_id_t * context_handle; +-gss_buffer_t interprocess_token; +- ++gss_export_sec_context(OM_uint32 *minor_status, gss_ctx_id_t *context_handle, ++ gss_buffer_t interprocess_token) + { + OM_uint32 status; + OM_uint32 length; +diff --git a/src/lib/gssapi/mechglue/g_export_name.c b/src/lib/gssapi/mechglue/g_export_name.c +index c845f8caf7..2e0611d2d5 100644 +--- a/src/lib/gssapi/mechglue/g_export_name.c ++++ b/src/lib/gssapi/mechglue/g_export_name.c +@@ -20,12 +20,8 @@ + #include + + OM_uint32 KRB5_CALLCONV +-gss_export_name(minor_status, +- input_name, +- exported_name) +-OM_uint32 * minor_status; +-const gss_name_t input_name; +-gss_buffer_t exported_name; ++gss_export_name(OM_uint32 *minor_status, const gss_name_t input_name, ++ gss_buffer_t exported_name) + { + gss_union_name_t union_name; + +diff --git a/src/lib/gssapi/mechglue/g_glue.c b/src/lib/gssapi/mechglue/g_glue.c +index 176fbe63eb..47f499307a 100644 +--- a/src/lib/gssapi/mechglue/g_glue.c ++++ b/src/lib/gssapi/mechglue/g_glue.c +@@ -75,9 +75,8 @@ static gss_OID_desc gss_krb5_mechanism_oid_desc = + + #define NTLMSSP_SIGNATURE "NTLMSSP" + +-OM_uint32 gssint_get_mech_type(OID, token) +- gss_OID OID; +- gss_buffer_t token; ++OM_uint32 ++gssint_get_mech_type(gss_OID OID, gss_buffer_t token) + { + /* Check for interoperability exceptions */ + if (token->length >= sizeof(NTLMSSP_SIGNATURE) && +@@ -163,12 +162,10 @@ import_internal_attributes(OM_uint32 *minor, + * Internal routines to get and release an internal mechanism name + */ + +-OM_uint32 gssint_import_internal_name (minor_status, mech_type, union_name, +- internal_name) +-OM_uint32 *minor_status; +-gss_OID mech_type; +-gss_union_name_t union_name; +-gss_name_t *internal_name; ++OM_uint32 ++gssint_import_internal_name(OM_uint32 *minor_status, gss_OID mech_type, ++ gss_union_name_t union_name, ++ gss_name_t *internal_name) + { + OM_uint32 status, tmpMinor; + gss_mechanism mech; +@@ -220,12 +217,10 @@ gss_name_t *internal_name; + return (status); + } + +-OM_uint32 gssint_export_internal_name(minor_status, mech_type, +- internal_name, name_buf) +- OM_uint32 *minor_status; +- const gss_OID mech_type; +- const gss_name_t internal_name; +- gss_buffer_t name_buf; ++OM_uint32 ++gssint_export_internal_name(OM_uint32 *minor_status, const gss_OID mech_type, ++ const gss_name_t internal_name, ++ gss_buffer_t name_buf) + { + OM_uint32 status; + gss_mechanism mech; +@@ -307,13 +302,10 @@ OM_uint32 gssint_export_internal_name(minor_status, mech_type, + return (GSS_S_COMPLETE); + } /* gssint_export_internal_name */ + +-OM_uint32 gssint_display_internal_name (minor_status, mech_type, internal_name, +- external_name, name_type) +-OM_uint32 *minor_status; +-gss_OID mech_type; +-gss_name_t internal_name; +-gss_buffer_t external_name; +-gss_OID *name_type; ++OM_uint32 ++gssint_display_internal_name(OM_uint32 *minor_status, gss_OID mech_type, ++ gss_name_t internal_name, ++ gss_buffer_t external_name, gss_OID *name_type) + { + OM_uint32 status; + gss_mechanism mech; +@@ -337,10 +329,9 @@ gss_OID *name_type; + return (GSS_S_BAD_MECH); + } + +-OM_uint32 gssint_release_internal_name (minor_status, mech_type, internal_name) +-OM_uint32 *minor_status; +-gss_OID mech_type; +-gss_name_t *internal_name; ++OM_uint32 ++gssint_release_internal_name(OM_uint32 *minor_status, gss_OID mech_type, ++ gss_name_t *internal_name) + { + OM_uint32 status; + gss_mechanism mech; +@@ -362,14 +353,10 @@ gss_name_t *internal_name; + return (GSS_S_BAD_MECH); + } + +-OM_uint32 gssint_delete_internal_sec_context (minor_status, +- mech_type, +- internal_ctx, +- output_token) +-OM_uint32 *minor_status; +-gss_OID mech_type; +-gss_ctx_id_t *internal_ctx; +-gss_buffer_t output_token; ++OM_uint32 ++gssint_delete_internal_sec_context(OM_uint32 *minor_status, gss_OID mech_type, ++ gss_ctx_id_t *internal_ctx, ++ gss_buffer_t output_token) + { + OM_uint32 status; + gss_mechanism mech; +@@ -394,12 +381,10 @@ gss_buffer_t output_token; + * name. Note that internal_name should be considered "consumed" by + * this call, whether or not we return an error. + */ +-OM_uint32 gssint_convert_name_to_union_name(minor_status, mech, +- internal_name, external_name) +- OM_uint32 *minor_status; +- gss_mechanism mech; +- gss_name_t internal_name; +- gss_name_t *external_name; ++OM_uint32 ++gssint_convert_name_to_union_name(OM_uint32 *minor_status, gss_mechanism mech, ++ gss_name_t internal_name, ++ gss_name_t *external_name) + { + OM_uint32 major_status,tmp; + gss_union_name_t union_name; +@@ -473,9 +458,7 @@ allocation_failure: + * external union credential. + */ + gss_cred_id_t +-gssint_get_mechanism_cred(union_cred, mech_type) +- gss_union_cred_t union_cred; +- gss_OID mech_type; ++gssint_get_mechanism_cred(gss_union_cred_t union_cred, gss_OID mech_type) + { + int i; + +@@ -494,10 +477,8 @@ gssint_get_mechanism_cred(union_cred, mech_type) + * Both space for the structure and the data is allocated. + */ + OM_uint32 +-gssint_create_copy_buffer(srcBuf, destBuf, addNullChar) +- const gss_buffer_t srcBuf; +- gss_buffer_t *destBuf; +- int addNullChar; ++gssint_create_copy_buffer(const gss_buffer_t srcBuf, gss_buffer_t *destBuf, ++ int addNullChar) + { + gss_buffer_t aBuf; + unsigned int len; +diff --git a/src/lib/gssapi/mechglue/g_imp_name.c b/src/lib/gssapi/mechglue/g_imp_name.c +index a805078a81..65fa6c0fb3 100644 +--- a/src/lib/gssapi/mechglue/g_imp_name.c ++++ b/src/lib/gssapi/mechglue/g_imp_name.c +@@ -81,16 +81,8 @@ val_imp_name_args( + static gss_buffer_desc emptyNameBuffer; + + OM_uint32 KRB5_CALLCONV +-gss_import_name(minor_status, +- input_name_buffer, +- input_name_type, +- output_name) +- +-OM_uint32 * minor_status; +-gss_buffer_t input_name_buffer; +-gss_OID input_name_type; +-gss_name_t * output_name; +- ++gss_import_name(OM_uint32 * minor_status, gss_buffer_t input_name_buffer, ++ gss_OID input_name_type, gss_name_t * output_name) + { + gss_union_name_t union_name; + OM_uint32 tmp, major_status = GSS_S_FAILURE; +@@ -183,10 +175,8 @@ allocation_failure: + } + + static OM_uint32 +-importExportName(minor, unionName, inputNameType) +- OM_uint32 *minor; +- gss_union_name_t unionName; +- gss_OID inputNameType; ++importExportName(OM_uint32 *minor, gss_union_name_t unionName, ++ gss_OID inputNameType) + { + gss_OID_desc mechOid; + gss_buffer_desc expName; +diff --git a/src/lib/gssapi/mechglue/g_imp_sec_context.c b/src/lib/gssapi/mechglue/g_imp_sec_context.c +index 6315201a5f..55a3136df1 100644 +--- a/src/lib/gssapi/mechglue/g_imp_sec_context.c ++++ b/src/lib/gssapi/mechglue/g_imp_sec_context.c +@@ -69,14 +69,9 @@ val_imp_sec_ctx_args( + + + OM_uint32 KRB5_CALLCONV +-gss_import_sec_context(minor_status, +- interprocess_token, +- context_handle) +- +-OM_uint32 * minor_status; +-gss_buffer_t interprocess_token; +-gss_ctx_id_t * context_handle; +- ++gss_import_sec_context(OM_uint32 *minor_status, ++ gss_buffer_t interprocess_token, ++ gss_ctx_id_t *context_handle) + { + OM_uint32 length = 0; + OM_uint32 status; +diff --git a/src/lib/gssapi/mechglue/g_init_sec_context.c b/src/lib/gssapi/mechglue/g_init_sec_context.c +index a58074c007..d639a8de3b 100644 +--- a/src/lib/gssapi/mechglue/g_init_sec_context.c ++++ b/src/lib/gssapi/mechglue/g_init_sec_context.c +@@ -88,34 +88,15 @@ val_init_sec_ctx_args( + + + OM_uint32 KRB5_CALLCONV +-gss_init_sec_context (minor_status, +- claimant_cred_handle, +- context_handle, +- target_name, +- req_mech_type, +- req_flags, +- time_req, +- input_chan_bindings, +- input_token, +- actual_mech_type, +- output_token, +- ret_flags, +- time_rec) +- +-OM_uint32 * minor_status; +-gss_cred_id_t claimant_cred_handle; +-gss_ctx_id_t * context_handle; +-gss_name_t target_name; +-gss_OID req_mech_type; +-OM_uint32 req_flags; +-OM_uint32 time_req; +-gss_channel_bindings_t input_chan_bindings; +-gss_buffer_t input_token; +-gss_OID * actual_mech_type; +-gss_buffer_t output_token; +-OM_uint32 * ret_flags; +-OM_uint32 * time_rec; +- ++gss_init_sec_context(OM_uint32 *minor_status, ++ gss_cred_id_t claimant_cred_handle, ++ gss_ctx_id_t *context_handle, gss_name_t target_name, ++ gss_OID req_mech_type, OM_uint32 req_flags, ++ OM_uint32 time_req, ++ gss_channel_bindings_t input_chan_bindings, ++ gss_buffer_t input_token, gss_OID *actual_mech_type, ++ gss_buffer_t output_token, OM_uint32 *ret_flags, ++ OM_uint32 *time_rec) + { + OM_uint32 status, temp_minor_status; + gss_union_name_t union_name; +diff --git a/src/lib/gssapi/mechglue/g_initialize.c b/src/lib/gssapi/mechglue/g_initialize.c +index 22f6c615c1..7e36c4a0d0 100644 +--- a/src/lib/gssapi/mechglue/g_initialize.c ++++ b/src/lib/gssapi/mechglue/g_initialize.c +@@ -169,9 +169,7 @@ gssint_mechglue_initialize_library(void) + * This routine requires direct access to the mechList. + */ + OM_uint32 KRB5_CALLCONV +-gss_release_oid(minor_status, oid) +-OM_uint32 *minor_status; +-gss_OID *oid; ++gss_release_oid(OM_uint32 *minor_status, gss_OID *oid) + { + OM_uint32 major; + gss_mech_info aMech; +@@ -267,9 +265,7 @@ prune_deprecated(gss_OID_set mech_set) + * a mech oid set, and only update it once the file has changed. + */ + OM_uint32 KRB5_CALLCONV +-gss_indicate_mechs(minorStatus, mechSet_out) +-OM_uint32 *minorStatus; +-gss_OID_set *mechSet_out; ++gss_indicate_mechs(OM_uint32 *minorStatus, gss_OID_set *mechSet_out) + { + OM_uint32 status; + +@@ -417,8 +413,7 @@ build_mechSet(void) + * caller is responsible for freeing the memory + */ + char * +-gssint_get_modOptions(oid) +-const gss_OID oid; ++gssint_get_modOptions(const gss_OID oid) + { + gss_mech_info aMech; + char *modOptions = NULL; +@@ -479,7 +474,7 @@ load_if_changed(const char *pathname, time_t last, time_t *highest) + /* Try to load any config files which have changed since the last call. Config + * files are MECH_CONF and any files matching MECH_CONF_PATTERN. */ + static void +-loadConfigFiles() ++loadConfigFiles(void) + { + glob_t globbuf; + time_t highest = (time_t)-1, now; +@@ -679,7 +674,8 @@ gssint_register_mechinfo(gss_mech_info template) + memset(&errinfo, 0, sizeof(errinfo)); \ + if (krb5int_get_plugin_func(_dl, \ + #_symbol, \ +- (void (**)())&(_mech)->_symbol, \ ++ (void (**)(void)) \ ++ &(_mech)->_symbol, \ + &errinfo) || errinfo.code) { \ + (_mech)->_symbol = NULL; \ + k5_clear_error(&errinfo); \ +@@ -801,7 +797,7 @@ build_dynamicMech(void *dl, const gss_OID mech_type) + memset(&errinfo, 0, sizeof(errinfo)); \ + if (krb5int_get_plugin_func(_dl, \ + "gssi" #_nsym, \ +- (void (**)())&(_mech)->_psym \ ++ (void (**)(void))&(_mech)->_psym \ + ## _nsym, \ + &errinfo) || errinfo.code) { \ + (_mech)->_psym ## _nsym = NULL; \ +@@ -948,7 +944,7 @@ loadInterMech(gss_mech_info minfo) + } + + if (krb5int_get_plugin_func(dl, MECH_INTERPOSER_SYM, +- (void (**)())&isym, &errinfo) != 0) ++ (void (**)(void))&isym, &errinfo) != 0) + goto cleanup; + + /* Get a list of mechs to interpose. */ +@@ -1184,7 +1180,7 @@ gssint_get_mechanism(gss_const_OID oid) + return ((gss_mechanism)NULL); + } + +- if (krb5int_get_plugin_func(dl, MECH_SYM, (void (**)())&sym, ++ if (krb5int_get_plugin_func(dl, MECH_SYM, (void (**)(void))&sym, + &errinfo) == 0) { + /* Call the symbol to get the mechanism table */ + aMech->mech = (*sym)(aMech->mech_type); +diff --git a/src/lib/gssapi/mechglue/g_inq_cred.c b/src/lib/gssapi/mechglue/g_inq_cred.c +index 4ed7774f1a..0aa9acc889 100644 +--- a/src/lib/gssapi/mechglue/g_inq_cred.c ++++ b/src/lib/gssapi/mechglue/g_inq_cred.c +@@ -35,20 +35,9 @@ + #include + + OM_uint32 KRB5_CALLCONV +-gss_inquire_cred(minor_status, +- cred_handle, +- name, +- lifetime, +- cred_usage, +- mechanisms) +- +-OM_uint32 * minor_status; +-gss_cred_id_t cred_handle; +-gss_name_t * name; +-OM_uint32 * lifetime; +-int * cred_usage; +-gss_OID_set * mechanisms; +- ++gss_inquire_cred(OM_uint32 *minor_status, gss_cred_id_t cred_handle, ++ gss_name_t *name, OM_uint32 *lifetime, int *cred_usage, ++ gss_OID_set *mechanisms) + { + OM_uint32 status, temp_minor_status; + gss_union_cred_t union_cred; +@@ -159,15 +148,11 @@ error: + } + + OM_uint32 KRB5_CALLCONV +-gss_inquire_cred_by_mech(minor_status, cred_handle, mech_type, name, +- initiator_lifetime, acceptor_lifetime, cred_usage) +- OM_uint32 *minor_status; +- gss_cred_id_t cred_handle; +- gss_OID mech_type; +- gss_name_t *name; +- OM_uint32 *initiator_lifetime; +- OM_uint32 *acceptor_lifetime; +- gss_cred_usage_t *cred_usage; ++gss_inquire_cred_by_mech(OM_uint32 *minor_status, gss_cred_id_t cred_handle, ++ gss_OID mech_type, gss_name_t *name, ++ OM_uint32 *initiator_lifetime, ++ OM_uint32 *acceptor_lifetime, ++ gss_cred_usage_t *cred_usage) + { + gss_union_cred_t union_cred; + gss_cred_id_t mech_cred; +diff --git a/src/lib/gssapi/mechglue/g_inq_names.c b/src/lib/gssapi/mechglue/g_inq_names.c +index d22af8bcf9..066c00c042 100644 +--- a/src/lib/gssapi/mechglue/g_inq_names.c ++++ b/src/lib/gssapi/mechglue/g_inq_names.c +@@ -32,12 +32,8 @@ + + /* Last argument new for V2 */ + OM_uint32 KRB5_CALLCONV +-gss_inquire_names_for_mech(minor_status, mechanism, name_types) +- +-OM_uint32 * minor_status; +-gss_OID mechanism; +-gss_OID_set * name_types; +- ++gss_inquire_names_for_mech(OM_uint32 *minor_status, gss_OID mechanism, ++ gss_OID_set *name_types) + { + OM_uint32 status; + gss_OID selected_mech = GSS_C_NO_OID, public_mech; +diff --git a/src/lib/gssapi/mechglue/g_mechname.c b/src/lib/gssapi/mechglue/g_mechname.c +index cfb0a0d2af..5664fa157e 100644 +--- a/src/lib/gssapi/mechglue/g_mechname.c ++++ b/src/lib/gssapi/mechglue/g_mechname.c +@@ -20,8 +20,8 @@ static gss_mech_spec_name name_list = NULL; + /* + * generic searching helper function. + */ +-static gss_mech_spec_name search_mech_spec(name_type) +- gss_OID name_type; ++static gss_mech_spec_name ++search_mech_spec(gss_OID name_type) + { + gss_mech_spec_name p; + +@@ -36,8 +36,8 @@ static gss_mech_spec_name search_mech_spec(name_type) + * Given a name_type, if it is specific to a mechanism, return the + * mechanism OID. Otherwise, return NULL. + */ +-gss_OID gss_find_mechanism_from_name_type(name_type) +- gss_OID name_type; ++gss_OID ++gss_find_mechanism_from_name_type(gss_OID name_type) + { + gss_mech_spec_name p; + +@@ -54,10 +54,8 @@ gss_OID gss_find_mechanism_from_name_type(name_type) + * Otherwise, enter the pair into the registry. + */ + OM_uint32 +-gss_add_mech_name_type(minor_status, name_type, mech) +- OM_uint32 *minor_status; +- gss_OID name_type; +- gss_OID mech; ++gss_add_mech_name_type(OM_uint32 *minor_status, gss_OID name_type, ++ gss_OID mech) + { + OM_uint32 major_status, tmp; + gss_mech_spec_name p; +diff --git a/src/lib/gssapi/mechglue/g_oid_ops.c b/src/lib/gssapi/mechglue/g_oid_ops.c +index 1d7970c5dd..f29fb3b33e 100644 +--- a/src/lib/gssapi/mechglue/g_oid_ops.c ++++ b/src/lib/gssapi/mechglue/g_oid_ops.c +@@ -33,9 +33,7 @@ + */ + + OM_uint32 KRB5_CALLCONV +-gss_create_empty_oid_set(minor_status, oid_set) +- OM_uint32 *minor_status; +- gss_OID_set *oid_set; ++gss_create_empty_oid_set(OM_uint32 *minor_status, gss_OID_set *oid_set) + { + OM_uint32 status; + status = generic_gss_create_empty_oid_set(minor_status, oid_set); +@@ -45,10 +43,8 @@ gss_create_empty_oid_set(minor_status, oid_set) + } + + OM_uint32 KRB5_CALLCONV +-gss_add_oid_set_member(minor_status, member_oid, oid_set) +- OM_uint32 *minor_status; +- gss_OID member_oid; +- gss_OID_set *oid_set; ++gss_add_oid_set_member(OM_uint32 *minor_status, gss_OID member_oid, ++ gss_OID_set *oid_set) + { + OM_uint32 status; + status = generic_gss_add_oid_set_member(minor_status, member_oid, oid_set); +@@ -58,20 +54,14 @@ gss_add_oid_set_member(minor_status, member_oid, oid_set) + } + + OM_uint32 KRB5_CALLCONV +-gss_test_oid_set_member(minor_status, member, set, present) +- OM_uint32 *minor_status; +- gss_OID member; +- gss_OID_set set; +- int *present; ++gss_test_oid_set_member(OM_uint32 *minor_status, gss_OID member, ++ gss_OID_set set, int *present) + { + return generic_gss_test_oid_set_member(minor_status, member, set, present); + } + + OM_uint32 KRB5_CALLCONV +-gss_oid_to_str(minor_status, oid, oid_str) +- OM_uint32 *minor_status; +- gss_OID oid; +- gss_buffer_t oid_str; ++gss_oid_to_str(OM_uint32 *minor_status, gss_OID oid, gss_buffer_t oid_str) + { + OM_uint32 status = generic_gss_oid_to_str(minor_status, oid, oid_str); + if (status != GSS_S_COMPLETE) +@@ -80,10 +70,7 @@ gss_oid_to_str(minor_status, oid, oid_str) + } + + OM_uint32 KRB5_CALLCONV +-gss_str_to_oid(minor_status, oid_str, oid) +- OM_uint32 *minor_status; +- gss_buffer_t oid_str; +- gss_OID *oid; ++gss_str_to_oid(OM_uint32 *minor_status, gss_buffer_t oid_str, gss_OID *oid) + { + OM_uint32 status = generic_gss_str_to_oid(minor_status, oid_str, oid); + if (status != GSS_S_COMPLETE) +diff --git a/src/lib/gssapi/mechglue/g_process_context.c b/src/lib/gssapi/mechglue/g_process_context.c +index 3968b5d9c6..2b3f6c704d 100644 +--- a/src/lib/gssapi/mechglue/g_process_context.c ++++ b/src/lib/gssapi/mechglue/g_process_context.c +@@ -29,14 +29,8 @@ + #include "mglueP.h" + + OM_uint32 KRB5_CALLCONV +-gss_process_context_token (minor_status, +- context_handle, +- token_buffer) +- +-OM_uint32 * minor_status; +-gss_ctx_id_t context_handle; +-gss_buffer_t token_buffer; +- ++gss_process_context_token(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ gss_buffer_t token_buffer) + { + OM_uint32 status; + gss_union_ctx_id_t ctx; +diff --git a/src/lib/gssapi/mechglue/g_rel_buffer.c b/src/lib/gssapi/mechglue/g_rel_buffer.c +index 8c3328acc5..60117bdb56 100644 +--- a/src/lib/gssapi/mechglue/g_rel_buffer.c ++++ b/src/lib/gssapi/mechglue/g_rel_buffer.c +@@ -33,11 +33,7 @@ + #endif + + OM_uint32 KRB5_CALLCONV +-gss_release_buffer (minor_status, +- buffer) +- +-OM_uint32 * minor_status; +-gss_buffer_t buffer; ++gss_release_buffer(OM_uint32 *minor_status, gss_buffer_t buffer) + { + if (minor_status) + *minor_status = 0; +diff --git a/src/lib/gssapi/mechglue/g_rel_cred.c b/src/lib/gssapi/mechglue/g_rel_cred.c +index ccdee05a56..ee3d1d71e3 100644 +--- a/src/lib/gssapi/mechglue/g_rel_cred.c ++++ b/src/lib/gssapi/mechglue/g_rel_cred.c +@@ -31,12 +31,7 @@ + #endif + + OM_uint32 KRB5_CALLCONV +-gss_release_cred(minor_status, +- cred_handle) +- +-OM_uint32 * minor_status; +-gss_cred_id_t * cred_handle; +- ++gss_release_cred(OM_uint32 *minor_status, gss_cred_id_t *cred_handle) + { + OM_uint32 status, temp_status; + int j; +diff --git a/src/lib/gssapi/mechglue/g_rel_name.c b/src/lib/gssapi/mechglue/g_rel_name.c +index e008692383..d490f9f290 100644 +--- a/src/lib/gssapi/mechglue/g_rel_name.c ++++ b/src/lib/gssapi/mechglue/g_rel_name.c +@@ -34,12 +34,7 @@ + #include + + OM_uint32 KRB5_CALLCONV +-gss_release_name (minor_status, +- input_name) +- +-OM_uint32 * minor_status; +-gss_name_t * input_name; +- ++gss_release_name(OM_uint32 *minor_status, gss_name_t *input_name) + { + gss_union_name_t union_name; + +diff --git a/src/lib/gssapi/mechglue/g_rel_oid_set.c b/src/lib/gssapi/mechglue/g_rel_oid_set.c +index fa008d6bb9..9151dd2e71 100644 +--- a/src/lib/gssapi/mechglue/g_rel_oid_set.c ++++ b/src/lib/gssapi/mechglue/g_rel_oid_set.c +@@ -33,11 +33,7 @@ + #endif + + OM_uint32 KRB5_CALLCONV +-gss_release_oid_set (minor_status, +- set) +- +-OM_uint32 * minor_status; +-gss_OID_set * set; ++gss_release_oid_set(OM_uint32 *minor_status, gss_OID_set *set) + { + return generic_gss_release_oid_set(minor_status, set); + } +diff --git a/src/lib/gssapi/mechglue/g_sign.c b/src/lib/gssapi/mechglue/g_sign.c +index 03fbd8c01f..c9af1da570 100644 +--- a/src/lib/gssapi/mechglue/g_sign.c ++++ b/src/lib/gssapi/mechglue/g_sign.c +@@ -66,18 +66,9 @@ val_get_mic_args( + + + OM_uint32 KRB5_CALLCONV +-gss_get_mic (minor_status, +- context_handle, +- qop_req, +- message_buffer, +- msg_token) +- +-OM_uint32 * minor_status; +-gss_ctx_id_t context_handle; +-gss_qop_t qop_req; +-gss_buffer_t message_buffer; +-gss_buffer_t msg_token; +- ++gss_get_mic(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ gss_qop_t qop_req, gss_buffer_t message_buffer, ++ gss_buffer_t msg_token) + { + OM_uint32 status; + gss_union_ctx_id_t ctx; +@@ -118,18 +109,8 @@ gss_buffer_t msg_token; + } + + OM_uint32 KRB5_CALLCONV +-gss_sign (minor_status, +- context_handle, +- qop_req, +- message_buffer, +- msg_token) +- +-OM_uint32 * minor_status; +-gss_ctx_id_t context_handle; +-int qop_req; +-gss_buffer_t message_buffer; +-gss_buffer_t msg_token; +- ++gss_sign(OM_uint32 *minor_status, gss_ctx_id_t context_handle, int qop_req, ++ gss_buffer_t message_buffer, gss_buffer_t msg_token) + { + return (gss_get_mic(minor_status, context_handle, (gss_qop_t) qop_req, + message_buffer, msg_token)); +diff --git a/src/lib/gssapi/mechglue/g_store_cred.c b/src/lib/gssapi/mechglue/g_store_cred.c +index c2b6ddf3c0..231b3e81a0 100644 +--- a/src/lib/gssapi/mechglue/g_store_cred.c ++++ b/src/lib/gssapi/mechglue/g_store_cred.c +@@ -93,24 +93,10 @@ val_store_cred_args( + + + OM_uint32 KRB5_CALLCONV +-gss_store_cred(minor_status, +- input_cred_handle, +- cred_usage, +- desired_mech, +- overwrite_cred, +- default_cred, +- elements_stored, +- cred_usage_stored) +- +-OM_uint32 *minor_status; +-gss_cred_id_t input_cred_handle; +-gss_cred_usage_t cred_usage; +-const gss_OID desired_mech; +-OM_uint32 overwrite_cred; +-OM_uint32 default_cred; +-gss_OID_set *elements_stored; +-gss_cred_usage_t *cred_usage_stored; +- ++gss_store_cred(OM_uint32 *minor_status, gss_cred_id_t input_cred_handle, ++ gss_cred_usage_t cred_usage, const gss_OID desired_mech, ++ OM_uint32 overwrite_cred, OM_uint32 default_cred, ++ gss_OID_set *elements_stored, gss_cred_usage_t *cred_usage_stored) + { + return gss_store_cred_into(minor_status, input_cred_handle, cred_usage, + desired_mech, overwrite_cred, default_cred, +@@ -119,26 +105,12 @@ gss_cred_usage_t *cred_usage_stored; + } + + OM_uint32 KRB5_CALLCONV +-gss_store_cred_into(minor_status, +- input_cred_handle, +- cred_usage, +- desired_mech, +- overwrite_cred, +- default_cred, +- cred_store, +- elements_stored, +- cred_usage_stored) +- +-OM_uint32 *minor_status; +-gss_cred_id_t input_cred_handle; +-gss_cred_usage_t cred_usage; +-gss_OID desired_mech; +-OM_uint32 overwrite_cred; +-OM_uint32 default_cred; +-gss_const_key_value_set_t cred_store; +-gss_OID_set *elements_stored; +-gss_cred_usage_t *cred_usage_stored; +- ++gss_store_cred_into(OM_uint32 *minor_status, gss_cred_id_t input_cred_handle, ++ gss_cred_usage_t cred_usage, gss_OID desired_mech, ++ OM_uint32 overwrite_cred, OM_uint32 default_cred, ++ gss_const_key_value_set_t cred_store, ++ gss_OID_set *elements_stored, ++ gss_cred_usage_t *cred_usage_stored) + { + OM_uint32 major_status = GSS_S_FAILURE; + gss_union_cred_t union_cred; +diff --git a/src/lib/gssapi/mechglue/g_unseal.c b/src/lib/gssapi/mechglue/g_unseal.c +index c208635b67..2be3745d1f 100644 +--- a/src/lib/gssapi/mechglue/g_unseal.c ++++ b/src/lib/gssapi/mechglue/g_unseal.c +@@ -29,20 +29,10 @@ + #include "mglueP.h" + + OM_uint32 KRB5_CALLCONV +-gss_unwrap (minor_status, +- context_handle, +- input_message_buffer, +- output_message_buffer, +- conf_state, +- qop_state) +- +-OM_uint32 * minor_status; +-gss_ctx_id_t context_handle; +-gss_buffer_t input_message_buffer; +-gss_buffer_t output_message_buffer; +-int * conf_state; +-gss_qop_t * qop_state; +- ++gss_unwrap(OM_uint32 * minor_status, gss_ctx_id_t context_handle, ++ gss_buffer_t input_message_buffer, ++ gss_buffer_t output_message_buffer, ++ int *conf_state, gss_qop_t *qop_state) + { + /* EXPORT DELETE START */ + OM_uint32 status; +@@ -111,20 +101,9 @@ gss_qop_t * qop_state; + } + + OM_uint32 KRB5_CALLCONV +-gss_unseal (minor_status, +- context_handle, +- input_message_buffer, +- output_message_buffer, +- conf_state, +- qop_state) +- +-OM_uint32 * minor_status; +-gss_ctx_id_t context_handle; +-gss_buffer_t input_message_buffer; +-gss_buffer_t output_message_buffer; +-int * conf_state; +-int * qop_state; +- ++gss_unseal(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ gss_buffer_t input_message_buffer, ++ gss_buffer_t output_message_buffer, int *conf_state, int *qop_state) + { + return (gss_unwrap(minor_status, context_handle, + input_message_buffer, +diff --git a/src/lib/gssapi/mechglue/g_unwrap_aead.c b/src/lib/gssapi/mechglue/g_unwrap_aead.c +index 0682bd8998..5c9ff30031 100644 +--- a/src/lib/gssapi/mechglue/g_unwrap_aead.c ++++ b/src/lib/gssapi/mechglue/g_unwrap_aead.c +@@ -154,20 +154,11 @@ gssint_unwrap_aead (gss_mechanism mech, + } + + OM_uint32 KRB5_CALLCONV +-gss_unwrap_aead (minor_status, +- context_handle, +- input_message_buffer, +- input_assoc_buffer, +- output_payload_buffer, +- conf_state, +- qop_state) +-OM_uint32 * minor_status; +-gss_ctx_id_t context_handle; +-gss_buffer_t input_message_buffer; +-gss_buffer_t input_assoc_buffer; +-gss_buffer_t output_payload_buffer; +-int *conf_state; +-gss_qop_t *qop_state; ++gss_unwrap_aead(OM_uint32 * minor_status, gss_ctx_id_t context_handle, ++ gss_buffer_t input_message_buffer, ++ gss_buffer_t input_assoc_buffer, ++ gss_buffer_t output_payload_buffer, ++ int *conf_state, gss_qop_t *qop_state) + { + + OM_uint32 status; +diff --git a/src/lib/gssapi/mechglue/g_unwrap_iov.c b/src/lib/gssapi/mechglue/g_unwrap_iov.c +index 599be2c7b2..bf9c3bcc33 100644 +--- a/src/lib/gssapi/mechglue/g_unwrap_iov.c ++++ b/src/lib/gssapi/mechglue/g_unwrap_iov.c +@@ -59,18 +59,9 @@ val_unwrap_iov_args( + + + OM_uint32 KRB5_CALLCONV +-gss_unwrap_iov (minor_status, +- context_handle, +- conf_state, +- qop_state, +- iov, +- iov_count) +-OM_uint32 * minor_status; +-gss_ctx_id_t context_handle; +-int * conf_state; +-gss_qop_t *qop_state; +-gss_iov_buffer_desc * iov; +-int iov_count; ++gss_unwrap_iov(OM_uint32 * minor_status, gss_ctx_id_t context_handle, ++ int *conf_state, gss_qop_t *qop_state, ++ gss_iov_buffer_desc *iov, int iov_count) + { + /* EXPORT DELETE START */ + +diff --git a/src/lib/gssapi/mechglue/g_verify.c b/src/lib/gssapi/mechglue/g_verify.c +index 8996fce8d5..86ade66877 100644 +--- a/src/lib/gssapi/mechglue/g_verify.c ++++ b/src/lib/gssapi/mechglue/g_verify.c +@@ -29,18 +29,9 @@ + #include "mglueP.h" + + OM_uint32 KRB5_CALLCONV +-gss_verify_mic (minor_status, +- context_handle, +- message_buffer, +- token_buffer, +- qop_state) +- +-OM_uint32 * minor_status; +-gss_ctx_id_t context_handle; +-gss_buffer_t message_buffer; +-gss_buffer_t token_buffer; +-gss_qop_t * qop_state; +- ++gss_verify_mic(OM_uint32 * minor_status, gss_ctx_id_t context_handle, ++ gss_buffer_t message_buffer, gss_buffer_t token_buffer, ++ gss_qop_t *qop_state) + { + OM_uint32 status; + gss_union_ctx_id_t ctx; +@@ -89,18 +80,9 @@ gss_qop_t * qop_state; + } + + OM_uint32 KRB5_CALLCONV +-gss_verify (minor_status, +- context_handle, +- message_buffer, +- token_buffer, +- qop_state) +- +-OM_uint32 * minor_status; +-gss_ctx_id_t context_handle; +-gss_buffer_t message_buffer; +-gss_buffer_t token_buffer; +-int * qop_state; +- ++gss_verify(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ gss_buffer_t message_buffer, gss_buffer_t token_buffer, ++ int *qop_state) + { + return (gss_verify_mic(minor_status, context_handle, + message_buffer, token_buffer, +diff --git a/src/lib/gssapi/mechglue/g_wrap_aead.c b/src/lib/gssapi/mechglue/g_wrap_aead.c +index 7fe3b7b35b..5a6570f7f9 100644 +--- a/src/lib/gssapi/mechglue/g_wrap_aead.c ++++ b/src/lib/gssapi/mechglue/g_wrap_aead.c +@@ -177,15 +177,11 @@ gssint_wrap_aead_iov_shim(gss_mechanism mech, + } + + OM_uint32 +-gssint_wrap_aead (gss_mechanism mech, +- OM_uint32 *minor_status, +- gss_union_ctx_id_t ctx, +- int conf_req_flag, +- gss_qop_t qop_req, +- gss_buffer_t input_assoc_buffer, +- gss_buffer_t input_payload_buffer, +- int *conf_state, +- gss_buffer_t output_message_buffer) ++gssint_wrap_aead(gss_mechanism mech, OM_uint32 *minor_status, ++ gss_union_ctx_id_t ctx, int conf_req_flag, gss_qop_t qop_req, ++ gss_buffer_t input_assoc_buffer, ++ gss_buffer_t input_payload_buffer, ++ int *conf_state, gss_buffer_t output_message_buffer) + { + /* EXPORT DELETE START */ + OM_uint32 status; +@@ -223,22 +219,15 @@ gssint_wrap_aead (gss_mechanism mech, + } + + OM_uint32 KRB5_CALLCONV +-gss_wrap_aead (minor_status, +- context_handle, +- conf_req_flag, +- qop_req, +- input_assoc_buffer, +- input_payload_buffer, +- conf_state, +- output_message_buffer) +-OM_uint32 * minor_status; +-gss_ctx_id_t context_handle; +-int conf_req_flag; +-gss_qop_t qop_req; +-gss_buffer_t input_assoc_buffer; +-gss_buffer_t input_payload_buffer; +-int * conf_state; +-gss_buffer_t output_message_buffer; ++gss_wrap_aead ( ++ OM_uint32 * minor_status, ++ gss_ctx_id_t context_handle, ++ int conf_req_flag, ++ gss_qop_t qop_req, ++ gss_buffer_t input_assoc_buffer, ++ gss_buffer_t input_payload_buffer, ++ int * conf_state, ++ gss_buffer_t output_message_buffer) + { + OM_uint32 status; + gss_mechanism mech; +diff --git a/src/lib/gssapi/mechglue/g_wrap_iov.c b/src/lib/gssapi/mechglue/g_wrap_iov.c +index 14447c4ee1..aaf3a9308e 100644 +--- a/src/lib/gssapi/mechglue/g_wrap_iov.c ++++ b/src/lib/gssapi/mechglue/g_wrap_iov.c +@@ -60,20 +60,9 @@ val_wrap_iov_args( + + + OM_uint32 KRB5_CALLCONV +-gss_wrap_iov (minor_status, +- context_handle, +- conf_req_flag, +- qop_req, +- conf_state, +- iov, +- iov_count) +-OM_uint32 * minor_status; +-gss_ctx_id_t context_handle; +-int conf_req_flag; +-gss_qop_t qop_req; +-int * conf_state; +-gss_iov_buffer_desc * iov; +-int iov_count; ++gss_wrap_iov(OM_uint32 * minor_status, gss_ctx_id_t context_handle, ++ int conf_req_flag, gss_qop_t qop_req, int *conf_state, ++ gss_iov_buffer_desc *iov, int iov_count) + { + /* EXPORT DELETE START */ + +@@ -120,20 +109,10 @@ int iov_count; + } + + OM_uint32 KRB5_CALLCONV +-gss_wrap_iov_length (minor_status, +- context_handle, +- conf_req_flag, +- qop_req, +- conf_state, +- iov, +- iov_count) +-OM_uint32 * minor_status; +-gss_ctx_id_t context_handle; +-int conf_req_flag; +-gss_qop_t qop_req; +-int * conf_state; +-gss_iov_buffer_desc * iov; +-int iov_count; ++gss_wrap_iov_length(OM_uint32 *minor_status, gss_ctx_id_t context_handle, ++ int conf_req_flag, gss_qop_t qop_req, ++ int *conf_state, gss_iov_buffer_desc *iov, ++ int iov_count) + { + /* EXPORT DELETE START */ + +@@ -239,12 +218,8 @@ gss_get_mic_iov_length(OM_uint32 *minor_status, gss_ctx_id_t context_handle, + } + + OM_uint32 KRB5_CALLCONV +-gss_release_iov_buffer (minor_status, +- iov, +- iov_count) +-OM_uint32 * minor_status; +-gss_iov_buffer_desc * iov; +-int iov_count; ++gss_release_iov_buffer(OM_uint32 * minor_status, gss_iov_buffer_desc *iov, ++ int iov_count) + { + OM_uint32 status = GSS_S_COMPLETE; + int i; +diff --git a/src/lib/kadm5/clnt/client_rpc.c b/src/lib/kadm5/clnt/client_rpc.c +index d84d158b46..c8d844e4c7 100644 +--- a/src/lib/kadm5/clnt/client_rpc.c ++++ b/src/lib/kadm5/clnt/client_rpc.c +@@ -1,6 +1,7 @@ + /* -*- mode: c; c-file-style: "bsd"; indent-tabs-mode: t -*- */ + #include + #include ++#include + #include + #include + #include /* for memset prototype */ +diff --git a/src/lib/kadm5/kadm_rpc.h b/src/lib/kadm5/kadm_rpc.h +index 5099c6c145..9efe49a373 100644 +--- a/src/lib/kadm5/kadm_rpc.h ++++ b/src/lib/kadm5/kadm_rpc.h +@@ -360,49 +360,4 @@ extern enum clnt_stat get_principal_keys_2(getpkeys_arg *, getpkeys_ret *, + CLIENT *); + extern bool_t get_principal_keys_2_svc(getpkeys_arg *, getpkeys_ret *, + struct svc_req *); +- +-extern bool_t xdr_cprinc_arg (); +-extern bool_t xdr_cprinc3_arg (); +-extern bool_t xdr_generic_ret (); +-extern bool_t xdr_dprinc_arg (); +-extern bool_t xdr_mprinc_arg (); +-extern bool_t xdr_rprinc_arg (); +-extern bool_t xdr_gprincs_arg (); +-extern bool_t xdr_gprincs_ret (); +-extern bool_t xdr_chpass_arg (); +-extern bool_t xdr_chpass3_arg (); +-extern bool_t xdr_setkey_arg (); +-extern bool_t xdr_setkey3_arg (); +-extern bool_t xdr_setkey4_arg (); +-extern bool_t xdr_chrand_arg (); +-extern bool_t xdr_chrand3_arg (); +-extern bool_t xdr_chrand_ret (); +-extern bool_t xdr_gprinc_arg (); +-extern bool_t xdr_gprinc_ret (); +-extern bool_t xdr_kadm5_ret_t (); +-extern bool_t xdr_kadm5_principal_ent_rec (); +-extern bool_t xdr_kadm5_policy_ent_rec (); +-extern bool_t xdr_krb5_keyblock (); +-extern bool_t xdr_krb5_principal (); +-extern bool_t xdr_krb5_enctype (); +-extern bool_t xdr_krb5_octet (); +-extern bool_t xdr_krb5_int32 (); +-extern bool_t xdr_u_int32 (); +-extern bool_t xdr_cpol_arg (); +-extern bool_t xdr_dpol_arg (); +-extern bool_t xdr_mpol_arg (); +-extern bool_t xdr_gpol_arg (); +-extern bool_t xdr_gpol_ret (); +-extern bool_t xdr_gpols_arg (); +-extern bool_t xdr_gpols_ret (); +-extern bool_t xdr_getprivs_ret (); +-extern bool_t xdr_purgekeys_arg (); +-extern bool_t xdr_gstrings_arg (); +-extern bool_t xdr_gstrings_ret (); +-extern bool_t xdr_sstring_arg (); +-extern bool_t xdr_krb5_string_attr (); +-extern bool_t xdr_kadm5_key_data (); +-extern bool_t xdr_getpkeys_arg (); +-extern bool_t xdr_getpkeys_ret (); +- + #endif /* __KADM_RPC_H__ */ +diff --git a/src/lib/kadm5/kadm_rpc_xdr.c b/src/lib/kadm5/kadm_rpc_xdr.c +index 287cae750f..5e052dd90c 100644 +--- a/src/lib/kadm5/kadm_rpc_xdr.c ++++ b/src/lib/kadm5/kadm_rpc_xdr.c +@@ -408,7 +408,7 @@ _xdr_kadm5_principal_ent_rec(XDR *xdrs, kadm5_principal_ent_rec *objp, + return (FALSE); + } + if (!xdr_nulltype(xdrs, (void **) &objp->mod_name, +- xdr_krb5_principal)) { ++ (xdrproc_t)xdr_krb5_principal)) { + return (FALSE); + } + if (!xdr_krb5_timestamp(xdrs, &objp->mod_date)) { +@@ -451,12 +451,13 @@ _xdr_kadm5_principal_ent_rec(XDR *xdrs, kadm5_principal_ent_rec *objp, + return (FALSE); + } + if (!xdr_nulltype(xdrs, (void **) &objp->tl_data, +- xdr_krb5_tl_data)) { ++ (xdrproc_t)xdr_krb5_tl_data)) { + return FALSE; + } + n = objp->n_key_data; + r = xdr_array(xdrs, (caddr_t *) &objp->key_data, &n, objp->n_key_data, +- sizeof(krb5_key_data), xdr_krb5_key_data_nocontents); ++ sizeof(krb5_key_data), ++ (xdrproc_t)xdr_krb5_key_data_nocontents); + objp->n_key_data = n; + if (!r) { + return (FALSE); +@@ -528,7 +529,7 @@ _xdr_kadm5_policy_ent_rec(XDR *xdrs, kadm5_policy_ent_rec *objp, int vers) + return (FALSE); + } + if (!xdr_nulltype(xdrs, (void **) &objp->tl_data, +- xdr_krb5_tl_data)) { ++ (xdrproc_t)xdr_krb5_tl_data)) { + return FALSE; + } + } +@@ -576,7 +577,7 @@ xdr_cprinc3_arg(XDR *xdrs, cprinc3_arg *objp) + if (!xdr_array(xdrs, (caddr_t *)&objp->ks_tuple, + (unsigned int *)&objp->n_ks_tuple, ~0, + sizeof(krb5_key_salt_tuple), +- xdr_krb5_key_salt_tuple)) { ++ (xdrproc_t)xdr_krb5_key_salt_tuple)) { + return (FALSE); + } + if (!xdr_nullstring(xdrs, &objp->passwd)) { +@@ -668,7 +669,7 @@ xdr_gprincs_ret(XDR *xdrs, gprincs_ret *objp) + } + if (!xdr_array(xdrs, (caddr_t *) &objp->princs, + (unsigned int *) &objp->count, ~0, +- sizeof(char *), xdr_nullstring)) { ++ sizeof(char *), (xdrproc_t)xdr_nullstring)) { + return (FALSE); + } + } +@@ -706,7 +707,7 @@ xdr_chpass3_arg(XDR *xdrs, chpass3_arg *objp) + if (!xdr_array(xdrs, (caddr_t *)&objp->ks_tuple, + (unsigned int*)&objp->n_ks_tuple, ~0, + sizeof(krb5_key_salt_tuple), +- xdr_krb5_key_salt_tuple)) { ++ (xdrproc_t)xdr_krb5_key_salt_tuple)) { + return (FALSE); + } + if (!xdr_nullstring(xdrs, &objp->pass)) { +@@ -726,7 +727,7 @@ xdr_setkey_arg(XDR *xdrs, setkey_arg *objp) + } + if (!xdr_array(xdrs, (caddr_t *) &objp->keyblocks, + (unsigned int *) &objp->n_keys, ~0, +- sizeof(krb5_keyblock), xdr_krb5_keyblock)) { ++ sizeof(krb5_keyblock), (xdrproc_t)xdr_krb5_keyblock)) { + return (FALSE); + } + return (TRUE); +@@ -746,12 +747,13 @@ xdr_setkey3_arg(XDR *xdrs, setkey3_arg *objp) + } + if (!xdr_array(xdrs, (caddr_t *) &objp->ks_tuple, + (unsigned int *) &objp->n_ks_tuple, ~0, +- sizeof(krb5_key_salt_tuple), xdr_krb5_key_salt_tuple)) { ++ sizeof(krb5_key_salt_tuple), ++ (xdrproc_t)xdr_krb5_key_salt_tuple)) { + return (FALSE); + } + if (!xdr_array(xdrs, (caddr_t *) &objp->keyblocks, + (unsigned int *) &objp->n_keys, ~0, +- sizeof(krb5_keyblock), xdr_krb5_keyblock)) { ++ sizeof(krb5_keyblock), (xdrproc_t)xdr_krb5_keyblock)) { + return (FALSE); + } + return (TRUE); +@@ -771,7 +773,8 @@ xdr_setkey4_arg(XDR *xdrs, setkey4_arg *objp) + } + if (!xdr_array(xdrs, (caddr_t *) &objp->key_data, + (unsigned int *) &objp->n_key_data, ~0, +- sizeof(kadm5_key_data), xdr_kadm5_key_data)) { ++ sizeof(kadm5_key_data), ++ (xdrproc_t)xdr_kadm5_key_data)) { + return FALSE; + } + return TRUE; +@@ -804,7 +807,7 @@ xdr_chrand3_arg(XDR *xdrs, chrand3_arg *objp) + if (!xdr_array(xdrs, (caddr_t *)&objp->ks_tuple, + (unsigned int*)&objp->n_ks_tuple, ~0, + sizeof(krb5_key_salt_tuple), +- xdr_krb5_key_salt_tuple)) { ++ (xdrproc_t)xdr_krb5_key_salt_tuple)) { + return (FALSE); + } + return (TRUE); +@@ -822,7 +825,8 @@ xdr_chrand_ret(XDR *xdrs, chrand_ret *objp) + if (objp->code == KADM5_OK) { + if (!xdr_array(xdrs, (char **)&objp->keys, + (unsigned int *)&objp->n_keys, ~0, +- sizeof(krb5_keyblock), xdr_krb5_keyblock)) ++ sizeof(krb5_keyblock), ++ (xdrproc_t)xdr_krb5_keyblock)) + return FALSE; + } + +@@ -965,7 +969,7 @@ xdr_gpols_ret(XDR *xdrs, gpols_ret *objp) + } + if (!xdr_array(xdrs, (caddr_t *) &objp->pols, + (unsigned int *) &objp->count, ~0, +- sizeof(char *), xdr_nullstring)) { ++ sizeof(char *), (xdrproc_t)xdr_nullstring)) { + return (FALSE); + } + } +@@ -1030,7 +1034,7 @@ xdr_gstrings_ret(XDR *xdrs, gstrings_ret *objp) + if (!xdr_array(xdrs, (caddr_t *) &objp->strings, + (unsigned int *) &objp->count, ~0, + sizeof(krb5_string_attr), +- xdr_krb5_string_attr)) { ++ (xdrproc_t)xdr_krb5_string_attr)) { + return (FALSE); + } + } +@@ -1198,7 +1202,8 @@ xdr_getpkeys_ret(XDR *xdrs, getpkeys_ret *objp) + if (objp->code == KADM5_OK) { + if (!xdr_array(xdrs, (caddr_t *) &objp->key_data, + (unsigned int *) &objp->n_key_data, ~0, +- sizeof(kadm5_key_data), xdr_kadm5_key_data)) { ++ sizeof(kadm5_key_data), ++ (xdrproc_t)xdr_kadm5_key_data)) { + return FALSE; + } + } +diff --git a/src/lib/kadm5/misc_free.c b/src/lib/kadm5/misc_free.c +index 74d23760fb..9ac47bb87f 100644 +--- a/src/lib/kadm5/misc_free.c ++++ b/src/lib/kadm5/misc_free.c +@@ -41,9 +41,8 @@ kadm5_free_name_list(void *server_handle, char **names, int count) + } + + /* XXX this ought to be in libkrb5.a, but isn't */ +-kadm5_ret_t krb5_free_key_data_contents(context, key) +- krb5_context context; +- krb5_key_data *key; ++kadm5_ret_t ++krb5_free_key_data_contents(krb5_context context, krb5_key_data *key) + { + int i, idx; + +diff --git a/src/lib/kadm5/srv/adb_xdr.c b/src/lib/kadm5/srv/adb_xdr.c +index fc732971d2..b6ffdb8c7a 100644 +--- a/src/lib/kadm5/srv/adb_xdr.c ++++ b/src/lib/kadm5/srv/adb_xdr.c +@@ -53,8 +53,7 @@ xdr_osa_pw_hist_ent(XDR *xdrs, osa_pw_hist_ent *objp) + { + if (!xdr_array(xdrs, (caddr_t *) &objp->key_data, + (u_int *) &objp->n_key_data, ~0, +- sizeof(krb5_key_data), +- xdr_krb5_key_data)) ++ sizeof(krb5_key_data), (xdrproc_t)xdr_krb5_key_data)) + return (FALSE); + return (TRUE); + } +@@ -88,8 +87,7 @@ xdr_osa_princ_ent_rec(XDR *xdrs, osa_princ_ent_t objp) + return (FALSE); + if (!xdr_array(xdrs, (caddr_t *) &objp->old_keys, + (unsigned int *) &objp->old_key_len, ~0, +- sizeof(osa_pw_hist_ent), +- xdr_osa_pw_hist_ent)) ++ sizeof(osa_pw_hist_ent), (xdrproc_t)xdr_osa_pw_hist_ent)) + return (FALSE); + return (TRUE); + } +diff --git a/src/lib/kadm5/srv/svr_principal.c b/src/lib/kadm5/srv/svr_principal.c +index 8c3ad3a691..d5bb0b167d 100644 +--- a/src/lib/kadm5/srv/svr_principal.c ++++ b/src/lib/kadm5/srv/svr_principal.c +@@ -30,9 +30,9 @@ static int decrypt_key_data(krb5_context context, + /* + * XXX Functions that ought to be in libkrb5.a, but aren't. + */ +-kadm5_ret_t krb5_copy_key_data_contents(context, from, to) +- krb5_context context; +- krb5_key_data *from, *to; ++kadm5_ret_t ++krb5_copy_key_data_contents(krb5_context context, krb5_key_data *from, ++ krb5_key_data *to) + { + int i, idx; + +@@ -75,10 +75,8 @@ static krb5_tl_data *dup_tl_data(krb5_tl_data *tl) + } + + /* This is in lib/kdb/kdb_cpw.c, but is static */ +-static void cleanup_key_data(context, count, data) +- krb5_context context; +- int count; +- krb5_key_data * data; ++static void ++cleanup_key_data(krb5_context context, int count, krb5_key_data *data) + { + int i; + +diff --git a/src/lib/kadm5/str_conv.c b/src/lib/kadm5/str_conv.c +index 7982956062..f2fae832eb 100644 +--- a/src/lib/kadm5/str_conv.c ++++ b/src/lib/kadm5/str_conv.c +@@ -267,11 +267,8 @@ cleanup: + * Salttype may be negative to indicate a search for only a enctype. + */ + krb5_boolean +-krb5_keysalt_is_present(ksaltlist, nksalts, enctype, salttype) +- krb5_key_salt_tuple *ksaltlist; +- krb5_int32 nksalts; +- krb5_enctype enctype; +- krb5_int32 salttype; ++krb5_keysalt_is_present(krb5_key_salt_tuple *ksaltlist, krb5_int32 nksalts, ++ krb5_enctype enctype, krb5_int32 salttype) + { + krb5_boolean foundit; + int i; +@@ -375,12 +372,11 @@ cleanup: + * If ignoresalt set, then salttype is ignored. + */ + krb5_error_code +-krb5_keysalt_iterate(ksaltlist, nksalt, ignoresalt, iterator, arg) +- krb5_key_salt_tuple *ksaltlist; +- krb5_int32 nksalt; +- krb5_boolean ignoresalt; +- krb5_error_code (*iterator) (krb5_key_salt_tuple *, krb5_pointer); +- krb5_pointer arg; ++krb5_keysalt_iterate(krb5_key_salt_tuple *ksaltlist, krb5_int32 nksalt, ++ krb5_boolean ignoresalt, ++ krb5_error_code (*iterator)(krb5_key_salt_tuple *, ++ void *), ++ void *arg) + { + int i; + krb5_error_code kret; +diff --git a/src/lib/kadm5/t_kadm5.c b/src/lib/kadm5/t_kadm5.c +index 153147ffbf..b3ab1004f3 100644 +--- a/src/lib/kadm5/t_kadm5.c ++++ b/src/lib/kadm5/t_kadm5.c +@@ -276,7 +276,7 @@ cpw_test_succeed(char *user, krb5_principal princ, char *pass) + } + + static void +-test_chpass() ++test_chpass(void) + { + krb5_principal princ = parse_princ("chpass-test"); + krb5_principal hist_princ = parse_princ("kadmin/history"); +@@ -334,7 +334,7 @@ cpol_test_compare(char *user, kadm5_policy_ent_t ent, uint32_t mask) + } + + static void +-test_create_policy() ++test_create_policy(void) + { + void *handle; + kadm5_policy_ent_rec ent; +@@ -440,7 +440,7 @@ cprinc_test_compare(char *user, kadm5_principal_ent_t ent, uint32_t mask, + } + + static void +-test_create_principal() ++test_create_principal(void) + { + void *handle; + kadm5_principal_ent_rec ent; +@@ -535,7 +535,7 @@ dpol_test_succeed(char *user, char *name) + } + + static void +-test_delete_policy() ++test_delete_policy(void) + { + krb5_principal princ = parse_princ("delete-policy-test-princ"); + +@@ -587,7 +587,7 @@ dprinc_test_succeed(char *user, krb5_principal princ) + } + + static void +-test_delete_principal() ++test_delete_principal(void) + { + krb5_principal princ = parse_princ("delete-principal-test"); + +@@ -638,7 +638,7 @@ gpol_test_fail(char *user, char *name, krb5_error_code code) + } + + static void +-test_get_policy() ++test_get_policy(void) + { + /* Fails with unknown policy. */ + dpol_test_fail("admin", "unknown-policy", KADM5_UNK_POLICY); +@@ -684,7 +684,7 @@ gprinc_test_fail(char *user, krb5_principal princ, krb5_error_code code) + } + + static void +-test_get_principal() ++test_get_principal(void) + { + void *handle; + kadm5_principal_ent_rec ent; +@@ -743,7 +743,7 @@ test_get_principal() + } + + static void +-test_init_destroy() ++test_init_destroy(void) + { + krb5_context ctx; + kadm5_ret_t ret; +@@ -1019,7 +1019,7 @@ mpol_test_compare(void *handle, kadm5_policy_ent_t ent, uint32_t mask) + } + + static void +-test_modify_policy() ++test_modify_policy(void) + { + kadm5_policy_ent_rec ent; + +@@ -1109,7 +1109,7 @@ mprinc_test_compare(char *user, kadm5_principal_ent_t ent, uint32_t mask) + } + + static void +-test_modify_principal() ++test_modify_principal(void) + { + void *handle; + krb5_principal princ = parse_princ("modify-principal-test"); +@@ -1233,7 +1233,7 @@ rnd_test_succeed(char *user, krb5_principal princ) + } + + static void +-test_randkey() ++test_randkey(void) + { + void *handle; + krb5_principal princ = parse_princ("randkey-principal-test"); +diff --git a/src/lib/kdb/kdb5.c b/src/lib/kdb/kdb5.c +index 415ae64e22..0837f567cc 100644 +--- a/src/lib/kdb/kdb5.c ++++ b/src/lib/kdb/kdb5.c +@@ -75,13 +75,13 @@ free_mkey_list(krb5_context context, krb5_keylist_node *mkey_list) + } + + int +-kdb_init_lock_list() ++kdb_init_lock_list(void) + { + return k5_mutex_finish_init(&db_lock); + } + + static int +-kdb_lock_list() ++kdb_lock_list(void) + { + int err; + err = CALL_INIT_FUNCTION (kdb_init_lock_list); +@@ -92,14 +92,14 @@ kdb_lock_list() + } + + void +-kdb_fini_lock_list() ++kdb_fini_lock_list(void) + { + if (INITIALIZER_RAN(kdb_init_lock_list)) + k5_mutex_destroy(&db_lock); + } + + static void +-kdb_unlock_list() ++kdb_unlock_list(void) + { + k5_mutex_unlock(&db_lock); + } +diff --git a/src/lib/kdb/kdb_cpw.c b/src/lib/kdb/kdb_cpw.c +index 450860f470..c33c7cf8d0 100644 +--- a/src/lib/kdb/kdb_cpw.c ++++ b/src/lib/kdb/kdb_cpw.c +@@ -57,10 +57,7 @@ + enum save { DISCARD_ALL, KEEP_LAST_KVNO, KEEP_ALL }; + + int +-krb5_db_get_key_data_kvno(context, count, data) +- krb5_context context; +- int count; +- krb5_key_data * data; ++krb5_db_get_key_data_kvno(krb5_context context, int count, krb5_key_data *data) + { + int i, kvno; + /* Find last key version number */ +@@ -73,10 +70,7 @@ krb5_db_get_key_data_kvno(context, count, data) + } + + static void +-cleanup_key_data(context, count, data) +- krb5_context context; +- int count; +- krb5_key_data * data; ++cleanup_key_data(krb5_context context, int count, krb5_key_data *data) + { + int i; + +@@ -149,13 +143,9 @@ preserve_old_keys(krb5_context context, krb5_keyblock *mkey, + } + + static krb5_error_code +-add_key_rnd(context, master_key, ks_tuple, ks_tuple_count, db_entry, kvno) +- krb5_context context; +- krb5_keyblock * master_key; +- krb5_key_salt_tuple * ks_tuple; +- int ks_tuple_count; +- krb5_db_entry * db_entry; +- int kvno; ++add_key_rnd(krb5_context context, krb5_keyblock *master_key, ++ krb5_key_salt_tuple *ks_tuple, int ks_tuple_count, ++ krb5_db_entry *db_entry, int kvno) + { + krb5_keyblock key; + int i, j; +@@ -246,15 +236,9 @@ make_random_salt(krb5_context context, krb5_keysalt *salt_out) + * If passwd is NULL the assumes that the caller wants a random password. + */ + static krb5_error_code +-add_key_pwd(context, master_key, ks_tuple, ks_tuple_count, passwd, +- db_entry, kvno) +- krb5_context context; +- krb5_keyblock * master_key; +- krb5_key_salt_tuple * ks_tuple; +- int ks_tuple_count; +- const char * passwd; +- krb5_db_entry * db_entry; +- int kvno; ++add_key_pwd(krb5_context context, krb5_keyblock *master_key, ++ krb5_key_salt_tuple *ks_tuple, int ks_tuple_count, ++ const char *passwd, krb5_db_entry *db_entry, int kvno) + { + krb5_error_code retval; + krb5_keysalt key_salt; +diff --git a/src/lib/kdb/keytab.c b/src/lib/kdb/keytab.c +index a623e001ec..346cf962e8 100644 +--- a/src/lib/kdb/keytab.c ++++ b/src/lib/kdb/keytab.c +@@ -71,10 +71,7 @@ krb5_db_register_keytab(krb5_context context) + } + + krb5_error_code +-krb5_ktkdb_resolve(context, name, id) +- krb5_context context; +- const char * name; +- krb5_keytab * id; ++krb5_ktkdb_resolve(krb5_context context, const char *name, krb5_keytab *id) + { + if ((*id = (krb5_keytab) malloc(sizeof(**id))) == NULL) + return(ENOMEM); +@@ -84,9 +81,7 @@ krb5_ktkdb_resolve(context, name, id) + } + + krb5_error_code +-krb5_ktkdb_close(context, kt) +- krb5_context context; +- krb5_keytab kt; ++krb5_ktkdb_close(krb5_context context, krb5_keytab kt) + { + /* + * This routine is responsible for freeing all memory allocated +@@ -119,13 +114,9 @@ krb5_ktkdb_set_context(krb5_context ctx) + } + + krb5_error_code +-krb5_ktkdb_get_entry(in_context, id, principal, kvno, enctype, entry) +- krb5_context in_context; +- krb5_keytab id; +- krb5_const_principal principal; +- krb5_kvno kvno; +- krb5_enctype enctype; +- krb5_keytab_entry * entry; ++krb5_ktkdb_get_entry(krb5_context in_context, krb5_keytab id, ++ krb5_const_principal principal, krb5_kvno kvno, ++ krb5_enctype enctype, krb5_keytab_entry *entry) + { + krb5_context context; + krb5_error_code kerror = 0; +diff --git a/src/lib/kdb/t_stringattr.c b/src/lib/kdb/t_stringattr.c +index 11740368ea..2c643018b5 100644 +--- a/src/lib/kdb/t_stringattr.c ++++ b/src/lib/kdb/t_stringattr.c +@@ -38,7 +38,7 @@ + */ + + int +-main() ++main(void) + { + krb5_db_entry *ent; + krb5_context context; +diff --git a/src/lib/krad/packet.c b/src/lib/krad/packet.c +index fc2d248001..c5446b890c 100644 +--- a/src/lib/krad/packet.c ++++ b/src/lib/krad/packet.c +@@ -200,7 +200,7 @@ auth_generate_response(krb5_context ctx, const char *secret, + + /* Create a new packet. */ + static krad_packet * +-packet_new() ++packet_new(void) + { + krad_packet *pkt; + +diff --git a/src/lib/krad/t_attr.c b/src/lib/krad/t_attr.c +index 4d285ad9de..d5dd99a174 100644 +--- a/src/lib/krad/t_attr.c ++++ b/src/lib/krad/t_attr.c +@@ -40,7 +40,7 @@ const static unsigned char auth[] = { + }; + + int +-main() ++main(void) + { + unsigned char outbuf[MAX_ATTRSETSIZE]; + const char *decoded = "accept"; +diff --git a/src/lib/krad/t_attrset.c b/src/lib/krad/t_attrset.c +index 0f95762534..4cdb8b7d8e 100644 +--- a/src/lib/krad/t_attrset.c ++++ b/src/lib/krad/t_attrset.c +@@ -40,7 +40,7 @@ const static unsigned char encpass[] = { + }; + + int +-main() ++main(void) + { + unsigned char buffer[KRAD_PACKET_SIZE_MAX], encoded[MAX_ATTRSETSIZE]; + const char *username = "testUser", *password = "accept"; +diff --git a/src/lib/krad/t_code.c b/src/lib/krad/t_code.c +index b245a7efc0..6cd522af55 100644 +--- a/src/lib/krad/t_code.c ++++ b/src/lib/krad/t_code.c +@@ -30,7 +30,7 @@ + #include "t_test.h" + + int +-main() ++main(void) + { + const char *tmp; + +diff --git a/src/lib/krb5/ccache/cc_keyring.c b/src/lib/krb5/ccache/cc_keyring.c +index 1dadeef64f..ab3cda6fef 100644 +--- a/src/lib/krb5/ccache/cc_keyring.c ++++ b/src/lib/krb5/ccache/cc_keyring.c +@@ -314,7 +314,7 @@ get_persistent_real(uid_t uid) + * for the session anchor. + */ + static key_serial_t +-session_write_anchor() ++session_write_anchor(void) + { + key_serial_t s, u; + +diff --git a/src/lib/krb5/krb/plugin.c b/src/lib/krb5/krb/plugin.c +index 3bb7a38d44..1286e9e383 100644 +--- a/src/lib/krb5/krb/plugin.c ++++ b/src/lib/krb5/krb/plugin.c +@@ -355,7 +355,7 @@ load_if_needed(krb5_context context, struct plugin_mapping *map, + krb5_error_code ret; + char *symname = NULL; + struct plugin_file_handle *handle = NULL; +- void (*initvt_fn)(); ++ void (*initvt_fn)(void); + + if (map->module != NULL || map->dyn_path == NULL) + return; +diff --git a/src/lib/krb5/krb/t_authdata.c b/src/lib/krb5/krb/t_authdata.c +index dd834b9b0c..44f4a1cbd6 100644 +--- a/src/lib/krb5/krb/t_authdata.c ++++ b/src/lib/krb5/krb/t_authdata.c +@@ -74,7 +74,7 @@ static void compare_authdata(const krb5_authdata *adc1, krb5_authdata *adc2) { + } + + int +-main() ++main(void) + { + krb5_context context; + krb5_authdata **results; +diff --git a/src/lib/krb5/krb/t_response_items.c b/src/lib/krb5/krb/t_response_items.c +index 0deb9292a1..a6b02ca055 100644 +--- a/src/lib/krb5/krb/t_response_items.c ++++ b/src/lib/krb5/krb/t_response_items.c +@@ -61,7 +61,7 @@ nstrcmp(const char *a, const char *b) + } + + int +-main() ++main(void) + { + k5_response_items *ri; + +diff --git a/src/lib/krb5/krb/t_ser.c b/src/lib/krb5/krb/t_ser.c +index d6746b74bd..9780c2e564 100644 +--- a/src/lib/krb5/krb/t_ser.c ++++ b/src/lib/krb5/krb/t_ser.c +@@ -195,7 +195,7 @@ ser_checksum(krb5_checksum *cksum) + } + + static void +-ser_context_test() ++ser_context_test(void) + { + krb5_context context; + profile_t sprofile; +@@ -216,7 +216,7 @@ ser_context_test() + } + + static void +-ser_acontext_test() ++ser_acontext_test(void) + { + krb5_auth_context actx; + krb5_address local_address; +@@ -306,7 +306,7 @@ ser_acontext_test() + } + + static void +-ser_princ_test() ++ser_princ_test(void) + { + krb5_principal princ; + char pname[1024]; +@@ -320,7 +320,7 @@ ser_princ_test() + } + + static void +-ser_cksum_test() ++ser_cksum_test(void) + { + krb5_checksum checksum; + krb5_octet ckdata[24]; +diff --git a/src/lib/krb5/krb/t_sname_match.c b/src/lib/krb5/krb/t_sname_match.c +index 021b720d65..ee5623c158 100644 +--- a/src/lib/krb5/krb/t_sname_match.c ++++ b/src/lib/krb5/krb/t_sname_match.c +@@ -80,7 +80,7 @@ struct test { + }; + + int +-main() ++main(void) + { + size_t i; + struct test *t; +diff --git a/src/lib/krb5/krb/t_valid_times.c b/src/lib/krb5/krb/t_valid_times.c +index e4b5f1bce4..1a8036e811 100644 +--- a/src/lib/krb5/krb/t_valid_times.c ++++ b/src/lib/krb5/krb/t_valid_times.c +@@ -36,7 +36,7 @@ + #define BOUNDARY (uint32_t)INT32_MIN + + int +-main() ++main(void) + { + krb5_error_code ret; + krb5_context context; +diff --git a/src/lib/krb5/rcache/t_memrcache.c b/src/lib/krb5/rcache/t_memrcache.c +index 6f212b0ecd..665da75ea5 100644 +--- a/src/lib/krb5/rcache/t_memrcache.c ++++ b/src/lib/krb5/rcache/t_memrcache.c +@@ -33,7 +33,7 @@ + #include "memrcache.c" + + int +-main() ++main(void) + { + krb5_error_code ret; + krb5_context context; +diff --git a/src/lib/rpc/auth_gss.c b/src/lib/rpc/auth_gss.c +index 319bc759b1..f61322d82b 100644 +--- a/src/lib/rpc/auth_gss.c ++++ b/src/lib/rpc/auth_gss.c +@@ -445,9 +445,9 @@ authgss_refresh(AUTH *auth, struct rpc_msg *msg) + memset(&gr, 0, sizeof(gr)); + + call_stat = clnt_call(gd->clnt, NULLPROC, +- xdr_rpc_gss_init_args, ++ (xdrproc_t)xdr_rpc_gss_init_args, + &send_token, +- xdr_rpc_gss_init_res, ++ (xdrproc_t)xdr_rpc_gss_init_res, + (caddr_t)&gr, AUTH_TIMEOUT); + + gss_release_buffer(&min_stat, &send_token); +diff --git a/src/lib/rpc/auth_gssapi.c b/src/lib/rpc/auth_gssapi.c +index 8ab7ab5ba7..b5e03b9641 100644 +--- a/src/lib/rpc/auth_gssapi.c ++++ b/src/lib/rpc/auth_gssapi.c +@@ -283,11 +283,11 @@ next_token: + + PRINTF(("gssapi_create: calling GSSAPI_INIT (%d)\n", init_func)); + +- xdr_free(xdr_authgssapi_init_res, &call_res); ++ xdr_free((xdrproc_t)xdr_authgssapi_init_res, &call_res); + memset(&call_res, 0, sizeof(call_res)); + callstat = clnt_call(clnt, init_func, +- xdr_authgssapi_init_arg, &call_arg, +- xdr_authgssapi_init_res, &call_res, ++ (xdrproc_t)xdr_authgssapi_init_arg, &call_arg, ++ (xdrproc_t)xdr_authgssapi_init_res, &call_res, + timeout); + gss_release_buffer(minor_stat, &call_arg.token); + +@@ -436,7 +436,7 @@ next_token: + /* don't assume the caller will want to change clnt->cl_auth */ + clnt->cl_auth = save_auth; + +- xdr_free(xdr_authgssapi_init_res, &call_res); ++ xdr_free((xdrproc_t)xdr_authgssapi_init_res, &call_res); + return auth; + + /******************************************************************/ +@@ -458,7 +458,7 @@ cleanup: + if (rpc_createerr.cf_stat == 0) + rpc_createerr.cf_stat = RPC_AUTHERROR; + +- xdr_free(xdr_authgssapi_init_res, &call_res); ++ xdr_free((xdrproc_t)xdr_authgssapi_init_res, &call_res); + return auth; + } + +@@ -760,7 +760,7 @@ skip_call: + static bool_t auth_gssapi_wrap( + AUTH *auth, + XDR *out_xdrs, +- bool_t (*xdr_func)(), ++ xdrproc_t xdr_func, + caddr_t xdr_ptr) + { + OM_uint32 gssstat, minor_stat; +@@ -791,7 +791,7 @@ static bool_t auth_gssapi_wrap( + static bool_t auth_gssapi_unwrap( + AUTH *auth, + XDR *in_xdrs, +- bool_t (*xdr_func)(), ++ xdrproc_t xdr_func, + caddr_t xdr_ptr) + { + OM_uint32 gssstat, minor_stat; +diff --git a/src/lib/rpc/auth_gssapi_misc.c b/src/lib/rpc/auth_gssapi_misc.c +index a60eb7f7cb..57fc1fb39f 100644 +--- a/src/lib/rpc/auth_gssapi_misc.c ++++ b/src/lib/rpc/auth_gssapi_misc.c +@@ -199,7 +199,7 @@ bool_t auth_gssapi_wrap_data( + gss_ctx_id_t context, + uint32_t seq_num, + XDR *out_xdrs, +- bool_t (*xdr_func)(), ++ xdrproc_t xdr_func, + caddr_t xdr_ptr) + { + gss_buffer_desc in_buf, out_buf; +@@ -267,7 +267,7 @@ bool_t auth_gssapi_unwrap_data( + gss_ctx_id_t context, + uint32_t seq_num, + XDR *in_xdrs, +- bool_t (*xdr_func)(), ++ xdrproc_t xdr_func, + caddr_t xdr_ptr) + { + gss_buffer_desc in_buf, out_buf; +diff --git a/src/lib/rpc/authunix_prot.c b/src/lib/rpc/authunix_prot.c +index 512d5a51b7..92276c3ad4 100644 +--- a/src/lib/rpc/authunix_prot.c ++++ b/src/lib/rpc/authunix_prot.c +@@ -58,7 +58,8 @@ xdr_authunix_parms(XDR *xdrs, struct authunix_parms *p) + && xdr_int(xdrs, &(p->aup_uid)) + && xdr_int(xdrs, &(p->aup_gid)) + && xdr_array(xdrs, (caddr_t *)&(p->aup_gids), +- &(p->aup_len), NGRPS, sizeof(int), xdr_int) ) { ++ &(p->aup_len), NGRPS, sizeof(int), ++ (xdrproc_t)xdr_int)) { + return (TRUE); + } + return (FALSE); +diff --git a/src/lib/rpc/clnt_perror.c b/src/lib/rpc/clnt_perror.c +index fcc3657464..912b267867 100644 +--- a/src/lib/rpc/clnt_perror.c ++++ b/src/lib/rpc/clnt_perror.c +@@ -76,7 +76,6 @@ char * + clnt_sperror(CLIENT *rpch, char *s) + { + struct rpc_err e; +- void clnt_perrno(); + char *err; + char *bufstart = get_buf(); + char *str = bufstart; +diff --git a/src/lib/rpc/clnt_raw.c b/src/lib/rpc/clnt_raw.c +index dcbb5cf23d..7e62a5c776 100644 +--- a/src/lib/rpc/clnt_raw.c ++++ b/src/lib/rpc/clnt_raw.c +@@ -80,7 +80,7 @@ static struct clnt_ops client_ops = { + clntraw_control + }; + +-void svc_getreq(); ++void svc_getreq(int); + + /* + * Create a client handle for memory based rpc. +diff --git a/src/lib/rpc/dyn.c b/src/lib/rpc/dyn.c +index bce1fd2a7d..a505f34817 100644 +--- a/src/lib/rpc/dyn.c ++++ b/src/lib/rpc/dyn.c +@@ -30,10 +30,8 @@ + /* + * Made obsolete by DynInsert, now just a convenience function. + */ +-int DynAppend(obj, els, num) +- DynObjectP obj; +- DynPtr els; +- int num; ++int ++DynAppend(DynObjectP obj, DynPtr els, int num) + { + return DynInsert(obj, DynSize(obj), els, num); + } +@@ -52,8 +50,8 @@ int DynAppend(obj, els, num) + + static int default_increment = DEFAULT_INC; + +-DynObjectP DynCreate(el_size, inc) +- int el_size, inc; ++DynObjectP ++DynCreate(int el_size, int inc) + { + DynObjectP obj; + +@@ -77,8 +75,8 @@ DynObjectP DynCreate(el_size, inc) + return obj; + } + +-DynObjectP DynCopy(obj) +- DynObjectP obj; ++DynObjectP ++DynCopy(DynObjectP obj) + { + DynObjectP obj1; + +@@ -104,8 +102,8 @@ DynObjectP DynCopy(obj) + return obj1; + } + +-int DynDestroy(obj) +- /*@only@*/DynObjectP obj; ++int ++DynDestroy(/*@only@*/DynObjectP obj) + { + if (obj->paranoid) { + if (obj->debug) +@@ -118,8 +116,8 @@ int DynDestroy(obj) + return DYN_OK; + } + +-int DynRelease(obj) +- DynObjectP obj; ++int ++DynRelease(DynObjectP obj) + { + if (obj->debug) + fprintf(stderr, "dyn: release: freeing object structure.\n"); +@@ -134,9 +132,8 @@ int DynRelease(obj) + * contains the source code for the function DynDebug(). + */ + +-int DynDebug(obj, state) +- DynObjectP obj; +- int state; ++int ++DynDebug(DynObjectP obj, int state) + { + obj->debug = state; + +@@ -155,9 +152,8 @@ int DynDebug(obj, state) + * Checkers! Get away from that "hard disk erase" button! + * (Stupid dog. He almost did it to me again ...) + */ +-int DynDelete(obj, idx) +- DynObjectP obj; +- int idx; ++int ++DynDelete(DynObjectP obj, int idx) + { + if (idx < 0) { + if (obj->debug) +@@ -219,9 +215,8 @@ int DynDelete(obj, idx) + * contains the source code for the function DynInitZero(). + */ + +-int DynInitzero(obj, state) +- DynObjectP obj; +- int state; ++int ++DynInitzero(DynObjectP obj, int state) + { + obj->initzero = state; + +@@ -237,10 +232,8 @@ int DynInitzero(obj, state) + * contains the source code for the function DynInsert(). + */ + +-int DynInsert(obj, idx, els_in, num) +- DynObjectP obj; +- void *els_in; +- int idx, num; ++int ++DynInsert(DynObjectP obj, int idx, void *els_in, int num) + { + DynPtr els = (DynPtr) els_in; + int ret; +@@ -290,9 +283,8 @@ int DynInsert(obj, idx, els_in, num) + * contains the source code for the function DynDebug(). + */ + +-int DynParanoid(obj, state) +- DynObjectP obj; +- int state; ++int ++DynParanoid(DynObjectP obj, int state) + { + obj->paranoid = state; + +@@ -308,8 +300,8 @@ int DynParanoid(obj, state) + * contains the source code for the functions DynGet() and DynAdd(). + */ + +-DynPtr DynArray(obj) +- DynObjectP obj; ++DynPtr ++DynArray(DynObjectP obj) + { + if (obj->debug) + fprintf(stderr, "dyn: array: returning array pointer %p.\n", +@@ -318,9 +310,8 @@ DynPtr DynArray(obj) + return obj->array; + } + +-DynPtr DynGet(obj, num) +- DynObjectP obj; +- int num; ++DynPtr ++DynGet(DynObjectP obj, int num) + { + if (num < 0) { + if (obj->debug) +@@ -342,9 +333,7 @@ DynPtr DynGet(obj, num) + return (DynPtr) obj->array + obj->el_size*num; + } + +-int DynAdd(obj, el) +- DynObjectP obj; +- void *el; ++int DynAdd(DynObjectP obj, void *el) + { + int ret; + +@@ -364,10 +353,8 @@ int DynAdd(obj, el) + * obj->num_el) will not be updated properly and many other functions + * in the library will lose. Have a nice day. + */ +-int DynPut(obj, el_in, idx) +- DynObjectP obj; +- void *el_in; +- int idx; ++int ++DynPut(DynObjectP obj, void *el_in, int idx) + { + DynPtr el = (DynPtr) el_in; + int ret; +@@ -397,9 +384,8 @@ int DynPut(obj, el_in, idx) + /* + * Resize the array so that element req exists. + */ +-int _DynResize(obj, req) +- DynObjectP obj; +- int req; ++int ++_DynResize(DynObjectP obj, int req) + { + int size; + +@@ -430,9 +416,8 @@ int _DynResize(obj, req) + * Ideally, this function should not be called from outside the + * library. However, nothing will break if it is. + */ +-int _DynRealloc(obj, num_incs) +- DynObjectP obj; +- int num_incs; ++int ++_DynRealloc(DynObjectP obj, int num_incs) + { + DynPtr temp; + int new_size_in_bytes; +@@ -475,8 +460,8 @@ int _DynRealloc(obj, num_incs) + * contains the source code for the function DynSize(). + */ + +-int DynSize(obj) +- DynObjectP obj; ++int ++DynSize(DynObjectP obj) + { + if (obj->debug) + fprintf(stderr, "dyn: size: returning size %d.\n", obj->num_el); +@@ -484,8 +469,8 @@ int DynSize(obj) + return obj->num_el; + } + +-int DynCapacity(obj) +- DynObjectP obj; ++int ++DynCapacity(DynObjectP obj) + { + if (obj->debug) + fprintf(stderr, "dyn: capacity: returning cap of %d.\n", obj->size); +diff --git a/src/lib/rpc/pmap_clnt.c b/src/lib/rpc/pmap_clnt.c +index 952a251453..5c3bba3528 100644 +--- a/src/lib/rpc/pmap_clnt.c ++++ b/src/lib/rpc/pmap_clnt.c +@@ -54,8 +54,6 @@ static char sccsid[] = "@(#)pmap_clnt.c 1.37 87/08/11 Copyr 1984 Sun Micro"; + static struct timeval timeout = { 5, 0 }; + static struct timeval tottimeout = { 60, 0 }; + +-void clnt_perror(); +- + /* + * Set a mapping between program,version and port. + * Calls the pmap service remotely to do the mapping. +@@ -128,7 +126,8 @@ pmap_set( + } + } + #endif +- if (CLNT_CALL(client, PMAPPROC_SET, xdr_pmap, &parms, xdr_bool, &rslt, ++ if (CLNT_CALL(client, PMAPPROC_SET, (xdrproc_t)xdr_pmap, &parms, ++ (xdrproc_t)xdr_bool, &rslt, + tottimeout) != RPC_SUCCESS) { + clnt_perror(client, "Cannot register service"); + return (FALSE); +@@ -161,8 +160,8 @@ pmap_unset( + parms.pm_prog = program; + parms.pm_vers = version; + parms.pm_port = parms.pm_prot = 0; +- CLNT_CALL(client, PMAPPROC_UNSET, xdr_pmap, &parms, xdr_bool, &rslt, +- tottimeout); ++ CLNT_CALL(client, PMAPPROC_UNSET, (xdrproc_t)xdr_pmap, &parms, ++ (xdrproc_t)xdr_bool, &rslt, tottimeout); + CLNT_DESTROY(client); + (void)close(sock); + return (rslt); +diff --git a/src/lib/rpc/pmap_getmaps.c b/src/lib/rpc/pmap_getmaps.c +index b8a9cecf7e..a9c4c52906 100644 +--- a/src/lib/rpc/pmap_getmaps.c ++++ b/src/lib/rpc/pmap_getmaps.c +@@ -77,8 +77,9 @@ pmap_getmaps(struct sockaddr_in *address) + client = clnttcp_create(address, PMAPPROG, + PMAPVERS, &sock, 50, 500); + if (client != (CLIENT *)NULL) { +- if (CLNT_CALL(client, PMAPPROC_DUMP, xdr_void, NULL, xdr_pmaplist, +- &head, minutetimeout) != RPC_SUCCESS) { ++ if (CLNT_CALL(client, PMAPPROC_DUMP, xdr_void, NULL, ++ (xdrproc_t)xdr_pmaplist, &head, ++ minutetimeout) != RPC_SUCCESS) { + clnt_perror(client, "pmap_getmaps rpc problem"); + } + CLNT_DESTROY(client); +diff --git a/src/lib/rpc/pmap_getport.c b/src/lib/rpc/pmap_getport.c +index 66635a1034..2d0792b698 100644 +--- a/src/lib/rpc/pmap_getport.c ++++ b/src/lib/rpc/pmap_getport.c +@@ -79,8 +79,10 @@ pmap_getport( + parms.pm_vers = version; + parms.pm_prot = protocol; + parms.pm_port = 0; /* not needed or used */ +- if (CLNT_CALL(client, PMAPPROC_GETPORT, xdr_pmap, &parms, +- xdr_u_short, &port, tottimeout) != RPC_SUCCESS){ ++ if (CLNT_CALL(client, PMAPPROC_GETPORT, ++ (xdrproc_t)xdr_pmap, &parms, ++ (xdrproc_t)xdr_u_short, &port, ++ tottimeout) != RPC_SUCCESS){ + rpc_createerr.cf_stat = RPC_PMAPFAILURE; + clnt_geterr(client, &rpc_createerr.cf_error); + } else if (port == 0) { +diff --git a/src/lib/rpc/pmap_prot2.c b/src/lib/rpc/pmap_prot2.c +index aeccac6637..3c0c612bec 100644 +--- a/src/lib/rpc/pmap_prot2.c ++++ b/src/lib/rpc/pmap_prot2.c +@@ -109,7 +109,8 @@ xdr_pmaplist(XDR *xdrs, struct pmaplist **rp) + if (freeing) + next = &((*rp)->pml_next); + if (! xdr_reference(xdrs, (caddr_t *)rp, +- (u_int)sizeof(struct pmaplist), xdr_pmap)) ++ (u_int)sizeof(struct pmaplist), ++ (xdrproc_t)xdr_pmap)) + return (FALSE); + rp = (freeing) ? next : &((*rp)->pml_next); + } +diff --git a/src/lib/rpc/pmap_rmt.c b/src/lib/rpc/pmap_rmt.c +index 8c7e30c21a..434e4eea65 100644 +--- a/src/lib/rpc/pmap_rmt.c ++++ b/src/lib/rpc/pmap_rmt.c +@@ -105,8 +105,9 @@ pmap_rmtcall( + r.port_ptr = port_ptr; + r.results_ptr = resp; + r.xdr_results = xdrres; +- stat = CLNT_CALL(client, PMAPPROC_CALLIT, xdr_rmtcall_args, &a, +- xdr_rmtcallres, &r, tout); ++ stat = CLNT_CALL(client, PMAPPROC_CALLIT, ++ (xdrproc_t)xdr_rmtcall_args, &a, ++ (xdrproc_t)xdr_rmtcallres, &r, tout); + CLNT_DESTROY(client); + } else { + stat = RPC_FAILED; +@@ -161,7 +162,8 @@ xdr_rmtcallres( + + port_ptr = (caddr_t)(void *)crp->port_ptr; + if (xdr_reference(xdrs, &port_ptr, sizeof (uint32_t), +- xdr_u_int32) && xdr_u_int32(xdrs, &crp->resultslen)) { ++ (xdrproc_t)xdr_u_int32) && ++ xdr_u_int32(xdrs, &crp->resultslen)) { + crp->port_ptr = (uint32_t *)(void *)port_ptr; + return ((*(crp->xdr_results))(xdrs, crp->results_ptr)); + } +@@ -343,7 +345,7 @@ clnt_broadcast( + recv_again: + msg.acpted_rply.ar_verf = gssrpc__null_auth; + msg.acpted_rply.ar_results.where = (caddr_t)&r; +- msg.acpted_rply.ar_results.proc = xdr_rmtcallres; ++ msg.acpted_rply.ar_results.proc = (xdrproc_t)xdr_rmtcallres; + readfds = mask; + t2 = t; + switch (select(gssrpc__rpc_dtablesize(), &readfds, (fd_set *)NULL, +diff --git a/src/lib/rpc/rpc_prot.c b/src/lib/rpc/rpc_prot.c +index 9b82e12c34..296968b946 100644 +--- a/src/lib/rpc/rpc_prot.c ++++ b/src/lib/rpc/rpc_prot.c +@@ -132,8 +132,8 @@ xdr_rejected_reply(XDR *xdrs, struct rejected_reply *rr) + } + + static struct xdr_discrim reply_dscrm[3] = { +- { (int)MSG_ACCEPTED, xdr_accepted_reply }, +- { (int)MSG_DENIED, xdr_rejected_reply }, ++ { (int)MSG_ACCEPTED, (xdrproc_t)xdr_accepted_reply }, ++ { (int)MSG_DENIED, (xdrproc_t)xdr_rejected_reply }, + { __dontcare__, NULL_xdrproc_t } }; + + /* +diff --git a/src/lib/rpc/svc.c b/src/lib/rpc/svc.c +index cfbc7aad4d..0bcf04e8d4 100644 +--- a/src/lib/rpc/svc.c ++++ b/src/lib/rpc/svc.c +@@ -80,7 +80,7 @@ static struct svc_callout { + struct svc_callout *sc_next; + rpcprog_t sc_prog; + rpcprog_t sc_vers; +- void (*sc_dispatch)(); ++ void (*sc_dispatch)(struct svc_req *, SVCXPRT *); + } *svc_head; + + static struct svc_callout *svc_find(rpcprog_t, rpcvers_t, +@@ -162,7 +162,7 @@ svc_register( + SVCXPRT *xprt, + rpcprog_t prog, + rpcvers_t vers, +- void (*dispatch)(), ++ void (*dispatch)(struct svc_req *, SVCXPRT *), + int protocol) + { + struct svc_callout *prev; +diff --git a/src/lib/rpc/svc_auth_gss.c b/src/lib/rpc/svc_auth_gss.c +index aba7694807..98d601c8ab 100644 +--- a/src/lib/rpc/svc_auth_gss.c ++++ b/src/lib/rpc/svc_auth_gss.c +@@ -193,7 +193,7 @@ svcauth_gss_accept_sec_context(struct svc_req *rqst, + /* Deserialize arguments. */ + memset(&recv_tok, 0, sizeof(recv_tok)); + +- if (!svc_getargs(rqst->rq_xprt, xdr_rpc_gss_init_args, ++ if (!svc_getargs(rqst->rq_xprt, (xdrproc_t)xdr_rpc_gss_init_args, + (caddr_t)&recv_tok)) + return (FALSE); + +@@ -209,7 +209,8 @@ svcauth_gss_accept_sec_context(struct svc_req *rqst, + NULL, + NULL); + +- svc_freeargs(rqst->rq_xprt, xdr_rpc_gss_init_args, (caddr_t)&recv_tok); ++ svc_freeargs(rqst->rq_xprt, (xdrproc_t)xdr_rpc_gss_init_args, ++ (caddr_t)&recv_tok); + + log_status("accept_sec_context", gr->gr_major, gr->gr_minor); + if (gr->gr_major != GSS_S_COMPLETE && +@@ -495,7 +496,8 @@ gssrpc__svcauth_gss(struct svc_req *rqst, struct rpc_msg *msg, + } + *no_dispatch = TRUE; + +- call_stat = svc_sendreply(rqst->rq_xprt, xdr_rpc_gss_init_res, ++ call_stat = svc_sendreply(rqst->rq_xprt, ++ (xdrproc_t)xdr_rpc_gss_init_res, + (caddr_t)&gr); + + gss_release_buffer(&min_stat, &gr.gr_token); +@@ -544,7 +546,7 @@ gssrpc__svcauth_gss(struct svc_req *rqst, struct rpc_msg *msg, + } + retstat = AUTH_OK; + freegc: +- xdr_free(xdr_rpc_gss_cred, gc); ++ xdr_free((xdrproc_t)xdr_rpc_gss_cred, gc); + log_debug("returning %d from svcauth_gss()", retstat); + return (retstat); + } +diff --git a/src/lib/rpc/svc_auth_gssapi.c b/src/lib/rpc/svc_auth_gssapi.c +index b7ffee4515..267c1545bd 100644 +--- a/src/lib/rpc/svc_auth_gssapi.c ++++ b/src/lib/rpc/svc_auth_gssapi.c +@@ -201,7 +201,7 @@ enum auth_stat gssrpc__svcauth_gssapi( + if (! xdr_authgssapi_creds(&xdrs, &creds)) { + PRINTF(("svcauth_gssapi: failed decoding creds\n")); + LOG_MISCERR("protocol error in client credentials"); +- xdr_free(xdr_authgssapi_creds, &creds); ++ xdr_free((xdrproc_t)xdr_authgssapi_creds, &creds); + XDR_DESTROY(&xdrs); + ret = AUTH_BADCRED; + goto error; +@@ -223,7 +223,7 @@ enum auth_stat gssrpc__svcauth_gssapi( + if (creds.auth_msg && rqst->rq_proc == AUTH_GSSAPI_EXIT) { + PRINTF(("svcauth_gssapi: GSSAPI_EXIT, cleaning up\n")); + svc_sendreply(rqst->rq_xprt, xdr_void, NULL); +- xdr_free(xdr_authgssapi_creds, &creds); ++ xdr_free((xdrproc_t)xdr_authgssapi_creds, &creds); + cleanup(); + exit(0); + } +@@ -306,7 +306,7 @@ enum auth_stat gssrpc__svcauth_gssapi( + + /* call is for us, deserialize arguments */ + memset(&call_arg, 0, sizeof(call_arg)); +- if (! svc_getargs(rqst->rq_xprt, xdr_authgssapi_init_arg, ++ if (! svc_getargs(rqst->rq_xprt, (xdrproc_t)xdr_authgssapi_init_arg, + &call_arg)) { + PRINTF(("svcauth_gssapi: cannot decode args\n")); + LOG_MISCERR("protocol error in procedure arguments"); +@@ -446,7 +446,7 @@ enum auth_stat gssrpc__svcauth_gssapi( + minor_stat = call_res.gss_minor; + + /* done with call args */ +- xdr_free(xdr_authgssapi_init_arg, &call_arg); ++ xdr_free((xdrproc_t)xdr_authgssapi_init_arg, &call_arg); + + PRINTF(("svcauth_gssapi: accept_sec_context returned %#x %#x\n", + call_res.gss_major, call_res.gss_minor)); +@@ -459,7 +459,7 @@ enum auth_stat gssrpc__svcauth_gssapi( + badauth(call_res.gss_major, call_res.gss_minor, rqst->rq_xprt); + + gss_release_buffer(&minor_stat, &output_token); +- svc_sendreply(rqst->rq_xprt, xdr_authgssapi_init_res, ++ svc_sendreply(rqst->rq_xprt, (xdrproc_t)xdr_authgssapi_init_res, + (caddr_t) &call_res); + *no_dispatch = TRUE; + ret = AUTH_OK; +@@ -492,7 +492,7 @@ enum auth_stat gssrpc__svcauth_gssapi( + } + + PRINTF(("svcauth_gssapi: sending reply\n")); +- svc_sendreply(rqst->rq_xprt, xdr_authgssapi_init_res, ++ svc_sendreply(rqst->rq_xprt, (xdrproc_t)xdr_authgssapi_init_res, + (caddr_t) &call_res); + *no_dispatch = TRUE; + +@@ -583,11 +583,13 @@ enum auth_stat gssrpc__svcauth_gssapi( + case AUTH_GSSAPI_MSG: + PRINTF(("svcauth_gssapi: GSSAPI_MSG, getting args\n")); + memset(&call_arg, 0, sizeof(call_arg)); +- if (! svc_getargs(rqst->rq_xprt, xdr_authgssapi_init_arg, ++ if (! svc_getargs(rqst->rq_xprt, ++ (xdrproc_t)xdr_authgssapi_init_arg, + &call_arg)) { + PRINTF(("svcauth_gssapi: cannot decode args\n")); + LOG_MISCERR("protocol error in call arguments"); +- xdr_free(xdr_authgssapi_init_arg, &call_arg); ++ xdr_free((xdrproc_t)xdr_authgssapi_init_arg, ++ &call_arg); + ret = AUTH_BADCRED; + goto error; + } +@@ -598,7 +600,7 @@ enum auth_stat gssrpc__svcauth_gssapi( + &call_arg.token); + + /* done with call args */ +- xdr_free(xdr_authgssapi_init_arg, &call_arg); ++ xdr_free((xdrproc_t)xdr_authgssapi_init_arg, &call_arg); + + if (gssstat != GSS_S_COMPLETE) { + AUTH_GSSAPI_DISPLAY_STATUS(("processing token", +@@ -641,7 +643,7 @@ enum auth_stat gssrpc__svcauth_gssapi( + if (creds.client_handle.length != 0) { + PRINTF(("svcauth_gssapi: freeing client_handle len %d\n", + (int) creds.client_handle.length)); +- xdr_free(xdr_authgssapi_creds, &creds); ++ xdr_free((xdrproc_t)xdr_authgssapi_creds, &creds); + } + + PRINTF(("\n")); +@@ -651,7 +653,7 @@ error: + if (creds.client_handle.length != 0) { + PRINTF(("svcauth_gssapi: freeing client_handle len %d\n", + (int) creds.client_handle.length)); +- xdr_free(xdr_authgssapi_creds, &creds); ++ xdr_free((xdrproc_t)xdr_authgssapi_creds, &creds); + } + + PRINTF(("\n")); +@@ -1079,7 +1081,7 @@ void svcauth_gssapi_set_log_miscerr_func( + static bool_t svc_auth_gssapi_wrap( + SVCAUTH *auth, + XDR *out_xdrs, +- bool_t (*xdr_func)(), ++ xdrproc_t xdr_func, + caddr_t xdr_ptr) + { + OM_uint32 gssstat, minor_stat; +@@ -1102,7 +1104,7 @@ static bool_t svc_auth_gssapi_wrap( + static bool_t svc_auth_gssapi_unwrap( + SVCAUTH *auth, + XDR *in_xdrs, +- bool_t (*xdr_func)(), ++ xdrproc_t xdr_func, + caddr_t xdr_ptr) + { + svc_auth_gssapi_data *client_data = SVCAUTH_PRIVATE(auth); +diff --git a/src/lib/rpc/svc_simple.c b/src/lib/rpc/svc_simple.c +index 315275f5fd..aa6c0a63d0 100644 +--- a/src/lib/rpc/svc_simple.c ++++ b/src/lib/rpc/svc_simple.c +@@ -48,7 +48,7 @@ static char sccsid[] = "@(#)svc_simple.c 1.18 87/08/11 Copyr 1984 Sun Micro"; + #include + + static struct proglst { +- char *(*p_progname)(); ++ char *(*p_progname)(void *); + int p_prognum; + int p_procnum; + xdrproc_t p_inproc, p_outproc; +@@ -62,7 +62,7 @@ registerrpc( + rpcprog_t prognum, + rpcvers_t versnum, + rpcproc_t procnum, +- char *(*progname)(), ++ char *(*progname)(void *), + xdrproc_t inproc, + xdrproc_t outproc) + { +diff --git a/src/lib/rpc/unit-test/client.c b/src/lib/rpc/unit-test/client.c +index c9a812bc5a..9b907bcdc6 100644 +--- a/src/lib/rpc/unit-test/client.c ++++ b/src/lib/rpc/unit-test/client.c +@@ -42,7 +42,7 @@ char *whoami; + #ifdef __GNUC__ + __attribute__((noreturn)) + #endif +-static void usage() ++static void usage(void) + { + fprintf(stderr, "usage: %s {-t|-u} [-a] [-s num] [-m num] host service [count]\n", + whoami); +@@ -50,9 +50,7 @@ static void usage() + } + + int +-main(argc, argv) +- int argc; +- char **argv; ++main(int argc, char **argv) + { + char *host, *port, *target, *echo_arg, **echo_resp, buf[BIG_BUF]; + CLIENT *clnt; +@@ -172,7 +170,7 @@ main(argc, argv) + strcmp(echo_arg, (*echo_resp) + 6) != 0) + fprintf(stderr, "RPC_TEST_ECHO call %d response wrong: " + "arg = %s, resp = %s\n", i, echo_arg, *echo_resp); +- gssrpc_xdr_free(xdr_wrapstring, echo_resp); ++ gssrpc_xdr_free((xdrproc_t)xdr_wrapstring, echo_resp); + } + + /* +@@ -194,7 +192,7 @@ main(argc, argv) + clnt_perror(clnt, whoami); + } else { + fprintf(stderr, "bad seq didn't cause failure\n"); +- gssrpc_xdr_free(xdr_wrapstring, echo_resp); ++ gssrpc_xdr_free((xdrproc_t)xdr_wrapstring, echo_resp); + } + + AUTH_PRIVATE(clnt->cl_auth)->seq_num -= 3; +@@ -207,7 +205,7 @@ main(argc, argv) + if (echo_resp == NULL) + clnt_perror(clnt, "Sequence number improperly reset"); + else +- gssrpc_xdr_free(xdr_wrapstring, echo_resp); ++ gssrpc_xdr_free((xdrproc_t)xdr_wrapstring, echo_resp); + + /* + * Now simulate a lost server response, and see if +@@ -219,7 +217,7 @@ main(argc, argv) + if (echo_resp == NULL) + clnt_perror(clnt, "Auto-resynchronization failed"); + else +- gssrpc_xdr_free(xdr_wrapstring, echo_resp); ++ gssrpc_xdr_free((xdrproc_t)xdr_wrapstring, echo_resp); + + /* + * Now make sure auto-resyncrhonization actually worked +@@ -229,7 +227,7 @@ main(argc, argv) + if (echo_resp == NULL) + clnt_perror(clnt, "Auto-resynchronization did not work"); + else +- gssrpc_xdr_free(xdr_wrapstring, echo_resp); ++ gssrpc_xdr_free((xdrproc_t)xdr_wrapstring, echo_resp); + + if (! auth_once) { + tmp_auth = clnt->cl_auth; +@@ -259,7 +257,7 @@ main(argc, argv) + strcmp(echo_arg, (*echo_resp) + 6) != 0) + fprintf(stderr, + "RPC_TEST_LENGTHS call %d response wrong\n", i); +- gssrpc_xdr_free(xdr_wrapstring, echo_resp); ++ gssrpc_xdr_free((xdrproc_t)xdr_wrapstring, echo_resp); + } + + /* cycle from 1 to 255 */ +diff --git a/src/lib/rpc/unit-test/rpc_test_clnt.c b/src/lib/rpc/unit-test/rpc_test_clnt.c +index 4e4a18a720..b9141672b1 100644 +--- a/src/lib/rpc/unit-test/rpc_test_clnt.c ++++ b/src/lib/rpc/unit-test/rpc_test_clnt.c +@@ -5,9 +5,7 @@ + static struct timeval TIMEOUT = { 25, 0 }; + + char ** +-rpc_test_echo_1(argp, clnt) +- char **argp; +- CLIENT *clnt; ++rpc_test_echo_1(char **argp, CLIENT *clnt) + { + static char *clnt_res; + +diff --git a/src/lib/rpc/unit-test/rpc_test_svc.c b/src/lib/rpc/unit-test/rpc_test_svc.c +index c54c0813db..3aa7674c51 100644 +--- a/src/lib/rpc/unit-test/rpc_test_svc.c ++++ b/src/lib/rpc/unit-test/rpc_test_svc.c +@@ -14,16 +14,14 @@ static int _rpcsvcstate = _IDLE; /* Set when a request is serviced */ + static int _rpcsvccount = 0; /* Number of requests being serviced */ + + void +-rpc_test_prog_1_svc(rqstp, transp) +- struct svc_req *rqstp; +- SVCXPRT *transp; ++rpc_test_prog_1_svc(struct svc_req *rqstp, SVCXPRT *transp) + { + union { + char *rpc_test_echo_1_arg; + } argument; + char *result; +- bool_t (*xdr_argument)(), (*xdr_result)(); +- char *(*local)(); ++ xdrproc_t xdr_argument, xdr_result; ++ char *(*local)(char *, struct svc_req *); + + _rpcsvccount++; + switch (rqstp->rq_proc) { +@@ -35,9 +33,9 @@ rpc_test_prog_1_svc(rqstp, transp) + return; + + case RPC_TEST_ECHO: +- xdr_argument = xdr_wrapstring; +- xdr_result = xdr_wrapstring; +- local = (char *(*)()) rpc_test_echo_1_svc; ++ xdr_argument = (xdrproc_t)xdr_wrapstring; ++ xdr_result = (xdrproc_t)xdr_wrapstring; ++ local = (char *(*)(char *, struct svc_req *)) rpc_test_echo_1_svc; + break; + + default: +@@ -53,7 +51,7 @@ rpc_test_prog_1_svc(rqstp, transp) + _rpcsvcstate = _SERVED; + return; + } +- result = (*local)(&argument, rqstp); ++ result = (*local)((char *)&argument, rqstp); + if (result != NULL && !svc_sendreply(transp, xdr_result, result)) { + svcerr_systemerr(transp); + } +diff --git a/src/lib/rpc/unit-test/server.c b/src/lib/rpc/unit-test/server.c +index c3bbcbf8cf..4400b969f6 100644 +--- a/src/lib/rpc/unit-test/server.c ++++ b/src/lib/rpc/unit-test/server.c +@@ -40,7 +40,7 @@ static void rpc_test_badverf(gss_name_t client, gss_name_t server, + #define SERVICE_NAME "host" + #endif + +-static void usage() ++static void usage(void) + { + fprintf(stderr, "Usage: server {-t|-u} [svc-debug] [misc-debug]\n"); + exit(1); +diff --git a/src/lib/rpc/xdr.c b/src/lib/rpc/xdr.c +index 24c3de4bd9..49c31b3d1b 100644 +--- a/src/lib/rpc/xdr.c ++++ b/src/lib/rpc/xdr.c +@@ -579,14 +579,14 @@ xdr_union( + */ + for (; choices->proc != NULL_xdrproc_t; choices++) { + if (choices->value == dscm) +- return ((*(choices->proc))(xdrs, unp, LASTUNSIGNED)); ++ return choices->proc(xdrs, unp); + } + + /* + * no match - execute the default xdr routine if there is one + */ + return ((dfault == NULL_xdrproc_t) ? FALSE : +- (*dfault)(xdrs, unp, LASTUNSIGNED)); ++ (*dfault)(xdrs, unp)); + } + + +diff --git a/src/lib/rpc/xdr_array.c b/src/lib/rpc/xdr_array.c +index aeaa7f2bb0..3507d53aef 100644 +--- a/src/lib/rpc/xdr_array.c ++++ b/src/lib/rpc/xdr_array.c +@@ -113,7 +113,7 @@ xdr_array( + * now we xdr each element of array + */ + for (i = 0; (i < c) && stat; i++) { +- stat = (*elproc)(xdrs, target, LASTUNSIGNED); ++ stat = (*elproc)(xdrs, target); + target += elsize; + } + +@@ -150,7 +150,7 @@ xdr_vector( + + elptr = basep; + for (i = 0; i < nelem; i++) { +- if (! (*xdr_elem)(xdrs, elptr, LASTUNSIGNED)) { ++ if (! (*xdr_elem)(xdrs, elptr)) { + return(FALSE); + } + elptr += elemsize; +diff --git a/src/lib/rpc/xdr_rec.c b/src/lib/rpc/xdr_rec.c +index 1f6a7762fd..185254018a 100644 +--- a/src/lib/rpc/xdr_rec.c ++++ b/src/lib/rpc/xdr_rec.c +@@ -99,7 +99,7 @@ typedef struct rec_strm { + /* + * out-goung bits + */ +- int (*writeit)(); ++ int (*writeit)(caddr_t, caddr_t, int); + caddr_t out_base; /* output buffer (points to frag header) */ + caddr_t out_finger; /* next output position */ + caddr_t out_boundry; /* data cannot up to this address */ +@@ -108,7 +108,7 @@ typedef struct rec_strm { + /* + * in-coming bits + */ +- int (*readit)(); ++ int (*readit)(caddr_t, caddr_t, int); + uint32_t in_size; /* fixed size of the input buffer */ + caddr_t in_base; + caddr_t in_finger; /* location of next byte to be had */ +@@ -140,8 +140,10 @@ xdrrec_create( + u_int sendsize, + u_int recvsize, + caddr_t tcp_handle, +- int (*readit)(), /* like read, but pass it a tcp_handle, not sock */ +- int (*writeit)() /* like write, but pass it a tcp_handle, not sock */ ++ /* like read, but pass it a tcp_handle, not sock */ ++ int (*readit)(caddr_t, caddr_t, int), ++ /* like write, but pass it a tcp_handle, not sock */ ++ int (*writeit)(caddr_t, caddr_t, int) + ) + { + RECSTREAM *rstrm = mem_alloc(sizeof(RECSTREAM)); +@@ -528,8 +530,7 @@ get_input_bytes(RECSTREAM *rstrm, caddr_t addr, int len) + } + + static bool_t /* next four bytes of input stream are treated as a header */ +-set_input_fragment(rstrm) +- RECSTREAM *rstrm; ++set_input_fragment(RECSTREAM *rstrm) + { + uint32_t header; + +diff --git a/src/lib/rpc/xdr_reference.c b/src/lib/rpc/xdr_reference.c +index eff279dadf..f3d4b7dfb8 100644 +--- a/src/lib/rpc/xdr_reference.c ++++ b/src/lib/rpc/xdr_reference.c +@@ -47,8 +47,6 @@ static char sccsid[] = "@(#)xdr_reference.c 1.11 87/08/11 SMI"; + #include + #include + +-#define LASTUNSIGNED ((u_int)0-1) +- + /* + * XDR an indirect pointer + * xdr_reference is for recursively translating a structure that is +@@ -88,7 +86,7 @@ xdr_reference( + break; + } + +- stat = (*proc)(xdrs, loc, LASTUNSIGNED); ++ stat = (*proc)(xdrs, loc); + + if (xdrs->x_op == XDR_FREE) { + mem_free(loc, size); +diff --git a/src/lib/rpc/xdr_sizeof.c b/src/lib/rpc/xdr_sizeof.c +index 5b77fa6ac0..0c460e7cdb 100644 +--- a/src/lib/rpc/xdr_sizeof.c ++++ b/src/lib/rpc/xdr_sizeof.c +@@ -43,9 +43,7 @@ + + /* ARGSUSED */ + static bool_t +-x_putlong(xdrs, longp) +- XDR *xdrs; +- long *longp; ++x_putlong(XDR *xdrs, long *longp) + { + xdrs->x_handy += BYTES_PER_XDR_UNIT; + return (TRUE); +@@ -53,10 +51,7 @@ x_putlong(xdrs, longp) + + /* ARGSUSED */ + static bool_t +-x_putbytes(xdrs, bp, len) +- XDR *xdrs; +- char *bp; +- int len; ++x_putbytes(XDR *xdrs, char *bp, u_int len) + { + xdrs->x_handy += len; + +@@ -64,26 +59,21 @@ x_putbytes(xdrs, bp, len) + } + + static u_int +-x_getpostn(xdrs) +- XDR *xdrs; ++x_getpostn(XDR *xdrs) + { + return (xdrs->x_handy); + } + + /* ARGSUSED */ + static bool_t +-x_setpostn(xdrs, pos) +- XDR *xdrs; +- u_int pos; ++x_setpostn(XDR *xdrs, u_int pos) + { + /* This is not allowed */ + return (FALSE); + } + + static rpc_inline_t * +-x_inline(xdrs, len) +- XDR *xdrs; +- int len; ++x_inline(XDR *xdrs, int len) + { + if (len == 0) { + return (NULL); +@@ -110,15 +100,14 @@ x_inline(xdrs, len) + } + + static int +-harmless() ++harmless(void) + { + /* Always return FALSE/NULL, as the case may be */ + return (0); + } + + static void +-x_destroy(xdrs) +- XDR *xdrs; ++x_destroy(XDR *xdrs) + { + xdrs->x_handy = 0; + xdrs->x_private = NULL; +@@ -130,9 +119,7 @@ x_destroy(xdrs) + } + + unsigned long +-xdr_sizeof(func, data) +- xdrproc_t func; +- void *data; ++xdr_sizeof(xdrproc_t func, void *data) + { + XDR x; + struct xdr_ops ops; +diff --git a/src/plugins/kdb/db2/db2_exp.c b/src/plugins/kdb/db2/db2_exp.c +index 7cf8aa4d99..9b75f34a11 100644 +--- a/src/plugins/kdb/db2/db2_exp.c ++++ b/src/plugins/kdb/db2/db2_exp.c +@@ -68,7 +68,7 @@ k5_mutex_t *krb5_db2_mutex; + return result; \ + } \ + /* hack: decl to allow a following ";" */ \ +- static TYPE wrap_##NAME () ++ static TYPE wrap_##NAME ARGLIST + + /* Two special cases: void (can't assign result), and krb5_error_code + (return error from locking code). */ +@@ -81,7 +81,7 @@ k5_mutex_t *krb5_db2_mutex; + k5_mutex_unlock (krb5_db2_mutex); \ + } \ + /* hack: decl to allow a following ";" */ \ +- static void wrap_##NAME () ++ static void wrap_##NAME ARGLIST + + #define WRAP_K(NAME,ARGLIST,ARGNAMES) \ + WRAP(NAME,krb5_error_code,ARGLIST,ARGNAMES) +diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_close.c b/src/plugins/kdb/db2/libdb2/btree/bt_close.c +index 11be134113..f12d74ba32 100644 +--- a/src/plugins/kdb/db2/libdb2/btree/bt_close.c ++++ b/src/plugins/kdb/db2/libdb2/btree/bt_close.c +@@ -61,8 +61,7 @@ static int bt_meta __P((BTREE *)); + * RET_ERROR, RET_SUCCESS + */ + int +-__bt_close(dbp) +- DB *dbp; ++__bt_close(DB *dbp) + { + BTREE *t; + int fd; +@@ -116,9 +115,7 @@ __bt_close(dbp) + * RET_SUCCESS, RET_ERROR. + */ + int +-__bt_sync(dbp, flags) +- const DB *dbp; +- u_int flags; ++__bt_sync(const DB *dbp, u_int flags) + { + BTREE *t; + int status; +@@ -160,8 +157,7 @@ __bt_sync(dbp, flags) + * RET_ERROR, RET_SUCCESS + */ + static int +-bt_meta(t) +- BTREE *t; ++bt_meta(BTREE *t) + { + BTMETA m; + void *p; +diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_conv.c b/src/plugins/kdb/db2/libdb2/btree/bt_conv.c +index c0644ed713..99c4af56c0 100644 +--- a/src/plugins/kdb/db2/libdb2/btree/bt_conv.c ++++ b/src/plugins/kdb/db2/libdb2/btree/bt_conv.c +@@ -59,10 +59,7 @@ static void mswap __P((PAGE *)); + * h: page to convert + */ + void +-__bt_pgin(t, pg, pp) +- void *t; +- db_pgno_t pg; +- void *pp; ++__bt_pgin(void *t, db_pgno_t pg, void *pp) + { + PAGE *h; + indx_t i, top; +@@ -128,10 +125,7 @@ __bt_pgin(t, pg, pp) + } + + void +-__bt_pgout(t, pg, pp) +- void *t; +- db_pgno_t pg; +- void *pp; ++__bt_pgout(void *t, db_pgno_t pg, void *pp) + { + PAGE *h; + indx_t i, top; +@@ -203,8 +197,7 @@ __bt_pgout(t, pg, pp) + * p: page to convert + */ + static void +-mswap(pg) +- PAGE *pg; ++mswap(PAGE *pg) + { + char *p; + +diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_delete.c b/src/plugins/kdb/db2/libdb2/btree/bt_delete.c +index 28cc24d15a..f8dd59e85a 100644 +--- a/src/plugins/kdb/db2/libdb2/btree/bt_delete.c ++++ b/src/plugins/kdb/db2/libdb2/btree/bt_delete.c +@@ -59,10 +59,7 @@ static int __bt_stkacq __P((BTREE *, PAGE **, CURSOR *)); + * Return RET_SPECIAL if the key is not found. + */ + int +-__bt_delete(dbp, key, flags) +- const DB *dbp; +- const DBT *key; +- u_int flags; ++__bt_delete(const DB *dbp, const DBT *key, u_int flags) + { + BTREE *t; + CURSOR *c; +@@ -140,10 +137,7 @@ __bt_delete(dbp, key, flags) + * 0 on success, 1 on failure + */ + static int +-__bt_stkacq(t, hp, c) +- BTREE *t; +- PAGE **hp; +- CURSOR *c; ++__bt_stkacq(BTREE *t, PAGE **hp, CURSOR *c) + { + BINTERNAL *bi; + EPG *e; +@@ -288,9 +282,7 @@ ret: mpool_put(t->bt_mp, h, 0); + * RET_ERROR, RET_SUCCESS and RET_SPECIAL if the key not found. + */ + static int +-__bt_bdelete(t, key) +- BTREE *t; +- const DBT *key; ++__bt_bdelete(BTREE *t, const DBT *key) + { + EPG *e; + PAGE *h; +@@ -375,9 +367,7 @@ loop: if ((e = __bt_search(t, key, &exact)) == NULL) + * mpool_put's the page + */ + static int +-__bt_pdelete(t, h) +- BTREE *t; +- PAGE *h; ++__bt_pdelete(BTREE *t, PAGE *h) + { + BINTERNAL *bi; + PAGE *pg; +@@ -471,11 +461,7 @@ __bt_pdelete(t, h) + * RET_SUCCESS, RET_ERROR. + */ + int +-__bt_dleaf(t, key, h, idx) +- BTREE *t; +- const DBT *key; +- PAGE *h; +- u_int idx; ++__bt_dleaf(BTREE *t, const DBT *key, PAGE *h, u_int idx) + { + BLEAF *bl; + indx_t cnt, *ip, offset; +@@ -536,11 +522,7 @@ __bt_dleaf(t, key, h, idx) + * RET_SUCCESS, RET_ERROR. + */ + static int +-__bt_curdel(t, key, h, idx) +- BTREE *t; +- const DBT *key; +- PAGE *h; +- u_int idx; ++__bt_curdel(BTREE *t, const DBT *key, PAGE *h, u_int idx) + { + CURSOR *c; + EPG e; +@@ -635,9 +617,7 @@ dup2: c->pg.pgno = e.page->pgno; + * h: page to be deleted + */ + int +-__bt_relink(t, h) +- BTREE *t; +- PAGE *h; ++__bt_relink(BTREE *t, PAGE *h) + { + PAGE *pg; + +diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_get.c b/src/plugins/kdb/db2/libdb2/btree/bt_get.c +index b6318211a1..012a341b25 100644 +--- a/src/plugins/kdb/db2/libdb2/btree/bt_get.c ++++ b/src/plugins/kdb/db2/libdb2/btree/bt_get.c +@@ -60,11 +60,7 @@ static char sccsid[] = "@(#)bt_get.c 8.6 (Berkeley) 7/20/94"; + * RET_ERROR, RET_SUCCESS and RET_SPECIAL if the key not found. + */ + int +-__bt_get(dbp, key, data, flags) +- const DB *dbp; +- const DBT *key; +- DBT *data; +- u_int flags; ++__bt_get(const DB *dbp, const DBT *key, DBT *data, u_int flags) + { + BTREE *t; + EPG *e; +diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_open.c b/src/plugins/kdb/db2/libdb2/btree/bt_open.c +index d5809a5a93..a2910422eb 100644 +--- a/src/plugins/kdb/db2/libdb2/btree/bt_open.c ++++ b/src/plugins/kdb/db2/libdb2/btree/bt_open.c +@@ -90,10 +90,8 @@ static int tmp __P((void)); + * + */ + DB * +-__bt_open(fname, flags, mode, openinfo, dflags) +- const char *fname; +- int flags, mode, dflags; +- const BTREEINFO *openinfo; ++__bt_open(const char *fname, int flags, int mode, const BTREEINFO *openinfo, ++ int dflags) + { + struct stat sb; + BTMETA m; +@@ -353,8 +351,7 @@ err: if (t) { + * RET_ERROR, RET_SUCCESS + */ + static int +-nroot(t) +- BTREE *t; ++nroot(BTREE *t) + { + PAGE *meta, *root; + db_pgno_t npg; +@@ -459,8 +456,7 @@ byteorder() + } + + int +-__bt_fd(dbp) +- const DB *dbp; ++__bt_fd(const DB *dbp) + { + BTREE *t; + +diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_overflow.c b/src/plugins/kdb/db2/libdb2/btree/bt_overflow.c +index 8b1f597912..8301b5d19d 100644 +--- a/src/plugins/kdb/db2/libdb2/btree/bt_overflow.c ++++ b/src/plugins/kdb/db2/libdb2/btree/bt_overflow.c +@@ -77,12 +77,7 @@ static char sccsid[] = "@(#)bt_overflow.c 8.5 (Berkeley) 7/16/94"; + * RET_ERROR, RET_SUCCESS + */ + int +-__ovfl_get(t, p, ssz, buf, bufsz) +- BTREE *t; +- void *p; +- size_t *ssz; +- void **buf; +- size_t *bufsz; ++__ovfl_get(BTREE *t, void *p, size_t *ssz, void **buf, size_t *bufsz) + { + PAGE *h; + db_pgno_t pg; +@@ -136,10 +131,7 @@ __ovfl_get(t, p, ssz, buf, bufsz) + * RET_ERROR, RET_SUCCESS + */ + int +-__ovfl_put(t, dbt, pg) +- BTREE *t; +- const DBT *dbt; +- db_pgno_t *pg; ++__ovfl_put(BTREE *t, const DBT *dbt, db_pgno_t *pg) + { + PAGE *h, *last; + void *p; +@@ -190,9 +182,7 @@ __ovfl_put(t, dbt, pg) + * RET_ERROR, RET_SUCCESS + */ + int +-__ovfl_delete(t, p) +- BTREE *t; +- void *p; ++__ovfl_delete(BTREE *t, void *p) + { + PAGE *h; + db_pgno_t pg; +diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_page.c b/src/plugins/kdb/db2/libdb2/btree/bt_page.c +index 3663cf7f93..38aa39acfb 100644 +--- a/src/plugins/kdb/db2/libdb2/btree/bt_page.c ++++ b/src/plugins/kdb/db2/libdb2/btree/bt_page.c +@@ -57,9 +57,7 @@ static char sccsid[] = "@(#)bt_page.c 8.4 (Berkeley) 11/2/95"; + * mpool_put's the page. + */ + int +-__bt_free(t, h) +- BTREE *t; +- PAGE *h; ++__bt_free(BTREE *t, PAGE *h) + { + /* Insert the page at the head of the free list. */ + h->prevpg = P_INVALID; +@@ -83,9 +81,7 @@ __bt_free(t, h) + * Pointer to a page, NULL on error. + */ + PAGE * +-__bt_new(t, npg) +- BTREE *t; +- db_pgno_t *npg; ++__bt_new(BTREE *t, db_pgno_t *npg) + { + PAGE *h; + +diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_put.c b/src/plugins/kdb/db2/libdb2/btree/bt_put.c +index 7d6592841a..1303c0baef 100644 +--- a/src/plugins/kdb/db2/libdb2/btree/bt_put.c ++++ b/src/plugins/kdb/db2/libdb2/btree/bt_put.c +@@ -64,11 +64,7 @@ static EPG *bt_fast __P((BTREE *, const DBT *, const DBT *, int *)); + * tree and R_NOOVERWRITE specified. + */ + int +-__bt_put(dbp, key, data, flags) +- const DB *dbp; +- DBT *key; +- const DBT *data; +- u_int flags; ++__bt_put(const DB *dbp, DBT *key, const DBT *data, u_int flags) + { + BTREE *t; + DBT tkey, tdata; +@@ -272,10 +268,7 @@ u_long bt_cache_hit, bt_cache_miss; + * EPG for new record or NULL if not found. + */ + static EPG * +-bt_fast(t, key, data, exactp) +- BTREE *t; +- const DBT *key, *data; +- int *exactp; ++bt_fast(BTREE *t, const DBT *key, const DBT *data, int *exactp) + { + PAGE *h; + u_int32_t nbytes; +diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_search.c b/src/plugins/kdb/db2/libdb2/btree/bt_search.c +index c633d14dc6..ed512ccb65 100644 +--- a/src/plugins/kdb/db2/libdb2/btree/bt_search.c ++++ b/src/plugins/kdb/db2/libdb2/btree/bt_search.c +@@ -63,10 +63,7 @@ static int __bt_sprev __P((BTREE *, PAGE *, const DBT *, int *)); + * the bt_cur field of the tree. A pointer to the field is returned. + */ + EPG * +-__bt_search(t, key, exactp) +- BTREE *t; +- const DBT *key; +- int *exactp; ++__bt_search(BTREE *t, const DBT *key, int *exactp) + { + PAGE *h; + indx_t base, idx, lim; +@@ -148,11 +145,7 @@ next: BT_PUSH(t, h->pgno, idx); + * If an exact match found. + */ + static int +-__bt_snext(t, h, key, exactp) +- BTREE *t; +- PAGE *h; +- const DBT *key; +- int *exactp; ++__bt_snext(BTREE *t, PAGE *h, const DBT *key, int *exactp) + { + BINTERNAL *bi; + EPG e; +@@ -228,11 +221,7 @@ __bt_snext(t, h, key, exactp) + * If an exact match found. + */ + static int +-__bt_sprev(t, h, key, exactp) +- BTREE *t; +- PAGE *h; +- const DBT *key; +- int *exactp; ++__bt_sprev(BTREE *t, PAGE *h, const DBT *key, int *exactp) + { + BINTERNAL *bi; + EPG e; +diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_seq.c b/src/plugins/kdb/db2/libdb2/btree/bt_seq.c +index 2c8c2de96c..97db44abc8 100644 +--- a/src/plugins/kdb/db2/libdb2/btree/bt_seq.c ++++ b/src/plugins/kdb/db2/libdb2/btree/bt_seq.c +@@ -102,10 +102,7 @@ static int bt_rseq_prev(BTREE *, EPG *); + * RET_ERROR, RET_SUCCESS or RET_SPECIAL if there's no next key. + */ + int +-__bt_seq(dbp, key, data, flags) +- const DB *dbp; +- DBT *key, *data; +- u_int flags; ++__bt_seq(const DB *dbp, DBT *key, DBT *data, u_int flags) + { + BTREE *t; + EPG e; +@@ -179,11 +176,7 @@ __bt_seq(dbp, key, data, flags) + * RET_ERROR, RET_SUCCESS or RET_SPECIAL if there's no next key. + */ + static int +-__bt_seqset(t, ep, key, flags) +- BTREE *t; +- EPG *ep; +- DBT *key; +- int flags; ++__bt_seqset(BTREE *t, EPG *ep, DBT *key, int flags) + { + PAGE *h; + db_pgno_t pg; +@@ -273,10 +266,7 @@ __bt_seqset(t, ep, key, flags) + * RET_ERROR, RET_SUCCESS or RET_SPECIAL if there's no next key. + */ + static int +-__bt_seqadv(t, ep, flags) +- BTREE *t; +- EPG *ep; +- int flags; ++__bt_seqadv(BTREE *t, EPG *ep, int flags) + { + CURSOR *c; + PAGE *h; +@@ -495,11 +485,7 @@ bt_rseq_prev(BTREE *t, EPG *ep) + * or RET_SPECIAL if no such key exists. + */ + static int +-__bt_first(t, key, erval, exactp) +- BTREE *t; +- const DBT *key; +- EPG *erval; +- int *exactp; ++__bt_first(BTREE *t, const DBT *key, EPG *erval, int *exactp) + { + PAGE *h, *hprev; + EPG *ep, save; +@@ -596,10 +582,7 @@ __bt_first(t, key, erval, exactp) + * index: page index + */ + void +-__bt_setcur(t, pgno, idx) +- BTREE *t; +- db_pgno_t pgno; +- u_int idx; ++__bt_setcur(BTREE *t, db_pgno_t pgno, u_int idx) + { + /* Lose any already deleted key. */ + if (t->bt_cursor.key.data != NULL) { +diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_split.c b/src/plugins/kdb/db2/libdb2/btree/bt_split.c +index c7e4e72a90..8901bd64be 100644 +--- a/src/plugins/kdb/db2/libdb2/btree/bt_split.c ++++ b/src/plugins/kdb/db2/libdb2/btree/bt_split.c +@@ -79,13 +79,8 @@ u_long bt_rootsplit, bt_split, bt_sortsplit, bt_pfxsaved; + * RET_ERROR, RET_SUCCESS + */ + int +-__bt_split(t, sp, key, data, flags, ilen, argskip) +- BTREE *t; +- PAGE *sp; +- const DBT *key, *data; +- int flags; +- size_t ilen; +- u_int32_t argskip; ++__bt_split(BTREE *t, PAGE *sp, const DBT *key, const DBT *data, int flags, ++ size_t ilen, u_int32_t argskip) + { + BINTERNAL *bi = NULL; + BLEAF *bl = NULL, *tbl; +@@ -345,11 +340,7 @@ err2: mpool_put(t->bt_mp, l, 0); + * Pointer to page in which to insert or NULL on error. + */ + static PAGE * +-bt_page(t, h, lp, rp, skip, ilen) +- BTREE *t; +- PAGE *h, **lp, **rp; +- indx_t *skip; +- size_t ilen; ++bt_page(BTREE *t, PAGE *h, PAGE **lp, PAGE **rp, indx_t *skip, size_t ilen) + { + PAGE *l, *r, *tp; + db_pgno_t npg; +@@ -450,11 +441,7 @@ bt_page(t, h, lp, rp, skip, ilen) + * Pointer to page in which to insert or NULL on error. + */ + static PAGE * +-bt_root(t, h, lp, rp, skip, ilen) +- BTREE *t; +- PAGE *h, **lp, **rp; +- indx_t *skip; +- size_t ilen; ++bt_root(BTREE *t, PAGE *h, PAGE **lp, PAGE **rp, indx_t *skip, size_t ilen) + { + PAGE *l, *r, *tp; + db_pgno_t lnpg, rnpg; +@@ -497,9 +484,7 @@ bt_root(t, h, lp, rp, skip, ilen) + * RET_ERROR, RET_SUCCESS + */ + static int +-bt_rroot(t, h, l, r) +- BTREE *t; +- PAGE *h, *l, *r; ++bt_rroot(BTREE *t, PAGE *h, PAGE *l, PAGE *r) + { + char *dest; + +@@ -537,9 +522,7 @@ bt_rroot(t, h, l, r) + * RET_ERROR, RET_SUCCESS + */ + static int +-bt_broot(t, h, l, r) +- BTREE *t; +- PAGE *h, *l, *r; ++bt_broot(BTREE *t, PAGE *h, PAGE *l, PAGE *r) + { + BINTERNAL *bi; + BLEAF *bl; +@@ -617,11 +600,7 @@ bt_broot(t, h, l, r) + * Pointer to page in which to insert. + */ + static PAGE * +-bt_psplit(t, h, l, r, pskip, ilen) +- BTREE *t; +- PAGE *h, *l, *r; +- indx_t *pskip; +- size_t ilen; ++bt_psplit(BTREE *t, PAGE *h, PAGE *l, PAGE *r, indx_t *pskip, size_t ilen) + { + BINTERNAL *bi; + BLEAF *bl; +@@ -796,9 +775,7 @@ bt_psplit(t, h, l, r, pskip, ilen) + * RET_SUCCESS, RET_ERROR. + */ + static int +-bt_preserve(t, pg) +- BTREE *t; +- db_pgno_t pg; ++bt_preserve(BTREE *t, db_pgno_t pg) + { + PAGE *h; + +@@ -824,8 +801,7 @@ bt_preserve(t, pg) + * all the way back to bt_split/bt_rroot and it's not very clean. + */ + static recno_t +-rec_total(h) +- PAGE *h; ++rec_total(PAGE *h) + { + recno_t recs; + indx_t nxt, top; +diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_utils.c b/src/plugins/kdb/db2/libdb2/btree/bt_utils.c +index be2f24f219..13d1f2c84f 100644 +--- a/src/plugins/kdb/db2/libdb2/btree/bt_utils.c ++++ b/src/plugins/kdb/db2/libdb2/btree/bt_utils.c +@@ -64,11 +64,8 @@ static char sccsid[] = "@(#)bt_utils.c 8.8 (Berkeley) 7/20/94"; + * RET_SUCCESS, RET_ERROR. + */ + int +-__bt_ret(t, e, key, rkey, data, rdata, copy) +- BTREE *t; +- EPG *e; +- DBT *key, *rkey, *data, *rdata; +- int copy; ++__bt_ret(BTREE *t, EPG *e, DBT *key, DBT *rkey, DBT *data, DBT *rdata, ++ int copy) + { + BLEAF *bl; + void *p; +@@ -150,10 +147,7 @@ dataonly: + * > 0 if k1 is > record + */ + int +-__bt_cmp(t, k1, e) +- BTREE *t; +- const DBT *k1; +- EPG *e; ++__bt_cmp(BTREE *t, const DBT *k1, EPG *e) + { + BINTERNAL *bi; + BLEAF *bl; +@@ -213,8 +207,7 @@ __bt_cmp(t, k1, e) + * > 0 if a is > b + */ + int +-__bt_defcmp(a, b) +- const DBT *a, *b; ++__bt_defcmp(const DBT *a, const DBT *b) + { + size_t len; + u_char *p1, *p2; +@@ -243,8 +236,7 @@ __bt_defcmp(a, b) + * Number of bytes needed to distinguish b from a. + */ + size_t +-__bt_defpfx(a, b) +- const DBT *a, *b; ++__bt_defpfx(const DBT *a, const DBT *b) + { + u_char *p1, *p2; + size_t cnt, len; +diff --git a/src/plugins/kdb/db2/libdb2/db/db.c b/src/plugins/kdb/db2/libdb2/db/db.c +index fba7795342..f85484f077 100644 +--- a/src/plugins/kdb/db2/libdb2/db/db.c ++++ b/src/plugins/kdb/db2/libdb2/db/db.c +@@ -45,11 +45,8 @@ static char sccsid[] = "@(#)db.c 8.4 (Berkeley) 2/21/94"; + #include "db-int.h" + + DB * +-kdb2_dbopen(fname, flags, mode, type, openinfo) +- const char *fname; +- int flags, mode; +- DBTYPE type; +- const void *openinfo; ++kdb2_dbopen(const char *fname, int flags, int mode, DBTYPE type, ++ const void *openinfo) + { + + #define DB_FLAGS (DB_LOCK | DB_SHMEM | DB_TXN) +@@ -74,7 +71,7 @@ kdb2_dbopen(fname, flags, mode, type, openinfo) + } + + static int +-__dberr() ++__dberr(void) + { + return (RET_ERROR); + } +@@ -86,14 +83,15 @@ __dberr() + * dbp: pointer to the DB structure. + */ + void +-__dbpanic(dbp) +- DB *dbp; ++__dbpanic(DB *dbp) + { + /* The only thing that can succeed is a close. */ +- dbp->del = (int (*)())__dberr; +- dbp->fd = (int (*)())__dberr; +- dbp->get = (int (*)())__dberr; +- dbp->put = (int (*)())__dberr; +- dbp->seq = (int (*)())__dberr; +- dbp->sync = (int (*)())__dberr; ++ dbp->del = (int (*)(const struct __db *, const DBT *, u_int))__dberr; ++ dbp->fd = (int (*)(const struct __db *))__dberr; ++ dbp->get = (int (*)(const struct __db *, const DBT *, DBT *, ++ u_int))__dberr; ++ dbp->put = (int (*)(const struct __db *, DBT *, const DBT *, ++ u_int))__dberr; ++ dbp->seq = (int (*)(const struct __db *, DBT *, DBT *, u_int))__dberr; ++ dbp->sync = (int (*)(const struct __db *, u_int))__dberr; + } +diff --git a/src/plugins/kdb/db2/libdb2/hash/dbm.c b/src/plugins/kdb/db2/libdb2/hash/dbm.c +index 4878cbc0b6..2dca256dc3 100644 +--- a/src/plugins/kdb/db2/libdb2/hash/dbm.c ++++ b/src/plugins/kdb/db2/libdb2/hash/dbm.c +@@ -69,8 +69,7 @@ static DBM *__cur_db; + static void no_open_db __P((void)); + + int +-kdb2_dbminit(file) +- char *file; ++kdb2_dbminit(char *file) + { + if (__cur_db != NULL) + (void)kdb2_dbm_close(__cur_db); +@@ -82,8 +81,7 @@ kdb2_dbminit(file) + } + + datum +-kdb2_fetch(key) +- datum key; ++kdb2_fetch(datum key) + { + datum item; + +@@ -111,8 +109,7 @@ kdb2_firstkey() + } + + datum +-kdb2_nextkey(key) +- datum key; ++kdb2_nextkey(datum key) + { + datum item; + +@@ -126,8 +123,7 @@ kdb2_nextkey(key) + } + + int +-kdb2_delete(key) +- datum key; ++kdb2_delete(datum key) + { + if (__cur_db == NULL) { + no_open_db(); +@@ -137,8 +133,7 @@ kdb2_delete(key) + } + + int +-kdb2_store(key, dat) +- datum key, dat; ++kdb2_store(datum key, datum dat) + { + if (__cur_db == NULL) { + no_open_db(); +@@ -159,9 +154,7 @@ no_open_db() + * NULL on failure + */ + DBM * +-kdb2_dbm_open(file, flags, mode) +- const char *file; +- int flags, mode; ++kdb2_dbm_open(const char *file, int flags, int mode) + { + HASHINFO info; + char path[MAXPATHLEN]; +@@ -183,8 +176,7 @@ kdb2_dbm_open(file, flags, mode) + * Nothing. + */ + void +-kdb2_dbm_close(db) +- DBM *db; ++kdb2_dbm_close(DBM *db) + { + (void)(db->close)(db); + } +@@ -195,9 +187,7 @@ kdb2_dbm_close(db) + * NULL on failure + */ + datum +-kdb2_dbm_fetch(db, key) +- DBM *db; +- datum key; ++kdb2_dbm_fetch(DBM *db, datum key) + { + datum retval; + int status; +@@ -226,8 +216,7 @@ kdb2_dbm_fetch(db, key) + * NULL on failure + */ + datum +-kdb2_dbm_firstkey(db) +- DBM *db; ++kdb2_dbm_firstkey(DBM *db) + { + int status; + datum retkey; +@@ -254,8 +243,7 @@ kdb2_dbm_firstkey(db) + * NULL on failure + */ + datum +-kdb2_dbm_nextkey(db) +- DBM *db; ++kdb2_dbm_nextkey(DBM *db) + { + int status; + datum retkey; +@@ -282,9 +270,7 @@ kdb2_dbm_nextkey(db) + * <0 failure + */ + int +-kdb2_dbm_delete(db, key) +- DBM *db; +- datum key; ++kdb2_dbm_delete(DBM *db, datum key) + { + int status; + +@@ -310,10 +296,7 @@ kdb2_dbm_delete(db, key) + * 1 if DBM_INSERT and entry exists + */ + int +-kdb2_dbm_store(db, key, content, flags) +- DBM *db; +- datum key, content; +- int flags; ++kdb2_dbm_store(DBM *db, datum key, datum content, int flags) + { + #ifdef NEED_COPY + DBT k, c; +@@ -331,8 +314,7 @@ kdb2_dbm_store(db, key, content, flags) + } + + int +-kdb2_dbm_error(db) +- DBM *db; ++kdb2_dbm_error(DBM *db) + { + HTAB *hp; + +@@ -341,8 +323,7 @@ kdb2_dbm_error(db) + } + + int +-kdb2_dbm_clearerr(db) +- DBM *db; ++kdb2_dbm_clearerr(DBM *db) + { + HTAB *hp; + +@@ -352,8 +333,7 @@ kdb2_dbm_clearerr(db) + } + + int +-kdb2_dbm_dirfno(db) +- DBM *db; ++kdb2_dbm_dirfno(DBM *db) + { + return(((HTAB *)db->internal)->fp); + } +diff --git a/src/plugins/kdb/db2/libdb2/hash/hash.c b/src/plugins/kdb/db2/libdb2/hash/hash.c +index 686a960c96..9528b62538 100644 +--- a/src/plugins/kdb/db2/libdb2/hash/hash.c ++++ b/src/plugins/kdb/db2/libdb2/hash/hash.c +@@ -95,10 +95,8 @@ u_int32_t hash_accesses, hash_collisions, hash_expansions, hash_overflows, + /* OPEN/CLOSE */ + + extern DB * +-__kdb2_hash_open(file, flags, mode, info, dflags) +- const char *file; +- int flags, mode, dflags; +- const HASHINFO *info; /* Special directives for create */ ++__kdb2_hash_open(const char *file, int flags, int mode, const HASHINFO *info, ++ int dflags) + { + struct stat statbuf; + DB *dbp; +@@ -261,8 +259,7 @@ error0: + } + + static int32_t +-hash_close(dbp) +- DB *dbp; ++hash_close(DB *dbp) + { + HTAB *hashp; + int32_t retval; +@@ -277,8 +274,7 @@ hash_close(dbp) + } + + static int32_t +-hash_fd(dbp) +- const DB *dbp; ++hash_fd(const DB *dbp) + { + HTAB *hashp; + +@@ -295,10 +291,7 @@ hash_fd(dbp) + + /************************** LOCAL CREATION ROUTINES **********************/ + static HTAB * +-init_hash(hashp, file, info) +- HTAB *hashp; +- const char *file; +- const HASHINFO *info; ++init_hash(HTAB *hashp, const char *file, const HASHINFO *info) + { + struct stat statbuf; + +@@ -350,9 +343,7 @@ init_hash(hashp, file, info) + * Returns 0 on No Error + */ + static int32_t +-init_htab(hashp, nelem) +- HTAB *hashp; +- int32_t nelem; ++init_htab(HTAB *hashp, int32_t nelem) + { + int32_t l2, nbuckets; + +@@ -404,9 +395,7 @@ init_htab(hashp, nelem) + * Functions to get/put hash header. We access the file directly. + */ + static u_int32_t +-hget_header(hashp, page_size) +- HTAB *hashp; +- u_int32_t page_size; ++hget_header(HTAB *hashp, u_int32_t page_size) + { + u_int32_t num_copied; + u_int8_t *hdr_dest; +@@ -432,8 +421,7 @@ hget_header(hashp, page_size) + } + + static void +-hput_header(hashp) +- HTAB *hashp; ++hput_header(HTAB *hashp) + { + HASHHDR *whdrp; + #if DB_BYTE_ORDER == DB_LITTLE_ENDIAN +@@ -463,8 +451,7 @@ hput_header(hashp) + * structure, freeing all allocated space. + */ + static int32_t +-hdestroy(hashp) +- HTAB *hashp; ++hdestroy(HTAB *hashp) + { + int32_t save_errno; + +@@ -550,9 +537,7 @@ hdestroy(hashp) + * -1 ERROR + */ + static int32_t +-hash_sync(dbp, flags) +- const DB *dbp; +- u_int32_t flags; ++hash_sync(const DB *dbp, u_int32_t flags) + { + HTAB *hashp; + +@@ -571,8 +556,7 @@ hash_sync(dbp, flags) + * -1 indicates that errno should be set + */ + static int32_t +-flush_meta(hashp) +- HTAB *hashp; ++flush_meta(HTAB *hashp) + { + int32_t i; + +@@ -608,11 +592,7 @@ flush_meta(hashp) + /* *** make sure this is true! */ + + static int32_t +-hash_get(dbp, key, data, flag) +- const DB *dbp; +- const DBT *key; +- DBT *data; +- u_int32_t flag; ++hash_get(const DB *dbp, const DBT *key, DBT *data, u_int32_t flag) + { + HTAB *hashp; + +@@ -625,11 +605,7 @@ hash_get(dbp, key, data, flag) + } + + static int32_t +-hash_put(dbp, key, data, flag) +- const DB *dbp; +- DBT *key; +- const DBT *data; +- u_int32_t flag; ++hash_put(const DB *dbp, DBT *key, const DBT *data, u_int32_t flag) + { + HTAB *hashp; + +@@ -647,10 +623,7 @@ hash_put(dbp, key, data, flag) + } + + static int32_t +-hash_delete(dbp, key, flag) +- const DB *dbp; +- const DBT *key; +- u_int32_t flag; /* Ignored */ ++hash_delete(const DB *dbp, const DBT *key, u_int32_t flag) + { + HTAB *hashp; + +@@ -671,11 +644,7 @@ hash_delete(dbp, key, flag) + * Assume that hashp has been set in wrapper routine. + */ + static int32_t +-hash_access(hashp, action, key, val) +- HTAB *hashp; +- ACTION action; +- const DBT *key; +- DBT *val; ++hash_access(HTAB *hashp, ACTION action, const DBT *key, DBT *val) + { + DBT page_key, page_val; + CURSOR cursor; +@@ -792,8 +761,7 @@ found: __get_item_done(hashp, &cursor); + + /* ****************** CURSORS ********************************** */ + CURSOR * +-__cursor_creat(dbp) +- const DB *dbp; ++__cursor_creat(const DB *dbp) + { + CURSOR *new_curs; + HTAB *hashp; +@@ -824,11 +792,7 @@ __cursor_creat(dbp) + } + + static int32_t +-cursor_get(dbp, cursorp, key, val, flags) +- const DB *dbp; +- CURSOR *cursorp; +- DBT *key, *val; +- u_int32_t flags; ++cursor_get(const DB *dbp, CURSOR *cursorp, DBT *key, DBT *val, u_int32_t flags) + { + HTAB *hashp; + ITEM_INFO item_info; +@@ -897,10 +861,7 @@ cursor_get(dbp, cursorp, key, val, flags) + } + + static int32_t +-cursor_delete(dbp, cursor, flags) +- const DB *dbp; +- CURSOR *cursor; +- u_int32_t flags; ++cursor_delete(const DB *dbp, CURSOR *cursor, u_int32_t flags) + { + /* XXX this is empirically determined, so it might not be completely + correct, but it seems to work. At the very least it fixes +@@ -913,10 +874,7 @@ cursor_delete(dbp, cursor, flags) + } + + static int32_t +-hash_seq(dbp, key, val, flag) +- const DB *dbp; +- DBT *key, *val; +- u_int32_t flag; ++hash_seq(const DB *dbp, DBT *key, DBT *val, u_int32_t flag) + { + HTAB *hashp; + +@@ -940,8 +898,7 @@ hash_seq(dbp, key, val, flag) + * -1 ==> Error + */ + int32_t +-__expand_table(hashp) +- HTAB *hashp; ++__expand_table(HTAB *hashp) + { + u_int32_t old_bucket, new_bucket; + int32_t spare_ndx; +@@ -980,10 +937,7 @@ __expand_table(hashp) + } + + u_int32_t +-__call_hash(hashp, k, len) +- HTAB *hashp; +- int8_t *k; +- int32_t len; ++__call_hash(HTAB *hashp, int8_t *k, int32_t len) + { + u_int32_t n, bucket; + +@@ -999,8 +953,7 @@ __call_hash(hashp, k, len) + * Hashp->hdr needs to be byteswapped. + */ + static void +-swap_header_copy(srcp, destp) +- HASHHDR *srcp, *destp; ++swap_header_copy(HASHHDR *srcp, HASHHDR *destp) + { + int32_t i; + +@@ -1025,8 +978,7 @@ swap_header_copy(srcp, destp) + } + + static void +-swap_header(hashp) +- HTAB *hashp; ++swap_header(HTAB *hashp) + { + HASHHDR *hdrp; + int32_t i; +diff --git a/src/plugins/kdb/db2/libdb2/hash/hash_bigkey.c b/src/plugins/kdb/db2/libdb2/hash/hash_bigkey.c +index 4b95278f53..6befb7a57e 100644 +--- a/src/plugins/kdb/db2/libdb2/hash/hash_bigkey.c ++++ b/src/plugins/kdb/db2/libdb2/hash/hash_bigkey.c +@@ -83,10 +83,7 @@ static int32_t collect_data __P((HTAB *, PAGE16 *, int32_t)); + * -1 ==> ERROR + */ + int32_t +-__big_insert(hashp, pagep, key, val) +- HTAB *hashp; +- PAGE16 *pagep; +- const DBT *key, *val; ++__big_insert(HTAB *hashp, PAGE16 *pagep, const DBT *key, const DBT *val) + { + size_t key_size, val_size; + indx_t key_move_bytes, val_move_bytes; +@@ -185,11 +182,7 @@ __big_delete(hashp, pagep, ndx) + * -1 error + */ + int32_t +-__find_bigpair(hashp, cursorp, key, size) +- HTAB *hashp; +- CURSOR *cursorp; +- int8_t *key; +- int32_t size; ++__find_bigpair(HTAB *hashp, CURSOR *cursorp, int8_t *key, int32_t size) + { + PAGE16 *pagep, *hold_pagep; + db_pgno_t next_pgno; +@@ -257,11 +250,7 @@ __find_bigpair(hashp, cursorp, key, size) + * Fill in the key and data for this big pair. + */ + int32_t +-__big_keydata(hashp, pagep, key, val, ndx) +- HTAB *hashp; +- PAGE16 *pagep; +- DBT *key, *val; +- int32_t ndx; ++__big_keydata(HTAB *hashp, PAGE16 *pagep, DBT *key, DBT *val, int32_t ndx) + { + ITEM_INFO ii; + PAGE16 *key_pagep; +@@ -315,11 +304,8 @@ __get_bigkey(hashp, pagep, ndx, key) + * Return the big key and data indicated in item_info. + */ + int32_t +-__big_return(hashp, item_info, val, on_bigkey_page) +- HTAB *hashp; +- ITEM_INFO *item_info; +- DBT *val; +- int32_t on_bigkey_page; ++__big_return(HTAB *hashp, ITEM_INFO *item_info, DBT *val, ++ int32_t on_bigkey_page) + { + PAGE16 *pagep; + db_pgno_t next_pgno; +@@ -366,11 +352,7 @@ __big_return(hashp, item_info, val, on_bigkey_page) + * Return total length of data; -1 if error. + */ + static int32_t +-collect_key(hashp, pagep, len, last_page) +- HTAB *hashp; +- PAGE16 *pagep; +- int32_t len; +- db_pgno_t *last_page; ++collect_key(HTAB *hashp, PAGE16 *pagep, int32_t len, db_pgno_t *last_page) + { + PAGE16 *next_pagep; + int32_t totlen, retval; +@@ -434,10 +416,7 @@ collect_key(hashp, pagep, len, last_page) + * Return total length of data; -1 if error. + */ + static int32_t +-collect_data(hashp, pagep, len) +- HTAB *hashp; +- PAGE16 *pagep; +- int32_t len; ++collect_data(HTAB *hashp, PAGE16 *pagep, int32_t len) + { + PAGE16 *next_pagep; + int32_t totlen, retval; +diff --git a/src/plugins/kdb/db2/libdb2/hash/hash_func.c b/src/plugins/kdb/db2/libdb2/hash/hash_func.c +index 1dee694608..f169be685e 100644 +--- a/src/plugins/kdb/db2/libdb2/hash/hash_func.c ++++ b/src/plugins/kdb/db2/libdb2/hash/hash_func.c +@@ -66,9 +66,7 @@ u_int32_t (*__default_hash) __P((const void *, size_t)) = hash4; + + #if 0 + static u_int32_t +-hash1(key, len) +- const void *key; +- size_t len; ++hash1(const void *key, size_t len) + { + u_int32_t h; + u_int8_t *k; +@@ -88,9 +86,7 @@ hash1(key, len) + #define dcharhash(h, c) ((h) = 0x63c63cd9*(h) + 0x9c39c33d + (c)) + + static u_int32_t +-hash2(key, len) +- const void *key; +- size_t len; ++hash2(const void *key, size_t len) + { + u_int32_t h; + u_int8_t *e, c, *k; +@@ -116,9 +112,7 @@ hash2(key, len) + * Ozan Yigit's original sdbm hash. + */ + static u_int32_t +-hash3(key, len) +- const void *key; +- size_t len; ++hash3(const void *key, size_t len) + { + u_int32_t n, loop; + u_int8_t *k; +@@ -159,9 +153,7 @@ hash3(key, len) + + /* Chris Torek's hash function. */ + static u_int32_t +-hash4(key, len) +- const void *key; +- size_t len; ++hash4(const void *key, size_t len) + { + u_int32_t h, loop; + const u_int8_t *k; +diff --git a/src/plugins/kdb/db2/libdb2/hash/hash_log2.c b/src/plugins/kdb/db2/libdb2/hash/hash_log2.c +index 8c710e5d21..7fdfd854d2 100644 +--- a/src/plugins/kdb/db2/libdb2/hash/hash_log2.c ++++ b/src/plugins/kdb/db2/libdb2/hash/hash_log2.c +@@ -44,8 +44,7 @@ static char sccsid[] = "@(#)hash_log2.c 8.4 (Berkeley) 11/7/95"; + #include "extern.h" + + u_int32_t +-__kdb2_log2(num) +- u_int32_t num; ++__kdb2_log2(u_int32_t num) + { + u_int32_t i, limit; + +diff --git a/src/plugins/kdb/db2/libdb2/hash/hash_page.c b/src/plugins/kdb/db2/libdb2/hash/hash_page.c +index 0da357108a..dba29e0cb5 100644 +--- a/src/plugins/kdb/db2/libdb2/hash/hash_page.c ++++ b/src/plugins/kdb/db2/libdb2/hash/hash_page.c +@@ -84,11 +84,8 @@ static void account_page(HTAB *, db_pgno_t, int); + #endif + + u_int32_t +-__get_item(hashp, cursorp, key, val, item_info) +- HTAB *hashp; +- CURSOR *cursorp; +- DBT *key, *val; +- ITEM_INFO *item_info; ++__get_item(HTAB *hashp, CURSOR *cursorp, DBT *key, DBT *val, ++ ITEM_INFO *item_info) + { + db_pgno_t next_pgno; + int32_t i; +@@ -159,9 +156,7 @@ __get_item(hashp, cursorp, key, val, item_info) + } + + u_int32_t +-__get_item_reset(hashp, cursorp) +- HTAB *hashp; +- CURSOR *cursorp; ++__get_item_reset(HTAB *hashp, CURSOR *cursorp) + { + if (cursorp->pagep) + __put_page(hashp, cursorp->pagep, A_RAW, 0); +@@ -174,9 +169,7 @@ __get_item_reset(hashp, cursorp) + } + + u_int32_t +-__get_item_done(hashp, cursorp) +- HTAB *hashp; +- CURSOR *cursorp; ++__get_item_done(HTAB *hashp, CURSOR *cursorp) + { + if (cursorp->pagep) + __put_page(hashp, cursorp->pagep, A_RAW, 0); +@@ -190,11 +183,8 @@ __get_item_done(hashp, cursorp) + } + + u_int32_t +-__get_item_first(hashp, cursorp, key, val, item_info) +- HTAB *hashp; +- CURSOR *cursorp; +- DBT *key, *val; +- ITEM_INFO *item_info; ++__get_item_first(HTAB *hashp, CURSOR *cursorp, DBT *key, DBT *val, ++ ITEM_INFO *item_info) + { + __get_item_reset(hashp, cursorp); + cursorp->bucket = 0; +@@ -206,11 +196,8 @@ __get_item_first(hashp, cursorp, key, val, item_info) + * just returns the page number and index of the bigkey pointer pair. + */ + u_int32_t +-__get_item_next(hashp, cursorp, key, val, item_info) +- HTAB *hashp; +- CURSOR *cursorp; +- DBT *key, *val; +- ITEM_INFO *item_info; ++__get_item_next(HTAB *hashp, CURSOR *cursorp, DBT *key, DBT *val, ++ ITEM_INFO *item_info) + { + int status; + +@@ -224,9 +211,7 @@ __get_item_next(hashp, cursorp, key, val, item_info) + * Put a non-big pair on a page. + */ + static void +-putpair(p, key, val) +- PAGE8 *p; +- const DBT *key, *val; ++putpair(PAGE8 *p, const DBT *key, const DBT *val) + { + u_int16_t *pagep, n, off; + +@@ -275,10 +260,7 @@ prev_realkey(pagep, n) + * -1 error + */ + extern int32_t +-__delpair(hashp, cursorp, item_info) +- HTAB *hashp; +- CURSOR *cursorp; +- ITEM_INFO *item_info; ++__delpair(HTAB *hashp, CURSOR *cursorp, ITEM_INFO *item_info) + { + PAGE16 *pagep; + indx_t ndx; +@@ -412,9 +394,7 @@ __delpair(hashp, cursorp, item_info) + } + + extern int32_t +-__split_page(hashp, obucket, nbucket) +- HTAB *hashp; +- u_int32_t obucket, nbucket; ++__split_page(HTAB *hashp, u_int32_t obucket, u_int32_t nbucket) + { + DBT key, val; + ITEM_INFO old_ii, new_ii; +@@ -661,9 +641,7 @@ add_bigptr(hashp, item_info, big_pgno) + * NULL on error + */ + extern PAGE16 * +-__add_ovflpage(hashp, pagep) +- HTAB *hashp; +- PAGE16 *pagep; ++__add_ovflpage(HTAB *hashp, PAGE16 *pagep) + { + PAGE16 *new_pagep; + u_int16_t ovfl_num; +@@ -768,10 +746,7 @@ page_init(hashp, pagep, pgno, type) + } + + int32_t +-__new_page(hashp, addr, addr_type) +- HTAB *hashp; +- u_int32_t addr; +- int32_t addr_type; ++__new_page(HTAB *hashp, u_int32_t addr, int32_t addr_type) + { + db_pgno_t paddr; + PAGE16 *pagep; +@@ -804,10 +779,7 @@ __new_page(hashp, addr, addr_type) + } + + int32_t +-__delete_page(hashp, pagep, page_type) +- HTAB *hashp; +- PAGE16 *pagep; +- int32_t page_type; ++__delete_page(HTAB *hashp, PAGE16 *pagep, int32_t page_type) + { + if (page_type == A_OVFL) + __free_ovflpage(hashp, pagep); +@@ -815,9 +787,7 @@ __delete_page(hashp, pagep, page_type) + } + + static u_int8_t +-is_bitmap_pgno(hashp, pgno) +- HTAB *hashp; +- db_pgno_t pgno; ++is_bitmap_pgno(HTAB *hashp, db_pgno_t pgno) + { + int32_t i; + +@@ -828,10 +798,7 @@ is_bitmap_pgno(hashp, pgno) + } + + void +-__pgin_routine(pg_cookie, pgno, page) +- void *pg_cookie; +- db_pgno_t pgno; +- void *page; ++__pgin_routine(void *pg_cookie, db_pgno_t pgno, void *page) + { + HTAB *hashp; + PAGE16 *pagep; +@@ -868,10 +835,7 @@ __pgin_routine(pg_cookie, pgno, page) + } + + void +-__pgout_routine(pg_cookie, pgno, page) +- void *pg_cookie; +- db_pgno_t pgno; +- void *page; ++__pgout_routine(void *pg_cookie, db_pgno_t pgno, void *page) + { + HTAB *hashp; + PAGE16 *pagep; +@@ -905,10 +869,7 @@ __pgout_routine(pg_cookie, pgno, page) + * -1 ==>failure + */ + extern int32_t +-__put_page(hashp, pagep, addr_type, is_dirty) +- HTAB *hashp; +- PAGE16 *pagep; +- int32_t addr_type, is_dirty; ++__put_page(HTAB *hashp, PAGE16 *pagep, int32_t addr_type, int32_t is_dirty) + { + #if DEBUG_SLOW + account_page(hashp, +@@ -924,10 +885,7 @@ __put_page(hashp, pagep, addr_type, is_dirty) + * -1 indicates FAILURE + */ + extern PAGE16 * +-__get_page(hashp, addr, addr_type) +- HTAB *hashp; +- u_int32_t addr; +- int32_t addr_type; ++__get_page(HTAB *hashp, u_int32_t addr, int32_t addr_type) + { + PAGE16 *pagep; + db_pgno_t paddr; +@@ -958,8 +916,7 @@ __get_page(hashp, addr, addr_type) + } + + static void +-swap_page_header_in(pagep) +- PAGE16 *pagep; ++swap_page_header_in(PAGE16 *pagep) + { + u_int32_t i; + +@@ -977,8 +934,7 @@ swap_page_header_in(pagep) + } + + static void +-swap_page_header_out(pagep) +- PAGE16 *pagep; ++swap_page_header_out(PAGE16 *pagep) + { + u_int32_t i; + +@@ -1001,9 +957,7 @@ swap_page_header_out(pagep) + * once they are read in. + */ + extern int32_t +-__ibitmap(hashp, pnum, nbits, ndx) +- HTAB *hashp; +- int32_t pnum, nbits, ndx; ++__ibitmap(HTAB *hashp, int32_t pnum, int32_t nbits, int32_t ndx) + { + u_int32_t *ip; + int32_t clearbytes, clearints; +@@ -1027,8 +981,7 @@ __ibitmap(hashp, pnum, nbits, ndx) + } + + static u_int32_t +-first_free(map) +- u_int32_t map; ++first_free(u_int32_t map) + { + u_int32_t i, mask; + +@@ -1044,8 +997,7 @@ first_free(map) + * returns 0 on error + */ + static u_int16_t +-overflow_page(hashp) +- HTAB *hashp; ++overflow_page(HTAB *hashp) + { + u_int32_t *freep; + u_int32_t bit, first_page, free_bit, free_page, i, in_use_bits, j; +@@ -1206,9 +1158,7 @@ found: + + #ifdef DEBUG + int +-bucket_to_page(hashp, n) +- HTAB *hashp; +- int n; ++bucket_to_page(HTAB *hashp, int n) + { + int ret_val; + +@@ -1219,9 +1169,7 @@ bucket_to_page(hashp, n) + } + + int32_t +-oaddr_to_page(hashp, n) +- HTAB *hashp; +- int n; ++oaddr_to_page(HTAB *hashp, int n) + { + int ret_val, temp; + +@@ -1234,9 +1182,7 @@ oaddr_to_page(hashp, n) + #endif /* DEBUG */ + + static indx_t +-page_to_oaddr(hashp, pgno) +- HTAB *hashp; +- db_pgno_t pgno; ++page_to_oaddr(HTAB *hashp, db_pgno_t pgno) + { + int32_t sp, ret_val; + +@@ -1268,9 +1214,7 @@ page_to_oaddr(hashp, pgno) + * Mark this overflow page as free. + */ + extern void +-__free_ovflpage(hashp, pagep) +- HTAB *hashp; +- PAGE16 *pagep; ++__free_ovflpage(HTAB *hashp, PAGE16 *pagep) + { + u_int32_t *freep; + u_int32_t bit_address, free_page, free_bit; +@@ -1307,9 +1251,7 @@ __free_ovflpage(hashp, pagep) + } + + static u_int32_t * +-fetch_bitmap(hashp, ndx) +- HTAB *hashp; +- int32_t ndx; ++fetch_bitmap(HTAB *hashp, int32_t ndx) + { + if (ndx >= hashp->nmaps) + return (NULL); +@@ -1322,10 +1264,7 @@ fetch_bitmap(hashp, ndx) + + #ifdef DEBUG_SLOW + static void +-account_page(hashp, pgno, inout) +- HTAB *hashp; +- db_pgno_t pgno; +- int inout; ++account_page(HTAB *hashp, db_pgno_t pgno, int inout) + { + static struct { + db_pgno_t pgno; +diff --git a/src/plugins/kdb/db2/libdb2/hash/hsearch.c b/src/plugins/kdb/db2/libdb2/hash/hsearch.c +index 02ff7ef843..ffcdfcf294 100644 +--- a/src/plugins/kdb/db2/libdb2/hash/hsearch.c ++++ b/src/plugins/kdb/db2/libdb2/hash/hsearch.c +@@ -50,8 +50,7 @@ static DB *dbp = NULL; + static ENTRY retval; + + extern int +-hcreate(nel) +- u_int nel; ++hcreate(u_int nel) + { + HASHINFO info; + +@@ -66,9 +65,7 @@ hcreate(nel) + } + + extern ENTRY * +-hsearch(item, action) +- ENTRY item; +- ACTION action; ++hsearch(ENTRY item, ACTION action) + { + DBT key, val; + int status; +@@ -98,7 +95,7 @@ hsearch(item, action) + } + + extern void +-hdestroy() ++hdestroy(void) + { + if (dbp) { + (void)(dbp->close)(dbp); +diff --git a/src/plugins/kdb/db2/libdb2/mpool/mpool.c b/src/plugins/kdb/db2/libdb2/mpool/mpool.c +index 0fcfd4ac2b..028fb180ca 100644 +--- a/src/plugins/kdb/db2/libdb2/mpool/mpool.c ++++ b/src/plugins/kdb/db2/libdb2/mpool/mpool.c +@@ -56,10 +56,7 @@ static int mpool_write __P((MPOOL *, BKT *)); + * Initialize a memory pool. + */ + MPOOL * +-mpool_open(key, fd, pagesize, maxcache) +- void *key; +- int fd; +- db_pgno_t pagesize, maxcache; ++mpool_open(void *key, int fd, db_pgno_t pagesize, db_pgno_t maxcache) + { + struct stat sb; + MPOOL *mp; +@@ -96,11 +93,8 @@ mpool_open(key, fd, pagesize, maxcache) + * Initialize input/output filters. + */ + void +-mpool_filter(mp, pgin, pgout, pgcookie) +- MPOOL *mp; +- void (*pgin) __P((void *, db_pgno_t, void *)); +- void (*pgout) __P((void *, db_pgno_t, void *)); +- void *pgcookie; ++mpool_filter(MPOOL *mp, void (*pgin) __P((void *, db_pgno_t, void *)), ++ void (*pgout) __P((void *, db_pgno_t, void *)), void *pgcookie) + { + mp->pgin = pgin; + mp->pgout = pgout; +@@ -112,10 +106,7 @@ mpool_filter(mp, pgin, pgout, pgcookie) + * Get a new page of memory. + */ + void * +-mpool_new(mp, pgnoaddr, flags) +- MPOOL *mp; +- db_pgno_t *pgnoaddr; +- u_int flags; ++mpool_new(MPOOL *mp, db_pgno_t *pgnoaddr, u_int flags) + { + struct _hqh *head; + BKT *bp; +@@ -149,9 +140,7 @@ mpool_new(mp, pgnoaddr, flags) + } + + int +-mpool_delete(mp, page) +- MPOOL *mp; +- void *page; ++mpool_delete(MPOOL *mp, void *page) + { + struct _hqh *head; + BKT *bp; +@@ -180,10 +169,7 @@ mpool_delete(mp, page) + * Get a page. + */ + void * +-mpool_get(mp, pgno, flags) +- MPOOL *mp; +- db_pgno_t pgno; +- u_int flags; /* XXX not used? */ ++mpool_get(MPOOL *mp, db_pgno_t pgno, u_int flags) + { + struct _hqh *head; + BKT *bp; +@@ -278,10 +264,7 @@ mpool_get(mp, pgno, flags) + * Return a page. + */ + int +-mpool_put(mp, page, flags) +- MPOOL *mp; +- void *page; +- u_int flags; ++mpool_put(MPOOL *mp, void *page, u_int flags) + { + BKT *bp; + +@@ -307,8 +290,7 @@ mpool_put(mp, page, flags) + * Close the buffer pool. + */ + int +-mpool_close(mp) +- MPOOL *mp; ++mpool_close(MPOOL *mp) + { + BKT *bp; + +@@ -328,8 +310,7 @@ mpool_close(mp) + * Sync the pool to disk. + */ + int +-mpool_sync(mp) +- MPOOL *mp; ++mpool_sync(MPOOL *mp) + { + BKT *bp; + +@@ -348,8 +329,7 @@ mpool_sync(mp) + * Get a page from the cache (or create one). + */ + static BKT * +-mpool_bkt(mp) +- MPOOL *mp; ++mpool_bkt(MPOOL *mp) + { + struct _hqh *head; + BKT *bp; +@@ -407,9 +387,7 @@ new: if ((bp = (BKT *)malloc(sizeof(BKT) + mp->pagesize)) == NULL) + * Write a page to disk. + */ + static int +-mpool_write(mp, bp) +- MPOOL *mp; +- BKT *bp; ++mpool_write(MPOOL *mp, BKT *bp) + { + off_t off; + +@@ -451,9 +429,7 @@ mpool_write(mp, bp) + * Lookup a page in the cache. + */ + static BKT * +-mpool_look(mp, pgno) +- MPOOL *mp; +- db_pgno_t pgno; ++mpool_look(MPOOL *mp, db_pgno_t pgno) + { + struct _hqh *head; + BKT *bp; +@@ -478,8 +454,7 @@ mpool_look(mp, pgno) + * Print out cache statistics. + */ + void +-mpool_stat(mp) +- MPOOL *mp; ++mpool_stat(MPOOL *mp) + { + BKT *bp; + int cnt; +@@ -520,8 +495,7 @@ mpool_stat(mp) + } + #else + void +-mpool_stat(mp) +- MPOOL *mp; ++mpool_stat(MPOOL *mp) + { + } + #endif +diff --git a/src/plugins/kdb/db2/libdb2/recno/rec_close.c b/src/plugins/kdb/db2/libdb2/recno/rec_close.c +index 4ef4dd1bae..b858e5c909 100644 +--- a/src/plugins/kdb/db2/libdb2/recno/rec_close.c ++++ b/src/plugins/kdb/db2/libdb2/recno/rec_close.c +@@ -59,8 +59,7 @@ static char sccsid[] = "@(#)rec_close.c 8.9 (Berkeley) 11/18/94"; + * RET_ERROR, RET_SUCCESS + */ + int +-__rec_close(dbp) +- DB *dbp; ++__rec_close(DB *dbp) + { + BTREE *t; + int status; +@@ -108,9 +107,7 @@ __rec_close(dbp) + * RET_SUCCESS, RET_ERROR. + */ + int +-__rec_sync(dbp, flags) +- const DB *dbp; +- u_int flags; ++__rec_sync(const DB *dbp, u_int flags) + { + struct iovec iov[2]; + BTREE *t; +diff --git a/src/plugins/kdb/db2/libdb2/recno/rec_delete.c b/src/plugins/kdb/db2/libdb2/recno/rec_delete.c +index b69c9ad742..7e574df28e 100644 +--- a/src/plugins/kdb/db2/libdb2/recno/rec_delete.c ++++ b/src/plugins/kdb/db2/libdb2/recno/rec_delete.c +@@ -61,10 +61,7 @@ static int rec_rdelete __P((BTREE *, recno_t)); + * RET_ERROR, RET_SUCCESS and RET_SPECIAL if the key not found. + */ + int +-__rec_delete(dbp, key, flags) +- const DB *dbp; +- const DBT *key; +- u_int flags; ++__rec_delete(const DB *dbp, const DBT *key, u_int flags) + { + BTREE *t; + recno_t nrec; +@@ -117,9 +114,7 @@ einval: errno = EINVAL; + * RET_ERROR, RET_SUCCESS and RET_SPECIAL if the key not found. + */ + static int +-rec_rdelete(t, nrec) +- BTREE *t; +- recno_t nrec; ++rec_rdelete(BTREE *t, recno_t nrec) + { + EPG *e; + PAGE *h; +@@ -151,10 +146,7 @@ rec_rdelete(t, nrec) + * RET_SUCCESS, RET_ERROR. + */ + int +-__rec_dleaf(t, h, idx) +- BTREE *t; +- PAGE *h; +- u_int32_t idx; ++__rec_dleaf(BTREE *t, PAGE *h, u_int32_t idx) + { + RLEAF *rl; + indx_t *ip, cnt, offset; +diff --git a/src/plugins/kdb/db2/libdb2/recno/rec_get.c b/src/plugins/kdb/db2/libdb2/recno/rec_get.c +index 230b2d4f54..c89cb556fc 100644 +--- a/src/plugins/kdb/db2/libdb2/recno/rec_get.c ++++ b/src/plugins/kdb/db2/libdb2/recno/rec_get.c +@@ -60,11 +60,7 @@ static char sccsid[] = "@(#)rec_get.c 8.9 (Berkeley) 8/18/94"; + * RET_ERROR, RET_SUCCESS and RET_SPECIAL if the key not found. + */ + int +-__rec_get(dbp, key, data, flags) +- const DB *dbp; +- const DBT *key; +- DBT *data; +- u_int flags; ++__rec_get(const DB *dbp, const DBT *key, DBT *data, u_int flags) + { + BTREE *t; + EPG *e; +@@ -119,9 +115,7 @@ __rec_get(dbp, key, data, flags) + * RET_ERROR, RET_SUCCESS + */ + int +-__rec_fpipe(t, top) +- BTREE *t; +- recno_t top; ++__rec_fpipe(BTREE *t, recno_t top) + { + DBT data; + recno_t nrec; +@@ -175,9 +169,7 @@ __rec_fpipe(t, top) + * RET_ERROR, RET_SUCCESS + */ + int +-__rec_vpipe(t, top) +- BTREE *t; +- recno_t top; ++__rec_vpipe(BTREE *t, recno_t top) + { + DBT data; + recno_t nrec; +@@ -232,9 +224,7 @@ __rec_vpipe(t, top) + * RET_ERROR, RET_SUCCESS + */ + int +-__rec_fmap(t, top) +- BTREE *t; +- recno_t top; ++__rec_fmap(BTREE *t, recno_t top) + { + DBT data; + recno_t nrec; +@@ -282,9 +272,7 @@ __rec_fmap(t, top) + * RET_ERROR, RET_SUCCESS + */ + int +-__rec_vmap(t, top) +- BTREE *t; +- recno_t top; ++__rec_vmap(BTREE *t, recno_t top) + { + DBT data; + u_char *sp, *ep; +diff --git a/src/plugins/kdb/db2/libdb2/recno/rec_open.c b/src/plugins/kdb/db2/libdb2/recno/rec_open.c +index b0daa7c021..de3fc3f4d0 100644 +--- a/src/plugins/kdb/db2/libdb2/recno/rec_open.c ++++ b/src/plugins/kdb/db2/libdb2/recno/rec_open.c +@@ -56,10 +56,8 @@ static char sccsid[] = "@(#)rec_open.c 8.12 (Berkeley) 11/18/94"; + #include "recno.h" + + DB * +-__rec_open(fname, flags, mode, openinfo, dflags) +- const char *fname; +- int flags, mode, dflags; +- const RECNOINFO *openinfo; ++__rec_open(const char *fname, int flags, int mode, const RECNOINFO *openinfo, ++ int dflags) + { + BTREE *t; + BTREEINFO btopeninfo; +@@ -228,8 +226,7 @@ err: sverrno = errno; + } + + int +-__rec_fd(dbp) +- const DB *dbp; ++__rec_fd(const DB *dbp) + { + BTREE *t; + +diff --git a/src/plugins/kdb/db2/libdb2/recno/rec_put.c b/src/plugins/kdb/db2/libdb2/recno/rec_put.c +index c53c9578e5..8456f1dbf6 100644 +--- a/src/plugins/kdb/db2/libdb2/recno/rec_put.c ++++ b/src/plugins/kdb/db2/libdb2/recno/rec_put.c +@@ -59,11 +59,7 @@ static char sccsid[] = "@(#)rec_put.c 8.7 (Berkeley) 8/18/94"; + * already in the tree and R_NOOVERWRITE specified. + */ + int +-__rec_put(dbp, key, data, flags) +- const DB *dbp; +- DBT *key; +- const DBT *data; +- u_int flags; ++__rec_put(const DB *dbp, DBT *key, const DBT *data, u_int flags) + { + BTREE *t; + DBT fdata, tdata; +@@ -187,11 +183,7 @@ einval: errno = EINVAL; + * RET_ERROR, RET_SUCCESS + */ + int +-__rec_iput(t, nrec, data, flags) +- BTREE *t; +- recno_t nrec; +- const DBT *data; +- u_int flags; ++__rec_iput(BTREE *t, recno_t nrec, const DBT *data, u_int flags) + { + DBT tdata; + EPG *e; +diff --git a/src/plugins/kdb/db2/libdb2/recno/rec_search.c b/src/plugins/kdb/db2/libdb2/recno/rec_search.c +index 244d79f36d..55e5ba879b 100644 +--- a/src/plugins/kdb/db2/libdb2/recno/rec_search.c ++++ b/src/plugins/kdb/db2/libdb2/recno/rec_search.c +@@ -61,10 +61,7 @@ static char sccsid[] = "@(#)rec_search.c 8.4 (Berkeley) 7/14/94"; + * the bt_cur field of the tree. A pointer to the field is returned. + */ + EPG * +-__rec_search(t, recno, op) +- BTREE *t; +- recno_t recno; +- enum SRCHOP op; ++__rec_search(BTREE *t, recno_t recno, enum SRCHOP op) + { + indx_t idx; + PAGE *h; +diff --git a/src/plugins/kdb/db2/libdb2/recno/rec_seq.c b/src/plugins/kdb/db2/libdb2/recno/rec_seq.c +index 8af1378c34..cf48ea24d7 100644 +--- a/src/plugins/kdb/db2/libdb2/recno/rec_seq.c ++++ b/src/plugins/kdb/db2/libdb2/recno/rec_seq.c +@@ -58,10 +58,7 @@ static char sccsid[] = "@(#)rec_seq.c 8.3 (Berkeley) 7/14/94"; + * RET_ERROR, RET_SUCCESS or RET_SPECIAL if there's no next key. + */ + int +-__rec_seq(dbp, key, data, flags) +- const DB *dbp; +- DBT *key, *data; +- u_int flags; ++__rec_seq(const DB *dbp, DBT *key, DBT *data, u_int flags) + { + BTREE *t; + EPG *e; +diff --git a/src/plugins/kdb/db2/libdb2/recno/rec_utils.c b/src/plugins/kdb/db2/libdb2/recno/rec_utils.c +index f757a724f5..2eaa39b4a3 100644 +--- a/src/plugins/kdb/db2/libdb2/recno/rec_utils.c ++++ b/src/plugins/kdb/db2/libdb2/recno/rec_utils.c +@@ -59,11 +59,7 @@ static char sccsid[] = "@(#)rec_utils.c 8.6 (Berkeley) 7/16/94"; + * RET_SUCCESS, RET_ERROR. + */ + int +-__rec_ret(t, e, nrec, key, data) +- BTREE *t; +- EPG *e; +- recno_t nrec; +- DBT *key, *data; ++__rec_ret(BTREE *t, EPG *e, recno_t nrec, DBT *key, DBT *data) + { + RLEAF *rl; + void *p; +diff --git a/src/plugins/kdb/db2/libdb2/test/dbtest.c b/src/plugins/kdb/db2/libdb2/test/dbtest.c +index 5d76b1ddf9..04bf34b90d 100644 +--- a/src/plugins/kdb/db2/libdb2/test/dbtest.c ++++ b/src/plugins/kdb/db2/libdb2/test/dbtest.c +@@ -121,9 +121,7 @@ DB *XXdbp; /* Global for gdb. */ + u_long XXlineno; /* Fast breakpoint for gdb. */ + + int +-main(argc, argv) +- int argc; +- char *argv[]; ++main(int argc, char *argv[]) + { + extern int optind; + extern char *optarg; +@@ -380,8 +378,7 @@ lkey: switch (command) { + #define NOOVERWRITE "put failed, would overwrite key\n" + + void +-compare(db1, db2) +- DBT *db1, *db2; ++compare(DBT *db1, DBT *db2) + { + size_t len; + u_char *p1, *p2; +@@ -402,9 +399,7 @@ compare(db1, db2) + } + + void +-get(dbp, kp) +- DB *dbp; +- DBT *kp; ++get(DB *dbp, DBT *kp) + { + DBT data; + +@@ -437,9 +432,7 @@ get(dbp, kp) + } + + void +-getdata(dbp, kp, dp) +- DB *dbp; +- DBT *kp, *dp; ++getdata(DB *dbp, DBT *kp, DBT *dp) + { + switch (dbp->get(dbp, kp, dp, flags)) { + case 0: +@@ -454,9 +447,7 @@ getdata(dbp, kp, dp) + } + + void +-put(dbp, kp, dp) +- DB *dbp; +- DBT *kp, *dp; ++put(DB *dbp, DBT *kp, DBT *dp) + { + switch (dbp->put(dbp, kp, dp, flags)) { + case 0: +@@ -473,9 +464,7 @@ put(dbp, kp, dp) + } + + void +-rem(dbp, kp) +- DB *dbp; +- DBT *kp; ++rem(DB *dbp, DBT *kp) + { + switch (dbp->del(dbp, kp, flags)) { + case 0: +@@ -502,8 +491,7 @@ rem(dbp, kp) + } + + void +-synk(dbp) +- DB *dbp; ++synk(DB *dbp) + { + switch (dbp->sync(dbp, flags)) { + case 0: +@@ -515,9 +503,7 @@ synk(dbp) + } + + void +-seq(dbp, kp) +- DB *dbp; +- DBT *kp; ++seq(DB *dbp, DBT *kp) + { + DBT data; + +@@ -551,10 +537,7 @@ seq(dbp, kp) + } + + void +-dump(dbp, rev, recurse) +- DB *dbp; +- int rev; +- int recurse; ++dump(DB *dbp, int rev, int recurse) + { + DBT key, data; + int lflags, nflags; +@@ -588,8 +571,7 @@ done: return; + } + + void +-unlinkpg(dbp) +- DB *dbp; ++unlinkpg(DB *dbp) + { + BTREE *t = dbp->internal; + PAGE *h = NULL; +@@ -623,8 +605,7 @@ cleanup: + } + + u_int +-setflags(s) +- char *s; ++setflags(char *s) + { + char *p; + +@@ -648,8 +629,7 @@ setflags(s) + } + + char * +-sflags(lflags) +- int lflags; ++sflags(int lflags) + { + switch (lflags) { + case R_CURSOR: return ("R_CURSOR"); +@@ -667,8 +647,7 @@ sflags(lflags) + } + + DBTYPE +-dbtype(s) +- char *s; ++dbtype(char *s) + { + if (!strcmp(s, "btree")) + return (DB_BTREE); +@@ -681,9 +660,7 @@ dbtype(s) + } + + void * +-setinfo(db_type, s) +- DBTYPE db_type; +- char *s; ++setinfo(DBTYPE db_type, char *s) + { + static BTREEINFO ib; + static HASHINFO ih; +@@ -777,9 +754,7 @@ setinfo(db_type, s) + } + + void * +-rfile(name, lenp) +- char *name; +- size_t *lenp; ++rfile(char *name, size_t *lenp) + { + struct stat sb; + void *p; +@@ -806,9 +781,7 @@ rfile(name, lenp) + } + + void * +-xmalloc(text, len) +- char *text; +- size_t len; ++xmalloc(char *text, size_t len) + { + void *p; + +diff --git a/src/plugins/kdb/db2/pol_xdr.c b/src/plugins/kdb/db2/pol_xdr.c +index e8576337c8..448d4b0f51 100644 +--- a/src/plugins/kdb/db2/pol_xdr.c ++++ b/src/plugins/kdb/db2/pol_xdr.c +@@ -82,7 +82,7 @@ xdr_osa_policy_ent_rec(XDR *xdrs, osa_policy_ent_t objp) + if (!xdr_short(xdrs, &objp->n_tl_data)) + return (FALSE); + if (!xdr_nulltype(xdrs, (void **) &objp->tl_data, +- xdr_krb5_tl_data)) ++ (xdrproc_t)xdr_krb5_tl_data)) + return FALSE; + } + return (TRUE); +diff --git a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.c b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.c +index 0b56ba86a7..7ddea923a3 100644 +--- a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.c ++++ b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.c +@@ -186,8 +186,8 @@ static struct _cmd_table { + * The function cmd_lookup returns the structure matching the + * command name and returns NULL if nothing matches. + */ +-static struct _cmd_table *cmd_lookup(name) +- char *name; ++static struct _cmd_table * ++cmd_lookup(const char *name) + { + int i; + +diff --git a/src/plugins/kdb/lmdb/kdb_lmdb.c b/src/plugins/kdb/lmdb/kdb_lmdb.c +index bd288e2236..dbab7967c6 100644 +--- a/src/plugins/kdb/lmdb/kdb_lmdb.c ++++ b/src/plugins/kdb/lmdb/kdb_lmdb.c +@@ -468,13 +468,13 @@ error: + } + + static krb5_error_code +-klmdb_lib_init() ++klmdb_lib_init(void) + { + return 0; + } + + static krb5_error_code +-klmdb_lib_cleanup() ++klmdb_lib_cleanup(void) + { + return 0; + } +diff --git a/src/plugins/kdb/test/kdb_test.c b/src/plugins/kdb/test/kdb_test.c +index f4d4380d5b..8d14091f38 100644 +--- a/src/plugins/kdb/test/kdb_test.c ++++ b/src/plugins/kdb/test/kdb_test.c +@@ -312,13 +312,13 @@ make_strings(char **stringattrs, krb5_db_entry *ent) + } + + static krb5_error_code +-test_init() ++test_init(void) + { + return 0; + } + + static krb5_error_code +-test_cleanup() ++test_cleanup(void) + { + return 0; + } +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index 8cdc40bfb4..f5aade34cc 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -3471,7 +3471,7 @@ load_pkcs11_module(krb5_context context, const char *modname, + CK_RV (*getflist)(CK_FUNCTION_LIST_PTR_PTR); + struct errinfo einfo = EMPTY_ERRINFO; + const char *errmsg = NULL; +- void (*sym)(); ++ void (*sym)(void); + long err; + CK_RV rv; + +@@ -3490,7 +3490,7 @@ load_pkcs11_module(krb5_context context, const char *modname, + goto error; + } + +- getflist = (CK_RV (*)())sym; ++ getflist = (CK_RV (*)(CK_FUNCTION_LIST_PTR_PTR))sym; + rv = (*getflist)(p11p); + if (rv != CKR_OK) { + TRACE_PKINIT_PKCS11_GETFLIST_FAILED(context, pkcs11err(rv)); +diff --git a/src/plugins/preauth/spake/t_vectors.c b/src/plugins/preauth/spake/t_vectors.c +index 96b0307d78..ecffd3d7ee 100644 +--- a/src/plugins/preauth/spake/t_vectors.c ++++ b/src/plugins/preauth/spake/t_vectors.c +@@ -439,7 +439,7 @@ run_test(const struct test *t) + } + + int +-main() ++main(void) + { + size_t i; + +diff --git a/src/tests/asn.1/krb5_decode_test.c b/src/tests/asn.1/krb5_decode_test.c +index 926aa94706..2fa6dce8eb 100644 +--- a/src/tests/asn.1/krb5_decode_test.c ++++ b/src/tests/asn.1/krb5_decode_test.c +@@ -54,9 +54,8 @@ static void ktest_free_reply_key_pack(krb5_context context, + static void ktest_free_kkdcp_message(krb5_context context, + krb5_kkdcp_message *val); + +-int main(argc, argv) +- int argc; +- char **argv; ++int ++main(int argc, char **argv) + { + krb5_data code; + krb5_error_code retval; +diff --git a/src/tests/asn.1/krb5_encode_test.c b/src/tests/asn.1/krb5_encode_test.c +index 26c064e67d..f4e754b1cc 100644 +--- a/src/tests/asn.1/krb5_encode_test.c ++++ b/src/tests/asn.1/krb5_encode_test.c +@@ -37,7 +37,7 @@ krb5_context test_context; + int error_count = 0; + int do_trval = 0; + int first_trval = 1; +-int trval2(); ++int trval2(FILE *, unsigned char *, int, int, int *); + + static void + encoder_print_results(krb5_data *code, char *typestring, char *description) +@@ -51,7 +51,7 @@ encoder_print_results(krb5_data *code, char *typestring, char *description) + else + printf("\n"); + printf("encode_krb5_%s%s:\n", typestring, description); +- r = trval2(stdout, code->data, code->length, 0, &rlen); ++ r = trval2(stdout, (uint8_t *)code->data, code->length, 0, &rlen); + printf("\n"); + if (rlen < 0 || (unsigned int) rlen != code->length) { + printf("Error: length mismatch: was %d, parsed %d\n", +@@ -72,9 +72,8 @@ encoder_print_results(krb5_data *code, char *typestring, char *description) + ktest_destroy_data(&code); + } + +-static void PRS(argc, argv) +- int argc; +- char **argv; ++static void ++PRS(int argc, char **argv) + { + extern char *optarg; + int optchar; +@@ -107,9 +106,7 @@ static void PRS(argc, argv) + } + + int +-main(argc, argv) +- int argc; +- char **argv; ++main(int argc, char **argv) + { + krb5_data *code; + krb5_error_code retval; +diff --git a/src/tests/asn.1/t_trval.c b/src/tests/asn.1/t_trval.c +index 57d8253880..009ed5bb9e 100644 +--- a/src/tests/asn.1/t_trval.c ++++ b/src/tests/asn.1/t_trval.c +@@ -36,7 +36,8 @@ + -DSTANDALONE code. */ + #include "trval.c" + +-static void usage() ++static void ++usage(void) + { + fprintf(stderr, "Usage: trval [--types] [--krb5] [--krb5decode] [--hex] [-notypebytes] [file]\n"); + exit(1); +@@ -46,10 +47,8 @@ static void usage() + * Returns true if the option was selected. Allow "-option" and + * "--option" syntax, since we used to accept only "-option" + */ +-static +-int check_option(word, option) +- char *word; +- char *option; ++static int ++check_option(char *word, char *option) + { + if (word[0] != '-') + return 0; +@@ -60,9 +59,8 @@ int check_option(word, option) + return 1; + } + +-int main(argc, argv) +- int argc; +- char **argv; ++int ++main(int argc, char **argv) + { + int optflg = 1; + FILE *fp; +diff --git a/src/tests/asn.1/trval.c b/src/tests/asn.1/trval.c +index c14bcdeb69..e0e58cc19e 100644 +--- a/src/tests/asn.1/trval.c ++++ b/src/tests/asn.1/trval.c +@@ -120,7 +120,8 @@ int trval2 (FILE *, unsigned char *, int, int, int *); + + /****************************************************************************/ + +-static int convert_nibble(int ch) ++static int ++convert_nibble(int ch) + { + if (isdigit(ch)) + return (ch - '0'); +@@ -131,9 +132,8 @@ static int convert_nibble(int ch) + return -1; + } + +-int trval(fin, fout) +- FILE *fin; +- FILE *fout; ++int ++trval(FILE *fin, FILE *fout) + { + unsigned char *p; + unsigned int maxlen; +@@ -169,12 +169,8 @@ int trval(fin, fout) + return(r); + } + +-int trval2(fp, enc, len, lev, rlen) +- FILE *fp; +- unsigned char *enc; +- int len; +- int lev; +- int *rlen; ++int ++trval2(FILE *fp, unsigned char *enc, int len, int lev, int *rlen) + { + int l, eid, elen, xlen, r, rlen2 = 0; + int rlen_ext = 0; +@@ -248,10 +244,8 @@ context_restart: + return(r); + } + +-int decode_len(fp, enc, len) +- FILE *fp; +- unsigned char *enc; +- int len; ++int ++decode_len(FILE *fp, unsigned char *enc, int len) + { + int rlen; + int i; +@@ -270,12 +264,8 @@ int decode_len(fp, enc, len) + /* + * This is the printing function for bit strings + */ +-int do_prim_bitstring(fp, tag, enc, len, lev) +- FILE *fp; +- int tag; +- unsigned char *enc; +- int len; +- int lev; ++int ++do_prim_bitstring(FILE *fp, int tag, unsigned char *enc, int len, int lev) + { + int i; + long num = 0; +@@ -297,12 +287,8 @@ int do_prim_bitstring(fp, tag, enc, len, lev) + /* + * This is the printing function for integers + */ +-int do_prim_int(fp, tag, enc, len, lev) +- FILE *fp; +- int tag; +- unsigned char *enc; +- int len; +- int lev; ++int ++do_prim_int(FILE *fp, int tag, unsigned char *enc, int len, int lev) + { + int i; + long num = 0; +@@ -327,12 +313,8 @@ int do_prim_int(fp, tag, enc, len, lev) + * This is the printing function which we use if it's a string or + * other other type which is best printed as a string + */ +-int do_prim_string(fp, tag, enc, len, lev) +- FILE *fp; +- int tag; +- unsigned char *enc; +- int len; +- int lev; ++int ++do_prim_string(FILE *fp, int tag, unsigned char *enc, int len, int lev) + { + int i; + +@@ -349,12 +331,8 @@ int do_prim_string(fp, tag, enc, len, lev) + return 1; + } + +-int do_prim(fp, tag, enc, len, lev) +- FILE *fp; +- int tag; +- unsigned char *enc; +- int len; +- int lev; ++int ++do_prim(FILE *fp, int tag, unsigned char *enc, int len, int lev) + { + int n; + int i; +@@ -396,12 +374,8 @@ int do_prim(fp, tag, enc, len, lev) + return(OK); + } + +-int do_cons(fp, enc, len, lev, rlen) +- FILE *fp; +- unsigned char *enc; +- int len; +- int lev; +- int *rlen; ++int ++do_cons(FILE *fp, unsigned char *enc, int len, int lev, int *rlen) + { + int n; + int r = 0; +@@ -430,9 +404,8 @@ struct typestring_table { + int new_appl; + }; + +-static char *lookup_typestring(table, key1, key2) +- struct typestring_table *table; +- int key1, key2; ++static char * ++lookup_typestring(struct typestring_table *table, int key1, int key2) + { + struct typestring_table *ent; + +@@ -700,10 +673,8 @@ struct typestring_table krb5_fields[] = { + }; + #endif + +-void print_tag_type(fp, eid, lev) +- FILE *fp; +- int eid; +- int lev; ++void ++print_tag_type(FILE *fp, int eid, int lev) + { + int tag = eid & ID_TAG; + int do_space = 1; +diff --git a/src/tests/conccache.c b/src/tests/conccache.c +index 7b0ca6300c..9fe5305761 100644 +--- a/src/tests/conccache.c ++++ b/src/tests/conccache.c +@@ -110,7 +110,7 @@ refresh_cache(krb5_context context) + } + + static pid_t +-spawn_cred_subprocess() ++spawn_cred_subprocess(void) + { + krb5_context context; + pid_t pid; +@@ -133,7 +133,7 @@ spawn_cred_subprocess() + } + + static pid_t +-spawn_refresh_subprocess() ++spawn_refresh_subprocess(void) + { + krb5_context context; + pid_t pid; +diff --git a/src/tests/create/kdb5_mkdums.c b/src/tests/create/kdb5_mkdums.c +index 7c0666601c..61ca9f67a2 100644 +--- a/src/tests/create/kdb5_mkdums.c ++++ b/src/tests/create/kdb5_mkdums.c +@@ -56,9 +56,7 @@ struct mblock { + int set_dbname_help (char *, char *); + + static void +-usage(who, status) +- char *who; +- int status; ++usage(char *who, int status) + { + fprintf(stderr, + "usage: %s -p prefix -n num_to_create [-d dbpathname] [-r realmname]\n", +@@ -83,9 +81,7 @@ static krb5_boolean manual_mkey = FALSE; + void add_princ (krb5_context, char *); + + int +-main(argc, argv) +- int argc; +- char *argv[]; ++main(int argc, char *argv[]) + { + extern char *optarg; + int optchar, i, n; +@@ -209,9 +205,7 @@ main(argc, argv) + } + + void +-add_princ(context, str_newprinc) +- krb5_context context; +- char * str_newprinc; ++add_princ(krb5_context context, char *str_newprinc) + { + krb5_error_code retval; + krb5_principal newprinc; +@@ -317,9 +311,7 @@ error: /* Do cleanup of newentry regardless of error */ + } + + int +-set_dbname_help(pname, dbname) +- char *pname; +- char *dbname; ++set_dbname_help(char *pname, char *dbname) + { + krb5_error_code retval; + krb5_data pwd, scratch; +diff --git a/src/tests/forward.c b/src/tests/forward.c +index 7327cc9e62..90f359a586 100644 +--- a/src/tests/forward.c ++++ b/src/tests/forward.c +@@ -51,7 +51,7 @@ check(krb5_error_code code) + } + + int +-main() ++main(void) + { + krb5_ccache cc; + krb5_creds mcred, tgt, *fcred; +diff --git a/src/tests/gss-threads/gss-client.c b/src/tests/gss-threads/gss-client.c +index c0cf25ddaa..8c006c2915 100644 +--- a/src/tests/gss-threads/gss-client.c ++++ b/src/tests/gss-threads/gss-client.c +@@ -68,7 +68,7 @@ + static int verbose = 1; + + static void +-usage() ++usage(void) + { + fprintf(stderr, "Usage: gss-client [-port port] [-mech mechanism] [-d]\n"); + fprintf(stderr, " [-seq] [-noreplay] [-nomutual]"); +@@ -134,7 +134,7 @@ get_server_info(char *host, u_short port) + * displayed and -1 is returned. + */ + static int +-connect_to_server() ++connect_to_server(void) + { + int s; + +diff --git a/src/tests/gss-threads/gss-server.c b/src/tests/gss-threads/gss-server.c +index a9f980edb2..e0a37738e4 100644 +--- a/src/tests/gss-threads/gss-server.c ++++ b/src/tests/gss-threads/gss-server.c +@@ -74,7 +74,7 @@ + #endif + + static void +-usage() ++usage(void) + { + fprintf(stderr, "Usage: gss-server [-port port] [-verbose] [-once]"); + #ifdef _WIN32 +diff --git a/src/tests/gssapi/reload.c b/src/tests/gssapi/reload.c +index 4fe3565406..00bda32330 100644 +--- a/src/tests/gssapi/reload.c ++++ b/src/tests/gssapi/reload.c +@@ -64,7 +64,7 @@ load_gssapi(void) + } + + int +-main() ++main(void) + { + void *support; + +diff --git a/src/tests/gssapi/t_add_cred.c b/src/tests/gssapi/t_add_cred.c +index 68b37e3ed9..7ab52d6449 100644 +--- a/src/tests/gssapi/t_add_cred.c ++++ b/src/tests/gssapi/t_add_cred.c +@@ -43,7 +43,7 @@ + #include "common.h" + + int +-main() ++main(void) + { + OM_uint32 minor, major; + gss_cred_id_t cred1, cred2; +diff --git a/src/tests/gssapi/t_enctypes.c b/src/tests/gssapi/t_enctypes.c +index 3fd31e2f8c..3325db7696 100644 +--- a/src/tests/gssapi/t_enctypes.c ++++ b/src/tests/gssapi/t_enctypes.c +@@ -47,7 +47,7 @@ + */ + + static void +-usage() ++usage(void) + { + errout("Usage: t_enctypes [-i initenctypes] [-a accenctypes] " + "targetname"); +diff --git a/src/tests/gssapi/t_invalid.c b/src/tests/gssapi/t_invalid.c +index 8192935099..a052b8ab6e 100644 +--- a/src/tests/gssapi/t_invalid.c ++++ b/src/tests/gssapi/t_invalid.c +@@ -547,7 +547,7 @@ try_accept(void *value, size_t len) + + /* Accept contexts using superficially valid but truncated encapsulations. */ + static void +-test_short_encapsulation() ++test_short_encapsulation(void) + { + /* Include just the initial application tag, to see if we overrun reading + * the sequence length. */ +diff --git a/src/tests/gssapi/t_oid.c b/src/tests/gssapi/t_oid.c +index 1c9d394167..64253133d2 100644 +--- a/src/tests/gssapi/t_oid.c ++++ b/src/tests/gssapi/t_oid.c +@@ -129,7 +129,7 @@ oid_equal(gss_OID o1, gss_OID o2) + } + + int +-main() ++main(void) + { + size_t i; + OM_uint32 major, minor; +diff --git a/src/tests/gssapi/t_spnego.c b/src/tests/gssapi/t_spnego.c +index 2483228b1b..4091739f83 100644 +--- a/src/tests/gssapi/t_spnego.c ++++ b/src/tests/gssapi/t_spnego.c +@@ -195,7 +195,7 @@ test_mskrb_oid(gss_name_t tname, gss_cred_id_t acred) + /* Check that we return a compatibility NegTokenInit2 message containing + * NegHints for an empty initiator token. */ + static void +-test_neghints() ++test_neghints(void) + { + OM_uint32 major, minor; + gss_buffer_desc itok = GSS_C_EMPTY_BUFFER, atok; +diff --git a/src/tests/hammer/kdc5_hammer.c b/src/tests/hammer/kdc5_hammer.c +index 8220fd97bd..76ef527ccf 100644 +--- a/src/tests/hammer/kdc5_hammer.c ++++ b/src/tests/hammer/kdc5_hammer.c +@@ -68,9 +68,7 @@ int get_tgt + krb5_ccache); + + static void +-usage(who, status) +-char *who; +-int status; ++usage(char *who, int status) + { + fprintf(stderr, + "usage: %s -p prefix -n num_to_check [-c cachename] [-r realmname]\n", +@@ -100,9 +98,7 @@ struct h_timer tgs_req_times = { 0.0, 1000000.0, -1.0, 0 }; + tstart_time.tv_usec))/1000000.0))) + + int +-main(argc, argv) +- int argc; +- char **argv; ++main(int argc, char **argv) + { + krb5_ccache ccache = NULL; + char *cache_name = NULL; /* -f option */ +@@ -271,11 +267,8 @@ main(argc, argv) + + + static krb5_error_code +-get_server_key(context, server, enctype, key) +- krb5_context context; +- krb5_principal server; +- krb5_enctype enctype; +- krb5_keyblock ** key; ++get_server_key(krb5_context context, krb5_principal server, ++ krb5_enctype enctype, krb5_keyblock **key) + { + krb5_error_code retval; + krb5_encrypt_block eblock; +@@ -311,15 +304,10 @@ cleanup_salt: + return retval; + } + +-int verify_cs_pair(context, p_client_str, p_client, service, hostname, +- p_num, c_depth, s_depth, ccache) +- krb5_context context; +- char *p_client_str; +- krb5_principal p_client; +- char * service; +- char * hostname; +- int p_num, c_depth, s_depth; +- krb5_ccache ccache; ++int ++verify_cs_pair(krb5_context context, char *p_client_str, ++ krb5_principal p_client, char *service, char *hostname, ++ int p_num, int c_depth, int s_depth, krb5_ccache ccache) + { + krb5_error_code retval; + krb5_creds creds; +@@ -433,11 +421,9 @@ cleanup: + return retval; + } + +-int get_tgt (context, p_client_str, p_client, ccache) +- krb5_context context; +- char *p_client_str; +- krb5_principal *p_client; +- krb5_ccache ccache; ++int ++get_tgt(krb5_context context, char *p_client_str, krb5_principal *p_client, ++ krb5_ccache ccache) + { + long lifetime = KRB5_DEFAULT_LIFE; /* -l option */ + krb5_error_code code; +diff --git a/src/tests/kdbtest.c b/src/tests/kdbtest.c +index 3f61f3e83b..6459c3390f 100644 +--- a/src/tests/kdbtest.c ++++ b/src/tests/kdbtest.c +@@ -271,7 +271,7 @@ iter_pol_handler(void *data, osa_policy_ent_t pol) + } + + int +-main() ++main(void) + { + krb5_db_entry *ent; + osa_policy_ent_t pol; +diff --git a/src/tests/misc/test_getpw.c b/src/tests/misc/test_getpw.c +index 6031e15035..59ff5d3a5d 100644 +--- a/src/tests/misc/test_getpw.c ++++ b/src/tests/misc/test_getpw.c +@@ -32,7 +32,7 @@ + #include + #include + +-int main() ++int main(void) + { + uid_t my_uid; + struct passwd *pwd, pwx; +diff --git a/src/tests/plugorder.c b/src/tests/plugorder.c +index e1245e4765..a2b7e34eea 100644 +--- a/src/tests/plugorder.c ++++ b/src/tests/plugorder.c +@@ -77,7 +77,7 @@ blt3(krb5_context context, int maj_ver, int min_ver, krb5_plugin_vtable vtable) + } + + int +-main() ++main(void) + { + krb5_plugin_initvt_fn *modules = NULL, *mod; + struct krb5_pwqual_vtable_st vt; +diff --git a/src/tests/shlib/t_loader.c b/src/tests/shlib/t_loader.c +index 29481a7be2..203f023f69 100644 +--- a/src/tests/shlib/t_loader.c ++++ b/src/tests/shlib/t_loader.c +@@ -180,7 +180,7 @@ static void do_close(void *libhandle) + + #endif + +-int main() ++int main(void) + { + void *celib, *k5lib, *gsslib, *celib2; + +diff --git a/src/tests/softpkcs11/main.c b/src/tests/softpkcs11/main.c +index 82b05ff0da..908f926405 100644 +--- a/src/tests/softpkcs11/main.c ++++ b/src/tests/softpkcs11/main.c +@@ -860,7 +860,7 @@ func_not_supported(void) + } + + static char * +-get_rcfilename() ++get_rcfilename(void) + { + struct passwd *pw; + const char *home = NULL; +diff --git a/src/tests/t_inetd.c b/src/tests/t_inetd.c +index d22cf31ffa..3790467c7b 100644 +--- a/src/tests/t_inetd.c ++++ b/src/tests/t_inetd.c +@@ -59,16 +59,15 @@ + + char *progname; + +-static void usage() ++static void ++usage(void) + { + fprintf(stderr, "%s: port program argv0 argv1 ...\n", progname); + exit(1); + } + + int +-main(argc, argv) +- int argc; +- char **argv; ++main(int argc, char **argv) + { + unsigned short port; + char *path; +diff --git a/src/tests/test1.c b/src/tests/test1.c +index aed656ebe3..b213a349bf 100644 +--- a/src/tests/test1.c ++++ b/src/tests/test1.c +@@ -31,7 +31,7 @@ unsigned char key_two[8] = { 0xea, 0x89, 0x57, 0x76, 0x5b, 0xcd, 0x0d, 0x34 }; + + extern void dump_data(); + +-tkt_test_1() ++tkt_test_1(void) + { + krb5_data *data; + krb5_ticket tk_in, *tk_out; +@@ -185,7 +185,7 @@ tkt_test_1() + + + +-main() ++main(void) + { + krb5_init_ets(); + tkt_test_1(); +diff --git a/src/tests/verify/kdb5_verify.c b/src/tests/verify/kdb5_verify.c +index 3b152baed6..d53e92ad45 100644 +--- a/src/tests/verify/kdb5_verify.c ++++ b/src/tests/verify/kdb5_verify.c +@@ -50,9 +50,7 @@ struct mblock { + int set_dbname_help (krb5_context, char *, char *); + + static void +-usage(who, status) +- char *who; +- int status; ++usage(char *who, int status) + { + fprintf(stderr, + "usage: %s -p prefix -n num_to_check [-d dbpathname] [-r realmname]\n", +@@ -78,9 +76,7 @@ static krb5_boolean manual_mkey = FALSE; + int check_princ (krb5_context, char *); + + int +-main(argc, argv) +- int argc; +- char *argv[]; ++main(int argc, char *argv[]) + { + extern char *optarg; + int optchar, i, n; +@@ -221,9 +217,7 @@ main(argc, argv) + } + + int +-check_princ(context, str_princ) +- krb5_context context; +- char * str_princ; ++check_princ(krb5_context context, char *str_princ) + { + krb5_error_code retval; + krb5_db_entry *kdbe = NULL; +@@ -343,10 +337,7 @@ out: + } + + int +-set_dbname_help(context, pname, dbname) +- krb5_context context; +- char *pname; +- char *dbname; ++set_dbname_help(krb5_context context, char *pname, char *dbname) + { + krb5_error_code retval; + krb5_data pwd, scratch; +diff --git a/src/util/et/error_message.c b/src/util/et/error_message.c +index 7dc02a34ea..13ad3af6a2 100644 +--- a/src/util/et/error_message.c ++++ b/src/util/et/error_message.c +@@ -82,7 +82,7 @@ void com_err_terminate(void) + #endif + + static char * +-get_thread_buffer () ++get_thread_buffer(void) + { + char *cp; + cp = k5_getspecific(K5_KEY_COM_ERR); +diff --git a/src/util/et/test_et.c b/src/util/et/test_et.c +index 9faf10f460..2002e5ff46 100644 +--- a/src/util/et/test_et.c ++++ b/src/util/et/test_et.c +@@ -17,7 +17,8 @@ extern const char *error_table_name (errcode_t); + extern int sys_nerr; + #endif + +-int main() ++int ++main(void) + { + printf("Before initiating error table:\n\n"); + #ifndef EXPORT_LIST +diff --git a/src/util/profile/prof_init.c b/src/util/profile/prof_init.c +index cc92248f42..077c852e49 100644 +--- a/src/util/profile/prof_init.c ++++ b/src/util/profile/prof_init.c +@@ -103,7 +103,7 @@ init_load_module(const char *modspec, profile_t *ret_profile) + struct errinfo einfo = { 0 }; + prf_lib_handle_t lib_handle = NULL; + struct plugin_file_handle *plhandle = NULL; +- void *cbdata = NULL, (*fptr)(); ++ void *cbdata = NULL, (*fptr)(void); + int have_lock = 0, have_cbdata = 0; + struct profile_vtable vtable = { 1 }; /* Set minor_ver to 1, rest null. */ + errcode_t err; +diff --git a/src/util/profile/t_profile.c b/src/util/profile/t_profile.c +index b0e715ba02..bffd115618 100644 +--- a/src/util/profile/t_profile.c ++++ b/src/util/profile/t_profile.c +@@ -72,7 +72,7 @@ write_file(const char *name, int nlines, ...) + /* Regression test for #2685 (profile iterator breaks when modifications + * made) */ + static void +-test_iterate() ++test_iterate(void) + { + profile_t p; + void *iter; +@@ -129,7 +129,7 @@ test_iterate() + * global shared profiles list. + */ + static void +-test_shared() ++test_shared(void) + { + profile_t a, b; + struct utimbuf times; +@@ -164,7 +164,7 @@ test_shared() + /* Regression test for #2950 (profile_clear_relation not reflected within + * handle where deletion is performed) */ + static void +-test_clear() ++test_clear(void) + { + profile_t p; + const char *names[] = { "test section 1", "quux", NULL }; +@@ -183,7 +183,7 @@ test_clear() + } + + static void +-test_include() ++test_include(void) + { + profile_t p; + const char *names[] = { "test section 1", "bar", NULL }; +@@ -237,7 +237,7 @@ test_include() + + /* Test syntactic independence of included profile files. */ + static void +-test_independence() ++test_independence(void) + { + profile_t p; + const char *names1[] = { "sec1", "var", "a", NULL }; +@@ -264,7 +264,7 @@ test_independence() + + /* Regression test for #7971 (deleted sections should not be iterable) */ + static void +-test_delete_section() ++test_delete_section(void) + { + profile_t p; + const char *sect[] = { "test section 1", NULL }; +@@ -290,7 +290,7 @@ test_delete_section() + /* Regression test for #7971 (profile_clear_relation() error with deleted node + * at end of value set) */ + static void +-test_delete_clear_relation() ++test_delete_clear_relation(void) + { + profile_t p; + const char *names[] = { "test section 1", "testkey", NULL }; +@@ -305,7 +305,7 @@ test_delete_clear_relation() + + /* Test that order of relations is preserved if some relations are deleted. */ + static void +-test_delete_ordering() ++test_delete_ordering(void) + { + profile_t p; + const char *names[] = { "test section 1", "testkey", NULL }; +@@ -329,7 +329,7 @@ test_delete_ordering() + /* Regression test for #8431 (profile_flush_to_file erroneously changes flag + * state on source object) */ + static void +-test_flush_to_file() ++test_flush_to_file(void) + { + profile_t p; + +@@ -349,7 +349,7 @@ test_flush_to_file() + /* Regression test for #7863 (multiply-specified subsections should + * be merged) */ + static void +-test_merge_subsections() ++test_merge_subsections(void) + { + profile_t p; + const char *n1[] = { "test section 2", "child_section2", "child", NULL }; +@@ -374,7 +374,7 @@ test_merge_subsections() + } + + int +-main() ++main(void) + { + test_iterate(); + test_shared(); +diff --git a/src/util/profile/test_load.c b/src/util/profile/test_load.c +index cb870eff93..fe2d1e3e72 100644 +--- a/src/util/profile/test_load.c ++++ b/src/util/profile/test_load.c +@@ -29,7 +29,7 @@ + #include "prof_int.h" + + int +-main() ++main(void) + { + profile_t pr, pr2; + const char *files[] = { "./modtest.conf", NULL }; +diff --git a/src/util/profile/test_parse.c b/src/util/profile/test_parse.c +index 9f2631e949..0532254e8c 100644 +--- a/src/util/profile/test_parse.c ++++ b/src/util/profile/test_parse.c +@@ -11,9 +11,8 @@ + + void dump_profile (struct profile_node *root, int level); + +-int main(argc, argv) +- int argc; +- char **argv; ++int ++main(int argc, char **argv) + { + struct profile_node *root; + unsigned long retval; +diff --git a/src/util/profile/test_profile.c b/src/util/profile/test_profile.c +index 6f6fcc7ac5..31b1063951 100644 +--- a/src/util/profile/test_profile.c ++++ b/src/util/profile/test_profile.c +@@ -19,8 +19,8 @@ const char *program_name = "test_profile"; + #define PRINT_VALUE 1 + #define PRINT_VALUES 2 + +-static void do_batchmode(profile) +- profile_t profile; ++static void ++do_batchmode(profile_t profile) + { + errcode_t retval; + int argc, ret; +@@ -108,10 +108,8 @@ static void do_batchmode(profile) + + } + +- +-int main(argc, argv) +- int argc; +- char **argv; ++int ++main(int argc, char **argv) + { + profile_t profile; + long retval; +diff --git a/src/util/profile/test_vtable.c b/src/util/profile/test_vtable.c +index 9a0b2278a7..a7b6f54ae9 100644 +--- a/src/util/profile/test_vtable.c ++++ b/src/util/profile/test_vtable.c +@@ -232,7 +232,8 @@ struct profile_vtable full_vtable = { + full_flush + }; + +-int main() ++int ++main(void) + { + profile_t profile; + char **values, *str, *name, *value; +diff --git a/src/util/ss/error.c b/src/util/ss/error.c +index b5768a62b7..e5cd1b2d12 100644 +--- a/src/util/ss/error.c ++++ b/src/util/ss/error.c +@@ -33,8 +33,8 @@ + #include "com_err.h" + #include "copyright.h" + +-char * ss_name(sci_idx) +- int sci_idx; ++char * ++ss_name(int sci_idx) + { + ss_data *infop; + +@@ -50,7 +50,8 @@ char * ss_name(sci_idx) + } + } + +-void ss_error (int sci_idx, long code, const char * fmt, ...) ++void ++ss_error(int sci_idx, long code, const char *fmt, ...) + { + char *whoami; + va_list pvar; +@@ -61,10 +62,8 @@ void ss_error (int sci_idx, long code, const char * fmt, ...) + va_end(pvar); + } + +-void ss_perror (sci_idx, code, msg) /* for compatibility */ +- int sci_idx; +- long code; +- char const *msg; ++void ++ss_perror(int sci_idx, long code, char const *msg) /* for compatibility */ + { + ss_error (sci_idx, code, "%s", msg); + } +diff --git a/src/util/ss/execute_cmd.c b/src/util/ss/execute_cmd.c +index c06ee56547..065c24148b 100644 +--- a/src/util/ss/execute_cmd.c ++++ b/src/util/ss/execute_cmd.c +@@ -52,11 +52,9 @@ + * Notes: + */ + +-static int check_request_table (rqtbl, argc, argv, sci_idx) +- ss_request_table *rqtbl; +- int argc; +- char *argv[]; +- int sci_idx; ++static int ++check_request_table(ss_request_table *rqtbl, int argc, char *argv[], ++ int sci_idx) + { + ss_request_entry *request; + ss_data *info; +@@ -101,10 +99,8 @@ static int check_request_table (rqtbl, argc, argv, sci_idx) + * Notes: + */ + +-static int really_execute_command (sci_idx, argc, argv) +- int sci_idx; +- int argc; +- char **argv[]; ++static int ++really_execute_command(int sci_idx, int argc, char **argv[]) + { + ss_request_table **rqtbl; + ss_data *info; +@@ -135,9 +131,7 @@ static int really_execute_command (sci_idx, argc, argv) + */ + + int +-ss_execute_command(sci_idx, argv) +- int sci_idx; +- char *argv[]; ++ss_execute_command(int sci_idx, char *argv[]) + { + unsigned int i, argc; + char **argp; +@@ -172,9 +166,8 @@ ss_execute_command(sci_idx, argv) + * Notes: + */ + +-int ss_execute_line (sci_idx, line_ptr) +- int sci_idx; +- char *line_ptr; ++int ++ss_execute_line(int sci_idx, char *line_ptr) + { + char **argv; + int argc, ret; +diff --git a/src/util/ss/help.c b/src/util/ss/help.c +index 6d333c9710..747fde5351 100644 +--- a/src/util/ss/help.c ++++ b/src/util/ss/help.c +@@ -15,11 +15,8 @@ + #include "copyright.h" + + +-void ss_help (argc, argv, sci_idx, info_ptr) +- int argc; +- char const * const *argv; +- int sci_idx; +- pointer info_ptr; ++void ++ss_help(int argc, char const * const *argv, int sci_idx, pointer info_ptr) + { + char buffer[MAXPATHLEN]; + char const *request_name; +@@ -81,15 +78,11 @@ got_it: + ss_page_stdin(); + default: + (void) close(fd); /* what can we do if it fails? */ +-#ifdef WAIT_USES_INT +- while (wait((int *)NULL) != child) { +-#else +- while (wait((union wait *)NULL) != child) { +-#endif +- /* do nothing if wrong pid */ +- }; +- } ++ while (wait(NULL) != child) { ++ /* do nothing if wrong pid */ ++ }; + } ++} + + #ifndef USE_DIRENT_H + #include +@@ -97,60 +90,56 @@ got_it: + #include + #endif + +- void ss_add_info_dir(sci_idx, info_dir, code_ptr) +- int sci_idx; +- char *info_dir; +- int *code_ptr; +- { +- ss_data *info; +- DIR *d; +- int n_dirs; +- char **dirs; ++void ++ss_add_info_dir(int sci_idx, char *info_dir, int *code_ptr) ++{ ++ ss_data *info; ++ DIR *d; ++ int n_dirs; ++ char **dirs; + +- info = ss_info(sci_idx); +- if ((info_dir == NULL) || (*info_dir == '\0')) { +- *code_ptr = SS_ET_NO_INFO_DIR; +- return; +- } +- if ((d = opendir(info_dir)) == (DIR *)NULL) { +- *code_ptr = errno; +- return; +- } +- closedir(d); +- dirs = info->info_dirs; +- for (n_dirs = 0; dirs[n_dirs] != (char *)NULL; n_dirs++) +- ; /* get number of non-NULL dir entries */ +- dirs = (char **)realloc((char *)dirs, +- (unsigned)(n_dirs + 2)*sizeof(char *)); +- if (dirs == (char **)NULL) { +- info->info_dirs = (char **)NULL; +- *code_ptr = errno; +- return; +- } +- info->info_dirs = dirs; +- dirs[n_dirs + 1] = (char *)NULL; +- dirs[n_dirs] = strdup(info_dir); +- *code_ptr = 0; ++ info = ss_info(sci_idx); ++ if ((info_dir == NULL) || (*info_dir == '\0')) { ++ *code_ptr = SS_ET_NO_INFO_DIR; ++ return; ++ } ++ if ((d = opendir(info_dir)) == (DIR *)NULL) { ++ *code_ptr = errno; ++ return; + } ++ closedir(d); ++ dirs = info->info_dirs; ++ for (n_dirs = 0; dirs[n_dirs] != (char *)NULL; n_dirs++) ++ ; /* get number of non-NULL dir entries */ ++ dirs = (char **)realloc((char *)dirs, ++ (unsigned)(n_dirs + 2)*sizeof(char *)); ++ if (dirs == (char **)NULL) { ++ info->info_dirs = (char **)NULL; ++ *code_ptr = errno; ++ return; ++ } ++ info->info_dirs = dirs; ++ dirs[n_dirs + 1] = (char *)NULL; ++ dirs[n_dirs] = strdup(info_dir); ++ *code_ptr = 0; ++} + +- void ss_delete_info_dir(sci_idx, info_dir, code_ptr) +- int sci_idx; +- char *info_dir; +- int *code_ptr; +- { +- char **i_d; +- char **info_dirs; ++void ++ss_delete_info_dir(int sci_idx, char *info_dir, int *code_ptr) ++{ ++ char **i_d; ++ char **info_dirs; + +- info_dirs = ss_info(sci_idx)->info_dirs; +- for (i_d = info_dirs; *i_d; i_d++) { +- if (!strcmp(*i_d, info_dir)) { +- while (*i_d) { +- *i_d = *(i_d+1); +- i_d++; +- } +- *code_ptr = 0; +- return; ++ info_dirs = ss_info(sci_idx)->info_dirs; ++ for (i_d = info_dirs; *i_d; i_d++) { ++ if (!strcmp(*i_d, info_dir)) { ++ while (*i_d) { ++ *i_d = *(i_d+1); ++ i_d++; + } ++ *code_ptr = 0; ++ return; + } +- *code_ptr = SS_ET_NO_INFO_DIR; + } ++ *code_ptr = SS_ET_NO_INFO_DIR; ++} +diff --git a/src/util/ss/invocation.c b/src/util/ss/invocation.c +index 378bc3e927..7736c957d4 100644 +--- a/src/util/ss/invocation.c ++++ b/src/util/ss/invocation.c +@@ -36,12 +36,10 @@ + _ss_table[sci_idx], make sure you change the allocation routine to + not assume there are no null pointers in the middle of the + array. */ +-int ss_create_invocation(subsystem_name, version_string, info_ptr, +- request_table_ptr, code_ptr) +- char *subsystem_name, *version_string; +- char *info_ptr; +- ss_request_table *request_table_ptr; +- int *code_ptr; ++int ++ss_create_invocation(char *subsystem_name, char *version_string, ++ char *info_ptr, ss_request_table *request_table_ptr, ++ int *code_ptr) + { + int sci_idx; + ss_data *new_table; +@@ -115,8 +113,7 @@ int ss_create_invocation(subsystem_name, version_string, info_ptr, + } + + void +-ss_delete_invocation(sci_idx) +- int sci_idx; ++ss_delete_invocation(int sci_idx) + { + ss_data *t; + int ignored_code; +diff --git a/src/util/ss/list_rqs.c b/src/util/ss/list_rqs.c +index c0882bf908..8376e21be8 100644 +--- a/src/util/ss/list_rqs.c ++++ b/src/util/ss/list_rqs.c +@@ -21,15 +21,8 @@ static char const twentyfive_spaces[26] = + static char const NL[2] = "\n"; + + void +-ss_list_requests(argc, argv, sci_idx, info_ptr) +- int argc; +- const char * const *argv; +- int sci_idx; +-#ifdef __STDC__ +- void *info_ptr; +-#else +- char *info_ptr; +-#endif ++ss_list_requests(int argc, const char * const *argv, int sci_idx, ++ void *info_ptr) + { + ss_request_entry *entry; + char const *const *name; +diff --git a/src/util/ss/listen.c b/src/util/ss/listen.c +index fe18475447..79f258fbc4 100644 +--- a/src/util/ss/listen.c ++++ b/src/util/ss/listen.c +@@ -28,7 +28,8 @@ static jmp_buf listen_jmpb; + + #ifdef NO_READLINE + /* Dumb replacement for readline when we don't have support for a real one. */ +-static char *readline(const char *prompt) ++static char * ++readline(const char *prompt) + { + struct termios termbuf; + char input[BUFSIZ]; +@@ -49,20 +50,21 @@ static char *readline(const char *prompt) + } + + /* No-op replacement for add_history() when we have no readline support. */ +-static void add_history(const char *line) ++static void ++add_history(const char *line) + { + } + #endif + +-static void listen_int_handler(signo) +- int signo; ++static void ++listen_int_handler(int signo) + { + putc('\n', stdout); + longjmp(listen_jmpb, 1); + } + +-int ss_listen (sci_idx) +- int sci_idx; ++int ++ss_listen(int sci_idx) + { + char *cp; + ss_data *info; +@@ -83,12 +85,12 @@ int ss_listen (sci_idx) + info->abort = 0; + + #ifdef POSIX_SIGNALS +- csig.sa_handler = (void (*)())0; ++ csig.sa_handler = (void (*)(int))0; + sigemptyset(&nmask); + sigaddset(&nmask, SIGINT); + sigprocmask(SIG_BLOCK, &nmask, &omask); + #else +- sig_cont = (void (*)())0; ++ sig_cont = (void (*)(int))0; + mask = sigblock(sigmask(SIGINT)); + #endif + +@@ -115,7 +117,7 @@ int ss_listen (sci_idx) + nsig.sa_handler = listen_int_handler; /* fgets is not signal-safe */ + osig = csig; + sigaction(SIGCONT, &nsig, &csig); +- if ((void (*)())csig.sa_handler==(void (*)())listen_int_handler) ++ if ((void (*)(int))csig.sa_handler==(void (*)(int))listen_int_handler) + csig = osig; + #else + old_sig_cont = sig_cont; +@@ -166,20 +168,16 @@ egress: + return code; + } + +-void ss_abort_subsystem(sci_idx, code) +- int sci_idx; +- int code; ++void ++ss_abort_subsystem(int sci_idx, int code) + { + ss_info(sci_idx)->abort = 1; + ss_info(sci_idx)->exit_status = code; + + } + +-void ss_quit(argc, argv, sci_idx, infop) +- int argc; +- char const * const *argv; +- int sci_idx; +- pointer infop; ++void ++ss_quit(int argc, char const * const *argv, int sci_idx, pointer infop) + { + ss_abort_subsystem(sci_idx, 0); + } +diff --git a/src/util/ss/pager.c b/src/util/ss/pager.c +index 3e47ed3993..255c721ad1 100644 +--- a/src/util/ss/pager.c ++++ b/src/util/ss/pager.c +@@ -10,13 +10,13 @@ + #include "copyright.h" + #include + #include ++#include + #include + #include + #include + + static char MORE[] = "more"; + extern char *_ss_pager_name; +-extern char *getenv(); + + /* + * this needs a *lot* of work.... +@@ -25,10 +25,10 @@ extern char *getenv(); + * handle SIGINT sensibly + * allow finer control -- put-page-break-here + */ +-void ss_page_stdin(); ++void ss_page_stdin(void); + + #ifndef NO_FORK +-int ss_pager_create() ++int ss_pager_create(void) + { + int filedes[2]; + +@@ -56,7 +56,7 @@ int ss_pager_create() + } + } + #else /* don't fork */ +-int ss_pager_create() ++int ss_pager_create(void) + { + int fd; + fd = open("/dev/tty", O_WRONLY, 0); +@@ -66,7 +66,7 @@ int ss_pager_create() + } + #endif + +-void ss_page_stdin() ++void ss_page_stdin(void) + { + int i; + #ifdef POSIX_SIGNALS +diff --git a/src/util/ss/parse.c b/src/util/ss/parse.c +index 78a831bf36..6fb031cdcd 100644 +--- a/src/util/ss/parse.c ++++ b/src/util/ss/parse.c +@@ -53,10 +53,8 @@ enum parse_mode { WHITESPACE, TOKEN, QUOTED_STRING }; + #define NEW_ARGV(old,n) (char **)realloc((char *)old, \ + (unsigned)(n+2)*sizeof(char*)) + +-char **ss_parse (sci_idx, line_ptr, argc_ptr) +- int sci_idx; +- char *line_ptr; +- int *argc_ptr; ++char ** ++ss_parse(int sci_idx, char *line_ptr, int *argc_ptr) + { + char **argv, *cp; + char **newargv; +diff --git a/src/util/ss/prompt.c b/src/util/ss/prompt.c +index 5aa2ad6140..48e57d6702 100644 +--- a/src/util/ss/prompt.c ++++ b/src/util/ss/prompt.c +@@ -11,16 +11,13 @@ + #include "ss_internal.h" + + void +-ss_set_prompt(sci_idx, new_prompt) +- int sci_idx; +- char *new_prompt; ++ss_set_prompt(int sci_idx, char *new_prompt) + { + ss_info(sci_idx)->prompt = new_prompt; + } + + char * +-ss_get_prompt(sci_idx) +- int sci_idx; ++ss_get_prompt(int sci_idx) + { + return(ss_info(sci_idx)->prompt); + } +diff --git a/src/util/ss/request_tbl.c b/src/util/ss/request_tbl.c +index 03cde1b7d0..fc4461bb00 100644 +--- a/src/util/ss/request_tbl.c ++++ b/src/util/ss/request_tbl.c +@@ -11,11 +11,7 @@ + #define ssrt ss_request_table /* for some readable code... */ + + void +-ss_add_request_table(sci_idx, rqtbl_ptr, position, code_ptr) +- int sci_idx; +- ssrt *rqtbl_ptr; +- int position; /* 1 -> becomes second... */ +- int *code_ptr; ++ss_add_request_table(int sci_idx, ssrt *rqtbl_ptr, int position, int *code_ptr) + { + ss_data *info; + int i, size; +@@ -44,10 +40,7 @@ ss_add_request_table(sci_idx, rqtbl_ptr, position, code_ptr) + } + + void +-ss_delete_request_table(sci_idx, rqtbl_ptr, code_ptr) +- int sci_idx; +- ssrt *rqtbl_ptr; +- int *code_ptr; ++ss_delete_request_table(int sci_idx, ssrt *rqtbl_ptr, int *code_ptr) + { + ss_data *info; + ssrt **rt1, **rt2; +diff --git a/src/util/ss/requests.c b/src/util/ss/requests.c +index aa6752fa11..651f2201d2 100644 +--- a/src/util/ss/requests.c ++++ b/src/util/ss/requests.c +@@ -9,7 +9,7 @@ + #include + #include "ss_internal.h" + +-#define DECLARE(name) void name(argc,argv,sci_idx,info_ptr)int argc,sci_idx;const char * const *argv; pointer info_ptr; ++#define DECLARE(name) void name(int argc, const char *const *argv, int sci_idx, pointer info_ptr) + + /* + * ss_self_identify -- assigned by default to the "." request +diff --git a/src/util/ss/ss.h b/src/util/ss/ss.h +index 38d8974e3c..faac0d97c1 100644 +--- a/src/util/ss/ss.h ++++ b/src/util/ss/ss.h +@@ -48,7 +48,6 @@ typedef struct _ss_rp_options { /* DEFAULT VALUES */ + void ss_help __SS_PROTO; + void ss_list_requests __SS_PROTO; + void ss_quit __SS_PROTO; +-char *ss_current_request(); + char *ss_name(int); + void ss_error (int, long, char const *, ...) + #if !defined(__cplusplus) && (__GNUC__ > 2) +diff --git a/src/util/ss/ss_internal.h b/src/util/ss/ss_internal.h +index 1f5ddfff91..cdd88af218 100644 +--- a/src/util/ss/ss_internal.h ++++ b/src/util/ss/ss_internal.h +@@ -84,8 +84,7 @@ typedef struct _ss_data { /* init values */ + #define ss_info(sci_idx) (_ss_table[sci_idx]) + #define ss_current_request(sci_idx,code_ptr) \ + (*code_ptr=0,ss_info(sci_idx)->current_request) +-void ss_unknown_function(); +-void ss_delete_info_dir(); ++void ss_delete_info_dir(int, char *, int *); + char **ss_parse (int, char *, int *); + ss_abbrev_info *ss_abbrev_initialize (char *, int *); + void ss_page_stdin (void); +diff --git a/src/util/support/plugins.c b/src/util/support/plugins.c +index 0850565687..253b118dcb 100644 +--- a/src/util/support/plugins.c ++++ b/src/util/support/plugins.c +@@ -240,13 +240,13 @@ krb5int_get_plugin_data(struct plugin_file_handle *h, const char *csymname, + + long KRB5_CALLCONV + krb5int_get_plugin_func(struct plugin_file_handle *h, const char *csymname, +- void (**sym_out)(), struct errinfo *ep) ++ void (**sym_out)(void), struct errinfo *ep) + { + void *dptr = NULL; + long ret = get_sym(h, csymname, &dptr, ep); + + if (!ret) +- *sym_out = (void (*)())dptr; ++ *sym_out = (void (*)(void))dptr; + return ret; + } + +@@ -552,7 +552,7 @@ krb5int_get_plugin_dir_func (struct plugin_dir_handle *dirhandle, + struct errinfo *ep) + { + long err = 0; +- void (**p)() = NULL; ++ void (**p)(void) = NULL; + size_t count = 0; + + /* XXX Do we need to add a leading "_" to the symbol name on any +@@ -569,10 +569,10 @@ krb5int_get_plugin_dir_func (struct plugin_dir_handle *dirhandle, + int i = 0; + + for (i = 0; !err && (dirhandle->files[i] != NULL); i++) { +- void (*sym)() = NULL; ++ void (*sym)(void) = NULL; + + if (krb5int_get_plugin_func (dirhandle->files[i], symname, &sym, ep) == 0) { +- void (**newp)() = NULL; ++ void (**newp)(void) = NULL; + + count++; + newp = realloc (p, ((count + 1) * sizeof (*p))); /* +1 for NULL */ +diff --git a/src/util/support/t_hashtab.c b/src/util/support/t_hashtab.c +index f51abc4f19..d90d5d9d02 100644 +--- a/src/util/support/t_hashtab.c ++++ b/src/util/support/t_hashtab.c +@@ -104,7 +104,7 @@ const uint64_t vectors[64] = { + }; + + static void +-test_siphash() ++test_siphash(void) + { + uint8_t seq[64]; + uint64_t k0, k1, hval; +@@ -122,7 +122,7 @@ test_siphash() + } + + static void +-test_hashtab() ++test_hashtab(void) + { + int st; + struct k5_hashtab *ht; +@@ -168,7 +168,7 @@ test_hashtab() + } + + int +-main() ++main(void) + { + test_siphash(); + test_hashtab(); +diff --git a/src/util/support/t_hex.c b/src/util/support/t_hex.c +index a586a1bc89..40e6aa2327 100644 +--- a/src/util/support/t_hex.c ++++ b/src/util/support/t_hex.c +@@ -137,7 +137,8 @@ struct { + { "F8F9FAFBFCFDFEFF", "\xF8\xF9\xFA\xFB\xFC\xFD\xFE\xFF", 8, 1 }, + }; + +-int main() ++int ++main(void) + { + size_t i; + char *hex; +diff --git a/src/util/support/t_json.c b/src/util/support/t_json.c +index 1f229247b4..bacca6f8da 100644 +--- a/src/util/support/t_json.c ++++ b/src/util/support/t_json.c +@@ -86,7 +86,7 @@ check(int pred, const char *str) + } + + static void +-test_array() ++test_array(void) + { + k5_json_string v1; + k5_json_number v2; +diff --git a/src/util/support/t_k5buf.c b/src/util/support/t_k5buf.c +index 734b2720c0..18e7e9b7be 100644 +--- a/src/util/support/t_k5buf.c ++++ b/src/util/support/t_k5buf.c +@@ -54,7 +54,7 @@ check_buf(struct k5buf *buf, const char *name) + } + + static void +-test_basic() ++test_basic(void) + { + struct k5buf buf; + char storage[1024]; +@@ -76,7 +76,7 @@ test_basic() + } + + static void +-test_realloc() ++test_realloc(void) + { + struct k5buf buf; + char data[1024]; +@@ -132,7 +132,7 @@ test_realloc() + } + + static void +-test_overflow() ++test_overflow(void) + { + struct k5buf buf; + char storage[10]; +@@ -153,7 +153,7 @@ test_overflow() + } + + static void +-test_error() ++test_error(void) + { + struct k5buf buf; + char storage[1]; +@@ -173,7 +173,7 @@ test_error() + } + + static void +-test_truncate() ++test_truncate(void) + { + struct k5buf buf; + +@@ -188,7 +188,7 @@ test_truncate() + } + + static void +-test_binary() ++test_binary(void) + { + struct k5buf buf; + char data[] = { 'a', 0, 'b' }, *s; +@@ -205,7 +205,7 @@ test_binary() + } + + static void +-test_fmt() ++test_fmt(void) + { + struct k5buf buf; + char storage[10], data[1024]; +@@ -246,7 +246,7 @@ test_fmt() + } + + int +-main() ++main(void) + { + test_basic(); + test_realloc(); +diff --git a/src/util/support/t_unal.c b/src/util/support/t_unal.c +index f67cd31edf..6d097f0f83 100644 +--- a/src/util/support/t_unal.c ++++ b/src/util/support/t_unal.c +@@ -2,7 +2,8 @@ + #undef NDEBUG + #include "k5-platform.h" + +-int main () ++int ++main(void) + { + /* Test some low-level assumptions the Kerberos code depends + on. */ +-- +2.45.1 + diff --git a/0017-Fix-two-unlikely-memory-leaks.patch b/0017-Fix-two-unlikely-memory-leaks.patch new file mode 100644 index 0000000..09fedb7 --- /dev/null +++ b/0017-Fix-two-unlikely-memory-leaks.patch @@ -0,0 +1,206 @@ +From ee66c1feedb57ce06ce51aaa823f9a61f564c58e Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Tue, 5 Mar 2024 19:53:07 -0500 +Subject: [PATCH] Fix two unlikely memory leaks + +In gss_krb5int_make_seal_token_v3(), one of the bounds checks (which +could probably never be triggered) leaks plain.data. Fix this leak +and use current practices for cleanup throughout the function. + +In xmt_rmtcallres() (unused within the tree and likely elsewhere), +store port_ptr into crp->port_ptr as soon as it is allocated; +otherwise it could leak if the subsequent xdr_u_int32() operation +fails. + +(cherry picked from commit c5f9c816107f70139de11b38aa02db2f1774ee0d) +--- + src/lib/gssapi/krb5/k5sealv3.c | 56 +++++++++++++++------------------- + src/lib/rpc/pmap_rmt.c | 10 +++--- + 2 files changed, 29 insertions(+), 37 deletions(-) + +diff --git a/src/lib/gssapi/krb5/k5sealv3.c b/src/lib/gssapi/krb5/k5sealv3.c +index 1fcbdfbb87..d3210c1107 100644 +--- a/src/lib/gssapi/krb5/k5sealv3.c ++++ b/src/lib/gssapi/krb5/k5sealv3.c +@@ -65,7 +65,7 @@ gss_krb5int_make_seal_token_v3 (krb5_context context, + int conf_req_flag, int toktype) + { + size_t bufsize = 16; +- unsigned char *outbuf = 0; ++ unsigned char *outbuf = NULL; + krb5_error_code err; + int key_usage; + unsigned char acceptor_flag; +@@ -75,9 +75,13 @@ gss_krb5int_make_seal_token_v3 (krb5_context context, + #endif + size_t ec; + unsigned short tok_id; +- krb5_checksum sum; ++ krb5_checksum sum = { 0 }; + krb5_key key; + krb5_cksumtype cksumtype; ++ krb5_data plain = empty_data(); ++ ++ token->value = NULL; ++ token->length = 0; + + acceptor_flag = ctx->initiate ? 0 : FLAG_SENDER_IS_ACCEPTOR; + key_usage = (toktype == KG_TOK_WRAP_MSG +@@ -107,14 +111,15 @@ gss_krb5int_make_seal_token_v3 (krb5_context context, + #endif + + if (toktype == KG_TOK_WRAP_MSG && conf_req_flag) { +- krb5_data plain; + krb5_enc_data cipher; + size_t ec_max; + size_t encrypt_size; + + /* 300: Adds some slop. */ +- if (SIZE_MAX - 300 < message->length) +- return ENOMEM; ++ if (SIZE_MAX - 300 < message->length) { ++ err = ENOMEM; ++ goto cleanup; ++ } + ec_max = SIZE_MAX - message->length - 300; + if (ec_max > 0xffff) + ec_max = 0xffff; +@@ -126,20 +131,20 @@ gss_krb5int_make_seal_token_v3 (krb5_context context, + #endif + err = alloc_data(&plain, message->length + 16 + ec); + if (err) +- return err; ++ goto cleanup; + + /* Get size of ciphertext. */ + encrypt_size = krb5_encrypt_size(plain.length, key->keyblock.enctype); + if (encrypt_size > SIZE_MAX / 2) { + err = ENOMEM; +- goto error; ++ goto cleanup; + } + bufsize = 16 + encrypt_size; + /* Allocate space for header plus encrypted data. */ + outbuf = gssalloc_malloc(bufsize); + if (outbuf == NULL) { +- free(plain.data); +- return ENOMEM; ++ err = ENOMEM; ++ goto cleanup; + } + + /* TOK_ID */ +@@ -164,11 +169,8 @@ gss_krb5int_make_seal_token_v3 (krb5_context context, + cipher.ciphertext.length = bufsize - 16; + cipher.enctype = key->keyblock.enctype; + err = krb5_k_encrypt(context, key, key_usage, 0, &plain, &cipher); +- zap(plain.data, plain.length); +- free(plain.data); +- plain.data = 0; + if (err) +- goto error; ++ goto cleanup; + + /* Now that we know we're returning a valid token.... */ + ctx->seq_send++; +@@ -181,7 +183,6 @@ gss_krb5int_make_seal_token_v3 (krb5_context context, + /* If the rotate fails, don't worry about it. */ + #endif + } else if (toktype == KG_TOK_WRAP_MSG && !conf_req_flag) { +- krb5_data plain; + size_t cksumsize; + + /* Here, message is the application-supplied data; message2 is +@@ -193,21 +194,19 @@ gss_krb5int_make_seal_token_v3 (krb5_context context, + wrap_with_checksum: + err = alloc_data(&plain, message->length + 16); + if (err) +- return err; ++ goto cleanup; + + err = krb5_c_checksum_length(context, cksumtype, &cksumsize); + if (err) +- goto error; ++ goto cleanup; + + assert(cksumsize <= 0xffff); + + bufsize = 16 + message2->length + cksumsize; + outbuf = gssalloc_malloc(bufsize); + if (outbuf == NULL) { +- free(plain.data); +- plain.data = 0; + err = ENOMEM; +- goto error; ++ goto cleanup; + } + + /* TOK_ID */ +@@ -239,23 +238,15 @@ gss_krb5int_make_seal_token_v3 (krb5_context context, + if (message2->length) + memcpy(outbuf + 16, message2->value, message2->length); + +- sum.contents = outbuf + 16 + message2->length; +- sum.length = cksumsize; +- + err = krb5_k_make_checksum(context, cksumtype, key, + key_usage, &plain, &sum); +- zap(plain.data, plain.length); +- free(plain.data); +- plain.data = 0; + if (err) { + zap(outbuf,bufsize); +- goto error; ++ goto cleanup; + } + if (sum.length != cksumsize) + abort(); + memcpy(outbuf + 16 + message2->length, sum.contents, cksumsize); +- krb5_free_checksum_contents(context, &sum); +- sum.contents = 0; + /* Now that we know we're actually generating the token... */ + ctx->seq_send++; + +@@ -285,12 +276,13 @@ gss_krb5int_make_seal_token_v3 (krb5_context context, + + token->value = outbuf; + token->length = bufsize; +- return 0; ++ outbuf = NULL; ++ err = 0; + +-error: ++cleanup: ++ krb5_free_checksum_contents(context, &sum); ++ zapfree(plain.data, plain.length); + gssalloc_free(outbuf); +- token->value = NULL; +- token->length = 0; + return err; + } + +diff --git a/src/lib/rpc/pmap_rmt.c b/src/lib/rpc/pmap_rmt.c +index 434e4eea65..f55ca46c60 100644 +--- a/src/lib/rpc/pmap_rmt.c ++++ b/src/lib/rpc/pmap_rmt.c +@@ -161,12 +161,12 @@ xdr_rmtcallres( + caddr_t port_ptr; + + port_ptr = (caddr_t)(void *)crp->port_ptr; +- if (xdr_reference(xdrs, &port_ptr, sizeof (uint32_t), +- (xdrproc_t)xdr_u_int32) && +- xdr_u_int32(xdrs, &crp->resultslen)) { +- crp->port_ptr = (uint32_t *)(void *)port_ptr; ++ if (!xdr_reference(xdrs, &port_ptr, sizeof (uint32_t), ++ (xdrproc_t)xdr_u_int32)) ++ return (FALSE); ++ crp->port_ptr = (uint32_t *)(void *)port_ptr; ++ if (xdr_u_int32(xdrs, &crp->resultslen)) + return ((*(crp->xdr_results))(xdrs, crp->results_ptr)); +- } + return (FALSE); + } + +-- +2.45.1 + diff --git a/0016-Fix-unimportant-memory-leaks.patch b/0018-Fix-unimportant-memory-leaks.patch similarity index 90% rename from 0016-Fix-unimportant-memory-leaks.patch rename to 0018-Fix-unimportant-memory-leaks.patch index 3406316..0697f06 100644 --- a/0016-Fix-unimportant-memory-leaks.patch +++ b/0018-Fix-unimportant-memory-leaks.patch @@ -1,4 +1,4 @@ -From f0414954d79283075d1f627dbb9fe6e4f43c1aae Mon Sep 17 00:00:00 2001 +From c8d8cab52172a934bdad1041448b43bc15acf441 Mon Sep 17 00:00:00 2001 From: Steve Grubb Date: Thu, 13 Jul 2023 16:22:30 -0400 Subject: [PATCH] Fix unimportant memory leaks @@ -16,10 +16,10 @@ some unused ksu functions; rewrote commit message] src/appl/gss-sample/gss-client.c | 367 ++++++++---------- src/appl/gss-sample/gss-server.c | 3 +- src/clients/klist/klist.c | 59 +-- - src/clients/ksu/authorization.c | 140 +++---- - src/clients/ksu/ccache.c | 289 +++++--------- + src/clients/ksu/authorization.c | 134 +++---- + src/clients/ksu/ccache.c | 283 +++++--------- src/clients/ksu/heuristic.c | 128 +++--- - src/clients/ksu/krb_auth_su.c | 137 ++----- + src/clients/ksu/krb_auth_su.c | 134 ++----- src/clients/ksu/ksu.h | 6 - src/clients/ksu/main.c | 3 +- src/kadmin/cli/keytab.c | 6 +- @@ -32,10 +32,10 @@ some unused ksu functions; rewrote commit message] src/lib/krb5/ccache/ccfns.c | 12 +- src/lib/krb5/keytab/kt_file.c | 3 +- src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c | 8 +- - 19 files changed, 520 insertions(+), 684 deletions(-) + 19 files changed, 517 insertions(+), 672 deletions(-) diff --git a/src/appl/gss-sample/gss-client.c b/src/appl/gss-sample/gss-client.c -index 6e2aa33690..cf94623d63 100644 +index 0722ae196f..2cfcfc6cc5 100644 --- a/src/appl/gss-sample/gss-client.c +++ b/src/appl/gss-sample/gss-client.c @@ -182,180 +182,148 @@ client_establish_context(int s, char *service_name, OM_uint32 gss_flags, @@ -345,7 +345,7 @@ index 6e2aa33690..cf94623d63 100644 } static void -@@ -449,11 +417,11 @@ call_server(host, port, oid, service_name, gss_flags, auth_flag, +@@ -436,11 +404,11 @@ call_server(char *host, u_short port, gss_OID oid, char *service_name, { gss_ctx_id_t context = GSS_C_NO_CONTEXT; gss_buffer_desc in_buf, out_buf; @@ -360,7 +360,7 @@ index 6e2aa33690..cf94623d63 100644 OM_uint32 lifetime; gss_OID mechanism, name_type; int is_local; -@@ -467,14 +435,13 @@ call_server(host, port, oid, service_name, gss_flags, auth_flag, +@@ -454,14 +422,13 @@ call_server(char *host, u_short port, gss_OID oid, char *service_name, /* Open connection */ if ((s = connect_to_server(host, port)) < 0) @@ -377,7 +377,7 @@ index 6e2aa33690..cf94623d63 100644 } if (auth_flag && verbose) { -@@ -488,19 +455,19 @@ call_server(host, port, oid, service_name, gss_flags, auth_flag, +@@ -475,19 +442,19 @@ call_server(char *host, u_short port, gss_OID oid, char *service_name, &is_local, &is_open); if (maj_stat != GSS_S_COMPLETE) { display_status("inquiring context", maj_stat, min_stat); @@ -400,7 +400,7 @@ index 6e2aa33690..cf94623d63 100644 } printf("\"%.*s\" to \"%.*s\", lifetime %d, flags %x, %s, %s\n", (int) sname.length, (char *) sname.value, -@@ -509,15 +476,10 @@ call_server(host, port, oid, service_name, gss_flags, auth_flag, +@@ -496,15 +463,10 @@ call_server(char *host, u_short port, gss_OID oid, char *service_name, (is_local) ? "locally initiated" : "remotely initiated", (is_open) ? "open" : "closed"); @@ -417,7 +417,7 @@ index 6e2aa33690..cf94623d63 100644 } printf("Name type of source name is %.*s.\n", (int) oid_name.length, (char *) oid_name.value); -@@ -528,13 +490,13 @@ call_server(host, port, oid, service_name, gss_flags, auth_flag, +@@ -515,13 +477,13 @@ call_server(char *host, u_short port, gss_OID oid, char *service_name, mechanism, &mech_names); if (maj_stat != GSS_S_COMPLETE) { display_status("inquiring mech names", maj_stat, min_stat); @@ -433,7 +433,7 @@ index 6e2aa33690..cf94623d63 100644 } printf("Mechanism %.*s supports %d names\n", (int) oid_name.length, (char *) oid_name.value, -@@ -546,7 +508,7 @@ call_server(host, port, oid, service_name, gss_flags, auth_flag, +@@ -533,7 +495,7 @@ call_server(char *host, u_short port, gss_OID oid, char *service_name, &mech_names->elements[i], &oid_name); if (maj_stat != GSS_S_COMPLETE) { display_status("converting oid->string", maj_stat, min_stat); @@ -442,7 +442,7 @@ index 6e2aa33690..cf94623d63 100644 } printf(" %d: %.*s\n", (int) i, (int) oid_name.length, (char *) oid_name.value); -@@ -571,10 +533,7 @@ call_server(host, port, oid, service_name, gss_flags, auth_flag, +@@ -558,10 +520,7 @@ call_server(char *host, u_short port, gss_OID oid, char *service_name, &in_buf, &state, &out_buf); if (maj_stat != GSS_S_COMPLETE) { display_status("wrapping message", maj_stat, min_stat); @@ -454,7 +454,7 @@ index 6e2aa33690..cf94623d63 100644 } else if (encrypt_flag && !state) { fprintf(stderr, "Warning! Message not encrypted.\n"); } -@@ -588,22 +547,15 @@ call_server(host, port, oid, service_name, gss_flags, auth_flag, +@@ -575,22 +534,15 @@ call_server(char *host, u_short port, gss_OID oid, char *service_name, (wrap_flag ? TOKEN_WRAPPED : 0) | (encrypt_flag ? TOKEN_ENCRYPTED : 0) | (mic_flag ? TOKEN_SEND_MIC : 0))), @@ -482,7 +482,7 @@ index 6e2aa33690..cf94623d63 100644 if (mic_flag) { /* Verify signature block */ -@@ -611,10 +563,7 @@ call_server(host, port, oid, service_name, gss_flags, auth_flag, +@@ -598,10 +550,7 @@ call_server(char *host, u_short port, gss_OID oid, char *service_name, &out_buf, &qop_state); if (maj_stat != GSS_S_COMPLETE) { display_status("verifying signature", maj_stat, min_stat); @@ -494,7 +494,7 @@ index 6e2aa33690..cf94623d63 100644 } if (verbose) -@@ -634,23 +583,17 @@ call_server(host, port, oid, service_name, gss_flags, auth_flag, +@@ -621,23 +570,17 @@ call_server(char *host, u_short port, gss_OID oid, char *service_name, if (!v1_format) (void) send_token(s, TOKEN_NOOP, empty_token); @@ -529,7 +529,7 @@ index 6e2aa33690..cf94623d63 100644 static void diff --git a/src/appl/gss-sample/gss-server.c b/src/appl/gss-sample/gss-server.c -index 9b6ce9ffb3..ce25df8b40 100644 +index 0e9c857e56..4ba864d9fb 100644 --- a/src/appl/gss-sample/gss-server.c +++ b/src/appl/gss-sample/gss-server.c @@ -138,13 +138,12 @@ server_acquire_creds(char *service_name, gss_OID mech, @@ -548,7 +548,7 @@ index 9b6ce9ffb3..ce25df8b40 100644 } diff --git a/src/clients/klist/klist.c b/src/clients/klist/klist.c -index dcdc5a2d59..43392d2337 100644 +index c797b1698f..b5ae96a843 100644 --- a/src/clients/klist/klist.c +++ b/src/clients/klist/klist.c @@ -469,20 +469,21 @@ do_ccache() @@ -667,7 +667,7 @@ index dcdc5a2d59..43392d2337 100644 * current. Otherwise accept any current cred. */ if (found_tgt) diff --git a/src/clients/ksu/authorization.c b/src/clients/ksu/authorization.c -index fb9d5d0942..6c6a2d007e 100644 +index 17a8a8f2f0..1f2650c2ab 100644 --- a/src/clients/ksu/authorization.c +++ b/src/clients/ksu/authorization.c @@ -28,7 +28,17 @@ @@ -687,9 +687,9 @@ index fb9d5d0942..6c6a2d007e 100644 + free(list); +} - krb5_boolean fowner(fp, uid) - FILE *fp; -@@ -53,10 +63,10 @@ krb5_boolean fowner(fp, uid) + krb5_boolean + fowner(FILE *fp, uid_t uid) +@@ -52,10 +62,10 @@ fowner(FILE *fp, uid_t uid) /* * Given a Kerberos principal "principal", and a local username "luser", @@ -703,9 +703,9 @@ index fb9d5d0942..6c6a2d007e 100644 + * (regardless of its result), non-zero if it encountered an error. */ - krb5_error_code krb5_authorization(context, principal, luser, -@@ -71,7 +81,7 @@ krb5_error_code krb5_authorization(context, principal, luser, - char **out_fcmd; + krb5_error_code +@@ -64,7 +74,7 @@ krb5_authorization(krb5_context context, krb5_principal principal, + char **out_fcmd) { struct passwd *pwd; - char *princname; @@ -713,7 +713,7 @@ index fb9d5d0942..6c6a2d007e 100644 int k5login_flag =0; int k5users_flag =0; krb5_boolean retbool =FALSE; -@@ -83,7 +93,7 @@ krb5_error_code krb5_authorization(context, principal, luser, +@@ -76,7 +86,7 @@ krb5_authorization(krb5_context context, krb5_principal principal, /* no account => no access */ if ((pwd = getpwnam(luser)) == NULL) @@ -722,7 +722,7 @@ index fb9d5d0942..6c6a2d007e 100644 retval = krb5_unparse_name(context, principal, &princname); if (retval) -@@ -100,22 +110,19 @@ krb5_error_code krb5_authorization(context, principal, luser, +@@ -93,22 +103,19 @@ krb5_authorization(krb5_context context, krb5_principal principal, /* k5login and k5users must be owned by target user or root */ if (!k5login_flag){ @@ -755,7 +755,7 @@ index fb9d5d0942..6c6a2d007e 100644 } if (auth_debug){ -@@ -134,10 +141,8 @@ krb5_error_code krb5_authorization(context, principal, luser, +@@ -127,10 +134,8 @@ krb5_authorization(krb5_context context, krb5_principal principal, princname); retval = k5login_lookup(login_fp, princname, &retbool); @@ -768,7 +768,7 @@ index fb9d5d0942..6c6a2d007e 100644 if (retbool) { if (cmd) *out_fcmd = xstrdup(cmd); -@@ -147,10 +152,8 @@ krb5_error_code krb5_authorization(context, principal, luser, +@@ -140,10 +145,8 @@ krb5_authorization(krb5_context context, krb5_principal principal, if ((!k5users_flag) && (retbool == FALSE) ){ retval = k5users_lookup (users_fp, princname, cmd, &retbool, out_fcmd); @@ -781,7 +781,7 @@ index fb9d5d0942..6c6a2d007e 100644 } if (k5login_flag && k5users_flag){ -@@ -166,8 +169,14 @@ krb5_error_code krb5_authorization(context, principal, luser, +@@ -159,8 +162,14 @@ krb5_authorization(krb5_context context, krb5_principal principal, } *ok =retbool; @@ -798,8 +798,8 @@ index fb9d5d0942..6c6a2d007e 100644 } /*********************************************************** -@@ -334,10 +343,11 @@ krb5_boolean fcmd_resolve(fcmd, out_fcmd, out_err) - char **out_err; +@@ -320,10 +329,11 @@ krb5_boolean + fcmd_resolve(char *fcmd, char ***out_fcmd, char **out_err) { char * err; - char ** tmp_fcmd; @@ -811,7 +811,7 @@ index fb9d5d0942..6c6a2d007e 100644 tmp_fcmd = (char **) xcalloc (MAX_CMD, sizeof(char *)); -@@ -345,7 +355,7 @@ krb5_boolean fcmd_resolve(fcmd, out_fcmd, out_err) +@@ -331,7 +341,7 @@ fcmd_resolve(char *fcmd, char ***out_fcmd, char **out_err) tmp_fcmd[0] = xstrdup(fcmd); tmp_fcmd[1] = NULL; *out_fcmd = tmp_fcmd; @@ -820,7 +820,7 @@ index fb9d5d0942..6c6a2d007e 100644 }else{ /* must be either full path or just the cmd name */ if (strchr(fcmd, '/')){ -@@ -353,7 +363,7 @@ krb5_boolean fcmd_resolve(fcmd, out_fcmd, out_err) +@@ -339,7 +349,7 @@ fcmd_resolve(char *fcmd, char ***out_fcmd, char **out_err) "either full path or just the cmd name\n"), fcmd, KRB5_USERS_NAME); *out_err = err; @@ -829,7 +829,7 @@ index fb9d5d0942..6c6a2d007e 100644 } #ifndef CMD_PATH -@@ -361,7 +371,7 @@ krb5_boolean fcmd_resolve(fcmd, out_fcmd, out_err) +@@ -347,7 +357,7 @@ fcmd_resolve(char *fcmd, char ***out_fcmd, char **out_err) "the cmd name, CMD_PATH must be defined \n"), fcmd, KRB5_USERS_NAME, fcmd); *out_err = err; @@ -838,7 +838,7 @@ index fb9d5d0942..6c6a2d007e 100644 #else path = xstrdup (CMD_PATH); -@@ -375,7 +385,7 @@ krb5_boolean fcmd_resolve(fcmd, out_fcmd, out_err) +@@ -361,7 +371,7 @@ fcmd_resolve(char *fcmd, char ***out_fcmd, char **out_err) asprintf(&err, _("Error: bad entry - %s in %s file, CMD_PATH " "contains no paths \n"), fcmd, KRB5_USERS_NAME); *out_err = err; @@ -847,7 +847,7 @@ index fb9d5d0942..6c6a2d007e 100644 } i=0; -@@ -384,7 +394,7 @@ krb5_boolean fcmd_resolve(fcmd, out_fcmd, out_err) +@@ -370,7 +380,7 @@ fcmd_resolve(char *fcmd, char ***out_fcmd, char **out_err) asprintf(&err, _("Error: bad path %s in CMD_PATH for %s must " "start with '/' \n"), tc, KRB5_USERS_NAME ); *out_err = err; @@ -856,7 +856,7 @@ index fb9d5d0942..6c6a2d007e 100644 } tmp_fcmd[i] = xasprintf("%s/%s", tc, fcmd); -@@ -395,10 +405,15 @@ krb5_boolean fcmd_resolve(fcmd, out_fcmd, out_err) +@@ -381,10 +391,15 @@ fcmd_resolve(char *fcmd, char ***out_fcmd, char **out_err) tmp_fcmd[i] = NULL; *out_fcmd = tmp_fcmd; @@ -874,9 +874,9 @@ index fb9d5d0942..6c6a2d007e 100644 } /******************************************** -@@ -524,41 +539,42 @@ int match_commands (fcmd, cmd, match, cmd_out, err_out) - char **cmd_out; - char **err_out; +@@ -503,41 +518,42 @@ int + match_commands(char *fcmd, char *cmd, krb5_boolean *match, + char **cmd_out, char **err_out) { - char ** fcmd_arr; + char ** fcmd_arr = NULL; @@ -930,7 +930,7 @@ index fb9d5d0942..6c6a2d007e 100644 } /********************************************************* -@@ -587,10 +603,7 @@ krb5_error_code get_line (fp, out_line) +@@ -563,10 +579,7 @@ get_line(FILE *fp, char **out_line) } else { chunk_count ++; @@ -942,14 +942,12 @@ index fb9d5d0942..6c6a2d007e 100644 line_ptr = line + (BUFSIZ -1) *( chunk_count -1) ; } -@@ -677,21 +690,8 @@ char * get_next_token (lnext) +@@ -652,17 +665,6 @@ get_next_token (char **lnext) return out_ptr; } --static void auth_cleanup(users_fp, login_fp, princname) -- FILE *users_fp; -- FILE *login_fp; -- char *princname; +-static void +-auth_cleanup(FILE *users_fp, FILE *login_fp, char *princname) -{ - - free (princname); @@ -959,22 +957,17 @@ index fb9d5d0942..6c6a2d007e 100644 - fclose(login_fp); -} - --void init_auth_names(pw_dir) -- char *pw_dir; -+void -+init_auth_names(char *pw_dir) + void + init_auth_names(char *pw_dir) { - const char *sep; - int r1, r2; diff --git a/src/clients/ksu/ccache.c b/src/clients/ksu/ccache.c -index cbb9aa2b85..45667dd24a 100644 +index cca9ce2dfc..76cb1d6aa4 100644 --- a/src/clients/ksu/ccache.c +++ b/src/clients/ksu/ccache.c -@@ -40,7 +40,19 @@ copies the default cache into the secondary cache, +@@ -40,6 +40,18 @@ copies the default cache into the secondary cache, ************************************************************************/ --void show_credential(); +static void +free_creds_list(krb5_context context, krb5_creds **list) +{ @@ -987,13 +980,12 @@ index cbb9aa2b85..45667dd24a 100644 + free(list); +} + -+void show_credential(krb5_context, krb5_creds *, krb5_ccache); + void show_credential(krb5_context, krb5_creds *, krb5_ccache); /* modifies only the cc_other, the algorithm may look a bit funny, - but I had to do it this way, since remove function did not come -@@ -59,20 +71,19 @@ krb5_error_code krb5_ccache_copy(context, cc_def, target_principal, cc_target, - /* OUT */ - krb5_boolean *stored; +@@ -53,20 +65,19 @@ krb5_ccache_copy(krb5_context context, krb5_ccache cc_def, + krb5_boolean restrict_creds, krb5_principal primary_principal, + krb5_boolean *stored) { - int i=0; krb5_error_code retval=0; @@ -1016,7 +1008,7 @@ index cbb9aa2b85..45667dd24a 100644 if (restrict_creds) { retval = krb5_store_some_creds(context, cc_target, cc_def_creds_arr, -@@ -85,22 +96,9 @@ krb5_error_code krb5_ccache_copy(context, cc_def, target_principal, cc_target, +@@ -79,22 +90,9 @@ krb5_ccache_copy(krb5_context context, krb5_ccache cc_def, cc_other_creds_arr); } @@ -1042,7 +1034,7 @@ index cbb9aa2b85..45667dd24a 100644 return retval; } -@@ -198,32 +196,29 @@ krb5_error_code krb5_get_nonexp_tkts(context, cc, creds_array) +@@ -184,32 +182,29 @@ krb5_get_nonexp_tkts(krb5_context context, krb5_ccache cc, { krb5_creds creds, temp_tktq, temp_tkt; @@ -1082,7 +1074,7 @@ index cbb9aa2b85..45667dd24a 100644 } if (auth_debug){ fprintf(stderr,"krb5_ccache_copy: CREDS EXPIRED:\n"); -@@ -233,19 +228,19 @@ krb5_error_code krb5_get_nonexp_tkts(context, cc, creds_array) +@@ -219,19 +214,19 @@ krb5_get_nonexp_tkts(krb5_context context, krb5_ccache cc, } } else { /* these credentials didn't expire */ @@ -1111,7 +1103,7 @@ index cbb9aa2b85..45667dd24a 100644 } } -@@ -253,13 +248,15 @@ krb5_error_code krb5_get_nonexp_tkts(context, cc, creds_array) +@@ -239,13 +234,15 @@ krb5_get_nonexp_tkts(krb5_context context, krb5_ccache cc, temp_creds[count] = NULL; *creds_array = temp_creds; @@ -1127,16 +1119,14 @@ index cbb9aa2b85..45667dd24a 100644 - } - -@@ -331,97 +328,6 @@ void printtime(krb5_timestamp ts) + krb5_error_code +@@ -315,122 +312,33 @@ printtime(krb5_timestamp ts) printf("%s", fmtbuf); } - -krb5_error_code --krb5_get_login_princ(luser, princ_list) -- const char *luser; -- char ***princ_list; +-krb5_get_login_princ(const char *luser, char ***princ_list) -{ - struct stat sbuf; - struct passwd *pwd; @@ -1220,14 +1210,9 @@ index cbb9aa2b85..45667dd24a 100644 - fclose(fp); - return 0; -} -- -- - void - show_credential(context, cred, cc) - krb5_context context; -@@ -429,31 +335,29 @@ show_credential(context, cred, cc) - krb5_ccache cc; + show_credential(krb5_context context, krb5_creds *cred, krb5_ccache cc) { krb5_error_code retval; - char *name, *sname, *flags; @@ -1264,7 +1249,7 @@ index cbb9aa2b85..45667dd24a 100644 } if (!cred->times.starttime) -@@ -491,8 +395,12 @@ show_credential(context, cred, cc) +@@ -468,8 +376,12 @@ show_credential(krb5_context context, krb5_creds *cred, krb5_ccache cc) } } putchar('\n'); @@ -1277,8 +1262,8 @@ index cbb9aa2b85..45667dd24a 100644 } /* Create a random string suitable for a filename extension. */ -@@ -526,37 +434,26 @@ krb5_error_code krb5_ccache_overwrite(context, ccs, cct, primary_principal) - krb5_principal primary_principal; +@@ -501,37 +413,26 @@ krb5_ccache_overwrite(krb5_context context, krb5_ccache ccs, krb5_ccache cct, + krb5_principal primary_principal) { krb5_error_code retval=0; - krb5_principal temp_principal; @@ -1327,8 +1312,8 @@ index cbb9aa2b85..45667dd24a 100644 return retval; } -@@ -616,45 +513,40 @@ krb5_error_code krb5_ccache_filter (context, cc, prst) - krb5_principal prst; +@@ -585,45 +486,40 @@ krb5_error_code + krb5_ccache_filter(krb5_context context, krb5_ccache cc, krb5_principal prst) { - int i=0; @@ -1395,10 +1380,10 @@ index cbb9aa2b85..45667dd24a 100644 + return retval; } - krb5_boolean krb5_find_princ_in_cred_list (context, creds_list, princ) -@@ -688,17 +580,20 @@ krb5_error_code krb5_find_princ_in_cache (context, cc, princ, found) - krb5_principal princ; - krb5_boolean *found; + krb5_boolean +@@ -654,17 +550,20 @@ krb5_error_code + krb5_find_princ_in_cache(krb5_context context, krb5_ccache cc, + krb5_principal princ, krb5_boolean *found) { - krb5_error_code retval; + krb5_error_code retval = 0; @@ -1423,10 +1408,10 @@ index cbb9aa2b85..45667dd24a 100644 krb5_boolean diff --git a/src/clients/ksu/heuristic.c b/src/clients/ksu/heuristic.c -index 4f7280f4cb..47baa785e5 100644 +index e906de8ef0..6ed94eb887 100644 --- a/src/clients/ksu/heuristic.c +++ b/src/clients/ksu/heuristic.c -@@ -156,28 +156,31 @@ filter(fp, cmd, k5users_list, k5users_filt_list) +@@ -149,28 +149,31 @@ filter(FILE *fp, char *cmd, char **k5users_list, char ***k5users_filt_list) *k5users_filt_list = NULL; @@ -1464,7 +1449,7 @@ index 4f7280f4cb..47baa785e5 100644 for(j= 0, k=0; j < i; j++ ) { if (k5users_list[j]){ -@@ -191,7 +194,10 @@ filter(fp, cmd, k5users_list, k5users_filt_list) +@@ -184,7 +187,10 @@ filter(FILE *fp, char *cmd, char **k5users_list, char ***k5users_filt_list) free (k5users_list); *k5users_filt_list = temp_filt_list; @@ -1476,7 +1461,7 @@ index 4f7280f4cb..47baa785e5 100644 } krb5_error_code -@@ -335,7 +341,7 @@ krb5_error_code get_closest_principal(context, plist, client, found) +@@ -318,7 +324,7 @@ get_closest_principal(krb5_context context, char **plist, retval = krb5_parse_name(context, plist[i], &temp_client); if (retval) @@ -1485,7 +1470,7 @@ index 4f7280f4cb..47baa785e5 100644 pnelem = krb5_princ_size(context, temp_client); -@@ -363,6 +369,7 @@ krb5_error_code get_closest_principal(context, plist, client, found) +@@ -346,6 +352,7 @@ get_closest_principal(krb5_context context, char **plist, if(best_client){ if(krb5_princ_size(context, best_client) > krb5_princ_size(context, temp_client)){ @@ -1493,7 +1478,7 @@ index 4f7280f4cb..47baa785e5 100644 best_client = temp_client; } }else -@@ -375,9 +382,12 @@ krb5_error_code get_closest_principal(context, plist, client, found) +@@ -358,9 +365,12 @@ get_closest_principal(krb5_context context, char **plist, if (best_client) { *found = TRUE; *client = best_client; @@ -1507,7 +1492,7 @@ index 4f7280f4cb..47baa785e5 100644 } /**************************************************************** -@@ -499,6 +509,7 @@ krb5_error_code find_princ_in_list (context, princ, plist, found) +@@ -471,6 +481,7 @@ find_princ_in_list(krb5_context context, krb5_principal princ, char **plist, i++; } @@ -1515,7 +1500,7 @@ index 4f7280f4cb..47baa785e5 100644 return 0; } -@@ -534,11 +545,9 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, +@@ -498,11 +509,9 @@ get_best_princ_for_target(krb5_context context, uid_t source_uid, { princ_info princ_trials[10]; @@ -1530,7 +1515,7 @@ index 4f7280f4cb..47baa785e5 100644 krb5_error_code retval; char ** aplist =NULL; krb5_boolean found = FALSE; -@@ -555,54 +564,59 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, +@@ -519,54 +528,59 @@ get_best_princ_for_target(krb5_context context, uid_t source_uid, if (ks_ccache_is_initialized(context, cc_source)) { retval = krb5_cc_get_principal(context, cc_source, &cc_def_princ); if (retval) @@ -1609,7 +1594,7 @@ index 4f7280f4cb..47baa785e5 100644 if (cmd) *path_out = NOT_AUTHORIZED; -@@ -610,26 +624,25 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, +@@ -574,26 +588,25 @@ get_best_princ_for_target(krb5_context context, uid_t source_uid, if (auth_debug) printf(" GET_best_princ_for_target: via no auth files path\n"); @@ -1640,7 +1625,7 @@ index 4f7280f4cb..47baa785e5 100644 /* first see if default principal of the source cache * can get us in, then the target_user@realm, then the -@@ -652,7 +665,7 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, +@@ -616,7 +629,7 @@ get_best_princ_for_target(krb5_context context, uid_t source_uid, retval= find_princ_in_list(context, princ_trials[i].p, aplist, &found); if (retval) @@ -1649,7 +1634,7 @@ index 4f7280f4cb..47baa785e5 100644 if (found == TRUE){ princ_trials[i].found = TRUE; -@@ -661,12 +674,13 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, +@@ -625,12 +638,13 @@ get_best_princ_for_target(krb5_context context, uid_t source_uid, princ_trials[i].p, end_server, &found); if (retval) @@ -1666,7 +1651,7 @@ index 4f7280f4cb..47baa785e5 100644 } } } -@@ -679,21 +693,23 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, +@@ -643,21 +657,23 @@ get_best_princ_for_target(krb5_context context, uid_t source_uid, while (aplist[i]){ retval = krb5_parse_name(context, aplist[i], &temp_client); if (retval) @@ -1693,7 +1678,7 @@ index 4f7280f4cb..47baa785e5 100644 i++; } -@@ -704,11 +720,11 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, +@@ -668,11 +684,11 @@ get_best_princ_for_target(krb5_context context, uid_t source_uid, for (i=0; i < count; i ++){ if (princ_trials[i].found == TRUE){ @@ -1707,7 +1692,7 @@ index 4f7280f4cb..47baa785e5 100644 } } -@@ -718,7 +734,7 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, +@@ -682,7 +698,7 @@ get_best_princ_for_target(krb5_context context, uid_t source_uid, retval=krb5_copy_principal(context, princ_trials[i].p, &temp_client); if(retval) @@ -1716,7 +1701,7 @@ index 4f7280f4cb..47baa785e5 100644 /* get the client name that is the closest to the three princ in trials */ -@@ -726,15 +742,15 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, +@@ -690,15 +706,15 @@ get_best_princ_for_target(krb5_context context, uid_t source_uid, retval=get_closest_principal(context, aplist, &temp_client, &found); if(retval) @@ -1735,7 +1720,7 @@ index 4f7280f4cb..47baa785e5 100644 } } -@@ -745,5 +761,13 @@ krb5_error_code get_best_princ_for_target(context, source_uid, target_uid, +@@ -709,5 +725,13 @@ get_best_princ_for_target(krb5_context context, uid_t source_uid, printf( "GET_best_princ_for_target: out of luck, can't get appropriate default principal\n"); *path_out = NOT_AUTHORIZED; @@ -1751,12 +1736,12 @@ index 4f7280f4cb..47baa785e5 100644 + return retval; } diff --git a/src/clients/ksu/krb_auth_su.c b/src/clients/ksu/krb_auth_su.c -index fb848dcab1..a99c4c826c 100644 +index db10251f95..68cfe6b0ed 100644 --- a/src/clients/ksu/krb_auth_su.c +++ b/src/clients/ksu/krb_auth_su.c -@@ -42,33 +42,31 @@ krb5_boolean krb5_auth_check(context, client_pname, hostname, options, - krb5_ccache cc; - int *path_passwd; +@@ -37,33 +37,31 @@ krb5_auth_check(krb5_context context, krb5_principal client_pname, + char *target_user, krb5_ccache cc, int *path_passwd, + uid_t target_uid) { - krb5_principal client; + krb5_principal client = NULL; @@ -1794,7 +1779,7 @@ index fb848dcab1..a99c4c826c 100644 } if (auth_debug){ dump_principal(context, "local tgt principal name", tgtq.server ); } -@@ -82,7 +80,7 @@ krb5_boolean krb5_auth_check(context, client_pname, hostname, options, +@@ -77,7 +75,7 @@ krb5_auth_check(krb5_context context, krb5_principal client_pname, if ((retval != KRB5_CC_NOTFOUND) && (retval != KRB5KRB_AP_ERR_TKT_EXPIRED)){ com_err(prog_name, retval, _("while retrieving creds from cache")); @@ -1803,7 +1788,7 @@ index fb848dcab1..a99c4c826c 100644 } } else{ got_it = 1; -@@ -93,7 +91,7 @@ krb5_boolean krb5_auth_check(context, client_pname, hostname, options, +@@ -88,7 +86,7 @@ krb5_auth_check(krb5_context context, krb5_principal client_pname, #ifdef GET_TGT_VIA_PASSWD if (krb5_seteuid(0)||krb5_seteuid(target_uid)) { com_err("ksu", errno, _("while switching to target uid")); @@ -1812,7 +1797,7 @@ index fb848dcab1..a99c4c826c 100644 } -@@ -107,19 +105,19 @@ krb5_boolean krb5_auth_check(context, client_pname, hostname, options, +@@ -102,19 +100,19 @@ krb5_auth_check(krb5_context context, krb5_principal client_pname, &tgt) == FALSE) { krb5_seteuid(0); @@ -1835,7 +1820,7 @@ index fb848dcab1..a99c4c826c 100644 #endif /* GET_TGT_VIA_PASSWD */ -@@ -131,10 +129,16 @@ krb5_boolean krb5_auth_check(context, client_pname, hostname, options, +@@ -126,10 +124,16 @@ krb5_auth_check(krb5_context context, krb5_principal client_pname, &vfy_opts); if (retval) { com_err(prog_name, retval, _("while verifying ticket for server")); @@ -1853,10 +1838,10 @@ index fb848dcab1..a99c4c826c 100644 + return ok; } - krb5_boolean ksu_get_tgt_via_passwd(context, client, options, zero_password, -@@ -145,11 +149,12 @@ krb5_boolean ksu_get_tgt_via_passwd(context, client, options, zero_password, - krb5_boolean *zero_password; - krb5_creds *creds_out; + krb5_boolean +@@ -137,11 +141,12 @@ ksu_get_tgt_via_passwd(krb5_context context, krb5_principal client, + krb5_get_init_creds_opt *options, + krb5_boolean *zero_password, krb5_creds *creds_out) { + krb5_boolean ok = FALSE; krb5_error_code code; @@ -1869,7 +1854,7 @@ index fb848dcab1..a99c4c826c 100644 int result; *zero_password = FALSE; -@@ -158,14 +163,14 @@ krb5_boolean ksu_get_tgt_via_passwd(context, client, options, zero_password, +@@ -150,14 +155,14 @@ ksu_get_tgt_via_passwd(krb5_context context, krb5_principal client, if ((code = krb5_unparse_name(context, client, &client_name))) { com_err (prog_name, code, _("when unparsing name")); @@ -1886,7 +1871,7 @@ index fb848dcab1..a99c4c826c 100644 } result = snprintf(prompt, sizeof(prompt), _("Kerberos password for %s: "), -@@ -174,7 +179,7 @@ krb5_boolean ksu_get_tgt_via_passwd(context, client, options, zero_password, +@@ -166,7 +171,7 @@ ksu_get_tgt_via_passwd(krb5_context context, krb5_principal client, fprintf(stderr, _("principal name %s too long for internal buffer space\n"), client_name); @@ -1895,7 +1880,7 @@ index fb848dcab1..a99c4c826c 100644 } pwsize = sizeof(password); -@@ -183,13 +188,13 @@ krb5_boolean ksu_get_tgt_via_passwd(context, client, options, zero_password, +@@ -175,13 +180,13 @@ ksu_get_tgt_via_passwd(krb5_context context, krb5_principal client, if (code ) { com_err(prog_name, code, _("while reading password for '%s'\n"), client_name); @@ -1911,7 +1896,7 @@ index fb848dcab1..a99c4c826c 100644 } code = krb5_get_init_creds_password(context, &creds, client, password, -@@ -203,13 +208,19 @@ krb5_boolean ksu_get_tgt_via_passwd(context, client, options, zero_password, +@@ -195,13 +200,19 @@ ksu_get_tgt_via_passwd(krb5_context context, krb5_principal client, fprintf(stderr, _("%s: Password incorrect\n"), prog_name); else com_err(prog_name, code, _("while getting initial credentials")); @@ -1935,8 +1920,8 @@ index fb848dcab1..a99c4c826c 100644 + return ok; } - -@@ -224,8 +235,10 @@ void dump_principal (context, str, p) + void +@@ -213,8 +224,10 @@ dump_principal(krb5_context context, char *str, krb5_principal p) if ((retval = krb5_unparse_name(context, p, &stname))) { fprintf(stderr, _(" %s while unparsing name\n"), error_message(retval)); @@ -1946,8 +1931,8 @@ index fb848dcab1..a99c4c826c 100644 + free(stname); } - void plain_dump_principal (context, p) -@@ -238,74 +251,8 @@ void plain_dump_principal (context, p) + void +@@ -226,71 +239,8 @@ plain_dump_principal (krb5_context context, krb5_principal p) if ((retval = krb5_unparse_name(context, p, &stname))) { fprintf(stderr, _(" %s while unparsing name\n"), error_message(retval)); @@ -1965,11 +1950,8 @@ index fb848dcab1..a99c4c826c 100644 - -**********************************************************************/ - -- --krb5_error_code get_best_principal(context, plist, client) -- krb5_context context; -- char **plist; -- krb5_principal *client; +-krb5_error_code +-get_best_principal(krb5_context context, char **plist, krb5_principal *client) -{ - krb5_error_code retval =0; - krb5_principal temp_client, best_client = NULL; @@ -2049,10 +2031,10 @@ index 66fb4bcc6a..32ce11cb85 100644 (krb5_context, krb5_creds *, krb5_ccache); diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c -index 931f054041..a7cb7ed3be 100644 +index 2a351662c8..77703a6a2b 100644 --- a/src/clients/ksu/main.c +++ b/src/clients/ksu/main.c -@@ -1003,7 +1003,7 @@ resolve_target_cache(krb5_context context, krb5_principal princ, +@@ -1002,7 +1002,7 @@ resolve_target_cache(krb5_context context, krb5_principal princ, if (retval) { com_err(prog_name, retval, _("while generating part of the target ccache name")); @@ -2061,7 +2043,7 @@ index 931f054041..a7cb7ed3be 100644 } if (asprintf(&ccname, "%s.%s", target, sym) < 0) { retval = ENOMEM; -@@ -1015,6 +1015,7 @@ resolve_target_cache(krb5_context context, krb5_principal princ, +@@ -1014,6 +1014,7 @@ resolve_target_cache(krb5_context context, krb5_principal princ, free(sym); } while (ks_ccache_name_is_initialized(context, ccname)); retval = krb5_cc_resolve(context, ccname, &ccache); @@ -2070,7 +2052,7 @@ index 931f054041..a7cb7ed3be 100644 /* Look for a cache in the collection that we can reuse. */ retval = krb5_cc_cache_match(context, princ, &ccache); diff --git a/src/kadmin/cli/keytab.c b/src/kadmin/cli/keytab.c -index b0c8378b40..8a59188216 100644 +index 26f340af31..976c8969e8 100644 --- a/src/kadmin/cli/keytab.c +++ b/src/kadmin/cli/keytab.c @@ -363,7 +363,7 @@ remove_principal(char *keytab_str, krb5_keytab keytab, @@ -2108,10 +2090,10 @@ index b0c8378b40..8a59188216 100644 } diff --git a/src/kadmin/ktutil/ktutil.c b/src/kadmin/ktutil/ktutil.c -index 92d7023a4f..782c7289c5 100644 +index 87a69ca145..a1c17d154d 100644 --- a/src/kadmin/ktutil/ktutil.c +++ b/src/kadmin/ktutil/ktutil.c -@@ -263,6 +263,7 @@ void ktutil_list(argc, argv) +@@ -254,6 +254,7 @@ ktutil_list(int argc, char *argv[]) buf, sizeof(buf)))) { com_err(argv[0], retval, _("While converting enctype to string")); @@ -2120,7 +2102,7 @@ index 92d7023a4f..782c7289c5 100644 } printf(" (%s) ", buf); diff --git a/src/kprop/kpropd.c b/src/kprop/kpropd.c -index cb9785aaeb..286b3a655e 100644 +index f883ae2df8..9a4826e441 100644 --- a/src/kprop/kpropd.c +++ b/src/kprop/kpropd.c @@ -1300,19 +1300,20 @@ static krb5_boolean @@ -2187,7 +2169,7 @@ index 96a408c237..bf5cede54a 100644 if (json_kgcred(context, cred, &jcred)) diff --git a/src/lib/gssapi/krb5/val_cred.c b/src/lib/gssapi/krb5/val_cred.c -index cb1cb9393a..87a46cd533 100644 +index 83e7634106..d4b070f8c0 100644 --- a/src/lib/gssapi/krb5/val_cred.c +++ b/src/lib/gssapi/krb5/val_cred.c @@ -35,6 +35,7 @@ krb5_gss_validate_cred_1(OM_uint32 *minor_status, gss_cred_id_t cred_handle, @@ -2330,5 +2312,5 @@ index 753929b06d..f7fad27867 100644 } } -- -2.41.0 +2.45.1 diff --git a/0018-Fix-vulnerabilities-in-GSS-message-token-handling.patch b/0018-Fix-vulnerabilities-in-GSS-message-token-handling.patch deleted file mode 100644 index 4934355..0000000 --- a/0018-Fix-vulnerabilities-in-GSS-message-token-handling.patch +++ /dev/null @@ -1,535 +0,0 @@ -From 7b0e4a36b82b4ab388b520eaba396de365574774 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Fri, 14 Jun 2024 10:56:12 -0400 -Subject: [PATCH] Fix vulnerabilities in GSS message token handling - -In gss_krb5int_unseal_token_v3() and gss_krb5int_unseal_v3_iov(), -verify the Extra Count field of CFX wrap tokens against the encrypted -header. Reported by Jacob Champion. - -In gss_krb5int_unseal_token_v3(), check for a decrypted plaintext -length too short to contain the encrypted header and extra count -bytes. Reported by Jacob Champion. - -In kg_unseal_iov_token(), separately track the header IOV length and -complete token length when parsing the token's ASN.1 wrapper. This -fix contains modified versions of functions from k5-der.h and -util_token.c; this duplication will be cleaned up in a future commit. - -CVE-2024-37370: - -In MIT krb5 release 1.3 and later, an attacker can modify the -plaintext Extra Count field of a confidential GSS krb5 wrap token, -causing the unwrapped token to appear truncated to the application. - -CVE-2024-37371: - -In MIT krb5 release 1.3 and later, an attacker can cause invalid -memory reads by sending message tokens with invalid length fields. - -ticket: 9128 (new) -tags: pullup -target_version: 1.21-next - -(cherry picked from commit b0a2f8a5365f2eec3e27d78907de9f9d2c80505a) ---- - src/lib/gssapi/krb5/k5sealv3.c | 5 + - src/lib/gssapi/krb5/k5sealv3iov.c | 3 +- - src/lib/gssapi/krb5/k5unsealiov.c | 80 +++++++++- - src/tests/gssapi/t_invalid.c | 233 +++++++++++++++++++++++++----- - 4 files changed, 275 insertions(+), 46 deletions(-) - -diff --git a/src/lib/gssapi/krb5/k5sealv3.c b/src/lib/gssapi/krb5/k5sealv3.c -index 3b4f8cb837..1fcbdfbb87 100644 ---- a/src/lib/gssapi/krb5/k5sealv3.c -+++ b/src/lib/gssapi/krb5/k5sealv3.c -@@ -408,10 +408,15 @@ gss_krb5int_unseal_token_v3(krb5_context *contextptr, - /* Don't use bodysize here! Use the fact that - cipher.ciphertext.length has been adjusted to the - correct length. */ -+ if (plain.length < 16 + ec) { -+ free(plain.data); -+ goto defective; -+ } - althdr = (unsigned char *)plain.data + plain.length - 16; - if (load_16_be(althdr) != KG2_TOK_WRAP_MSG - || althdr[2] != ptr[2] - || althdr[3] != ptr[3] -+ || load_16_be(althdr+4) != ec - || memcmp(althdr+8, ptr+8, 8)) { - free(plain.data); - goto defective; -diff --git a/src/lib/gssapi/krb5/k5sealv3iov.c b/src/lib/gssapi/krb5/k5sealv3iov.c -index 333ee124dd..f8e90c35b4 100644 ---- a/src/lib/gssapi/krb5/k5sealv3iov.c -+++ b/src/lib/gssapi/krb5/k5sealv3iov.c -@@ -402,9 +402,10 @@ gss_krb5int_unseal_v3_iov(krb5_context context, - if (load_16_be(althdr) != KG2_TOK_WRAP_MSG - || althdr[2] != ptr[2] - || althdr[3] != ptr[3] -+ || load_16_be(althdr + 4) != ec - || memcmp(althdr + 8, ptr + 8, 8) != 0) { - *minor_status = 0; -- return GSS_S_BAD_SIG; -+ return GSS_S_DEFECTIVE_TOKEN; - } - } else { - /* Verify checksum: note EC is checksum size here, not padding */ -diff --git a/src/lib/gssapi/krb5/k5unsealiov.c b/src/lib/gssapi/krb5/k5unsealiov.c -index 3ce2a90ce9..6a6585d9af 100644 ---- a/src/lib/gssapi/krb5/k5unsealiov.c -+++ b/src/lib/gssapi/krb5/k5unsealiov.c -@@ -25,6 +25,7 @@ - */ - - #include "k5-int.h" -+#include "k5-der.h" - #include "gssapiP_krb5.h" - - static OM_uint32 -@@ -247,6 +248,73 @@ cleanup: - return retval; - } - -+/* Similar to k5_der_get_value(), but output an unchecked content length -+ * instead of a k5input containing the contents. */ -+static inline bool -+get_der_tag(struct k5input *in, uint8_t idbyte, size_t *len_out) -+{ -+ uint8_t lenbyte, i; -+ size_t len; -+ -+ /* Do nothing if in is empty or the next byte doesn't match idbyte. */ -+ if (in->status || in->len == 0 || *in->ptr != idbyte) -+ return false; -+ -+ /* Advance past the identifier byte and decode the length. */ -+ (void)k5_input_get_byte(in); -+ lenbyte = k5_input_get_byte(in); -+ if (lenbyte < 128) { -+ len = lenbyte; -+ } else { -+ len = 0; -+ for (i = 0; i < (lenbyte & 0x7F); i++) { -+ if (len > (SIZE_MAX >> 8)) { -+ k5_input_set_status(in, EOVERFLOW); -+ return false; -+ } -+ len = (len << 8) | k5_input_get_byte(in); -+ } -+ } -+ -+ if (in->status) -+ return false; -+ -+ *len_out = len; -+ return true; -+} -+ -+/* -+ * Similar to g_verify_token_header() without toktype or flags, but do not read -+ * more than *header_len bytes of ASN.1 wrapper, and on output set *header_len -+ * to the remaining number of header bytes. Verify the outer DER tag's length -+ * against token_len, which may be larger (but not smaller) than *header_len. -+ */ -+static gss_int32 -+verify_detached_wrapper(const gss_OID_desc *mech, size_t *header_len, -+ uint8_t **header_in, size_t token_len) -+{ -+ struct k5input in, mech_der; -+ gss_OID_desc toid; -+ size_t len; -+ -+ k5_input_init(&in, *header_in, *header_len); -+ -+ if (get_der_tag(&in, 0x60, &len)) { -+ if (len != token_len - (in.ptr - *header_in)) -+ return G_BAD_TOK_HEADER; -+ if (!k5_der_get_value(&in, 0x06, &mech_der)) -+ return G_BAD_TOK_HEADER; -+ toid.elements = (uint8_t *)mech_der.ptr; -+ toid.length = mech_der.len; -+ if (!g_OID_equal(&toid, mech)) -+ return G_WRONG_MECH; -+ } -+ -+ *header_in = (uint8_t *)in.ptr; -+ *header_len = in.len; -+ return 0; -+} -+ - /* - * Caller must provide TOKEN | DATA | PADDING | TRAILER, except - * for DCE in which case it can just provide TOKEN | DATA (must -@@ -267,8 +335,7 @@ kg_unseal_iov_token(OM_uint32 *minor_status, - gss_iov_buffer_t header; - gss_iov_buffer_t padding; - gss_iov_buffer_t trailer; -- size_t input_length; -- unsigned int bodysize; -+ size_t input_length, hlen; - int toktype2; - - header = kg_locate_header_iov(iov, iov_count, toktype); -@@ -298,15 +365,14 @@ kg_unseal_iov_token(OM_uint32 *minor_status, - input_length += trailer->buffer.length; - } - -- code = g_verify_token_header(ctx->mech_used, -- &bodysize, &ptr, -1, -- input_length, 0); -+ hlen = header->buffer.length; -+ code = verify_detached_wrapper(ctx->mech_used, &hlen, &ptr, input_length); - if (code != 0) { - *minor_status = code; - return GSS_S_DEFECTIVE_TOKEN; - } - -- if (bodysize < 2) { -+ if (hlen < 2) { - *minor_status = (OM_uint32)G_BAD_TOK_HEADER; - return GSS_S_DEFECTIVE_TOKEN; - } -@@ -314,7 +380,7 @@ kg_unseal_iov_token(OM_uint32 *minor_status, - toktype2 = load_16_be(ptr); - - ptr += 2; -- bodysize -= 2; -+ hlen -= 2; - - switch (toktype2) { - case KG2_TOK_MIC_MSG: -diff --git a/src/tests/gssapi/t_invalid.c b/src/tests/gssapi/t_invalid.c -index fb8fe55111..8192935099 100644 ---- a/src/tests/gssapi/t_invalid.c -+++ b/src/tests/gssapi/t_invalid.c -@@ -36,31 +36,41 @@ - * - * 1. A pre-CFX wrap or MIC token processed with a CFX-only context causes a - * null pointer dereference. (The token must use SEAL_ALG_NONE or it will -- * be rejected.) -+ * be rejected.) This vulnerability also applies to IOV unwrap. - * -- * 2. A pre-CFX wrap or MIC token with fewer than 24 bytes after the ASN.1 -+ * 2. A CFX wrap token with a different value of EC between the plaintext and -+ * encrypted copies will be erroneously accepted, which allows a message -+ * truncation attack. This vulnerability also applies to IOV unwrap. -+ * -+ * 3. A CFX wrap token with a plaintext length fewer than 16 bytes causes an -+ * access before the beginning of the input buffer, possibly leading to a -+ * crash. -+ * -+ * 4. A CFX wrap token with a plaintext EC value greater than the plaintext -+ * length - 16 causes an integer underflow when computing the result length, -+ * likely causing a crash. -+ * -+ * 5. An IOV unwrap operation will overrun the header buffer if an ASN.1 -+ * wrapper longer than the header buffer is present. -+ * -+ * 6. A pre-CFX wrap or MIC token with fewer than 24 bytes after the ASN.1 - * header causes an input buffer overrun, usually leading to either a segv - * or a GSS_S_DEFECTIVE_TOKEN error due to garbage algorithm, filler, or -- * sequence number values. -+ * sequence number values. This vulnerability also applies to IOV unwrap. - * -- * 3. A pre-CFX wrap token with fewer than 16 + cksumlen bytes after the ASN.1 -+ * 7. A pre-CFX wrap token with fewer than 16 + cksumlen bytes after the ASN.1 - * header causes an integer underflow when computing the ciphertext length, - * leading to an allocation error on 32-bit platforms or a segv on 64-bit - * platforms. A pre-CFX MIC token of this size causes an input buffer - * overrun when comparing the checksum, perhaps leading to a segv. - * -- * 4. A pre-CFX wrap token with fewer than conflen + padlen bytes in the -+ * 8. A pre-CFX wrap token with fewer than conflen + padlen bytes in the - * ciphertext (where padlen is the last byte of the decrypted ciphertext) - * causes an integer underflow when computing the original message length, - * leading to an allocation error. - * -- * 5. In the mechglue, truncated encapsulation in the initial context token can -+ * 9. In the mechglue, truncated encapsulation in the initial context token can - * cause input buffer overruns in gss_accept_sec_context(). -- * -- * Vulnerabilities #1 and #2 also apply to IOV unwrap, although tokens with -- * fewer than 16 bytes after the ASN.1 header will be rejected. -- * Vulnerabilities #2 and #5 can only be robustly detected using a -- * memory-checking environment such as valgrind. - */ - - #include "k5-int.h" -@@ -97,17 +107,25 @@ struct test { - } - }; - --/* Fake up enough of a CFX GSS context for gss_unwrap, using an AES key. */ -+static void * -+ealloc(size_t len) -+{ -+ void *ptr = calloc(len, 1); -+ -+ if (ptr == NULL) -+ abort(); -+ return ptr; -+} -+ -+/* Fake up enough of a CFX GSS context for gss_unwrap, using an AES key. -+ * The context takes ownership of subkey. */ - static gss_ctx_id_t --make_fake_cfx_context() -+make_fake_cfx_context(krb5_key subkey) - { - gss_union_ctx_id_t uctx; - krb5_gss_ctx_id_t kgctx; -- krb5_keyblock kb; - -- kgctx = calloc(1, sizeof(*kgctx)); -- if (kgctx == NULL) -- abort(); -+ kgctx = ealloc(sizeof(*kgctx)); - kgctx->established = 1; - kgctx->proto = 1; - if (g_seqstate_init(&kgctx->seqstate, 0, 0, 0, 0) != 0) -@@ -116,15 +134,10 @@ make_fake_cfx_context() - kgctx->sealalg = -1; - kgctx->signalg = -1; - -- kb.enctype = ENCTYPE_AES128_CTS_HMAC_SHA1_96; -- kb.length = 16; -- kb.contents = (unsigned char *)"1234567887654321"; -- if (krb5_k_create_key(NULL, &kb, &kgctx->subkey) != 0) -- abort(); -+ kgctx->subkey = subkey; -+ kgctx->cksumtype = CKSUMTYPE_HMAC_SHA1_96_AES128; - -- uctx = calloc(1, sizeof(*uctx)); -- if (uctx == NULL) -- abort(); -+ uctx = ealloc(sizeof(*uctx)); - uctx->mech_type = &mech_krb5; - uctx->internal_ctx_id = (gss_ctx_id_t)kgctx; - return (gss_ctx_id_t)uctx; -@@ -138,9 +151,7 @@ make_fake_context(const struct test *test) - krb5_gss_ctx_id_t kgctx; - krb5_keyblock kb; - -- kgctx = calloc(1, sizeof(*kgctx)); -- if (kgctx == NULL) -- abort(); -+ kgctx = ealloc(sizeof(*kgctx)); - kgctx->established = 1; - if (g_seqstate_init(&kgctx->seqstate, 0, 0, 0, 0) != 0) - abort(); -@@ -162,9 +173,7 @@ make_fake_context(const struct test *test) - if (krb5_k_create_key(NULL, &kb, &kgctx->enc) != 0) - abort(); - -- uctx = calloc(1, sizeof(*uctx)); -- if (uctx == NULL) -- abort(); -+ uctx = ealloc(sizeof(*uctx)); - uctx->mech_type = &mech_krb5; - uctx->internal_ctx_id = (gss_ctx_id_t)kgctx; - return (gss_ctx_id_t)uctx; -@@ -194,9 +203,7 @@ make_token(unsigned char *token, size_t len, gss_buffer_t out) - - assert(mech_krb5.length == 9); - assert(len + 11 < 128); -- wrapped = malloc(len + 13); -- if (wrapped == NULL) -- abort(); -+ wrapped = ealloc(len + 13); - wrapped[0] = 0x60; - wrapped[1] = len + 11; - wrapped[2] = 0x06; -@@ -207,6 +214,18 @@ make_token(unsigned char *token, size_t len, gss_buffer_t out) - out->value = wrapped; - } - -+/* Create a 16-byte header for a CFX confidential wrap token to be processed by -+ * the fake CFX context. */ -+static void -+write_cfx_header(uint16_t ec, uint8_t *out) -+{ -+ memset(out, 0, 16); -+ store_16_be(KG2_TOK_WRAP_MSG, out); -+ out[2] = FLAG_WRAP_CONFIDENTIAL; -+ out[3] = 0xFF; -+ store_16_be(ec, out + 4); -+} -+ - /* Unwrap a superficially valid RFC 1964 token with a CFX-only context, with - * regular and IOV unwrap. */ - static void -@@ -238,6 +257,134 @@ test_bogus_1964_token(gss_ctx_id_t ctx) - free(in.value); - } - -+static void -+test_cfx_altered_ec(gss_ctx_id_t ctx, krb5_key subkey) -+{ -+ OM_uint32 major, minor; -+ uint8_t tokbuf[128], plainbuf[24]; -+ krb5_data plain; -+ krb5_enc_data cipher; -+ gss_buffer_desc in, out; -+ gss_iov_buffer_desc iov[2]; -+ -+ /* Construct a header with a plaintext EC value of 3. */ -+ write_cfx_header(3, tokbuf); -+ -+ /* Encrypt a plaintext and a copy of the header with the EC value 0. */ -+ memcpy(plainbuf, "truncate", 8); -+ memcpy(plainbuf + 8, tokbuf, 16); -+ store_16_be(0, plainbuf + 12); -+ plain = make_data(plainbuf, 24); -+ cipher.ciphertext.data = (char *)tokbuf + 16; -+ cipher.ciphertext.length = sizeof(tokbuf) - 16; -+ cipher.enctype = subkey->keyblock.enctype; -+ if (krb5_k_encrypt(NULL, subkey, KG_USAGE_INITIATOR_SEAL, NULL, -+ &plain, &cipher) != 0) -+ abort(); -+ -+ /* Verify that the token is rejected by gss_unwrap(). */ -+ in.value = tokbuf; -+ in.length = 16 + cipher.ciphertext.length; -+ major = gss_unwrap(&minor, ctx, &in, &out, NULL, NULL); -+ if (major != GSS_S_DEFECTIVE_TOKEN) -+ abort(); -+ (void)gss_release_buffer(&minor, &out); -+ -+ /* Verify that the token is rejected by gss_unwrap_iov(). */ -+ iov[0].type = GSS_IOV_BUFFER_TYPE_STREAM; -+ iov[0].buffer = in; -+ iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; -+ major = gss_unwrap_iov(&minor, ctx, NULL, NULL, iov, 2); -+ if (major != GSS_S_DEFECTIVE_TOKEN) -+ abort(); -+} -+ -+static void -+test_cfx_short_plaintext(gss_ctx_id_t ctx, krb5_key subkey) -+{ -+ OM_uint32 major, minor; -+ uint8_t tokbuf[128], zerobyte = 0; -+ krb5_data plain; -+ krb5_enc_data cipher; -+ gss_buffer_desc in, out; -+ -+ write_cfx_header(0, tokbuf); -+ -+ /* Encrypt a single byte, with no copy of the header. */ -+ plain = make_data(&zerobyte, 1); -+ cipher.ciphertext.data = (char *)tokbuf + 16; -+ cipher.ciphertext.length = sizeof(tokbuf) - 16; -+ cipher.enctype = subkey->keyblock.enctype; -+ if (krb5_k_encrypt(NULL, subkey, KG_USAGE_INITIATOR_SEAL, NULL, -+ &plain, &cipher) != 0) -+ abort(); -+ -+ /* Verify that the token is rejected by gss_unwrap(). */ -+ in.value = tokbuf; -+ in.length = 16 + cipher.ciphertext.length; -+ major = gss_unwrap(&minor, ctx, &in, &out, NULL, NULL); -+ if (major != GSS_S_DEFECTIVE_TOKEN) -+ abort(); -+ (void)gss_release_buffer(&minor, &out); -+} -+ -+static void -+test_cfx_large_ec(gss_ctx_id_t ctx, krb5_key subkey) -+{ -+ OM_uint32 major, minor; -+ uint8_t tokbuf[128] = { 0 }, plainbuf[20]; -+ krb5_data plain; -+ krb5_enc_data cipher; -+ gss_buffer_desc in, out; -+ -+ /* Construct a header with an EC value of 5. */ -+ write_cfx_header(5, tokbuf); -+ -+ /* Encrypt a 4-byte plaintext plus the header. */ -+ memcpy(plainbuf, "abcd", 4); -+ memcpy(plainbuf + 4, tokbuf, 16); -+ plain = make_data(plainbuf, 20); -+ cipher.ciphertext.data = (char *)tokbuf + 16; -+ cipher.ciphertext.length = sizeof(tokbuf) - 16; -+ cipher.enctype = subkey->keyblock.enctype; -+ if (krb5_k_encrypt(NULL, subkey, KG_USAGE_INITIATOR_SEAL, NULL, -+ &plain, &cipher) != 0) -+ abort(); -+ -+ /* Verify that the token is rejected by gss_unwrap(). */ -+ in.value = tokbuf; -+ in.length = 16 + cipher.ciphertext.length; -+ major = gss_unwrap(&minor, ctx, &in, &out, NULL, NULL); -+ if (major != GSS_S_DEFECTIVE_TOKEN) -+ abort(); -+ (void)gss_release_buffer(&minor, &out); -+} -+ -+static void -+test_iov_large_asn1_wrapper(gss_ctx_id_t ctx) -+{ -+ OM_uint32 minor, major; -+ uint8_t databuf[10] = { 0 }; -+ gss_iov_buffer_desc iov[2]; -+ -+ /* -+ * In this IOV array, the header contains a DER tag with a dangling eight -+ * bytes of length field. The data IOV indicates a total token length -+ * sufficient to contain the length bytes. -+ */ -+ iov[0].type = GSS_IOV_BUFFER_TYPE_HEADER; -+ iov[0].buffer.value = ealloc(2); -+ iov[0].buffer.length = 2; -+ memcpy(iov[0].buffer.value, "\x60\x88", 2); -+ iov[1].type = GSS_IOV_BUFFER_TYPE_DATA; -+ iov[1].buffer.value = databuf; -+ iov[1].buffer.length = 10; -+ major = gss_unwrap_iov(&minor, ctx, NULL, NULL, iov, 2); -+ if (major != GSS_S_DEFECTIVE_TOKEN) -+ abort(); -+ free(iov[0].buffer.value); -+} -+ - /* Process wrap and MIC tokens with incomplete headers. */ - static void - test_short_header(gss_ctx_id_t ctx) -@@ -387,9 +534,7 @@ try_accept(void *value, size_t len) - gss_ctx_id_t ctx = GSS_C_NO_CONTEXT; - - /* Copy the provided value to make input overruns more obvious. */ -- in.value = malloc(len); -- if (in.value == NULL) -- abort(); -+ in.value = ealloc(len); - memcpy(in.value, value, len); - in.length = len; - (void)gss_accept_sec_context(&minor, &ctx, GSS_C_NO_CREDENTIAL, &in, -@@ -424,11 +569,23 @@ test_short_encapsulation() - int - main(int argc, char **argv) - { -+ krb5_keyblock kb; -+ krb5_key cfx_subkey; - gss_ctx_id_t ctx; - size_t i; - -- ctx = make_fake_cfx_context(); -+ kb.enctype = ENCTYPE_AES128_CTS_HMAC_SHA1_96; -+ kb.length = 16; -+ kb.contents = (unsigned char *)"1234567887654321"; -+ if (krb5_k_create_key(NULL, &kb, &cfx_subkey) != 0) -+ abort(); -+ -+ ctx = make_fake_cfx_context(cfx_subkey); - test_bogus_1964_token(ctx); -+ test_cfx_altered_ec(ctx, cfx_subkey); -+ test_cfx_short_plaintext(ctx, cfx_subkey); -+ test_cfx_large_ec(ctx, cfx_subkey); -+ test_iov_large_asn1_wrapper(ctx); - free_fake_context(ctx); - - for (i = 0; i < sizeof(tests) / sizeof(*tests); i++) { --- -2.45.1 - diff --git a/0017-Remove-klist-s-defname-global-variable.patch b/0019-Remove-klist-s-defname-global-variable.patch similarity index 93% rename from 0017-Remove-klist-s-defname-global-variable.patch rename to 0019-Remove-klist-s-defname-global-variable.patch index 56beacc..1cf7d80 100644 --- a/0017-Remove-klist-s-defname-global-variable.patch +++ b/0019-Remove-klist-s-defname-global-variable.patch @@ -1,4 +1,4 @@ -From c5cdf6f71621569c6c389be720937ac97ace988f Mon Sep 17 00:00:00 2001 +From 05bb6d9c729a3c6a4ba35270368bc0f6e1875ad0 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Mon, 8 Jan 2024 16:52:27 +0100 Subject: [PATCH] Remove klist's defname global variable @@ -13,12 +13,14 @@ Convert "defname" to a local variable initialized at the beginning of show_ccache(). [ghudson@mit.edu: edited commit message] + +(cherry picked from commit 5b00197227231943bd2305328c8260dd0b0dbcf0) --- src/clients/klist/klist.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/clients/klist/klist.c b/src/clients/klist/klist.c -index 43392d2337..394c75b6b7 100644 +index b5ae96a843..b5808e5c93 100644 --- a/src/clients/klist/klist.c +++ b/src/clients/klist/klist.c @@ -53,7 +53,6 @@ int show_flags = 0, show_time = 0, status_only = 0, show_keys = 0; @@ -65,5 +67,5 @@ index 43392d2337..394c75b6b7 100644 krb5_error_code ret; krb5_ticket *tkt = NULL; -- -2.41.0 +2.45.1 diff --git a/krb5.spec b/krb5.spec index cc17078..88e4de7 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 6 +%global baserelease 1 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -24,7 +24,7 @@ %global krb5_version_major 1 %global krb5_version_minor 21 # For a release without a patch number set to %%nil -%global krb5_version_patch 2 +%global krb5_version_patch 3 %global krb5_version_major_minor %{krb5_version_major}.%{krb5_version_minor} %global krb5_version %{krb5_version_major_minor} @@ -59,7 +59,7 @@ Source13: kadmind.logrotate Source14: krb5-krb5kdc.conf Source15: %{name}-tests -Patch0001: 0001-Revert-Don-t-issue-session-keys-with-deprecated-enct.patch +Patch0001: 0001-downstream-Revert-Don-t-issue-session-keys-with-depr.patch Patch0002: 0002-downstream-ksu-pam-integration.patch Patch0003: 0003-downstream-SELinux-integration.patch Patch0004: 0004-downstream-fix-debuginfo-with-y.tab.c.patch @@ -74,11 +74,12 @@ Patch0012: 0012-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch Patch0013: 0013-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch Patch0014: 0014-Enable-PKINIT-if-at-least-one-group-is-available.patch Patch0015: 0015-Replace-ssl.wrap_socket-for-tests.patch -Patch0016: 0016-Fix-unimportant-memory-leaks.patch -Patch0017: 0017-Remove-klist-s-defname-global-variable.patch -Patch0018: 0018-Fix-vulnerabilities-in-GSS-message-token-handling.patch +Patch0016: 0016-Eliminate-old-style-function-declarations.patch +Patch0017: 0017-Fix-two-unlikely-memory-leaks.patch +Patch0018: 0018-Fix-unimportant-memory-leaks.patch +Patch0019: 0019-Remove-klist-s-defname-global-variable.patch -License: BSD-2-Clause AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-3-Clause AND BSD-4-Clause AND FSFULLRWD AND HPND-export-US AND HPND-export-US-modify AND ISC AND MIT AND MIT-CMU AND OLDAP-2.8 AND RSA-MD +License: Brian-Gladman-2-Clause AND BSD-2-Clause AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-first-lines AND BSD-3-Clause AND BSD-4-Clause AND CMU-Mach-nodoc AND FSFULLRWD AND HPND AND HPND-export2-US AND HPND-export-US AND HPND-export-US-acknowledgement AND HPND-export-US-modify AND ISC AND MIT AND MIT-CMU AND OLDAP-2.8 AND OpenVision URL: https://web.mit.edu/kerberos/www/ BuildRequires: autoconf, bison, make, flex, gawk, gettext, pkgconfig, sed BuildRequires: gcc, gcc-c++ @@ -713,6 +714,17 @@ exit 0 %{_datarootdir}/%{name}-tests/%{_arch} %changelog +* Tue Jul 09 2024 Julien Rische - 1.21.3-1 +- New upstream version (1.21.3) +- CVE-2024-26458: Memory leak in src/lib/rpc/pmap_rmt.c + Resolves: rhbz#2266732 +- CVE-2024-26461: Memory leak in src/lib/gssapi/krb5/k5sealv3.c + Resolves: rhbz#2266741 +- CVE-2024-26462: Memory leak in src/kdc/ndr.c + Resolves: rhbz#2266743 +- Add missing SPDX license identifiers + Resolves: rhbz#2265333 + * Mon Jul 08 2024 Julien Rische - 1.21.2-6 - CVE-2024-37370 CVE-2024-37371: GSS message token handling Resolves: rhbz#2294678 rhbz#2294680 diff --git a/sources b/sources index 58dc8d0..e8b99ef 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (krb5-1.21.2.tar.gz) = 4e09296b412383d53872661718dbfaa90201e0d85f69db48e57a8d4bd73c95a90c7ec7b6f0f325f6bc967f8d203b256b071c0191facf080aca0e2caec5d0ac49 -SHA512 (krb5-1.21.2.tar.gz.asc) = 1cee1ed77047067d7b6fb3620ffa6f5807d4182ae7cfeec6d5cc847c99f30c6dd2a5c1a160d992a13eb6d84754b202895a982111618711f3c14f4aa33c07d9e9 +SHA512 (krb5-1.21.3.tar.gz) = 87bc06607f4d95ff604169cea22180703a42d667af05f66f1569b8bd592670c42820b335e5c279e8b4f066d1e7da20f1948a1e4def7c5d295c170cbfc7f49c71 +SHA512 (krb5-1.21.3.tar.gz.asc) = 8992a5f5247315b9846aa73be4ee1ea223c0231a52d5c6c28718b1f3e3b45d62e2dad4aa5543a83163d1369bb79886b6c1c22766f22d8aa2f6b2575c54d0075c From 9767c1c24e7e33d616e286f5b3cfb70dd4ac87d7 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 18 Jul 2024 12:40:10 +0000 Subject: [PATCH 093/103] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- krb5.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/krb5.spec b/krb5.spec index 88e4de7..9df5405 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 1 +%global baserelease 2 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -714,6 +714,9 @@ exit 0 %{_datarootdir}/%{name}-tests/%{_arch} %changelog +* Thu Jul 18 2024 Fedora Release Engineering - 1.21.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Tue Jul 09 2024 Julien Rische - 1.21.3-1 - New upstream version (1.21.3) - CVE-2024-26458: Memory leak in src/lib/rpc/pmap_rmt.c From 4c1f565dfadd698f3609de1b49745031c5ccdad6 Mon Sep 17 00:00:00 2001 From: Gordon Messmer Date: Sat, 3 Aug 2024 19:35:59 -0700 Subject: [PATCH 094/103] Examine the server process GOT for signs of tampering. --- tests/got-audit/got-audit.gdb | 2 + tests/got-audit/kdc.conf | 12 ++++ tests/got-audit/krb5.conf | 29 ++++++++ tests/got-audit/main.fmf | 12 ++++ tests/got-audit/runtest.sh | 121 ++++++++++++++++++++++++++++++++++ 5 files changed, 176 insertions(+) create mode 100644 tests/got-audit/got-audit.gdb create mode 100644 tests/got-audit/kdc.conf create mode 100644 tests/got-audit/krb5.conf create mode 100644 tests/got-audit/main.fmf create mode 100755 tests/got-audit/runtest.sh diff --git a/tests/got-audit/got-audit.gdb b/tests/got-audit/got-audit.gdb new file mode 100644 index 0000000..6661297 --- /dev/null +++ b/tests/got-audit/got-audit.gdb @@ -0,0 +1,2 @@ +gef config gef.disable_color True +got-audit --all diff --git a/tests/got-audit/kdc.conf b/tests/got-audit/kdc.conf new file mode 100644 index 0000000..ed7299f --- /dev/null +++ b/tests/got-audit/kdc.conf @@ -0,0 +1,12 @@ +[kdcdefaults] + kdc_ports = 88 + kdc_tcp_ports = 88 + +[realms] + ${krb5REALM1} = { + #master_key_type = aes256-cts + acl_file = /var/kerberos/krb5kdc/kadm5.acl + dict_file = /usr/share/dict/words + admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab + supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal + } diff --git a/tests/got-audit/krb5.conf b/tests/got-audit/krb5.conf new file mode 100644 index 0000000..6979cb7 --- /dev/null +++ b/tests/got-audit/krb5.conf @@ -0,0 +1,29 @@ +# To opt out of the system crypto-policies configuration of krb5, remove the +# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated. +includedir /etc/krb5.conf.d/ + +[logging] + default = FILE:/var/log/krb5libs.log + kdc = FILE:/var/log/krb5kdc.log + admin_server = FILE:/var/log/kadmind.log + +[libdefaults] + default_realm = ${krb5REALM1} + dns_lookup_realm = false + ticket_lifetime = 24h + renew_lifetime = 7d + forwardable = true + rdns = false + default_ccache_name = KEYRING:persistent:%{uid} + +[realms] + ${krb5REALM1} = { + kdc = localhost.localdomain + admin_server = localhost.localdomain + } + +[domain_realm] + ${krb5HostName} = ${krb5REALM1} + +[capaths] + ${krb5REALM1} = . diff --git a/tests/got-audit/main.fmf b/tests/got-audit/main.fmf new file mode 100644 index 0000000..f2c1f97 --- /dev/null +++ b/tests/got-audit/main.fmf @@ -0,0 +1,12 @@ +summary: Audit the GOT for signs of tampering +description: | + Pointers in the server process GOT will be checked to ensure that + each function pointer's value is within a shared object file + that exports a symbol of that name, and that no shared object + files export conflicting symbols. +contact: Gordon Messmer +require+: + - gdb-gef # needed to test got-audit + - krb5-server +test: ./runtest.sh +framework: beakerlib diff --git a/tests/got-audit/runtest.sh b/tests/got-audit/runtest.sh new file mode 100755 index 0000000..925a04e --- /dev/null +++ b/tests/got-audit/runtest.sh @@ -0,0 +1,121 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/openssh/Sanity/got-audit +# Description: Check pointers in the server process GOT for signs of tampering +# Author: Gordon Messmer +# + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +krb5REALM1='TEST1.REDHAT.COM' +krb5HostName=`hostname` +krb5DomainName=`hostname -d` +krb5User='alice' +krb5UserPass='alice' +krb5UserKrbPass='aaa' +krb5User2='bob' +krb5User3='carl' +krb5KDCPass='qwe' +krb5RootPass='rrr' + +krb5conf="/etc/krb5.conf" +krb5confdir="/etc/krb5.conf.d" +krb5kdcconf="/var/kerberos/krb5kdc/kdc.conf" +krb5kadmacl="/var/kerberos/krb5kdc/kadm5.acl" + +rlJournalStart + rlPhaseStartSetup + rlServiceStart sshd + rlRun "TestDir=\$(pwd)" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlRun "auditfile=\$(mktemp --tmpdir=${TmpDir})" + rlPhaseEnd + + rlPhaseStartSetup "KDC and kadmind setup" + # Stop and backup + rlRun "rlServiceStop kadmin krb5kdc" + rlRun "rm -f /var/kerberos/krb5kdc/principal* /var/kerberos/krb5kdc/.k5*" + rlFileBackup $krb5conf /var/kerberos/krb5kdc /etc/sysconfig/{kadmin,krb5kdc} /etc/hosts + rlFileBackup --clean /root/.k5login + [ -e /etc/krb5.keytab ] && rlFileBackup /etc/krb5.keytab + [ -e $krb5confdir ] && rlFileBackup $krb5confdir + # Basic setup of KDC and krb5.conf + rlRun "sed -i \"s/\[libdefaults\]/[libdefaults]\n default_realm = $krb5REALM1/\" $krb5conf" + rlRun "sed -i \"s/\[realms\]/[realms]\n $krb5REALM1 = {\n kdc = $krb5HostName\n admin_server = $krb5HostName\n }/\" $krb5conf" + if [ "$krb5DomainName" ]; then + rlRun "sed -i \"s/\[domain_realm\]/[domain_realm]\n .$krb5DomainName = $krb5REALM1\n $krb5DomainName = $krb5REALM1/\" $krb5conf" + else + rlRun "sed -i \"s/\[domain_realm\]/[domain_realm]\n $krb5HostName = $krb5REALM1/\" $krb5conf" + fi + rlRun "sed -i s/EXAMPLE.COM/$krb5REALM1/ $krb5kdcconf" + # Configure the kadmin ACL + rlRun "echo \"*/master@$krb5REALM1 *\" > $krb5kadmacl" + if rlIsFedora '>=31';then + rlLog "Modify supported_enctypes for Fedora >=31. Remove *DES ciphers." + rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal/\" /var/kerberos/krb5kdc/kdc.conf" + elif rlIsRHEL '8' && [ `rpm -q --qf '%{VERSION}' krb5-server | cut -d"." -f2` -lt 18 ];then + rlLog "Modify supported_enctypes for RHEL-8." + rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal/\" /var/kerberos/krb5kdc/kdc.conf" + else + #RHEL-8 Bug 1802334 - [Rebase] krb5: rebase to 1.18: + #- Removal of *DES encryption types + #https://bugzilla.redhat.com/show_bug.cgi?id=1802334 + rlLog "Modify supported_enctypes for RHEL-8 with krb-1.18. Remove *DES ciphers." + rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal/\" /var/kerberos/krb5kdc/kdc.conf" + fi + # Create the realm databases + rlRun "rngd -r /dev/urandom" + rlRun "kdb5_util create -s -r $krb5REALM1 -P $krb5KDCPass" + rlRun "rlServiceStart kadmin krb5kdc" + rlRun "kadmin.local -r $krb5REALM1 -q \"addprinc -pw $krb5RootPass root/master\"" + rlRun "kadmin.local -r $krb5REALM1 -q \"addprinc -pw $krb5UserKrbPass $krb5User\"" + rlRun "kadmin.local -r $krb5REALM1 -q \"addprinc -randkey host/$krb5HostName\"" + rlRun "kadmin.local -r $krb5REALM1 -q \"ktadd host/$krb5HostName\"" + # Create test system user + [ $krb5User != "root" ] && rlRun "useradd $krb5User" + rlRun "echo $krb5UserPass | passwd --stdin $krb5User" + rlPhaseEnd + + rlPhaseStartTest "Run GEF got-audit" + rlRun "systemctl restart krb5kdc.service" + rlRun "systemctl restart kadmin.service" + rlRun "systemctl --no-pager status krb5kdc.service" + rlRun "systemctl --no-pager status kadmin.service" + + rlRun "SERVICE_PID=\$( systemctl show --property=MainPID krb5kdc.service | cut -f2 -d= )" + rlRun "echo SERVICE_PID is '$SERVICE_PID'" + [ -n "$SERVICE_PID" ] || rlFail "No service pid was found" + rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'" + # Basic test: ensure that at least one symbol is found in libc.so, + # to verify that the report looks plausible. + rlAssertGrep " : /.*/libc.so" "$auditfile" + # Ensure the got-audit did not report any errors + rlAssertNotGrep " :: ERROR" "$auditfile" + rlRun "cp '$auditfile' '$TMT_TEST_DATA'/krb5kdc-got-audit.txt" + + rlRun "SERVICE_PID=\$( systemctl show --property=MainPID kadmin.service | cut -f2 -d= )" + rlRun "echo SERVICE_PID is '$SERVICE_PID'" + [ -n "$SERVICE_PID" ] || rlFail "No service pid was found" + rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'" + # Basic test: ensure that at least one symbol is found in libc.so, + # to verify that the report looks plausible. + rlAssertGrep " : /.*/libc.so" "$auditfile" + # Ensure the got-audit did not report any errors + rlAssertNotGrep " :: ERROR" "$auditfile" + rlRun "cp '$auditfile' '$TMT_TEST_DATA'/kadmin-got-audit.txt" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -rf /var/kerberos/krb5kdc/* /var/kerberos/krb5kdc/.k5* /etc/krb5* /etc/sysconfig/{kadmin,krb5kdc}" + rlFileRestore + rlServiceRestore krb5kdc kadmin + [ $krb5User != "root" ] && rlRun "userdel -r -f $krb5User" + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 9e0ac6c61688e049e1b9d2868eabe559bdefd27c Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Wed, 30 Oct 2024 12:30:57 +0100 Subject: [PATCH 095/103] krb5 1.21.3-3 - libkrad: implement support for Message-Authenticator (CVE-2024-3596) Resolves: rhbz#2304071 - Fix various issues detected by static analysis Resolves: rhbz#2322704 - Remove RSA protocol for PKINIT Resolves: rhbz#2322706 - Make TCP waiting time configurable Resolves: rhbz#2322711 Signed-off-by: Julien Rische --- ...onnection-on-KDC_ERR_SVC_UNAVAILABLE.patch | 34 + ...uest_timeout-configuration-parameter.patch | 226 +++ ...-indefinitely-on-KDC-TCP-connections.patch | 138 ++ 0023-Remove-PKINIT-RSA-support.patch | 1297 +++++++++++++++++ ...s-issues-detected-by-static-analysis.patch | 265 ++++ ...e-and-verify-message-MACs-in-libkrad.patch | 629 ++++++++ krb5.spec | 18 +- 7 files changed, 2606 insertions(+), 1 deletion(-) create mode 100644 0020-End-connection-on-KDC_ERR_SVC_UNAVAILABLE.patch create mode 100644 0021-Add-request_timeout-configuration-parameter.patch create mode 100644 0022-Wait-indefinitely-on-KDC-TCP-connections.patch create mode 100644 0023-Remove-PKINIT-RSA-support.patch create mode 100644 0024-Fix-various-issues-detected-by-static-analysis.patch create mode 100644 0025-Generate-and-verify-message-MACs-in-libkrad.patch diff --git a/0020-End-connection-on-KDC_ERR_SVC_UNAVAILABLE.patch b/0020-End-connection-on-KDC_ERR_SVC_UNAVAILABLE.patch new file mode 100644 index 0000000..1674fd6 --- /dev/null +++ b/0020-End-connection-on-KDC_ERR_SVC_UNAVAILABLE.patch @@ -0,0 +1,34 @@ +From d7bcca2a215de880f4419afc450a96a747d48560 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Fri, 27 Oct 2023 00:44:53 -0400 +Subject: [PATCH] End connection on KDC_ERR_SVC_UNAVAILABLE + +In sendto_kdc.c:service_fds(), if a message handler indicates that a +message should be discarded, kill the connection so we don't continue +waiting on it for more data. + +ticket: 7899 +(cherry picked from commit ca80f64c786341d5871ae1de18142e62af64f7b9) +--- + src/lib/krb5/os/sendto_kdc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c +index 0f4bf23a95..262edf09b4 100644 +--- a/src/lib/krb5/os/sendto_kdc.c ++++ b/src/lib/krb5/os/sendto_kdc.c +@@ -1440,7 +1440,10 @@ service_fds(krb5_context context, struct select_state *selstate, + if (msg_handler != NULL) { + krb5_data reply = make_data(state->in.buf, state->in.pos); + +- stop = (msg_handler(context, &reply, msg_handler_data) != 0); ++ if (!msg_handler(context, &reply, msg_handler_data)) { ++ kill_conn(context, state, selstate); ++ stop = 0; ++ } + } + + if (stop) { +-- +2.46.0 + diff --git a/0021-Add-request_timeout-configuration-parameter.patch b/0021-Add-request_timeout-configuration-parameter.patch new file mode 100644 index 0000000..5b84513 --- /dev/null +++ b/0021-Add-request_timeout-configuration-parameter.patch @@ -0,0 +1,226 @@ +From a07b3ae29fd972c40e30b95f6bcc8fb3ed4d9991 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Thu, 26 Oct 2023 14:20:34 -0400 +Subject: [PATCH] Add request_timeout configuration parameter + +Add a parameter to limit the total amount of time taken for a KDC or +password change request. + +ticket: 9106 (new) +(cherry picked from commit 802318cda963456b3ed7856c836e89da891483be) +--- + doc/admin/conf_files/krb5_conf.rst | 9 ++++++ + src/include/k5-int.h | 2 ++ + src/lib/krb5/krb/init_ctx.c | 14 +++++++- + src/lib/krb5/os/sendto_kdc.c | 51 ++++++++++++++++++++---------- + 4 files changed, 58 insertions(+), 18 deletions(-) + +diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst +index a33711d918..65fb592d98 100644 +--- a/doc/admin/conf_files/krb5_conf.rst ++++ b/doc/admin/conf_files/krb5_conf.rst +@@ -356,6 +356,15 @@ The libdefaults section may contain any of the following relations: + (:ref:`duration` string.) Sets the default renewable lifetime + for initial ticket requests. The default value is 0. + ++**request_timeout** ++ (:ref:`duration` string.) Sets the maximum total time for KDC or ++ password change requests. This timeout does not affect the ++ intervals between requests, so setting a low timeout may result in ++ fewer requests being attempted and/or some servers not being ++ contacted. A value of 0 indicates no specific maximum, in which ++ case requests will time out if no server responds after several ++ tries. The default value is 0. (New in release 1.22.) ++ + **spake_preauth_groups** + A whitespace or comma-separated list of words which specifies the + groups allowed for SPAKE preauthentication. The possible values +diff --git a/src/include/k5-int.h b/src/include/k5-int.h +index b3e07945c1..69d6a6f569 100644 +--- a/src/include/k5-int.h ++++ b/src/include/k5-int.h +@@ -296,6 +296,7 @@ typedef unsigned char u_char; + #define KRB5_CONF_SPAKE_PREAUTH_INDICATOR "spake_preauth_indicator" + #define KRB5_CONF_SPAKE_PREAUTH_KDC_CHALLENGE "spake_preauth_kdc_challenge" + #define KRB5_CONF_SPAKE_PREAUTH_GROUPS "spake_preauth_groups" ++#define KRB5_CONF_REQUEST_TIMEOUT "request_timeout" + #define KRB5_CONF_TICKET_LIFETIME "ticket_lifetime" + #define KRB5_CONF_UDP_PREFERENCE_LIMIT "udp_preference_limit" + #define KRB5_CONF_UNLOCKITER "unlockiter" +@@ -1200,6 +1201,7 @@ struct _krb5_context { + kdb5_dal_handle *dal_handle; + /* allowable clock skew */ + krb5_deltat clockskew; ++ krb5_deltat req_timeout; + krb5_flags kdc_default_options; + krb5_flags library_options; + krb5_boolean profile_secure; +diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c +index 2b5abcd817..582a2945ff 100644 +--- a/src/lib/krb5/krb/init_ctx.c ++++ b/src/lib/krb5/krb/init_ctx.c +@@ -157,7 +157,7 @@ krb5_init_context_profile(profile_t profile, krb5_flags flags, + krb5_context ctx = 0; + krb5_error_code retval; + int tmp; +- char *plugin_dir = NULL; ++ char *plugin_dir = NULL, *timeout_str = NULL; + + /* Verify some assumptions. If the assumptions hold and the + compiler is optimizing, this should result in no code being +@@ -240,6 +240,17 @@ krb5_init_context_profile(profile_t profile, krb5_flags flags, + get_integer(ctx, KRB5_CONF_CLOCKSKEW, DEFAULT_CLOCKSKEW, &tmp); + ctx->clockskew = tmp; + ++ retval = profile_get_string(ctx->profile, KRB5_CONF_LIBDEFAULTS, ++ KRB5_CONF_REQUEST_TIMEOUT, NULL, NULL, ++ &timeout_str); ++ if (retval) ++ goto cleanup; ++ if (timeout_str != NULL) { ++ retval = krb5_string_to_deltat(timeout_str, &ctx->req_timeout); ++ if (retval) ++ goto cleanup; ++ } ++ + get_integer(ctx, KRB5_CONF_KDC_DEFAULT_OPTIONS, KDC_OPT_RENEWABLE_OK, + &tmp); + ctx->kdc_default_options = tmp; +@@ -281,6 +292,7 @@ krb5_init_context_profile(profile_t profile, krb5_flags flags, + + cleanup: + profile_release_string(plugin_dir); ++ profile_release_string(timeout_str); + krb5_free_context(ctx); + return retval; + } +diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c +index 262edf09b4..98247a1089 100644 +--- a/src/lib/krb5/os/sendto_kdc.c ++++ b/src/lib/krb5/os/sendto_kdc.c +@@ -1395,34 +1395,41 @@ get_endtime(time_ms endtime, struct conn_state *conns) + + static krb5_boolean + service_fds(krb5_context context, struct select_state *selstate, +- time_ms interval, struct conn_state *conns, ++ time_ms interval, time_ms timeout, struct conn_state *conns, + struct select_state *seltemp, const krb5_data *realm, + int (*msg_handler)(krb5_context, const krb5_data *, void *), + void *msg_handler_data, struct conn_state **winner_out) + { + int e, selret = 0; +- time_ms endtime; ++ time_ms curtime, interval_end, endtime; + struct conn_state *state; + + *winner_out = NULL; + +- e = get_curtime_ms(&endtime); ++ e = get_curtime_ms(&curtime); + if (e) + return TRUE; +- endtime += interval; ++ interval_end = curtime + interval; + + e = 0; + while (selstate->nfds > 0) { +- e = cm_select_or_poll(selstate, get_endtime(endtime, conns), +- seltemp, &selret); ++ endtime = get_endtime(interval_end, conns); ++ /* Don't wait longer than the whole request should last. */ ++ if (timeout && endtime > timeout) ++ endtime = timeout; ++ e = cm_select_or_poll(selstate, endtime, seltemp, &selret); + if (e == EINTR) + continue; + if (e != 0) + break; + +- if (selret == 0) +- /* Timeout, return to caller. */ ++ if (selret == 0) { ++ /* We timed out. Stop if we hit the overall request timeout. */ ++ if (timeout && (get_curtime_ms(&curtime) || curtime >= timeout)) ++ return TRUE; ++ /* Otherwise return to the caller to send the next request. */ + return FALSE; ++ } + + /* Got something on a socket, process it. */ + for (state = conns; state != NULL; state = state->next) { +@@ -1495,7 +1502,7 @@ k5_sendto(krb5_context context, const krb5_data *message, + void *msg_handler_data) + { + int pass; +- time_ms delay; ++ time_ms delay, timeout = 0; + krb5_error_code retval; + struct conn_state *conns = NULL, *state, **tailptr, *next, *winner; + size_t s; +@@ -1505,6 +1512,13 @@ k5_sendto(krb5_context context, const krb5_data *message, + + *reply = empty_data(); + ++ if (context->req_timeout) { ++ retval = get_curtime_ms(&timeout); ++ if (retval) ++ return retval; ++ timeout += 1000 * context->req_timeout; ++ } ++ + /* One for use here, listing all our fds in use, and one for + * temporary use in service_fds, for the fds of interest. */ + sel_state = malloc(2 * sizeof(*sel_state)); +@@ -1532,8 +1546,9 @@ k5_sendto(krb5_context context, const krb5_data *message, + if (maybe_send(context, state, message, sel_state, realm, + callback_info)) + continue; +- done = service_fds(context, sel_state, 1000, conns, seltemp, +- realm, msg_handler, msg_handler_data, &winner); ++ done = service_fds(context, sel_state, 1000, timeout, conns, ++ seltemp, realm, msg_handler, msg_handler_data, ++ &winner); + } + } + +@@ -1545,13 +1560,13 @@ k5_sendto(krb5_context context, const krb5_data *message, + if (maybe_send(context, state, message, sel_state, realm, + callback_info)) + continue; +- done = service_fds(context, sel_state, 1000, conns, seltemp, ++ done = service_fds(context, sel_state, 1000, timeout, conns, seltemp, + realm, msg_handler, msg_handler_data, &winner); + } + + /* Wait for two seconds at the end of the first pass. */ + if (!done) { +- done = service_fds(context, sel_state, 2000, conns, seltemp, ++ done = service_fds(context, sel_state, 2000, timeout, conns, seltemp, + realm, msg_handler, msg_handler_data, &winner); + } + +@@ -1562,15 +1577,17 @@ k5_sendto(krb5_context context, const krb5_data *message, + if (maybe_send(context, state, message, sel_state, realm, + callback_info)) + continue; +- done = service_fds(context, sel_state, 1000, conns, seltemp, +- realm, msg_handler, msg_handler_data, &winner); ++ done = service_fds(context, sel_state, 1000, timeout, conns, ++ seltemp, realm, msg_handler, msg_handler_data, ++ &winner); + if (sel_state->nfds == 0) + break; + } + /* Wait for the delay backoff at the end of this pass. */ + if (!done) { +- done = service_fds(context, sel_state, delay, conns, seltemp, +- realm, msg_handler, msg_handler_data, &winner); ++ done = service_fds(context, sel_state, delay, timeout, conns, ++ seltemp, realm, msg_handler, msg_handler_data, ++ &winner); + } + if (sel_state->nfds == 0) + break; +-- +2.46.0 + diff --git a/0022-Wait-indefinitely-on-KDC-TCP-connections.patch b/0022-Wait-indefinitely-on-KDC-TCP-connections.patch new file mode 100644 index 0000000..26b884b --- /dev/null +++ b/0022-Wait-indefinitely-on-KDC-TCP-connections.patch @@ -0,0 +1,138 @@ +From 1da153d97d7fb30a44fca35f9b71b8f4ed5385b9 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Thu, 26 Oct 2023 16:26:42 -0400 +Subject: [PATCH] Wait indefinitely on KDC TCP connections + +When making a KDC or password change request, wait indefinitely +(limited only by request_timeout if set) once a KDC has accepted a TCP +connection. + +ticket: 9105 (new) +(cherry picked from commit 6436a3808061da787a43c6810f5f0370cdfb6e36) +--- + doc/admin/conf_files/krb5_conf.rst | 2 +- + src/lib/krb5/os/sendto_kdc.c | 50 ++++++++++++++++-------------- + 2 files changed, 27 insertions(+), 25 deletions(-) + +diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst +index 65fb592d98..b7284c47df 100644 +--- a/doc/admin/conf_files/krb5_conf.rst ++++ b/doc/admin/conf_files/krb5_conf.rst +@@ -357,7 +357,7 @@ The libdefaults section may contain any of the following relations: + for initial ticket requests. The default value is 0. + + **request_timeout** +- (:ref:`duration` string.) Sets the maximum total time for KDC or ++ (:ref:`duration` string.) Sets the maximum total time for KDC and + password change requests. This timeout does not affect the + intervals between requests, so setting a low timeout may result in + fewer requests being attempted and/or some servers not being +diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c +index 98247a1089..924f5b2d26 100644 +--- a/src/lib/krb5/os/sendto_kdc.c ++++ b/src/lib/krb5/os/sendto_kdc.c +@@ -134,7 +134,6 @@ struct conn_state { + krb5_data callback_buffer; + size_t server_index; + struct conn_state *next; +- time_ms endtime; + krb5_boolean defer; + struct { + const char *uri_path; +@@ -344,15 +343,19 @@ cm_select_or_poll(const struct select_state *in, time_ms endtime, + struct select_state *out, int *sret) + { + #ifndef USE_POLL +- struct timeval tv; ++ struct timeval tv, *tvp; + #endif + krb5_error_code retval; + time_ms curtime, interval; + +- retval = get_curtime_ms(&curtime); +- if (retval != 0) +- return retval; +- interval = (curtime < endtime) ? endtime - curtime : 0; ++ if (endtime != 0) { ++ retval = get_curtime_ms(&curtime); ++ if (retval != 0) ++ return retval; ++ interval = (curtime < endtime) ? endtime - curtime : 0; ++ } else { ++ interval = -1; ++ } + + /* We don't need a separate copy of the selstate for poll, but use one for + * consistency with how we use select. */ +@@ -361,9 +364,14 @@ cm_select_or_poll(const struct select_state *in, time_ms endtime, + #ifdef USE_POLL + *sret = poll(out->fds, out->nfds, interval); + #else +- tv.tv_sec = interval / 1000; +- tv.tv_usec = interval % 1000 * 1000; +- *sret = select(out->max, &out->rfds, &out->wfds, &out->xfds, &tv); ++ if (interval != -1) { ++ tv.tv_sec = interval / 1000; ++ tv.tv_usec = interval % 1000 * 1000; ++ tvp = &tv; ++ } else { ++ tvp = NULL; ++ } ++ *sret = select(out->max, &out->rfds, &out->wfds, &out->xfds, tvp); + #endif + + return (*sret < 0) ? SOCKET_ERRNO : 0; +@@ -1099,11 +1107,6 @@ service_tcp_connect(krb5_context context, const krb5_data *realm, + } + + conn->state = WRITING; +- +- /* Record this connection's timeout for service_fds. */ +- if (get_curtime_ms(&conn->endtime) == 0) +- conn->endtime += 10000; +- + return conn->service_write(context, realm, conn, selstate); + } + +@@ -1378,19 +1381,18 @@ kill_conn: + return FALSE; + } + +-/* Return the maximum of endtime and the endtime fields of all currently active +- * TCP connections. */ +-static time_ms +-get_endtime(time_ms endtime, struct conn_state *conns) ++/* Return true if conns contains any states with connected TCP sockets. */ ++static krb5_boolean ++any_tcp_connections(struct conn_state *conns) + { + struct conn_state *state; + + for (state = conns; state != NULL; state = state->next) { +- if ((state->state == READING || state->state == WRITING) && +- state->endtime > endtime) +- endtime = state->endtime; ++ if (state->addr.transport != UDP && ++ (state->state == READING || state->state == WRITING)) ++ return TRUE; + } +- return endtime; ++ return FALSE; + } + + static krb5_boolean +@@ -1413,9 +1415,9 @@ service_fds(krb5_context context, struct select_state *selstate, + + e = 0; + while (selstate->nfds > 0) { +- endtime = get_endtime(interval_end, conns); ++ endtime = any_tcp_connections(conns) ? 0 : interval_end; + /* Don't wait longer than the whole request should last. */ +- if (timeout && endtime > timeout) ++ if (timeout && (!endtime || endtime > timeout)) + endtime = timeout; + e = cm_select_or_poll(selstate, endtime, seltemp, &selret); + if (e == EINTR) +-- +2.46.0 + diff --git a/0023-Remove-PKINIT-RSA-support.patch b/0023-Remove-PKINIT-RSA-support.patch new file mode 100644 index 0000000..7672f02 --- /dev/null +++ b/0023-Remove-PKINIT-RSA-support.patch @@ -0,0 +1,1297 @@ +From 4f008362334dc2d66d67453448061e19feda889d Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Sun, 26 Nov 2023 17:42:34 -0500 +Subject: [PATCH] Remove PKINIT RSA support + +RSA mode is no longer needed for interoperability. Reduce the attack +surface of clients and KDCs by removing support for it. + +ticket: 9108 (new) +(cherry picked from commit 401f584526e501b68e7516c17d8e467883f8f210) +--- + doc/user/user_commands/kinit.rst | 4 - + src/plugins/preauth/pkinit/pkinit.h | 2 - + src/plugins/preauth/pkinit/pkinit_clnt.c | 235 +++----- + src/plugins/preauth/pkinit/pkinit_crypto.h | 39 -- + .../preauth/pkinit/pkinit_crypto_openssl.c | 504 ------------------ + src/plugins/preauth/pkinit/pkinit_lib.c | 2 - + src/plugins/preauth/pkinit/pkinit_srv.c | 208 +++----- + src/plugins/preauth/pkinit/pkinit_trace.h | 9 - + src/tests/t_pkinit.py | 7 - + src/windows/leash/htmlhelp/html/KINIT.htm | 3 - + 10 files changed, 131 insertions(+), 882 deletions(-) + +diff --git a/doc/user/user_commands/kinit.rst b/doc/user/user_commands/kinit.rst +index 5b105e35a5..d947e83cc6 100644 +--- a/doc/user/user_commands/kinit.rst ++++ b/doc/user/user_commands/kinit.rst +@@ -193,10 +193,6 @@ OPTIONS + **X509_anchors**\ =\ *value* + specify where to find trusted X509 anchor information + +- **flag_RSA_PROTOCOL**\ [**=yes**] +- specify use of RSA, rather than the default Diffie-Hellman +- protocol +- + **disable_freshness**\ [**=yes**] + disable sending freshness tokens (for testing purposes only) + +diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h +index 66f92d8f03..5ab0f4bc28 100644 +--- a/src/plugins/preauth/pkinit/pkinit.h ++++ b/src/plugins/preauth/pkinit/pkinit.h +@@ -146,7 +146,6 @@ typedef struct _pkinit_plg_opts { + int require_eku; /* require EKU checking (default is true) */ + int accept_secondary_eku;/* accept secondary EKU (default is false) */ + int allow_upn; /* allow UPN-SAN instead of pkinit-SAN */ +- int dh_or_rsa; /* selects DH or RSA based pkinit */ + int require_crl_checking; /* require CRL for a CA (default is false) */ + int require_freshness; /* require freshness token (default is false) */ + int disable_freshness; /* disable freshness token on client for testing */ +@@ -160,7 +159,6 @@ typedef struct _pkinit_req_opts { + int require_eku; + int accept_secondary_eku; + int allow_upn; +- int dh_or_rsa; + int require_crl_checking; + int dh_size; /* initial request DH modulus size (default=1024) */ + int require_hostname_match; +diff --git a/src/plugins/preauth/pkinit/pkinit_clnt.c b/src/plugins/preauth/pkinit/pkinit_clnt.c +index ea9ba454df..54e7537600 100644 +--- a/src/plugins/preauth/pkinit/pkinit_clnt.c ++++ b/src/plugins/preauth/pkinit/pkinit_clnt.c +@@ -191,7 +191,6 @@ pkinit_as_req_create(krb5_context context, + krb5_auth_pack auth_pack; + krb5_pa_pk_as_req *req = NULL; + krb5_algorithm_identifier **cmstypes = NULL; +- int protocol = reqctx->opts->dh_or_rsa; + + pkiDebug("pkinit_as_req_create pa_type = %d\n", reqctx->pa_type); + +@@ -214,29 +213,14 @@ pkinit_as_req_create(krb5_context context, + if (retval) + goto cleanup; + +- switch(protocol) { +- case DH_PROTOCOL: +- TRACE_PKINIT_CLIENT_REQ_DH(context); +- pkiDebug("as_req: DH key transport algorithm\n"); ++ TRACE_PKINIT_CLIENT_REQ_DH(context); + +- /* create client-side DH keys */ +- retval = client_create_dh(context, plgctx->cryptoctx, +- reqctx->cryptoctx, reqctx->idctx, +- reqctx->opts->dh_size, &spki); +- auth_pack.clientPublicValue = spki; +- if (retval != 0) { +- pkiDebug("failed to create dh parameters\n"); +- goto cleanup; +- } +- break; +- case RSA_PROTOCOL: +- TRACE_PKINIT_CLIENT_REQ_RSA(context); +- pkiDebug("as_req: RSA key transport algorithm\n"); +- break; +- default: +- pkiDebug("as_req: unknown key transport protocol %d\n", +- protocol); +- retval = -1; ++ /* create client-side DH keys */ ++ retval = client_create_dh(context, plgctx->cryptoctx, reqctx->cryptoctx, ++ reqctx->idctx, reqctx->opts->dh_size, &spki); ++ auth_pack.clientPublicValue = spki; ++ if (retval != 0) { ++ pkiDebug("failed to create dh parameters\n"); + goto cleanup; + } + +@@ -553,49 +537,34 @@ pkinit_as_rep_parse(krb5_context context, + return retval; + } + +- switch(kdc_reply->choice) { +- case choice_pa_pk_as_rep_dhInfo: +- pkiDebug("as_rep: DH key transport algorithm\n"); ++ if (kdc_reply->choice != choice_pa_pk_as_rep_dhInfo) { ++ pkiDebug("unknown as_rep type %d\n", kdc_reply->choice); ++ retval = KRB5KDC_ERR_PREAUTH_FAILED; ++ goto cleanup; ++ } ++ + #ifdef DEBUG_ASN1 +- print_buffer_bin(kdc_reply->u.dh_Info.dhSignedData.data, +- kdc_reply->u.dh_Info.dhSignedData.length, "/tmp/client_kdc_signeddata"); ++ print_buffer_bin(kdc_reply->u.dh_Info.dhSignedData.data, ++ kdc_reply->u.dh_Info.dhSignedData.length, ++ "/tmp/client_kdc_signeddata"); + #endif +- if ((retval = cms_signeddata_verify(context, plgctx->cryptoctx, +- reqctx->cryptoctx, reqctx->idctx, CMS_SIGN_SERVER, +- reqctx->opts->require_crl_checking, +- (unsigned char *) +- kdc_reply->u.dh_Info.dhSignedData.data, +- kdc_reply->u.dh_Info.dhSignedData.length, +- (unsigned char **)&dh_data.data, +- &dh_data.length, +- NULL, NULL, NULL)) != 0) { +- pkiDebug("failed to verify pkcs7 signed data\n"); +- TRACE_PKINIT_CLIENT_REP_DH_FAIL(context); +- goto cleanup; +- } +- TRACE_PKINIT_CLIENT_REP_DH(context); +- break; +- case choice_pa_pk_as_rep_encKeyPack: +- pkiDebug("as_rep: RSA key transport algorithm\n"); +- if ((retval = cms_envelopeddata_verify(context, plgctx->cryptoctx, +- reqctx->cryptoctx, reqctx->idctx, pa_type, +- reqctx->opts->require_crl_checking, +- (unsigned char *) +- kdc_reply->u.encKeyPack.data, +- kdc_reply->u.encKeyPack.length, +- (unsigned char **)&dh_data.data, +- &dh_data.length)) != 0) { +- pkiDebug("failed to verify pkcs7 enveloped data\n"); +- TRACE_PKINIT_CLIENT_REP_RSA_FAIL(context); +- goto cleanup; +- } +- TRACE_PKINIT_CLIENT_REP_RSA(context); +- break; +- default: +- pkiDebug("unknown as_rep type %d\n", kdc_reply->choice); +- retval = -1; ++ retval = cms_signeddata_verify(context, plgctx->cryptoctx, ++ reqctx->cryptoctx, reqctx->idctx, ++ CMS_SIGN_SERVER, ++ reqctx->opts->require_crl_checking, ++ (unsigned char *) ++ kdc_reply->u.dh_Info.dhSignedData.data, ++ kdc_reply->u.dh_Info.dhSignedData.length, ++ (unsigned char **)&dh_data.data, ++ &dh_data.length, ++ NULL, NULL, NULL); ++ if (retval) { ++ pkiDebug("failed to verify pkcs7 signed data\n"); ++ TRACE_PKINIT_CLIENT_REP_DH_FAIL(context); + goto cleanup; + } ++ TRACE_PKINIT_CLIENT_REP_DH(context); ++ + retval = krb5_build_principal_ext(context, &kdc_princ, + request->server->realm.length, + request->server->realm.data, +@@ -632,116 +601,54 @@ pkinit_as_rep_parse(krb5_context context, + + OCTETDATA_TO_KRB5DATA(&dh_data, &k5data); + +- switch(kdc_reply->choice) { +- case choice_pa_pk_as_rep_dhInfo: + #ifdef DEBUG_ASN1 +- print_buffer_bin(dh_data.data, dh_data.length, +- "/tmp/client_dh_key"); ++ print_buffer_bin(dh_data.data, dh_data.length, "/tmp/client_dh_key"); + #endif +- if ((retval = k5int_decode_krb5_kdc_dh_key_info(&k5data, +- &kdc_dh)) != 0) { +- pkiDebug("failed to decode kdc_dh_key_info\n"); +- goto cleanup; +- } +- +- /* client after KDC reply */ +- if ((retval = client_process_dh(context, plgctx->cryptoctx, +- reqctx->cryptoctx, reqctx->idctx, +- (unsigned char *) +- kdc_dh->subjectPublicKey.data, +- kdc_dh->subjectPublicKey.length, +- &client_key, &client_key_len)) != 0) { +- pkiDebug("failed to process dh params\n"); +- goto cleanup; +- } +- +- /* If we have a KDF algorithm ID, call the algorithm agility KDF... */ +- if (kdc_reply->u.dh_Info.kdfID) { +- secret.length = client_key_len; +- secret.data = (char *)client_key; +- +- retval = pkinit_alg_agility_kdf(context, &secret, +- kdc_reply->u.dh_Info.kdfID, +- request->client, request->server, +- etype, encoded_request, +- (krb5_data *)as_rep, key_block); +- +- if (retval) { +- pkiDebug("failed to create key pkinit_alg_agility_kdf %s\n", +- error_message(retval)); +- goto cleanup; +- } +- TRACE_PKINIT_CLIENT_KDF_ALG(context, kdc_reply->u.dh_Info.kdfID, +- key_block); ++ retval = k5int_decode_krb5_kdc_dh_key_info(&k5data, &kdc_dh); ++ if (retval) { ++ pkiDebug("failed to decode kdc_dh_key_info\n"); ++ goto cleanup; ++ } + +- /* ...otherwise, use the older octetstring2key function. */ +- } else { ++ /* client after KDC reply */ ++ retval = client_process_dh(context, plgctx->cryptoctx, reqctx->cryptoctx, ++ reqctx->idctx, ++ (unsigned char *)kdc_dh->subjectPublicKey.data, ++ kdc_dh->subjectPublicKey.length, &client_key, ++ &client_key_len); ++ if (retval) { ++ pkiDebug("failed to process dh params\n"); ++ goto cleanup; ++ } + +- retval = pkinit_octetstring2key(context, etype, client_key, +- client_key_len, key_block); +- if (retval) { +- pkiDebug("failed to create key pkinit_octetstring2key %s\n", +- error_message(retval)); +- goto cleanup; +- } +- TRACE_PKINIT_CLIENT_KDF_OS2K(context, key_block); +- } ++ /* If we have a KDF algorithm ID, call the algorithm agility KDF. */ ++ if (kdc_reply->u.dh_Info.kdfID) { ++ secret.length = client_key_len; ++ secret.data = (char *)client_key; + +- break; +- case choice_pa_pk_as_rep_encKeyPack: +-#ifdef DEBUG_ASN1 +- print_buffer_bin(dh_data.data, dh_data.length, +- "/tmp/client_key_pack"); +-#endif +- retval = k5int_decode_krb5_reply_key_pack(&k5data, &key_pack); ++ retval = pkinit_alg_agility_kdf(context, &secret, ++ kdc_reply->u.dh_Info.kdfID, ++ request->client, request->server, ++ etype, encoded_request, ++ (krb5_data *)as_rep, key_block); + if (retval) { +- pkiDebug("failed to decode reply_key_pack\n"); ++ pkiDebug("failed to create key pkinit_alg_agility_kdf %s\n", ++ error_message(retval)); + goto cleanup; + } +- retval = krb5_c_make_checksum(context, +- key_pack->asChecksum.checksum_type, +- &key_pack->replyKey, +- KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM, +- encoded_request, &cksum); ++ TRACE_PKINIT_CLIENT_KDF_ALG(context, kdc_reply->u.dh_Info.kdfID, ++ key_block); ++ ++ } else { ++ /* Otherwise, use the older octetstring2key function. */ ++ retval = pkinit_octetstring2key(context, etype, client_key, ++ client_key_len, key_block); + if (retval) { +- pkiDebug("failed to make a checksum\n"); ++ pkiDebug("failed to create key pkinit_octetstring2key %s\n", ++ error_message(retval)); + goto cleanup; + } +- +- if ((cksum.length != key_pack->asChecksum.length) || +- k5_bcmp(cksum.contents, key_pack->asChecksum.contents, +- cksum.length) != 0) { +- TRACE_PKINIT_CLIENT_REP_CHECKSUM_FAIL(context, &cksum, +- &key_pack->asChecksum); +- pkiDebug("failed to match the checksums\n"); +-#ifdef DEBUG_CKSUM +- pkiDebug("calculating checksum on buf size (%d)\n", +- encoded_request->length); +- print_buffer(encoded_request->data, encoded_request->length); +- pkiDebug("encrypting key (%d)\n", key_pack->replyKey.length); +- print_buffer(key_pack->replyKey.contents, +- key_pack->replyKey.length); +- pkiDebug("received checksum type=%d size=%d ", +- key_pack->asChecksum.checksum_type, +- key_pack->asChecksum.length); +- print_buffer(key_pack->asChecksum.contents, +- key_pack->asChecksum.length); +- pkiDebug("expected checksum type=%d size=%d ", +- cksum.checksum_type, cksum.length); +- print_buffer(cksum.contents, cksum.length); +-#endif +- goto cleanup; +- } else +- pkiDebug("checksums match\n"); +- +- krb5_copy_keyblock_contents(context, &key_pack->replyKey, +- key_block); +- TRACE_PKINIT_CLIENT_REP_RSA_KEY(context, key_block, &cksum); +- +- break; +- default: +- pkiDebug("unknown as_rep type %d\n", kdc_reply->choice); +- goto cleanup; ++ TRACE_PKINIT_CLIENT_KDF_OS2K(context, key_block); + } + + retval = 0; +@@ -1286,7 +1193,6 @@ pkinit_client_req_init(krb5_context context, + + reqctx->opts->require_eku = plgctx->opts->require_eku; + reqctx->opts->accept_secondary_eku = plgctx->opts->accept_secondary_eku; +- reqctx->opts->dh_or_rsa = plgctx->opts->dh_or_rsa; + reqctx->opts->allow_upn = plgctx->opts->allow_upn; + reqctx->opts->require_crl_checking = plgctx->opts->require_crl_checking; + reqctx->opts->disable_freshness = plgctx->opts->disable_freshness; +@@ -1457,11 +1363,6 @@ handle_gic_opt(krb5_context context, + retval = add_string_to_array(context, &plgctx->idopts->anchors, value); + if (retval) + return retval; +- } else if (strcmp(attr, "flag_RSA_PROTOCOL") == 0) { +- if (strcmp(value, "yes") == 0) { +- pkiDebug("Setting flag to use RSA_PROTOCOL\n"); +- plgctx->opts->dh_or_rsa = RSA_PROTOCOL; +- } + } else if (strcmp(attr, "disable_freshness") == 0) { + if (strcmp(value, "yes") == 0) + plgctx->opts->disable_freshness = 1; +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h +index 8bdbea8e95..04199b45a4 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto.h ++++ b/src/plugins/preauth/pkinit/pkinit_crypto.h +@@ -181,45 +181,6 @@ krb5_error_code cms_signeddata_verify + int *is_signed); /* OUT + receives whether message is signed */ + +-/* +- * this function creates a CMS message where eContentType is EnvelopedData +- */ +-krb5_error_code cms_envelopeddata_create +- (krb5_context context, /* IN */ +- pkinit_plg_crypto_context plg_cryptoctx, /* IN */ +- pkinit_req_crypto_context req_cryptoctx, /* IN */ +- pkinit_identity_crypto_context id_cryptoctx, /* IN */ +- krb5_preauthtype pa_type, /* IN */ +- unsigned char *key_pack, /* IN +- contains DER encoded ReplyKeyPack */ +- unsigned int key_pack_len, /* IN +- contains length of key_pack */ +- unsigned char **envel_data, /* OUT +- receives DER encoded encKeyPack */ +- unsigned int *envel_data_len); /* OUT +- receives length of envel_data */ +- +-/* +- * this function creates a CMS message where eContentType is EnvelopedData +- */ +-krb5_error_code cms_envelopeddata_verify +- (krb5_context context, /* IN */ +- pkinit_plg_crypto_context plg_cryptoctx, /* IN */ +- pkinit_req_crypto_context req_cryptoctx, /* IN */ +- pkinit_identity_crypto_context id_cryptoctx, /* IN */ +- krb5_preauthtype pa_type, /* IN */ +- int require_crl_checking, /* IN +- specifies whether CRL checking should be +- strictly enforced */ +- unsigned char *envel_data, /* IN +- contains DER encoded encKeyPack */ +- unsigned int envel_data_len, /* IN +- contains length of envel_data */ +- unsigned char **signed_data, /* OUT +- receives ReplyKeyPack */ +- unsigned int *signed_data_len); /* OUT +- receives length of signed_data */ +- + /* + * This function retrieves the signer's identity, in a form that could + * be passed back in to a future invocation of this module as a candidate +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index f5aade34cc..26fa9184b3 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -66,26 +66,14 @@ static krb5_error_code create_signature + (unsigned char **, unsigned int *, unsigned char *, unsigned int, + EVP_PKEY *pkey); + +-static krb5_error_code pkinit_decode_data +-(krb5_context context, pkinit_identity_crypto_context cryptoctx, +- const uint8_t *data, unsigned int data_len, uint8_t **decoded, +- unsigned int *decoded_len); +- + #ifdef DEBUG_DH + static void print_dh(DH *, char *); + static void print_pubkey(BIGNUM *, char *); + #endif + +-static int prepare_enc_data +-(const uint8_t *indata, int indata_len, uint8_t **outdata, int *outdata_len); +- + static int openssl_callback (int, X509_STORE_CTX *); + static int openssl_callback_ignore_crls (int, X509_STORE_CTX *); + +-static int pkcs7_decrypt +-(krb5_context context, pkinit_identity_crypto_context id_cryptoctx, PKCS7 *p7, +- unsigned char **data_out, unsigned int *len_out); +- + static ASN1_OBJECT * pkinit_pkcs7type2oid + (pkinit_plg_crypto_context plg_cryptoctx, int pkcs7_type); + +@@ -115,20 +103,12 @@ static krb5_error_code pkinit_sign_data_pkcs11 + (krb5_context context, pkinit_identity_crypto_context id_cryptoctx, + unsigned char *data, unsigned int data_len, + unsigned char **sig, unsigned int *sig_len); +-static krb5_error_code pkinit_decode_data_pkcs11 +-(krb5_context context, pkinit_identity_crypto_context id_cryptoctx, +- const uint8_t *data, unsigned int data_len, uint8_t **decoded_data, +- unsigned int *decoded_data_len); + #endif /* WITHOUT_PKCS11 */ + + static krb5_error_code pkinit_sign_data_fs + (krb5_context context, pkinit_identity_crypto_context id_cryptoctx, + unsigned char *data, unsigned int data_len, + unsigned char **sig, unsigned int *sig_len); +-static krb5_error_code pkinit_decode_data_fs +-(krb5_context context, pkinit_identity_crypto_context id_cryptoctx, +- const uint8_t *data, unsigned int data_len, uint8_t **decoded_data, +- unsigned int *decoded_data_len); + + static krb5_error_code + create_krb5_invalidCertificates(krb5_context context, +@@ -140,10 +120,6 @@ create_krb5_invalidCertificates(krb5_context context, + static krb5_error_code + create_identifiers_from_stack(STACK_OF(X509) *sk, + krb5_external_principal_identifier *** ids); +-static int +-wrap_signeddata(unsigned char *data, unsigned int data_len, +- unsigned char **out, unsigned int *out_len); +- + static const char * + pkcs11err(int err); + +@@ -2177,177 +2153,6 @@ cleanup: + return retval; + } + +-krb5_error_code +-cms_envelopeddata_create(krb5_context context, +- pkinit_plg_crypto_context plgctx, +- pkinit_req_crypto_context reqctx, +- pkinit_identity_crypto_context idctx, +- krb5_preauthtype pa_type, +- unsigned char *key_pack, +- unsigned int key_pack_len, +- unsigned char **out, +- unsigned int *out_len) +-{ +- +- krb5_error_code retval = ENOMEM; +- PKCS7 *p7 = NULL; +- BIO *in = NULL; +- unsigned char *p = NULL, *signed_data = NULL, *enc_data = NULL; +- int signed_data_len = 0, enc_data_len = 0, flags = PKCS7_BINARY; +- STACK_OF(X509) *encerts = NULL; +- const EVP_CIPHER *cipher = NULL; +- +- retval = cms_signeddata_create(context, plgctx, reqctx, idctx, +- CMS_ENVEL_SERVER, key_pack, key_pack_len, +- &signed_data, +- (unsigned int *)&signed_data_len); +- if (retval) { +- pkiDebug("failed to create pkcs7 signed data\n"); +- goto cleanup; +- } +- +- /* check we have client's certificate */ +- if (reqctx->received_cert == NULL) { +- retval = KRB5KDC_ERR_PREAUTH_FAILED; +- goto cleanup; +- } +- encerts = sk_X509_new_null(); +- sk_X509_push(encerts, reqctx->received_cert); +- +- cipher = EVP_des_ede3_cbc(); +- in = BIO_new(BIO_s_mem()); +- prepare_enc_data(signed_data, signed_data_len, &enc_data, +- &enc_data_len); +- retval = BIO_write(in, enc_data, enc_data_len); +- if (retval != enc_data_len) { +- pkiDebug("BIO_write only wrote %d\n", retval); +- goto cleanup; +- } +- +- p7 = PKCS7_encrypt(encerts, in, cipher, flags); +- if (p7 == NULL) { +- retval = oerr(context, 0, _("Failed to encrypt PKCS7 object")); +- goto cleanup; +- } +- p7->d.enveloped->enc_data->content_type = OBJ_nid2obj(NID_pkcs7_signed); +- +- *out_len = i2d_PKCS7(p7, NULL); +- if (!*out_len || (p = *out = malloc(*out_len)) == NULL) { +- retval = ENOMEM; +- goto cleanup; +- } +- retval = i2d_PKCS7(p7, &p); +- if (!retval) { +- retval = oerr(context, 0, _("Failed to DER encode PKCS7")); +- goto cleanup; +- } +- retval = 0; +- +-#ifdef DEBUG_ASN1 +- print_buffer_bin(*out, *out_len, "/tmp/kdc_enveloped_data"); +-#endif +- +-cleanup: +- if (p7 != NULL) +- PKCS7_free(p7); +- if (in != NULL) +- BIO_free(in); +- free(signed_data); +- free(enc_data); +- if (encerts != NULL) +- sk_X509_free(encerts); +- +- return retval; +-} +- +-krb5_error_code +-cms_envelopeddata_verify(krb5_context context, +- pkinit_plg_crypto_context plg_cryptoctx, +- pkinit_req_crypto_context req_cryptoctx, +- pkinit_identity_crypto_context id_cryptoctx, +- krb5_preauthtype pa_type, +- int require_crl_checking, +- unsigned char *enveloped_data, +- unsigned int enveloped_data_len, +- unsigned char **data, +- unsigned int *data_len) +-{ +- krb5_error_code retval = KRB5KDC_ERR_PREAUTH_FAILED; +- PKCS7 *p7 = NULL; +- const unsigned char *p = enveloped_data; +- unsigned int tmp_buf_len = 0, tmp_buf2_len = 0, vfy_buf_len = 0; +- unsigned char *tmp_buf = NULL, *tmp_buf2 = NULL, *vfy_buf = NULL; +- +-#ifdef DEBUG_ASN1 +- print_buffer_bin(enveloped_data, enveloped_data_len, +- "/tmp/client_envelopeddata"); +-#endif +- /* decode received PKCS7 message */ +- if ((p7 = d2i_PKCS7(NULL, &p, (int)enveloped_data_len)) == NULL) { +- retval = oerr(context, 0, _("Failed to decode PKCS7")); +- goto cleanup; +- } +- +- /* verify that the received message is PKCS7 EnvelopedData message */ +- if (OBJ_obj2nid(p7->type) != NID_pkcs7_enveloped || +- p7->d.enveloped == NULL || +- p7->d.enveloped->enc_data->enc_data == NULL) { +- pkiDebug("Expected id-enveloped PKCS7 msg (received type = %d)\n", +- OBJ_obj2nid(p7->type)); +- krb5_set_error_message(context, retval, "wrong oid\n"); +- goto cleanup; +- } +- +- /* decrypt received PKCS7 message */ +- if (pkcs7_decrypt(context, id_cryptoctx, p7, &tmp_buf, &tmp_buf_len)) { +- pkiDebug("PKCS7 decryption successful\n"); +- } else { +- retval = oerr(context, 0, _("Failed to decrypt PKCS7 message")); +- goto cleanup; +- } +- +-#ifdef DEBUG_ASN1 +- print_buffer_bin(tmp_buf, tmp_buf_len, "/tmp/client_enc_keypack"); +-#endif +- /* verify PKCS7 SignedData message */ +- /* Wrap the signed data to make decoding easier in the verify routine. */ +- retval = wrap_signeddata(tmp_buf, tmp_buf_len, &tmp_buf2, &tmp_buf2_len); +- if (retval) { +- pkiDebug("failed to encode signeddata\n"); +- goto cleanup; +- } +- vfy_buf = tmp_buf2; +- vfy_buf_len = tmp_buf2_len; +- +-#ifdef DEBUG_ASN1 +- print_buffer_bin(vfy_buf, vfy_buf_len, "/tmp/client_enc_keypack2"); +-#endif +- +- retval = cms_signeddata_verify(context, plg_cryptoctx, req_cryptoctx, +- id_cryptoctx, CMS_ENVEL_SERVER, +- require_crl_checking, +- vfy_buf, vfy_buf_len, +- data, data_len, NULL, NULL, NULL); +- +- if (!retval) +- pkiDebug("PKCS7 Verification Success\n"); +- else { +- pkiDebug("PKCS7 Verification Failure\n"); +- goto cleanup; +- } +- +- retval = 0; +- +-cleanup: +- +- if (p7 != NULL) +- PKCS7_free(p7); +- free(tmp_buf); +- free(tmp_buf2); +- +- return retval; +-} +- + static krb5_error_code + crypto_retrieve_X509_sans(krb5_context context, + pkinit_plg_crypto_context plgctx, +@@ -3398,70 +3203,6 @@ pkinit_pkcs7type2oid(pkinit_plg_crypto_context cryptoctx, int pkcs7_type) + + } + +-static int +-wrap_signeddata(unsigned char *data, unsigned int data_len, +- unsigned char **out, unsigned int *out_len) +-{ +- +- unsigned int orig_len = 0, oid_len = 0, tot_len = 0; +- ASN1_OBJECT *oid = NULL; +- unsigned char *p = NULL; +- +- /* Get length to wrap the original data with SEQUENCE tag */ +- tot_len = orig_len = ASN1_object_size(1, (int)data_len, V_ASN1_SEQUENCE); +- +- /* Add the signedData OID and adjust lengths */ +- oid = OBJ_nid2obj(NID_pkcs7_signed); +- oid_len = i2d_ASN1_OBJECT(oid, NULL); +- +- tot_len = ASN1_object_size(1, (int)(orig_len+oid_len), V_ASN1_SEQUENCE); +- +- p = *out = malloc(tot_len); +- if (p == NULL) return -1; +- +- ASN1_put_object(&p, 1, (int)(orig_len+oid_len), +- V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL); +- +- i2d_ASN1_OBJECT(oid, &p); +- +- ASN1_put_object(&p, 1, (int)data_len, 0, V_ASN1_CONTEXT_SPECIFIC); +- memcpy(p, data, data_len); +- +- *out_len = tot_len; +- +- return 0; +-} +- +-static int +-prepare_enc_data(const uint8_t *indata, int indata_len, uint8_t **outdata, +- int *outdata_len) +-{ +- int tag, class; +- long tlen, slen; +- const uint8_t *p = indata, *oldp; +- +- if (ASN1_get_object(&p, &slen, &tag, &class, indata_len) & 0x80) +- return EINVAL; +- if (tag != V_ASN1_SEQUENCE) +- return EINVAL; +- +- oldp = p; +- if (ASN1_get_object(&p, &tlen, &tag, &class, slen) & 0x80) +- return EINVAL; +- p += tlen; +- slen -= (p - oldp); +- +- if (ASN1_get_object(&p, &tlen, &tag, &class, slen) & 0x80) +- return EINVAL; +- +- *outdata = malloc(tlen); +- if (*outdata == NULL) +- return ENOMEM; +- memcpy(*outdata, p, tlen); +- *outdata_len = tlen; +- return 0; +-} +- + #ifndef WITHOUT_PKCS11 + static struct plugin_file_handle * + load_pkcs11_module(krb5_context context, const char *modname, +@@ -3780,169 +3521,6 @@ pkinit_find_private_key(pkinit_identity_crypto_context id_cryptoctx, + } + #endif + +-static krb5_error_code +-pkinit_decode_data_fs(krb5_context context, +- pkinit_identity_crypto_context id_cryptoctx, +- const uint8_t *data, unsigned int data_len, +- uint8_t **decoded_data, unsigned int *decoded_data_len) +-{ +- X509 *cert = sk_X509_value(id_cryptoctx->my_certs, +- id_cryptoctx->cert_index); +- EVP_PKEY *pkey = id_cryptoctx->my_key; +- EVP_PKEY_CTX *ctx = NULL; +- uint8_t *buf = NULL; +- size_t buf_len = 0; +- int ok; +- +- *decoded_data = NULL; +- *decoded_data_len = 0; +- +- if (cert != NULL && !X509_check_private_key(cert, pkey)) { +- pkiDebug("private key does not match certificate\n"); +- return KRB5KDC_ERR_PREAUTH_FAILED; +- } +- +- ctx = EVP_PKEY_CTX_new(pkey, NULL); +- if (ctx == NULL) +- return KRB5KDC_ERR_PREAUTH_FAILED; +- +- ok = EVP_PKEY_decrypt_init(ctx); +- if (!ok) +- goto cleanup; +- +- /* Get the length of the eventual output. */ +- ok = EVP_PKEY_decrypt(ctx, NULL, &buf_len, data, data_len); +- if (!ok) { +- pkiDebug("unable to decrypt received data\n"); +- goto cleanup; +- } +- +- buf = malloc(buf_len); +- if (buf == NULL) { +- ok = 0; +- goto cleanup; +- } +- +- ok = EVP_PKEY_decrypt(ctx, buf, &buf_len, data, data_len); +- if (!ok) { +- pkiDebug("unable to decrypt received data\n"); +- goto cleanup; +- } +- +- *decoded_data = buf; +- *decoded_data_len = buf_len; +- buf = NULL; +-cleanup: +- zapfree(buf, buf_len); +- EVP_PKEY_CTX_free(ctx); +- return ok ? 0 : KRB5KDC_ERR_PREAUTH_FAILED; +-} +- +-#ifndef WITHOUT_PKCS11 +-/* +- * When using the ActivCard Linux pkcs11 library (v2.0.1), the decrypt function +- * fails. By inserting an extra function call, which serves nothing but to +- * change the stack, we were able to work around the issue. If the ActivCard +- * library is fixed in the future, this function can be inlined back into the +- * caller. +- */ +-static CK_RV +-pkinit_C_Decrypt(pkinit_identity_crypto_context id_cryptoctx, +- CK_BYTE_PTR pEncryptedData, +- CK_ULONG ulEncryptedDataLen, +- CK_BYTE_PTR pData, +- CK_ULONG_PTR pulDataLen) +-{ +- CK_RV rv = CKR_OK; +- +- rv = id_cryptoctx->p11->C_Decrypt(id_cryptoctx->session, pEncryptedData, +- ulEncryptedDataLen, pData, pulDataLen); +- if (rv == CKR_OK) { +- pkiDebug("pData %p *pulDataLen %d\n", (void *) pData, +- (int) *pulDataLen); +- } +- return rv; +-} +- +-static krb5_error_code +-pkinit_decode_data_pkcs11(krb5_context context, +- pkinit_identity_crypto_context id_cryptoctx, +- const uint8_t *data, unsigned int data_len, +- uint8_t **decoded_data, +- unsigned int *decoded_data_len) +-{ +- CK_OBJECT_HANDLE obj; +- CK_ULONG len; +- CK_MECHANISM mech; +- uint8_t *cp; +- int r; +- +- *decoded_data = NULL; +- *decoded_data_len = 0; +- +- if (pkinit_open_session(context, id_cryptoctx)) { +- pkiDebug("can't open pkcs11 session\n"); +- return KRB5KDC_ERR_PREAUTH_FAILED; +- } +- +- pkinit_find_private_key(id_cryptoctx, CKA_DECRYPT, &obj); +- +- mech.mechanism = CKM_RSA_PKCS; +- mech.pParameter = NULL; +- mech.ulParameterLen = 0; +- +- if ((r = id_cryptoctx->p11->C_DecryptInit(id_cryptoctx->session, &mech, +- obj)) != CKR_OK) { +- pkiDebug("C_DecryptInit: 0x%x\n", (int) r); +- return KRB5KDC_ERR_PREAUTH_FAILED; +- } +- pkiDebug("data_len = %d\n", data_len); +- cp = malloc((size_t) data_len); +- if (cp == NULL) +- return ENOMEM; +- len = data_len; +- pkiDebug("session %p edata %p edata_len %d data %p datalen @%p %d\n", +- (void *) id_cryptoctx->session, (void *) data, (int) data_len, +- (void *) cp, (void *) &len, (int) len); +- r = pkinit_C_Decrypt(id_cryptoctx, (CK_BYTE_PTR) data, (CK_ULONG) data_len, +- cp, &len); +- if (r != CKR_OK) { +- pkiDebug("C_Decrypt: %s\n", pkcs11err(r)); +- if (r == CKR_BUFFER_TOO_SMALL) +- pkiDebug("decrypt %d needs %d\n", (int) data_len, (int) len); +- return KRB5KDC_ERR_PREAUTH_FAILED; +- } +- pkiDebug("decrypt %d -> %d\n", (int) data_len, (int) len); +- *decoded_data_len = len; +- *decoded_data = cp; +- +- return 0; +-} +-#endif +- +-krb5_error_code +-pkinit_decode_data(krb5_context context, +- pkinit_identity_crypto_context id_cryptoctx, +- const uint8_t *data, unsigned int data_len, +- uint8_t **decoded_data, unsigned int *decoded_data_len) +-{ +- krb5_error_code retval = KRB5KDC_ERR_PREAUTH_FAILED; +- +- *decoded_data = NULL; +- *decoded_data_len = 0; +- +- if (id_cryptoctx->pkcs11_method != 1) +- retval = pkinit_decode_data_fs(context, id_cryptoctx, data, data_len, +- decoded_data, decoded_data_len); +-#ifndef WITHOUT_PKCS11 +- else +- retval = pkinit_decode_data_pkcs11(context, id_cryptoctx, data, +- data_len, decoded_data, decoded_data_len); +-#endif +- +- return retval; +-} +- + static krb5_error_code + pkinit_sign_data_fs(krb5_context context, + pkinit_identity_crypto_context id_cryptoctx, +@@ -5617,88 +5195,6 @@ cleanup: + return retval; + } + +-/* Originally based on OpenSSL's PKCS7_dataDecode(), now modified to remove the +- * use of BIO objects and to fit the PKINIT internal interfaces. */ +-static int +-pkcs7_decrypt(krb5_context context, +- pkinit_identity_crypto_context id_cryptoctx, PKCS7 *p7, +- unsigned char **data_out, unsigned int *len_out) +-{ +- krb5_error_code ret; +- int ok = 0, plaintext_len = 0, final_len; +- unsigned int keylen = 0, eklen = 0, blocksize; +- unsigned char *ek = NULL, *tkey = NULL, *plaintext = NULL, *use_key; +- ASN1_OCTET_STRING *data_body = p7->d.enveloped->enc_data->enc_data; +- const EVP_CIPHER *evp_cipher; +- EVP_CIPHER_CTX *evp_ctx = NULL; +- X509_ALGOR *enc_alg = p7->d.enveloped->enc_data->algorithm; +- STACK_OF(PKCS7_RECIP_INFO) *rsk = p7->d.enveloped->recipientinfo; +- PKCS7_RECIP_INFO *ri = NULL; +- +- *data_out = NULL; +- *len_out = 0; +- +- p7->state = PKCS7_S_HEADER; +- +- /* RFC 4556 section 3.2.3.2 requires that there be exactly one +- * recipientInfo. */ +- if (sk_PKCS7_RECIP_INFO_num(rsk) != 1) { +- pkiDebug("invalid number of EnvelopedData RecipientInfos\n"); +- return 0; +- } +- ri = sk_PKCS7_RECIP_INFO_value(rsk, 0); +- +- evp_cipher = EVP_get_cipherbyobj(enc_alg->algorithm); +- if (evp_cipher == NULL) +- goto cleanup; +- keylen = EVP_CIPHER_key_length(evp_cipher); +- blocksize = EVP_CIPHER_block_size(evp_cipher); +- +- evp_ctx = EVP_CIPHER_CTX_new(); +- if (evp_ctx == NULL) +- goto cleanup; +- if (!EVP_DecryptInit(evp_ctx, evp_cipher, NULL, NULL) || +- EVP_CIPHER_asn1_to_param(evp_ctx, enc_alg->parameter) <= 0) +- goto cleanup; +- +- /* Generate a random symmetric key to avoid exposing timing data if RSA +- * decryption fails the padding check. */ +- tkey = malloc(keylen); +- if (tkey == NULL || !EVP_CIPHER_CTX_rand_key(evp_ctx, tkey)) +- goto cleanup; +- +- /* Decrypt the secret key with the private key. */ +- ret = pkinit_decode_data(context, id_cryptoctx, +- ASN1_STRING_get0_data(ri->enc_key), +- ASN1_STRING_length(ri->enc_key), &ek, &eklen); +- use_key = (ret || eklen != keylen) ? tkey : ek; +- +- /* Allocate a plaintext buffer and decrypt data_body into it. */ +- plaintext = malloc(data_body->length + blocksize); +- if (plaintext == NULL) +- goto cleanup; +- if (!EVP_DecryptInit(evp_ctx, NULL, use_key, NULL)) +- goto cleanup; +- if (!EVP_DecryptUpdate(evp_ctx, plaintext, &plaintext_len, +- data_body->data, data_body->length)) +- goto cleanup; +- if (!EVP_DecryptFinal(evp_ctx, plaintext + plaintext_len, &final_len)) +- goto cleanup; +- plaintext_len += final_len; +- +- *len_out = plaintext_len; +- *data_out = plaintext; +- plaintext = NULL; +- ok = 1; +- +-cleanup: +- EVP_CIPHER_CTX_free(evp_ctx); +- zapfree(plaintext, plaintext_len); +- zapfree(ek, eklen); +- zapfree(tkey, keylen); +- return ok; +-} +- + #ifdef DEBUG_DH + static void + print_dh(DH * dh, char *msg) +diff --git a/src/plugins/preauth/pkinit/pkinit_lib.c b/src/plugins/preauth/pkinit/pkinit_lib.c +index 4c3d46bf5a..19db695a4d 100644 +--- a/src/plugins/preauth/pkinit/pkinit_lib.c ++++ b/src/plugins/preauth/pkinit/pkinit_lib.c +@@ -50,7 +50,6 @@ pkinit_init_req_opts(pkinit_req_opts **reqopts) + opts->require_eku = 1; + opts->accept_secondary_eku = 0; + opts->allow_upn = 0; +- opts->dh_or_rsa = DH_PROTOCOL; + opts->require_crl_checking = 0; + opts->dh_size = PKINIT_DEFAULT_DH_MIN_BITS; + +@@ -79,7 +78,6 @@ pkinit_init_plg_opts(pkinit_plg_opts **plgopts) + + opts->require_eku = 1; + opts->accept_secondary_eku = 0; +- opts->dh_or_rsa = DH_PROTOCOL; + opts->allow_upn = 0; + opts->require_crl_checking = 0; + opts->require_freshness = 0; +diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c +index 768a4e559f..aab21f951c 100644 +--- a/src/plugins/preauth/pkinit/pkinit_srv.c ++++ b/src/plugins/preauth/pkinit/pkinit_srv.c +@@ -821,132 +821,55 @@ pkinit_server_return_padata(krb5_context context, + retval = ENOMEM; + goto cleanup; + } +- /* let's assume it's RSA. we'll reset it to DH if needed */ +- rep->choice = choice_pa_pk_as_rep_encKeyPack; + +- if (reqctx->rcv_auth_pack != NULL && +- reqctx->rcv_auth_pack->clientPublicValue.length > 0) { +- rep->choice = choice_pa_pk_as_rep_dhInfo; +- +- pkiDebug("received DH key delivery AS REQ\n"); +- retval = server_process_dh(context, plgctx->cryptoctx, +- reqctx->cryptoctx, plgctx->idctx, +- &dh_pubkey, &dh_pubkey_len, +- &server_key, &server_key_len); +- if (retval) { +- pkiDebug("failed to process/create dh parameters\n"); +- goto cleanup; +- } +- +- /* +- * This is DH, so don't generate the key until after we +- * encode the reply, because the encoded reply is needed +- * to generate the key in some cases. +- */ +- +- dhkey_info.subjectPublicKey.length = dh_pubkey_len; +- dhkey_info.subjectPublicKey.data = (char *)dh_pubkey; +- dhkey_info.nonce = request->nonce; +- dhkey_info.dhKeyExpiration = 0; +- +- retval = k5int_encode_krb5_kdc_dh_key_info(&dhkey_info, +- &encoded_dhkey_info); +- if (retval) { +- pkiDebug("encode_krb5_kdc_dh_key_info failed\n"); +- goto cleanup; +- } +-#ifdef DEBUG_ASN1 +- print_buffer_bin((unsigned char *)encoded_dhkey_info->data, +- encoded_dhkey_info->length, +- "/tmp/kdc_dh_key_info"); +-#endif +- +- retval = cms_signeddata_create(context, plgctx->cryptoctx, +- reqctx->cryptoctx, plgctx->idctx, +- CMS_SIGN_SERVER, +- (unsigned char *) +- encoded_dhkey_info->data, +- encoded_dhkey_info->length, +- (unsigned char **) +- &rep->u.dh_Info.dhSignedData.data, +- &rep->u.dh_Info.dhSignedData.length); +- if (retval) { +- pkiDebug("failed to create pkcs7 signed data\n"); +- goto cleanup; +- } +- +- } else { +- pkiDebug("received RSA key delivery AS REQ\n"); +- +- init_krb5_reply_key_pack(&key_pack); +- if (key_pack == NULL) { +- retval = ENOMEM; +- goto cleanup; +- } ++ if (reqctx->rcv_auth_pack == NULL || ++ reqctx->rcv_auth_pack->clientPublicValue.length == 0) { ++ retval = KRB5KDC_ERR_PREAUTH_FAILED; ++ k5_setmsg(context, retval, _("Unsupported PKINIT RSA request")); ++ goto cleanup; ++ } + +- retval = krb5_c_make_random_key(context, enctype, &key_pack->replyKey); +- if (retval) { +- pkiDebug("unable to make a session key\n"); +- goto cleanup; +- } ++ rep->choice = choice_pa_pk_as_rep_dhInfo; + +- retval = krb5_c_make_checksum(context, 0, &key_pack->replyKey, +- KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM, +- req_pkt, &key_pack->asChecksum); +- if (retval) { +- pkiDebug("unable to calculate AS REQ checksum\n"); +- goto cleanup; +- } +-#ifdef DEBUG_CKSUM +- pkiDebug("calculating checksum on buf size = %d\n", req_pkt->length); +- print_buffer(req_pkt->data, req_pkt->length); +- pkiDebug("checksum size = %d\n", key_pack->asChecksum.length); +- print_buffer(key_pack->asChecksum.contents, +- key_pack->asChecksum.length); +- pkiDebug("encrypting key (%d)\n", key_pack->replyKey.length); +- print_buffer(key_pack->replyKey.contents, key_pack->replyKey.length); +-#endif ++ retval = server_process_dh(context, plgctx->cryptoctx, reqctx->cryptoctx, ++ plgctx->idctx, &dh_pubkey, &dh_pubkey_len, ++ &server_key, &server_key_len); ++ if (retval) { ++ pkiDebug("failed to process/create dh parameters\n"); ++ goto cleanup; ++ } + +- retval = k5int_encode_krb5_reply_key_pack(key_pack, +- &encoded_key_pack); +- if (retval) { +- pkiDebug("failed to encode reply_key_pack\n"); +- goto cleanup; +- } ++ dhkey_info.subjectPublicKey.length = dh_pubkey_len; ++ dhkey_info.subjectPublicKey.data = (char *)dh_pubkey; ++ dhkey_info.nonce = request->nonce; ++ dhkey_info.dhKeyExpiration = 0; + +- rep->choice = choice_pa_pk_as_rep_encKeyPack; +- retval = cms_envelopeddata_create(context, plgctx->cryptoctx, +- reqctx->cryptoctx, plgctx->idctx, +- padata->pa_type, +- (unsigned char *) +- encoded_key_pack->data, +- encoded_key_pack->length, +- (unsigned char **) +- &rep->u.encKeyPack.data, +- &rep->u.encKeyPack.length); +- if (retval) { +- pkiDebug("failed to create pkcs7 enveloped data: %s\n", +- error_message(retval)); +- goto cleanup; +- } ++ retval = k5int_encode_krb5_kdc_dh_key_info(&dhkey_info, ++ &encoded_dhkey_info); ++ if (retval) { ++ pkiDebug("encode_krb5_kdc_dh_key_info failed\n"); ++ goto cleanup; ++ } + #ifdef DEBUG_ASN1 +- print_buffer_bin((unsigned char *)encoded_key_pack->data, +- encoded_key_pack->length, +- "/tmp/kdc_key_pack"); +- print_buffer_bin(rep->u.encKeyPack.data, rep->u.encKeyPack.length, +- "/tmp/kdc_enc_key_pack"); ++ print_buffer_bin((unsigned char *)encoded_dhkey_info->data, ++ encoded_dhkey_info->length, "/tmp/kdc_dh_key_info"); + #endif + +- retval = cb->replace_reply_key(context, rock, &key_pack->replyKey, +- FALSE); +- if (retval) +- goto cleanup; ++ retval = cms_signeddata_create(context, plgctx->cryptoctx, ++ reqctx->cryptoctx, plgctx->idctx, ++ CMS_SIGN_SERVER, ++ (unsigned char *)encoded_dhkey_info->data, ++ encoded_dhkey_info->length, ++ (unsigned char **) ++ &rep->u.dh_Info.dhSignedData.data, ++ &rep->u.dh_Info.dhSignedData.length); ++ if (retval) { ++ pkiDebug("failed to create pkcs7 signed data\n"); ++ goto cleanup; + } + +- if (rep->choice == choice_pa_pk_as_rep_dhInfo && +- ((reqctx->rcv_auth_pack != NULL && +- reqctx->rcv_auth_pack->supportedKDFs != NULL))) { +- ++ if (reqctx->rcv_auth_pack != NULL && ++ reqctx->rcv_auth_pack->supportedKDFs != NULL) { + /* If using the alg-agility KDF, put the algorithm in the reply + * before encoding it. + */ +@@ -973,41 +896,36 @@ pkinit_server_return_padata(krb5_context context, + "/tmp/kdc_as_rep"); + #endif + +- /* If this is DH, we haven't computed the key yet, so do it now. */ +- if (rep->choice == choice_pa_pk_as_rep_dhInfo) { +- +- /* If mutually supported KDFs were found, use the algorithm agility +- * KDF. */ +- if (rep->u.dh_Info.kdfID) { +- secret.data = (char *)server_key; +- secret.length = server_key_len; ++ /* If mutually supported KDFs were found, use the algorithm agility KDF. */ ++ if (rep->u.dh_Info.kdfID) { ++ secret.data = (char *)server_key; ++ secret.length = server_key_len; + +- retval = pkinit_alg_agility_kdf(context, &secret, +- rep->u.dh_Info.kdfID, +- request->client, request->server, +- enctype, req_pkt, out_data, +- &reply_key); +- if (retval) { +- pkiDebug("pkinit_alg_agility_kdf failed: %s\n", +- error_message(retval)); +- goto cleanup; +- } ++ retval = pkinit_alg_agility_kdf(context, &secret, rep->u.dh_Info.kdfID, ++ request->client, request->server, ++ enctype, req_pkt, out_data, ++ &reply_key); ++ if (retval) { ++ pkiDebug("pkinit_alg_agility_kdf failed: %s\n", ++ error_message(retval)); ++ goto cleanup; ++ } + +- /* Otherwise, use the older octetstring2key() function */ +- } else { +- retval = pkinit_octetstring2key(context, enctype, server_key, ++ /* Otherwise, use the older octetstring2key() function */ ++ } else { ++ retval = pkinit_octetstring2key(context, enctype, server_key, + server_key_len, &reply_key); +- if (retval) { +- pkiDebug("pkinit_octetstring2key failed: %s\n", +- error_message(retval)); +- goto cleanup; +- } +- } +- retval = cb->replace_reply_key(context, rock, &reply_key, FALSE); +- if (retval) ++ if (retval) { ++ pkiDebug("pkinit_octetstring2key failed: %s\n", ++ error_message(retval)); + goto cleanup; ++ } + } + ++ retval = cb->replace_reply_key(context, rock, &reply_key, FALSE); ++ if (retval) ++ goto cleanup; ++ + *send_pa = malloc(sizeof(krb5_pa_data)); + if (*send_pa == NULL) { + retval = ENOMEM; +diff --git a/src/plugins/preauth/pkinit/pkinit_trace.h b/src/plugins/preauth/pkinit/pkinit_trace.h +index 5ee39c085c..d385759145 100644 +--- a/src/plugins/preauth/pkinit/pkinit_trace.h ++++ b/src/plugins/preauth/pkinit/pkinit_trace.h +@@ -58,19 +58,10 @@ + TRACE(c, "PKINIT client verified DH reply") + #define TRACE_PKINIT_CLIENT_REP_DH_FAIL(c) \ + TRACE(c, "PKINIT client could not verify DH reply") +-#define TRACE_PKINIT_CLIENT_REP_RSA(c) \ +- TRACE(c, "PKINIT client verified RSA reply") +-#define TRACE_PKINIT_CLIENT_REP_RSA_KEY(c, keyblock, cksum) \ +- TRACE(c, "PKINIT client retrieved reply key {keyblock} from RSA " \ +- "reply (checksum {cksum})", keyblock, cksum) +-#define TRACE_PKINIT_CLIENT_REP_RSA_FAIL(c) \ +- TRACE(c, "PKINIT client could not verify RSA reply") + #define TRACE_PKINIT_CLIENT_REQ_CHECKSUM(c, cksum) \ + TRACE(c, "PKINIT client computed kdc-req-body checksum {cksum}", cksum) + #define TRACE_PKINIT_CLIENT_REQ_DH(c) \ + TRACE(c, "PKINIT client making DH request") +-#define TRACE_PKINIT_CLIENT_REQ_RSA(c) \ +- TRACE(c, "PKINIT client making RSA request") + #define TRACE_PKINIT_CLIENT_SAN_CONFIG_DNSNAME(c, host) \ + TRACE(c, "PKINIT client config accepts KDC dNSName SAN {str}", host) + #define TRACE_PKINIT_CLIENT_SAN_MATCH_DNSNAME(c, host) \ +diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py +index ec2356ea22..62e6c426d3 100755 +--- a/src/tests/t_pkinit.py ++++ b/src/tests/t_pkinit.py +@@ -179,13 +179,6 @@ id_conf = {'realms': {'$realm': {'pkinit_identities': [file_identity + 'X', + id_env = realm.special_env('idconf', False, krb5_conf=id_conf) + realm.kinit(realm.user_princ, expected_trace=msgs, env=id_env) + +-# Try again using RSA instead of DH. +-mark('FILE identity, no password, RSA') +-realm.pkinit(realm.user_princ, flags=['-X', 'flag_RSA_PROTOCOL=yes'], +- expected_trace=('PKINIT client making RSA request', +- 'PKINIT client verified RSA reply')) +-realm.klist(realm.user_princ) +- + # Test a DH parameter renegotiation by temporarily setting a 4096-bit + # minimum on the KDC. (Preauth type 16 is PKINIT PA_PK_AS_REQ; + # 109 is PKINIT TD_DH_PARAMETERS; 133 is FAST PA-FX-COOKIE.) +diff --git a/src/windows/leash/htmlhelp/html/KINIT.htm b/src/windows/leash/htmlhelp/html/KINIT.htm +index eeee211a6e..46cb4a3ad8 100644 +--- a/src/windows/leash/htmlhelp/html/KINIT.htm ++++ b/src/windows/leash/htmlhelp/html/KINIT.htm +@@ -146,9 +146,6 @@ default credentials cache may vary between systems. If the KRB5CCNAME en + -S service_name + specify an alternate service name to use when getting initial + tickets. +- +- flag_RSA_PROTOCOL[=yes] +- specify use of RSA, rather than the default Diffie-Hellman protocol. + + +

ENVIRONMENT

+-- +2.46.0 + diff --git a/0024-Fix-various-issues-detected-by-static-analysis.patch b/0024-Fix-various-issues-detected-by-static-analysis.patch new file mode 100644 index 0000000..ebab90b --- /dev/null +++ b/0024-Fix-various-issues-detected-by-static-analysis.patch @@ -0,0 +1,265 @@ +From 3999883b9745bfd7065d41ff05b19e56bcb2e791 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Fri, 6 Sep 2024 17:18:11 +0200 +Subject: [PATCH] Fix various issues detected by static analysis + +In klists's show_credential(), ensure that the column counter doesn't +decrease if printf() fails. + +In process_k5beta7_princ(), bounds-check the e_length field. + +In ndr_enc_delegation_info(), initialize b so it is always valid for +the cleanup handler. + +In krb5_dbe_def_decrypt_key_data(), change the flow control so ret is +always set by the end of the function. Return KRB5_KDB_INVALIDKEYSIZE +if there isn't enough data in the first key_data_contents field or if +the serialized key length is invalid. + +In svcauth_gss_validate(), expand rpchdr to accomodate the header plus +MAX_AUTH_BYTES. + +In svcudp_reply(), change slen to unsigned to match the return type of +XDR_GETPOS() and eliminate an unnecessary check for slen >= 0. + +In krb5int_pthread_loaded()(), remove pthread_equal() from the weak +symbol checks. It is implemented as an inline function in some glibc +versions, which makes the comparison "&pthread_equal == 0" always +false. + +[ghudson@mit.edu: further modified krb5_dbe_def_decrypt_key_data() for +clarity; added detail to commit message] + +(cherry picked from commit a96541981ee34c8642ddeb6101b98e883e41c6e5) +--- + src/clients/klist/klist.c | 12 ++++----- + src/kadmin/dbutil/dump.c | 5 ++++ + src/kdc/ndr.c | 2 +- + src/lib/kdb/decrypt_key.c | 54 ++++++++++++++++++++------------------ + src/lib/rpc/svc_auth_gss.c | 5 +++- + src/lib/rpc/svc_udp.c | 13 ++++----- + src/util/support/threads.c | 2 -- + 7 files changed, 51 insertions(+), 42 deletions(-) + +diff --git a/src/clients/klist/klist.c b/src/clients/klist/klist.c +index b5808e5c93..ba9539fd23 100644 +--- a/src/clients/klist/klist.c ++++ b/src/clients/klist/klist.c +@@ -681,7 +681,7 @@ show_credential(krb5_creds *cred, const char *defname) + krb5_error_code ret; + krb5_ticket *tkt = NULL; + char *name = NULL, *sname = NULL, *tktsname, *flags; +- int extra_field = 0, ccol = 0, i; ++ int extra_field = 0, ccol = 0, i, r; + krb5_boolean is_config = krb5_is_config_principal(context, cred->server); + + ret = krb5_unparse_name(context, cred->client, &name); +@@ -711,11 +711,11 @@ show_credential(krb5_creds *cred, const char *defname) + fputs("config: ", stdout); + ccol = 8; + for (i = 1; i < cred->server->length; i++) { +- ccol += printf("%s%.*s%s", +- i > 1 ? "(" : "", +- (int)cred->server->data[i].length, +- cred->server->data[i].data, +- i > 1 ? ")" : ""); ++ r = printf("%s%.*s%s", i > 1 ? "(" : "", ++ (int)cred->server->data[i].length, ++ cred->server->data[i].data, i > 1 ? ")" : ""); ++ if (r >= 0) ++ ccol += r; + } + fputs(" = ", stdout); + ccol += 3; +diff --git a/src/kadmin/dbutil/dump.c b/src/kadmin/dbutil/dump.c +index 4d6cc0bdf9..feb053d834 100644 +--- a/src/kadmin/dbutil/dump.c ++++ b/src/kadmin/dbutil/dump.c +@@ -704,6 +704,11 @@ process_k5beta7_princ(krb5_context context, const char *fname, FILE *filep, + + dbentry->len = u1; + dbentry->n_key_data = u4; ++ ++ if (u5 > UINT16_MAX) { ++ load_err(fname, *linenop, _("invalid principal extra data size")); ++ goto fail; ++ } + dbentry->e_length = u5; + + if (kp != NULL) { +diff --git a/src/kdc/ndr.c b/src/kdc/ndr.c +index d438408ee2..38be9fe42a 100644 +--- a/src/kdc/ndr.c ++++ b/src/kdc/ndr.c +@@ -242,7 +242,7 @@ ndr_enc_delegation_info(struct pac_s4u_delegation_info *in, krb5_data *out) + { + krb5_error_code ret; + size_t i; +- struct k5buf b; ++ struct k5buf b = EMPTY_K5BUF; + struct encoded_wchars pt_encoded = { 0 }, *tss_encoded = NULL; + uint32_t pointer = 0; + +diff --git a/src/lib/kdb/decrypt_key.c b/src/lib/kdb/decrypt_key.c +index 82bbed6312..21aa3742b1 100644 +--- a/src/lib/kdb/decrypt_key.c ++++ b/src/lib/kdb/decrypt_key.c +@@ -60,7 +60,7 @@ krb5_dbe_def_decrypt_key_data(krb5_context context, const krb5_keyblock *mkey, + krb5_keyblock *dbkey_out, + krb5_keysalt *keysalt_out) + { +- krb5_error_code ret; ++ krb5_error_code ret = KRB5_CRYPTO_INTERNAL; + int16_t keylen; + krb5_enc_data cipher; + krb5_data plain = empty_data(); +@@ -74,36 +74,38 @@ krb5_dbe_def_decrypt_key_data(krb5_context context, const krb5_keyblock *mkey, + if (mkey == NULL) + return KRB5_KDB_BADSTORED_MKEY; + +- if (kd->key_data_contents[0] != NULL && kd->key_data_length[0] >= 2) { +- keylen = load_16_le(kd->key_data_contents[0]); +- if (keylen < 0) +- return EINVAL; +- cipher.enctype = ENCTYPE_UNKNOWN; +- cipher.ciphertext = make_data(kd->key_data_contents[0] + 2, +- kd->key_data_length[0] - 2); +- ret = alloc_data(&plain, kd->key_data_length[0] - 2); +- if (ret) +- goto cleanup; ++ if (kd->key_data_contents[0] == NULL || kd->key_data_length[0] < 2) ++ return KRB5_KDB_INVALIDKEYSIZE; + +- ret = krb5_c_decrypt(context, mkey, 0, 0, &cipher, &plain); +- if (ret) +- goto cleanup; ++ keylen = load_16_le(kd->key_data_contents[0]); ++ if (keylen < 0) ++ return KRB5_KDB_INVALIDKEYSIZE; + +- /* Make sure the plaintext has at least as many bytes as the true ke +- * length (it may have more due to padding). */ +- if ((unsigned int)keylen > plain.length) { +- ret = KRB5_CRYPTO_INTERNAL; +- if (ret) +- goto cleanup; +- } ++ cipher.enctype = ENCTYPE_UNKNOWN; ++ cipher.ciphertext = make_data(kd->key_data_contents[0] + 2, ++ kd->key_data_length[0] - 2); ++ ret = alloc_data(&plain, kd->key_data_length[0] - 2); ++ if (ret) ++ goto cleanup; + +- kb.magic = KV5M_KEYBLOCK; +- kb.enctype = kd->key_data_type[0]; +- kb.length = keylen; +- kb.contents = (uint8_t *)plain.data; +- plain = empty_data(); ++ ret = krb5_c_decrypt(context, mkey, 0, 0, &cipher, &plain); ++ if (ret) ++ goto cleanup; ++ ++ /* Make sure the plaintext has at least as many bytes as the true key ++ * length (it may have more due to padding). */ ++ if ((unsigned int)keylen > plain.length) { ++ ret = KRB5_CRYPTO_INTERNAL; ++ if (ret) ++ goto cleanup; + } + ++ kb.magic = KV5M_KEYBLOCK; ++ kb.enctype = kd->key_data_type[0]; ++ kb.length = keylen; ++ kb.contents = (uint8_t *)plain.data; ++ plain = empty_data(); ++ + /* Decode salt data. */ + if (keysalt_out != NULL) { + if (kd->key_data_ver == 2) { +diff --git a/src/lib/rpc/svc_auth_gss.c b/src/lib/rpc/svc_auth_gss.c +index 98d601c8ab..4f1d2911b0 100644 +--- a/src/lib/rpc/svc_auth_gss.c ++++ b/src/lib/rpc/svc_auth_gss.c +@@ -297,7 +297,7 @@ svcauth_gss_validate(struct svc_req *rqst, struct svc_rpc_gss_data *gd, struct r + struct opaque_auth *oa; + gss_buffer_desc rpcbuf, checksum; + OM_uint32 maj_stat, min_stat, qop_state; +- u_char rpchdr[128]; ++ u_char rpchdr[32 + MAX_AUTH_BYTES]; + int32_t *buf; + + log_debug("in svcauth_gss_validate()"); +@@ -315,6 +315,8 @@ svcauth_gss_validate(struct svc_req *rqst, struct svc_rpc_gss_data *gd, struct r + return (FALSE); + + buf = (int32_t *)(void *)rpchdr; ++ ++ /* Write the 32 first bytes of the header. */ + IXDR_PUT_LONG(buf, msg->rm_xid); + IXDR_PUT_ENUM(buf, msg->rm_direction); + IXDR_PUT_LONG(buf, msg->rm_call.cb_rpcvers); +@@ -323,6 +325,7 @@ svcauth_gss_validate(struct svc_req *rqst, struct svc_rpc_gss_data *gd, struct r + IXDR_PUT_LONG(buf, msg->rm_call.cb_proc); + IXDR_PUT_ENUM(buf, oa->oa_flavor); + IXDR_PUT_LONG(buf, oa->oa_length); ++ + if (oa->oa_length) { + memcpy((caddr_t)buf, oa->oa_base, oa->oa_length); + buf += RNDUP(oa->oa_length) / sizeof(int32_t); +diff --git a/src/lib/rpc/svc_udp.c b/src/lib/rpc/svc_udp.c +index 8ecbdf2b33..3aff277eb7 100644 +--- a/src/lib/rpc/svc_udp.c ++++ b/src/lib/rpc/svc_udp.c +@@ -248,8 +248,9 @@ static bool_t svcudp_reply( + { + struct svcudp_data *su = su_data(xprt); + XDR *xdrs = &su->su_xdrs; +- int slen; ++ u_int slen; + bool_t stat = FALSE; ++ ssize_t r; + + xdrproc_t xdr_results = NULL; + caddr_t xdr_location = 0; +@@ -272,12 +273,12 @@ static bool_t svcudp_reply( + if (xdr_replymsg(xdrs, msg) && + (!has_args || + (SVCAUTH_WRAP(xprt->xp_auth, xdrs, xdr_results, xdr_location)))) { +- slen = (int)XDR_GETPOS(xdrs); +- if (sendto(xprt->xp_sock, rpc_buffer(xprt), slen, 0, +- (struct sockaddr *)&(xprt->xp_raddr), xprt->xp_addrlen) +- == slen) { ++ slen = XDR_GETPOS(xdrs); ++ r = sendto(xprt->xp_sock, rpc_buffer(xprt), slen, 0, ++ (struct sockaddr *)&(xprt->xp_raddr), xprt->xp_addrlen); ++ if (r >= 0 && (u_int)r == slen) { + stat = TRUE; +- if (su->su_cache && slen >= 0) { ++ if (su->su_cache) { + cache_set(xprt, (uint32_t) slen); + } + } +diff --git a/src/util/support/threads.c b/src/util/support/threads.c +index be7e4c2e3f..4ded805b79 100644 +--- a/src/util/support/threads.c ++++ b/src/util/support/threads.c +@@ -118,7 +118,6 @@ struct tsd_block { + # pragma weak pthread_mutex_destroy + # pragma weak pthread_mutex_init + # pragma weak pthread_self +-# pragma weak pthread_equal + # pragma weak pthread_getspecific + # pragma weak pthread_setspecific + # pragma weak pthread_key_create +@@ -151,7 +150,6 @@ int krb5int_pthread_loaded (void) + || &pthread_mutex_destroy == 0 + || &pthread_mutex_init == 0 + || &pthread_self == 0 +- || &pthread_equal == 0 + /* Any program that's really multithreaded will have to be + able to create threads. */ + || &pthread_create == 0 +-- +2.46.0 + diff --git a/0025-Generate-and-verify-message-MACs-in-libkrad.patch b/0025-Generate-and-verify-message-MACs-in-libkrad.patch new file mode 100644 index 0000000..58c9352 --- /dev/null +++ b/0025-Generate-and-verify-message-MACs-in-libkrad.patch @@ -0,0 +1,629 @@ +From ea02fd7bb79861b8e36517c7c95af821a16657c4 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Thu, 22 Aug 2024 17:15:50 +0200 +Subject: [PATCH] Generate and verify message MACs in libkrad + +Implement some of the measures specified in +draft-ietf-radext-deprecating-radius-03 for mitigating the BlastRADIUS +attack (CVE-2024-3596): + +* Include a Message-Authenticator MAC as the first attribute when + generating a packet of type Access-Request, Access-Reject, + Access-Accept, or Access-Challenge (sections 5.2.1 and 5.2.4), if + the secret is non-empty. (An empty secret indicates the use of Unix + domain socket transport.) + +* Validate the Message-Authenticator MAC in received packets, if + present. + +FreeRADIUS enforces Message-Authenticator as of versions 3.2.5 and +3.0.27. libkrad must generate Message-Authenticator attributes in +order to remain compatible with these implementations. + +[ghudson@mit.edu: adjusted style and naming; simplified some +functions; edited commit message] + +ticket: 9142 (new) +tags: pullup +target_version: 1.21-next + +(cherry picked from commit 871125fea8ce0370a972bf65f7d1de63f619b06c) +--- + src/include/k5-int.h | 5 + + src/lib/crypto/krb/checksum_hmac_md5.c | 28 ++++ + src/lib/crypto/libk5crypto.exports | 1 + + src/lib/krad/attr.c | 17 ++ + src/lib/krad/attrset.c | 59 +++++-- + src/lib/krad/internal.h | 7 +- + src/lib/krad/packet.c | 206 +++++++++++++++++++++++-- + src/lib/krad/t_attrset.c | 2 +- + src/lib/krad/t_daemon.py | 3 +- + src/lib/krad/t_packet.c | 11 ++ + src/tests/t_otp.py | 3 + + 11 files changed, 311 insertions(+), 31 deletions(-) + +diff --git a/src/include/k5-int.h b/src/include/k5-int.h +index 69d6a6f569..b7789a2dd8 100644 +--- a/src/include/k5-int.h ++++ b/src/include/k5-int.h +@@ -2403,4 +2403,9 @@ krb5_boolean + k5_sname_compare(krb5_context context, krb5_const_principal sname, + krb5_const_principal princ); + ++/* Generate an HMAC-MD5 keyed checksum as specified by RFC 2104. */ ++krb5_error_code ++k5_hmac_md5(const krb5_data *key, const krb5_crypto_iov *data, size_t num_data, ++ krb5_data *output); ++ + #endif /* _KRB5_INT_H */ +diff --git a/src/lib/crypto/krb/checksum_hmac_md5.c b/src/lib/crypto/krb/checksum_hmac_md5.c +index ec024f3966..a809388549 100644 +--- a/src/lib/crypto/krb/checksum_hmac_md5.c ++++ b/src/lib/crypto/krb/checksum_hmac_md5.c +@@ -92,3 +92,31 @@ cleanup: + free(hash_iov); + return ret; + } ++ ++krb5_error_code ++k5_hmac_md5(const krb5_data *key, const krb5_crypto_iov *data, size_t num_data, ++ krb5_data *output) ++{ ++ krb5_error_code ret; ++ const struct krb5_hash_provider *hash = &krb5int_hash_md5; ++ krb5_keyblock keyblock = { 0 }; ++ krb5_data hashed_key; ++ uint8_t hkeybuf[16]; ++ krb5_crypto_iov iov; ++ ++ /* Hash the key if it is longer than the block size. */ ++ if (key->length > hash->blocksize) { ++ hashed_key = make_data(hkeybuf, sizeof(hkeybuf)); ++ iov.flags = KRB5_CRYPTO_TYPE_DATA; ++ iov.data = *key; ++ ret = hash->hash(&iov, 1, &hashed_key); ++ if (ret) ++ return ret; ++ key = &hashed_key; ++ } ++ ++ keyblock.magic = KV5M_KEYBLOCK; ++ keyblock.length = key->length; ++ keyblock.contents = (uint8_t *)key->data; ++ return krb5int_hmac_keyblock(hash, &keyblock, data, num_data, output); ++} +diff --git a/src/lib/crypto/libk5crypto.exports b/src/lib/crypto/libk5crypto.exports +index d8ffa63304..00e0ce1812 100644 +--- a/src/lib/crypto/libk5crypto.exports ++++ b/src/lib/crypto/libk5crypto.exports +@@ -102,3 +102,4 @@ krb5_c_prfplus + krb5_c_derive_prfplus + k5_enctype_to_ssf + krb5int_c_deprecated_enctype ++k5_hmac_md5 +diff --git a/src/lib/krad/attr.c b/src/lib/krad/attr.c +index 42d354a3b5..65ed1d35e7 100644 +--- a/src/lib/krad/attr.c ++++ b/src/lib/krad/attr.c +@@ -125,6 +125,23 @@ static const attribute_record attributes[UCHAR_MAX] = { + {"NAS-Port-Type", 4, 4, NULL, NULL}, + {"Port-Limit", 4, 4, NULL, NULL}, + {"Login-LAT-Port", 1, MAX_ATTRSIZE, NULL, NULL}, ++ {NULL, 0, 0, NULL, NULL}, /* Reserved for tunnelling */ ++ {NULL, 0, 0, NULL, NULL}, /* Reserved for tunnelling */ ++ {NULL, 0, 0, NULL, NULL}, /* Reserved for tunnelling */ ++ {NULL, 0, 0, NULL, NULL}, /* Reserved for tunnelling */ ++ {NULL, 0, 0, NULL, NULL}, /* Reserved for tunnelling */ ++ {NULL, 0, 0, NULL, NULL}, /* Reserved for tunnelling */ ++ {NULL, 0, 0, NULL, NULL}, /* Reserved for Apple Remote Access Protocol */ ++ {NULL, 0, 0, NULL, NULL}, /* Reserved for Apple Remote Access Protocol */ ++ {NULL, 0, 0, NULL, NULL}, /* Reserved for Apple Remote Access Protocol */ ++ {NULL, 0, 0, NULL, NULL}, /* Reserved for Apple Remote Access Protocol */ ++ {NULL, 0, 0, NULL, NULL}, /* Reserved for Apple Remote Access Protocol */ ++ {NULL, 0, 0, NULL, NULL}, /* Password-Retry */ ++ {NULL, 0, 0, NULL, NULL}, /* Prompt */ ++ {NULL, 0, 0, NULL, NULL}, /* Connect-Info */ ++ {NULL, 0, 0, NULL, NULL}, /* Configuration-Token */ ++ {NULL, 0, 0, NULL, NULL}, /* EAP-Message */ ++ {"Message-Authenticator", MD5_DIGEST_SIZE, MD5_DIGEST_SIZE, NULL, NULL}, + }; + + /* Encode User-Password attribute. */ +diff --git a/src/lib/krad/attrset.c b/src/lib/krad/attrset.c +index 6ec031e320..e5457ebfd7 100644 +--- a/src/lib/krad/attrset.c ++++ b/src/lib/krad/attrset.c +@@ -164,15 +164,44 @@ krad_attrset_copy(const krad_attrset *set, krad_attrset **copy) + return 0; + } + ++/* Place an encoded attributes into outbuf at position *i. Increment *i by the ++ * length of the encoding. */ ++static krb5_error_code ++append_attr(krb5_context ctx, const char *secret, ++ const uint8_t *auth, krad_attr type, const krb5_data *data, ++ uint8_t outbuf[MAX_ATTRSETSIZE], size_t *i, krb5_boolean *is_fips) ++{ ++ uint8_t buffer[MAX_ATTRSIZE]; ++ size_t attrlen; ++ krb5_error_code retval; ++ ++ retval = kr_attr_encode(ctx, secret, auth, type, data, buffer, &attrlen, ++ is_fips); ++ if (retval) ++ return retval; ++ ++ if (attrlen > MAX_ATTRSETSIZE - *i - 2) ++ return EMSGSIZE; ++ ++ outbuf[(*i)++] = type; ++ outbuf[(*i)++] = attrlen + 2; ++ memcpy(outbuf + *i, buffer, attrlen); ++ *i += attrlen; ++ ++ return 0; ++} ++ + krb5_error_code + kr_attrset_encode(const krad_attrset *set, const char *secret, +- const unsigned char *auth, ++ const uint8_t *auth, krb5_boolean add_msgauth, + unsigned char outbuf[MAX_ATTRSETSIZE], size_t *outlen, + krb5_boolean *is_fips) + { +- unsigned char buffer[MAX_ATTRSIZE]; + krb5_error_code retval; +- size_t i = 0, attrlen; ++ krad_attr msgauth_type = krad_attr_name2num("Message-Authenticator"); ++ const uint8_t zeroes[MD5_DIGEST_SIZE] = { 0 }; ++ krb5_data zerodata; ++ size_t i = 0; + attr *a; + + if (set == NULL) { +@@ -180,19 +209,21 @@ kr_attrset_encode(const krad_attrset *set, const char *secret, + return 0; + } + +- K5_TAILQ_FOREACH(a, &set->list, list) { +- retval = kr_attr_encode(set->ctx, secret, auth, a->type, &a->attr, +- buffer, &attrlen, is_fips); +- if (retval != 0) ++ if (add_msgauth) { ++ /* Encode Message-Authenticator as the first attribute, per ++ * draft-ietf-radext-deprecating-radius-03 section 5.2. */ ++ zerodata = make_data((uint8_t *)zeroes, MD5_DIGEST_SIZE); ++ retval = append_attr(set->ctx, secret, auth, msgauth_type, &zerodata, ++ outbuf, &i, is_fips); ++ if (retval) + return retval; ++ } + +- if (i + attrlen + 2 > MAX_ATTRSETSIZE) +- return EMSGSIZE; +- +- outbuf[i++] = a->type; +- outbuf[i++] = attrlen + 2; +- memcpy(&outbuf[i], buffer, attrlen); +- i += attrlen; ++ K5_TAILQ_FOREACH(a, &set->list, list) { ++ retval = append_attr(set->ctx, secret, auth, a->type, &a->attr, ++ outbuf, &i, is_fips); ++ if (retval) ++ return retval; + } + + *outlen = i; +diff --git a/src/lib/krad/internal.h b/src/lib/krad/internal.h +index a17b6f39b1..ca66f3ec68 100644 +--- a/src/lib/krad/internal.h ++++ b/src/lib/krad/internal.h +@@ -49,6 +49,8 @@ + #define UCHAR_MAX 255 + #endif + ++#define MD5_DIGEST_SIZE 16 ++ + /* RFC 2865 */ + #define MAX_ATTRSIZE (UCHAR_MAX - 2) + #define MAX_ATTRSETSIZE (KRAD_PACKET_SIZE_MAX - 20) +@@ -79,10 +81,11 @@ kr_attr_decode(krb5_context ctx, const char *secret, const unsigned char *auth, + krad_attr type, const krb5_data *in, + unsigned char outbuf[MAX_ATTRSIZE], size_t *outlen); + +-/* Encode the attributes into the buffer. */ ++/* Encode set into outbuf. If add_msgauth is true, include a zeroed ++ * Message-Authenticator as the first attribute. */ + krb5_error_code + kr_attrset_encode(const krad_attrset *set, const char *secret, +- const unsigned char *auth, ++ const uint8_t *auth, krb5_boolean add_msgauth, + unsigned char outbuf[MAX_ATTRSETSIZE], size_t *outlen, + krb5_boolean *is_fips); + +diff --git a/src/lib/krad/packet.c b/src/lib/krad/packet.c +index c5446b890c..3c1a4d507e 100644 +--- a/src/lib/krad/packet.c ++++ b/src/lib/krad/packet.c +@@ -36,6 +36,7 @@ + typedef unsigned char uchar; + + /* RFC 2865 */ ++#define MSGAUTH_SIZE (2 + MD5_DIGEST_SIZE) + #define OFFSET_CODE 0 + #define OFFSET_ID 1 + #define OFFSET_LENGTH 2 +@@ -222,6 +223,106 @@ packet_set_attrset(krb5_context ctx, const char *secret, krad_packet *pkt) + return kr_attrset_decode(ctx, &tmp, secret, pkt_auth(pkt), &pkt->attrset); + } + ++/* Determine if a packet requires a Message-Authenticator attribute. */ ++static inline krb5_boolean ++requires_msgauth(const char *secret, krad_code code) ++{ ++ /* If no secret is provided, assume that the transport is a UNIX socket. ++ * Message-Authenticator is required only on UDP and TCP connections. */ ++ if (*secret == '\0') ++ return FALSE; ++ ++ /* ++ * Per draft-ietf-radext-deprecating-radius-03 sections 5.2.1 and 5.2.4, ++ * Message-Authenticator is required in Access-Request packets and all ++ * potential responses when UDP or TCP transport is used. ++ */ ++ return code == krad_code_name2num("Access-Request") || ++ code == krad_code_name2num("Access-Reject") || ++ code == krad_code_name2num("Access-Accept") || ++ code == krad_code_name2num("Access-Challenge"); ++} ++ ++/* Check if the packet has a Message-Authenticator attribute. */ ++static inline krb5_boolean ++has_pkt_msgauth(const krad_packet *pkt) ++{ ++ krad_attr msgauth_type = krad_attr_name2num("Message-Authenticator"); ++ ++ return krad_attrset_get(pkt->attrset, msgauth_type, 0) != NULL; ++} ++ ++/* Return the beginning of the Message-Authenticator attribute in pkt, or NULL ++ * if no such attribute is present. */ ++static const uint8_t * ++lookup_msgauth_addr(const krad_packet *pkt) ++{ ++ krad_attr msgauth_type = krad_attr_name2num("Message-Authenticator"); ++ size_t i; ++ uint8_t *p; ++ ++ i = OFFSET_ATTR; ++ while (i + 2 < pkt->pkt.length) { ++ p = (uint8_t *)offset(&pkt->pkt, i); ++ if (msgauth_type == *p) ++ return p; ++ i += p[1]; ++ } ++ ++ return NULL; ++} ++ ++/* ++ * Calculate the message authenticator MAC for pkt as specified in RFC 2869 ++ * section 5.14, placing the result in mac_out. Use the provided authenticator ++ * auth, which may be from pkt or from a corresponding request. ++ */ ++static krb5_error_code ++calculate_mac(const char *secret, const krad_packet *pkt, ++ const uint8_t auth[AUTH_FIELD_SIZE], ++ uint8_t mac_out[MD5_DIGEST_SIZE]) ++{ ++ uint8_t zeroed_msgauth[MSGAUTH_SIZE]; ++ krad_attr msgauth_type = krad_attr_name2num("Message-Authenticator"); ++ const uint8_t *msgauth_attr, *msgauth_end, *pkt_end; ++ krb5_crypto_iov input[5]; ++ krb5_data ksecr, mac; ++ ++ msgauth_attr = lookup_msgauth_addr(pkt); ++ if (msgauth_attr == NULL) ++ return EINVAL; ++ msgauth_end = msgauth_attr + MSGAUTH_SIZE; ++ pkt_end = (const uint8_t *)pkt->pkt.data + pkt->pkt.length; ++ ++ /* Read code, id, and length from the packet. */ ++ input[0].flags = KRB5_CRYPTO_TYPE_DATA; ++ input[0].data = make_data(pkt->pkt.data, OFFSET_AUTH); ++ ++ /* Read the provided authenticator. */ ++ input[1].flags = KRB5_CRYPTO_TYPE_DATA; ++ input[1].data = make_data((uint8_t *)auth, AUTH_FIELD_SIZE); ++ ++ /* Read any attributes before Message-Authenticator. */ ++ input[2].flags = KRB5_CRYPTO_TYPE_DATA; ++ input[2].data = make_data(pkt_attr(pkt), msgauth_attr - pkt_attr(pkt)); ++ ++ /* Read Message-Authenticator with the data bytes all set to zero, per RFC ++ * 2869 section 5.14. */ ++ zeroed_msgauth[0] = msgauth_type; ++ zeroed_msgauth[1] = MSGAUTH_SIZE; ++ memset(zeroed_msgauth + 2, 0, MD5_DIGEST_SIZE); ++ input[3].flags = KRB5_CRYPTO_TYPE_DATA; ++ input[3].data = make_data(zeroed_msgauth, MSGAUTH_SIZE); ++ ++ /* Read any attributes after Message-Authenticator. */ ++ input[4].flags = KRB5_CRYPTO_TYPE_DATA; ++ input[4].data = make_data((uint8_t *)msgauth_end, pkt_end - msgauth_end); ++ ++ mac = make_data(mac_out, MD5_DIGEST_SIZE); ++ ksecr = string2data((char *)secret); ++ return k5_hmac_md5(&ksecr, input, 5, &mac); ++} ++ + ssize_t + krad_packet_bytes_needed(const krb5_data *buffer) + { +@@ -255,6 +356,7 @@ krad_packet_new_request(krb5_context ctx, const char *secret, krad_code code, + krad_packet *pkt; + uchar id; + size_t attrset_len; ++ krb5_boolean msgauth_required; + + pkt = packet_new(); + if (pkt == NULL) { +@@ -274,9 +376,13 @@ krad_packet_new_request(krb5_context ctx, const char *secret, krad_code code, + if (retval != 0) + goto error; + ++ /* Determine if Message-Authenticator is required. */ ++ msgauth_required = (*secret != '\0' && ++ code == krad_code_name2num("Access-Request")); ++ + /* Encode the attributes. */ +- retval = kr_attrset_encode(set, secret, pkt_auth(pkt), pkt_attr(pkt), +- &attrset_len, &pkt->is_fips); ++ retval = kr_attrset_encode(set, secret, pkt_auth(pkt), msgauth_required, ++ pkt_attr(pkt), &attrset_len, &pkt->is_fips); + if (retval != 0) + goto error; + +@@ -285,6 +391,13 @@ krad_packet_new_request(krb5_context ctx, const char *secret, krad_code code, + pkt_code_set(pkt, code); + pkt_len_set(pkt, pkt->pkt.length); + ++ if (msgauth_required) { ++ /* Calculate and set the Message-Authenticator MAC. */ ++ retval = calculate_mac(secret, pkt, pkt_auth(pkt), pkt_attr(pkt) + 2); ++ if (retval != 0) ++ goto error; ++ } ++ + /* Copy the attrset for future use. */ + retval = packet_set_attrset(ctx, secret, pkt); + if (retval != 0) +@@ -307,14 +420,19 @@ krad_packet_new_response(krb5_context ctx, const char *secret, krad_code code, + krb5_error_code retval; + krad_packet *pkt; + size_t attrset_len; ++ krb5_boolean msgauth_required; + + pkt = packet_new(); + if (pkt == NULL) + return ENOMEM; + ++ /* Determine if Message-Authenticator is required. */ ++ msgauth_required = requires_msgauth(secret, code); ++ + /* Encode the attributes. */ +- retval = kr_attrset_encode(set, secret, pkt_auth(request), pkt_attr(pkt), +- &attrset_len, &pkt->is_fips); ++ retval = kr_attrset_encode(set, secret, pkt_auth(request), ++ msgauth_required, pkt_attr(pkt), &attrset_len, ++ &pkt->is_fips); + if (retval != 0) + goto error; + +@@ -330,6 +448,18 @@ krad_packet_new_response(krb5_context ctx, const char *secret, krad_code code, + if (retval != 0) + goto error; + ++ if (msgauth_required) { ++ /* ++ * Calculate and replace the Message-Authenticator MAC. Per RFC 2869 ++ * section 5.14, use the authenticator from the request, not from the ++ * response. ++ */ ++ retval = calculate_mac(secret, pkt, pkt_auth(request), ++ pkt_attr(pkt) + 2); ++ if (retval != 0) ++ goto error; ++ } ++ + /* Copy the attrset for future use. */ + retval = packet_set_attrset(ctx, secret, pkt); + if (retval != 0) +@@ -343,6 +473,34 @@ error: + return retval; + } + ++/* Verify the Message-Authenticator value in pkt, using the provided ++ * authenticator (which may be from pkt or from a corresponding request). */ ++static krb5_error_code ++verify_msgauth(const char *secret, const krad_packet *pkt, ++ const uint8_t auth[AUTH_FIELD_SIZE]) ++{ ++ uint8_t mac[MD5_DIGEST_SIZE]; ++ krad_attr msgauth_type = krad_attr_name2num("Message-Authenticator"); ++ const krb5_data *msgauth; ++ krb5_error_code retval; ++ ++ msgauth = krad_packet_get_attr(pkt, msgauth_type, 0); ++ if (msgauth == NULL) ++ return ENODATA; ++ ++ retval = calculate_mac(secret, pkt, auth, mac); ++ if (retval) ++ return retval; ++ ++ if (msgauth->length != MD5_DIGEST_SIZE) ++ return EMSGSIZE; ++ ++ if (k5_bcmp(mac, msgauth->data, MD5_DIGEST_SIZE) != 0) ++ return EBADMSG; ++ ++ return 0; ++} ++ + /* Decode a packet. */ + static krb5_error_code + decode_packet(krb5_context ctx, const char *secret, const krb5_data *buffer, +@@ -394,21 +552,35 @@ krad_packet_decode_request(krb5_context ctx, const char *secret, + krad_packet **reqpkt) + { + const krad_packet *tmp = NULL; ++ krad_packet *req; + krb5_error_code retval; + +- retval = decode_packet(ctx, secret, buffer, reqpkt); +- if (cb != NULL && retval == 0) { ++ retval = decode_packet(ctx, secret, buffer, &req); ++ if (retval) ++ return retval; ++ ++ /* Verify Message-Authenticator if present. */ ++ if (has_pkt_msgauth(req)) { ++ retval = verify_msgauth(secret, req, pkt_auth(req)); ++ if (retval) { ++ krad_packet_free(req); ++ return retval; ++ } ++ } ++ ++ if (cb != NULL) { + for (tmp = (*cb)(data, FALSE); tmp != NULL; tmp = (*cb)(data, FALSE)) { + if (pkt_id_get(*reqpkt) == pkt_id_get(tmp)) + break; + } +- } + +- if (cb != NULL && (retval != 0 || tmp != NULL)) +- (*cb)(data, TRUE); ++ if (tmp != NULL) ++ (*cb)(data, TRUE); ++ } + ++ *reqpkt = req; + *duppkt = tmp; +- return retval; ++ return 0; + } + + krb5_error_code +@@ -435,9 +607,17 @@ krad_packet_decode_response(krb5_context ctx, const char *secret, + break; + } + +- /* If the authenticator matches, then the response is valid. */ +- if (memcmp(pkt_auth(*rsppkt), auth, sizeof(auth)) == 0) +- break; ++ /* Verify the response authenticator. */ ++ if (k5_bcmp(pkt_auth(*rsppkt), auth, sizeof(auth)) != 0) ++ continue; ++ ++ /* Verify Message-Authenticator if present. */ ++ if (has_pkt_msgauth(*rsppkt)) { ++ if (verify_msgauth(secret, *rsppkt, pkt_auth(tmp)) != 0) ++ continue; ++ } ++ ++ break; + } + } + +diff --git a/src/lib/krad/t_attrset.c b/src/lib/krad/t_attrset.c +index 4cdb8b7d8e..f9c66509bd 100644 +--- a/src/lib/krad/t_attrset.c ++++ b/src/lib/krad/t_attrset.c +@@ -63,7 +63,7 @@ main(void) + noerror(krad_attrset_add(set, krad_attr_name2num("User-Password"), &tmp)); + + /* Encode attrset. */ +- noerror(kr_attrset_encode(set, "foo", auth, buffer, &encode_len, ++ noerror(kr_attrset_encode(set, "foo", auth, FALSE, buffer, &encode_len, + &is_fips)); + krad_attrset_free(set); + +diff --git a/src/lib/krad/t_daemon.py b/src/lib/krad/t_daemon.py +index 4a3de079c7..647d4894eb 100755 +--- a/src/lib/krad/t_daemon.py ++++ b/src/lib/krad/t_daemon.py +@@ -40,6 +40,7 @@ DICTIONARY = """ + ATTRIBUTE\tUser-Name\t1\tstring + ATTRIBUTE\tUser-Password\t2\toctets + ATTRIBUTE\tNAS-Identifier\t32\tstring ++ATTRIBUTE\tMessage-Authenticator\t80\toctets + """ + + class TestServer(server.Server): +@@ -52,7 +53,7 @@ class TestServer(server.Server): + if key == "User-Password": + passwd = [pkt.PwDecrypt(x) for x in pkt[key]] + +- reply = self.CreateReplyPacket(pkt) ++ reply = self.CreateReplyPacket(pkt, message_authenticator=True) + if passwd == ['accept']: + reply.code = packet.AccessAccept + else: +diff --git a/src/lib/krad/t_packet.c b/src/lib/krad/t_packet.c +index c22489144f..104b6507a2 100644 +--- a/src/lib/krad/t_packet.c ++++ b/src/lib/krad/t_packet.c +@@ -172,6 +172,9 @@ main(int argc, const char **argv) + krb5_data username, password; + krb5_boolean auth = FALSE; + krb5_context ctx; ++ const krad_packet *dupreq; ++ const krb5_data *encpkt; ++ krad_packet *decreq; + + username = string2data("testUser"); + +@@ -184,9 +187,17 @@ main(int argc, const char **argv) + + password = string2data("accept"); + noerror(make_packet(ctx, &username, &password, &packets[ACCEPT_PACKET])); ++ encpkt = krad_packet_encode(packets[ACCEPT_PACKET]); ++ noerror(krad_packet_decode_request(ctx, "foo", encpkt, NULL, NULL, ++ &dupreq, &decreq)); ++ krad_packet_free(decreq); + + password = string2data("reject"); + noerror(make_packet(ctx, &username, &password, &packets[REJECT_PACKET])); ++ encpkt = krad_packet_encode(packets[REJECT_PACKET]); ++ noerror(krad_packet_decode_request(ctx, "foo", encpkt, NULL, NULL, ++ &dupreq, &decreq)); ++ krad_packet_free(decreq); + + memset(&hints, 0, sizeof(hints)); + hints.ai_family = AF_INET; +diff --git a/src/tests/t_otp.py b/src/tests/t_otp.py +index c3b820a411..dd5cdc5c26 100755 +--- a/src/tests/t_otp.py ++++ b/src/tests/t_otp.py +@@ -49,6 +49,7 @@ ATTRIBUTE User-Name 1 string + ATTRIBUTE User-Password 2 octets + ATTRIBUTE Service-Type 6 integer + ATTRIBUTE NAS-Identifier 32 string ++ATTRIBUTE Message-Authenticator 80 octets + ''' + + class RadiusDaemon(Process): +@@ -97,6 +98,8 @@ class RadiusDaemon(Process): + reply.code = packet.AccessReject + replyq['reply'] = False + ++ reply.add_message_authenticator() ++ + outq.put(replyq) + if addr is None: + sock.send(reply.ReplyPacket()) +-- +2.46.0 + diff --git a/krb5.spec b/krb5.spec index 9df5405..a7589a6 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 2 +%global baserelease 3 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -78,6 +78,12 @@ Patch0016: 0016-Eliminate-old-style-function-declarations.patch Patch0017: 0017-Fix-two-unlikely-memory-leaks.patch Patch0018: 0018-Fix-unimportant-memory-leaks.patch Patch0019: 0019-Remove-klist-s-defname-global-variable.patch +Patch0020: 0020-End-connection-on-KDC_ERR_SVC_UNAVAILABLE.patch +Patch0021: 0021-Add-request_timeout-configuration-parameter.patch +Patch0022: 0022-Wait-indefinitely-on-KDC-TCP-connections.patch +Patch0023: 0023-Remove-PKINIT-RSA-support.patch +Patch0024: 0024-Fix-various-issues-detected-by-static-analysis.patch +Patch0025: 0025-Generate-and-verify-message-MACs-in-libkrad.patch License: Brian-Gladman-2-Clause AND BSD-2-Clause AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-first-lines AND BSD-3-Clause AND BSD-4-Clause AND CMU-Mach-nodoc AND FSFULLRWD AND HPND AND HPND-export2-US AND HPND-export-US AND HPND-export-US-acknowledgement AND HPND-export-US-modify AND ISC AND MIT AND MIT-CMU AND OLDAP-2.8 AND OpenVision URL: https://web.mit.edu/kerberos/www/ @@ -714,6 +720,16 @@ exit 0 %{_datarootdir}/%{name}-tests/%{_arch} %changelog +* Wed Oct 30 2024 Julien Rische - 1.21.3-3 +- libkrad: implement support for Message-Authenticator (CVE-2024-3596) + Resolves: rhbz#2304071 +- Fix various issues detected by static analysis + Resolves: rhbz#2322704 +- Remove RSA protocol for PKINIT + Resolves: rhbz#2322706 +- Make TCP waiting time configurable + Resolves: rhbz#2322711 + * Thu Jul 18 2024 Fedora Release Engineering - 1.21.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From 099df268cebf61ee23d3982c6874ef137d0358e1 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jan 2025 09:48:45 +0000 Subject: [PATCH 096/103] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- krb5.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/krb5.spec b/krb5.spec index a7589a6..12c9e25 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 3 +%global baserelease 4 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -720,6 +720,9 @@ exit 0 %{_datarootdir}/%{name}-tests/%{_arch} %changelog +* Fri Jan 17 2025 Fedora Release Engineering - 1.21.3-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Wed Oct 30 2024 Julien Rische - 1.21.3-3 - libkrad: implement support for Message-Authenticator (CVE-2024-3596) Resolves: rhbz#2304071 From f2bc777d630ff93f1a3806a983cbdf69b2c02a81 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Thu, 19 Dec 2024 16:08:31 +0100 Subject: [PATCH 097/103] krb5 1.21.3-5 - Prevent overflow when calculating ulog block size (CVE-2025-24528) Resolves: rhbz#2342798 - Support PKCS11 EC client certs in PKINIT Resolves: rhbz#2341962 - kdb5_util: fix DB entry flags on modification Resolves: rhbz#2336555 - Add ECDH support for PKINIT (RFC5349) Resolves: rhbz#2214326 - Remove dependency of krb5-libs on gawk and sed Resolves: rhbz#2323859 Signed-off-by: Julien Rische --- 0026-PKINIT-ECDH-support.patch | 1027 ++++++++++ ...with-sha512-256-to-supportedCMSTypes.patch | 78 + 0028-Get-rid-of-pkinit_crypto_openssl.h.patch | 264 +++ ...se-SoftHSMv2-for-PKCS11-PKINIT-tests.patch | 157 ++ ...-Simplify-PKINIT-cert-representation.patch | 202 ++ ...ort-PKCS11-EC-client-certs-in-PKINIT.patch | 1768 +++++++++++++++++ ...ove-PKCS11-error-reporting-in-PKINIT.patch | 599 ++++++ ...-mask-flags-for-kdb5_util-operations.patch | 61 + ...low-when-calculating-ulog-block-size.patch | 64 + krb5.spec | 36 +- 10 files changed, 4252 insertions(+), 4 deletions(-) create mode 100644 0026-PKINIT-ECDH-support.patch create mode 100644 0027-Add-ecdsa-with-sha512-256-to-supportedCMSTypes.patch create mode 100644 0028-Get-rid-of-pkinit_crypto_openssl.h.patch create mode 100644 0029-Use-SoftHSMv2-for-PKCS11-PKINIT-tests.patch create mode 100644 0030-Simplify-PKINIT-cert-representation.patch create mode 100644 0031-Support-PKCS11-EC-client-certs-in-PKINIT.patch create mode 100644 0032-Improve-PKCS11-error-reporting-in-PKINIT.patch create mode 100644 0033-Set-missing-mask-flags-for-kdb5_util-operations.patch create mode 100644 0034-Prevent-overflow-when-calculating-ulog-block-size.patch diff --git a/0026-PKINIT-ECDH-support.patch b/0026-PKINIT-ECDH-support.patch new file mode 100644 index 0000000..14c86be --- /dev/null +++ b/0026-PKINIT-ECDH-support.patch @@ -0,0 +1,1027 @@ +From 5af8bb21de29e3b9a0d5b2001fab71ea102f7990 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Fri, 12 May 2023 15:38:46 -0400 +Subject: [PATCH] PKINIT ECDH support + +Add support for elliptic curve key exchange to PKINIT (RFC 5349 +section 4). Extend pkinit_dh_min_bits to allow the string values +"P-256", "P-384", and "P-521", using rough finite-field strength +equivalents to rank them relative to the Oakley Diffie-Hellman groups. + +When processing TD-DH-PARAMETERS on the client, only accept the three +Oakley groups or the three supported elliptic curve groups. +Previously we accepted any Diffie-Hellman parameters that passed +EVP_PKEY_param_check()/DH_check() and had equal or better bit strength +to the original proposal. + +ticket: 9095 (new) +(cherry picked from commit 0f870b1bcad960fd5319a3f97aafd7f4a289e2fb) +--- + doc/admin/conf_files/kdc_conf.rst | 7 +- + doc/admin/conf_files/krb5_conf.rst | 7 +- + src/plugins/preauth/pkinit/pkinit.h | 6 +- + src/plugins/preauth/pkinit/pkinit_clnt.c | 17 +- + src/plugins/preauth/pkinit/pkinit_constants.c | 27 + + src/plugins/preauth/pkinit/pkinit_crypto.h | 7 + + .../preauth/pkinit/pkinit_crypto_openssl.c | 470 ++++++++++++------ + .../preauth/pkinit/pkinit_crypto_openssl.h | 4 +- + src/plugins/preauth/pkinit/pkinit_lib.c | 3 - + src/plugins/preauth/pkinit/pkinit_srv.c | 17 +- + src/plugins/preauth/pkinit/pkinit_trace.h | 11 + + src/tests/t_pkinit.py | 12 + + 12 files changed, 405 insertions(+), 183 deletions(-) + +diff --git a/doc/admin/conf_files/kdc_conf.rst b/doc/admin/conf_files/kdc_conf.rst +index 846c58ed82..fb0593f281 100644 +--- a/doc/admin/conf_files/kdc_conf.rst ++++ b/doc/admin/conf_files/kdc_conf.rst +@@ -768,8 +768,11 @@ For information about the syntax of some of these options, see + be specified multiple times. + + **pkinit_dh_min_bits** +- Specifies the minimum number of bits the KDC is willing to accept +- for a client's Diffie-Hellman key. The default is 2048. ++ Specifies the minimum strength of Diffie-Hellman group the KDC is ++ willing to accept for key exchange. Valid values in order of ++ increasing strength are 1024, 2048, P-256, 4096, P-384, and P-521. ++ The default is 2048. (P-256, P-384, and P-521 are new in release ++ 1.22.) + + **pkinit_allow_upn** + Specifies that the KDC is willing to accept client certificates +diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst +index b7284c47df..dca52e1426 100644 +--- a/doc/admin/conf_files/krb5_conf.rst ++++ b/doc/admin/conf_files/krb5_conf.rst +@@ -1131,9 +1131,10 @@ PKINIT krb5.conf options + option is not recommended. + + **pkinit_dh_min_bits** +- Specifies the size of the Diffie-Hellman key the client will +- attempt to use. The acceptable values are 1024, 2048, and 4096. +- The default is 2048. ++ Specifies the group of the Diffie-Hellman key the client will ++ attempt to use. The acceptable values are 1024, 2048, P-256, ++ 4096, P-384, and P-521. The default is 2048. (P-256, P-384, and ++ P-521 are new in release 1.22.) + + **pkinit_identities** + Specifies the location(s) to be used to find the user's X.509 +diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h +index 5ab0f4bc28..7ba7155bb4 100644 +--- a/src/plugins/preauth/pkinit/pkinit.h ++++ b/src/plugins/preauth/pkinit/pkinit.h +@@ -59,6 +59,10 @@ + + #define PKINIT_DEFAULT_DH_MIN_BITS 2048 + #define PKINIT_DH_MIN_CONFIG_BITS 1024 ++/* Rough finite-field bit strength equivalents for the elliptic curve groups */ ++#define PKINIT_DH_P256_BITS 3072 ++#define PKINIT_DH_P384_BITS 7680 ++#define PKINIT_DH_P521_BITS 15360 + + #define KRB5_CONF_KDCDEFAULTS "kdcdefaults" + #define KRB5_CONF_LIBDEFAULTS "libdefaults" +@@ -101,8 +105,6 @@ static inline void pkiDebug (const char *fmt, ...) { } + #define OCTETDATA_TO_KRB5DATA(octd, k5d) \ + (k5d)->length = (octd)->length; (k5d)->data = (char *)(octd)->data; + +-extern const krb5_data dh_oid; +- + /* + * notes about crypto contexts: + * +diff --git a/src/plugins/preauth/pkinit/pkinit_clnt.c b/src/plugins/preauth/pkinit/pkinit_clnt.c +index 54e7537600..b08022a214 100644 +--- a/src/plugins/preauth/pkinit/pkinit_clnt.c ++++ b/src/plugins/preauth/pkinit/pkinit_clnt.c +@@ -681,7 +681,7 @@ pkinit_client_profile(krb5_context context, + const krb5_data *realm) + { + const char *configured_identity; +- char *eku_string = NULL; ++ char *eku_string = NULL, *minbits = NULL; + + pkiDebug("pkinit_client_profile %p %p %p %p\n", + context, plgctx, reqctx, realm); +@@ -690,17 +690,10 @@ pkinit_client_profile(krb5_context context, + KRB5_CONF_PKINIT_REQUIRE_CRL_CHECKING, + reqctx->opts->require_crl_checking, + &reqctx->opts->require_crl_checking); +- pkinit_libdefault_integer(context, realm, +- KRB5_CONF_PKINIT_DH_MIN_BITS, +- reqctx->opts->dh_size, +- &reqctx->opts->dh_size); +- if (reqctx->opts->dh_size != 1024 && reqctx->opts->dh_size != 2048 +- && reqctx->opts->dh_size != 4096) { +- pkiDebug("%s: invalid value (%d) for pkinit_dh_min_bits, " +- "using default value (%d) instead\n", __FUNCTION__, +- reqctx->opts->dh_size, PKINIT_DEFAULT_DH_MIN_BITS); +- reqctx->opts->dh_size = PKINIT_DEFAULT_DH_MIN_BITS; +- } ++ pkinit_libdefault_string(context, realm, KRB5_CONF_PKINIT_DH_MIN_BITS, ++ &minbits); ++ reqctx->opts->dh_size = parse_dh_min_bits(context, minbits); ++ free(minbits); + pkinit_libdefault_string(context, realm, + KRB5_CONF_PKINIT_EKU_CHECKING, + &eku_string); +diff --git a/src/plugins/preauth/pkinit/pkinit_constants.c b/src/plugins/preauth/pkinit/pkinit_constants.c +index 1da482e0b4..10f8688ec2 100644 +--- a/src/plugins/preauth/pkinit/pkinit_constants.c ++++ b/src/plugins/preauth/pkinit/pkinit_constants.c +@@ -320,6 +320,33 @@ static const uint8_t o4096[] = { + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF + }; + ++/* Named curve prime256v1 (1.2.840.10045.3.1.7) as parameters for RFC 3279 ++ * section 2.3.5 id-ecPublicKey */ ++static const uint8_t p256[] = { ++ 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07 ++}; ++ ++/* Named curve secp384r1 (1.3.132.0.34, from RFC 5480 section 2.1.1.1) as ++ * parameters for RFC 3279 section 2.3.5 id-ecPublicKey */ ++static const uint8_t p384[] = { ++ 0x06, 0x05, 0x2B, 0x81, 0x04, 0x00, 0x22 ++}; ++ ++/* Named curve secp521r1 (1.3.132.0.35, from RFC 5480 section 2.1.1.1) as ++ * parameters for RFC 3279 section 2.3.5 id-ecPublicKey */ ++static const uint8_t p521[] = { ++ 0x06, 0x05, 0x2B, 0x81, 0x04, 0x00, 0x23 ++}; ++ + const krb5_data oakley_1024 = { KV5M_DATA, sizeof(o1024), (char *)o1024 }; + const krb5_data oakley_2048 = { KV5M_DATA, sizeof(o2048), (char *)o2048 }; + const krb5_data oakley_4096 = { KV5M_DATA, sizeof(o4096), (char *)o4096 }; ++const krb5_data ec_p256 = { KV5M_DATA, sizeof(p256), (char *)p256 }; ++const krb5_data ec_p384 = { KV5M_DATA, sizeof(p384), (char *)p384 }; ++const krb5_data ec_p521 = { KV5M_DATA, sizeof(p521), (char *)p521 }; ++ ++/* RFC 3279 section 2.3.3 dhpublicnumber (1.2.840.10046.2.1) */ ++const krb5_data dh_oid = { 0, 7, "\x2A\x86\x48\xce\x3e\x02\x01" }; ++ ++/* RFC 3279 section 2.3.5 id-ecPublicKey (1.2.840.10045.2.1) */ ++const krb5_data ec_oid = { 0, 7, "\x2A\x86\x48\xCE\x3D\x02\x01" }; +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h +index 04199b45a4..fd876e4850 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto.h ++++ b/src/plugins/preauth/pkinit/pkinit_crypto.h +@@ -568,6 +568,11 @@ extern const krb5_data sha512_id; + extern const krb5_data oakley_1024; + extern const krb5_data oakley_2048; + extern const krb5_data oakley_4096; ++extern const krb5_data ec_p256; ++extern const krb5_data ec_p384; ++extern const krb5_data ec_p521; ++extern const krb5_data dh_oid; ++extern const krb5_data ec_oid; + + /** + * An ordered set of OIDs, stored as krb5_data, of KDF algorithms +@@ -590,4 +595,6 @@ crypto_req_cert_matching_data(krb5_context context, + pkinit_req_crypto_context reqctx, + pkinit_cert_matching_data **md_out); + ++int parse_dh_min_bits(krb5_context context, const char *str); ++ + #endif /* _PKINIT_CRYPTO_H */ +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index 26fa9184b3..f6d494bd11 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -181,6 +181,15 @@ compat_get0_DH(const EVP_PKEY *pkey) + + } + ++#define EVP_PKEY_get0_EC_KEY compat_get0_EC ++static EC_KEY * ++compat_get0_EC(const EVP_PKEY *pkey) ++{ ++ if (pkey->type != EVP_PKEY_EC) ++ return NULL; ++ return pkey->pkey.ec; ++} ++ + /* Return true if the cert c includes a key usage which doesn't include u. + * Define using direct member access for pre-1.1. */ + #define ku_reject(c, u) \ +@@ -260,37 +269,11 @@ decode_bn_der(const uint8_t *der, size_t len) + return bn; + } + +-#if OPENSSL_VERSION_NUMBER >= 0x10100000L +-static int +-params_valid(EVP_PKEY *params) +-{ +- EVP_PKEY_CTX *ctx; +- int result; +- +- ctx = EVP_PKEY_CTX_new(params, NULL); +- if (ctx == NULL) +- return 0; +- result = EVP_PKEY_param_check(ctx); +- EVP_PKEY_CTX_free(ctx); +- return result == 1; +-} +-#else +-static int +-params_valid(EVP_PKEY *params) +-{ +- DH *dh; +- int codes; +- +- dh = EVP_PKEY_get0_DH(params); +- return (dh == NULL) ? 0 : (DH_check(dh, &codes) && codes == 0); +-} +-#endif +- + #if OPENSSL_VERSION_NUMBER >= 0x10100000L + + #if OPENSSL_VERSION_NUMBER >= 0x30000000L + static EVP_PKEY * +-decode_dh_params(const krb5_data *params_der) ++decode_params(const krb5_data *params_der, const char *type) + { + EVP_PKEY *pkey = NULL; + const uint8_t *inptr = (uint8_t *)params_der->data; +@@ -298,7 +281,7 @@ decode_dh_params(const krb5_data *params_der) + OSSL_DECODER_CTX *dctx; + int ok; + +- dctx = OSSL_DECODER_CTX_new_for_pkey(&pkey, "DER", "type-specific", "DHX", ++ dctx = OSSL_DECODER_CTX_new_for_pkey(&pkey, "DER", "type-specific", type, + EVP_PKEY_KEY_PARAMETERS, NULL, NULL); + if (dctx == NULL) + return NULL; +@@ -307,7 +290,15 @@ decode_dh_params(const krb5_data *params_der) + OSSL_DECODER_CTX_free(dctx); + return ok ? pkey : NULL; + } ++ ++static EVP_PKEY * ++decode_dh_params(const krb5_data *params_der) ++{ ++ return decode_params(params_der, "DHX"); ++} ++ + #else ++ + static EVP_PKEY * + decode_dh_params(const krb5_data *params_der) + { +@@ -320,6 +311,7 @@ decode_dh_params(const krb5_data *params_der) + DH_free(dh); + return pkey; + } ++ + #endif + + static krb5_error_code +@@ -520,6 +512,39 @@ cleanup: + + #endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */ + ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++ ++static EVP_PKEY * ++decode_ec_params(const krb5_data *params_der) ++{ ++ return decode_params(params_der, "EC"); ++} ++ ++#else /* OPENSSL_VERSION_NUMBER < 0x30000000L */ ++ ++static EVP_PKEY * ++decode_ec_params(const krb5_data *params_der) ++{ ++ const uint8_t *p = (uint8_t *)params_der->data; ++ EC_KEY *eckey; ++ EVP_PKEY *pkey; ++ ++ eckey = d2i_ECParameters(NULL, &p, params_der->length); ++ if (eckey == NULL) ++ return NULL; ++ pkey = EVP_PKEY_new(); ++ if (pkey != NULL) { ++ if (!EVP_PKEY_set1_EC_KEY(pkey, eckey)) { ++ EVP_PKEY_free(pkey); ++ pkey = NULL; ++ } ++ } ++ EC_KEY_free(eckey); ++ return pkey; ++} ++ ++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ ++ + /* Attempt to specify padded Diffie-Hellman result derivation. Don't error out + * if this fails since we also detect short results and adjust them. */ + #if OPENSSL_VERSION_NUMBER >= 0x30000000L +@@ -551,7 +576,8 @@ dh_result(EVP_PKEY *pkey, EVP_PKEY *peer, + EVP_PKEY_CTX *derive_ctx = NULL; + int ok = 0; + uint8_t *buf = NULL; +- size_t len, dh_size = EVP_PKEY_get_size(pkey); ++ size_t len, result_size; ++ krb5_boolean ecc = (EVP_PKEY_id(pkey) == EVP_PKEY_EC); + + *result_out = NULL; + *len_out = 0; +@@ -561,24 +587,39 @@ dh_result(EVP_PKEY *pkey, EVP_PKEY *peer, + goto cleanup; + if (EVP_PKEY_derive_init(derive_ctx) <= 0) + goto cleanup; +- set_padded_derivation(derive_ctx); ++ if (!ecc) ++ set_padded_derivation(derive_ctx); + if (EVP_PKEY_derive_set_peer(derive_ctx, peer) <= 0) + goto cleanup; + +- buf = malloc(dh_size); ++ if (ecc) { ++ if (EVP_PKEY_derive(derive_ctx, NULL, &result_size) <= 0) ++ goto cleanup; ++ } else { ++ /* ++ * For finite-field Diffie-Hellman we must ensure that the result ++ * matches the key size (normally through padded derivation, but that ++ * isn't supported by OpenSSL 1.0 so we must check). ++ */ ++ result_size = EVP_PKEY_get_size(pkey); ++ } ++ buf = malloc(result_size); + if (buf == NULL) + goto cleanup; +- len = dh_size; ++ len = result_size; + if (EVP_PKEY_derive(derive_ctx, buf, &len) <= 0) + goto cleanup; +- if (len < dh_size) { /* only possible without padded derivation */ +- memmove(buf + (dh_size - len), buf, len); +- memset(buf, 0, dh_size - len); ++ ++ /* If we couldn't specify padded derivation for finite-field DH we may need ++ * to fix up the result by right-shifting it within the buffer. */ ++ if (len < result_size) { ++ memmove(buf + (result_size - len), buf, len); ++ memset(buf, 0, result_size - len); + } + + ok = 1; + *result_out = buf; +- *len_out = dh_size; ++ *len_out = result_size; + buf = NULL; + + cleanup: +@@ -592,13 +633,21 @@ static int + dh_pubkey_der(EVP_PKEY *pkey, uint8_t **pubkey_out, unsigned int *len_out) + { + BIGNUM *pubkey_bn = NULL; +- int len, ok; +- uint8_t *buf; +- +- if (!EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, &pubkey_bn)) +- return 0; +- ok = encode_bn_der(pubkey_bn, &buf, &len); +- BN_free(pubkey_bn); ++ int len, ok = 0; ++ uint8_t *buf, *outptr; ++ ++ if (EVP_PKEY_id(pkey) == EVP_PKEY_EC) { ++ len = i2d_PublicKey(pkey, NULL); ++ if (len > 0 && (outptr = buf = malloc(len)) != NULL) { ++ (void)i2d_PublicKey(pkey, &outptr); ++ ok = 1; ++ } ++ } else { ++ if (!EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, &pubkey_bn)) ++ return 0; ++ ok = encode_bn_der(pubkey_bn, &buf, &len); ++ BN_free(pubkey_bn); ++ } + if (ok) { + *pubkey_out = buf; + *len_out = len; +@@ -610,19 +659,33 @@ static int + dh_pubkey_der(EVP_PKEY *pkey, uint8_t **pubkey_out, unsigned int *len_out) + { + const DH *dh; ++ EC_KEY *eckey; /* can be const when OpenSSL 1.0 dropped */ + const BIGNUM *pubkey_bn; +- uint8_t *buf; ++ uint8_t *buf, *outptr; + int len; + + dh = EVP_PKEY_get0_DH(pkey); +- if (dh == NULL) +- return 0; +- DH_get0_key(dh, &pubkey_bn, NULL); +- if (!encode_bn_der(pubkey_bn, &buf, &len)) +- return 0; +- *pubkey_out = buf; +- *len_out = len; +- return 1; ++ if (dh != NULL) { ++ DH_get0_key(dh, &pubkey_bn, NULL); ++ if (!encode_bn_der(pubkey_bn, &buf, &len)) ++ return 0; ++ *pubkey_out = buf; ++ *len_out = len; ++ return 1; ++ } ++ ++ eckey = EVP_PKEY_get0_EC_KEY(pkey); ++ if (eckey != NULL) { ++ len = i2o_ECPublicKey(eckey, NULL); ++ if (len > 0 && (outptr = buf = malloc(len)) != NULL) { ++ (void)i2o_ECPublicKey(eckey, &outptr); ++ *pubkey_out = buf; ++ *len_out = len; ++ return 1; ++ } ++ } ++ ++ return 0; + } + #endif + +@@ -686,17 +749,23 @@ compose_dh_pkey(EVP_PKEY *params, const uint8_t *pubkey_der, size_t der_len) + if (pkey == NULL) + goto cleanup; + +- pubkey_bn = decode_bn_der(pubkey_der, der_len); +- if (pubkey_bn == NULL) +- goto cleanup; +- binlen = EVP_PKEY_get_size(pkey); +- pubkey_bin = malloc(binlen); +- if (pubkey_bin == NULL) +- goto cleanup; +- if (BN_bn2binpad(pubkey_bn, pubkey_bin, binlen) != binlen) +- goto cleanup; +- if (EVP_PKEY_set1_encoded_public_key(pkey, pubkey_bin, binlen) != 1) +- goto cleanup; ++ if (EVP_PKEY_id(params) == EVP_PKEY_EC) { ++ if (d2i_PublicKey(EVP_PKEY_id(params), &pkey, &pubkey_der, ++ der_len) == NULL) ++ goto cleanup; ++ } else { ++ pubkey_bn = decode_bn_der(pubkey_der, der_len); ++ if (pubkey_bn == NULL) ++ goto cleanup; ++ binlen = EVP_PKEY_get_size(pkey); ++ pubkey_bin = malloc(binlen); ++ if (pubkey_bin == NULL) ++ goto cleanup; ++ if (BN_bn2binpad(pubkey_bn, pubkey_bin, binlen) != binlen) ++ goto cleanup; ++ if (EVP_PKEY_set1_encoded_public_key(pkey, pubkey_bin, binlen) != 1) ++ goto cleanup; ++ } + + pkey_ret = pkey; + pkey = NULL; +@@ -741,29 +810,60 @@ static EVP_PKEY * + compose_dh_pkey(EVP_PKEY *params, const uint8_t *pubkey_der, size_t der_len) + { + DH *dhparams, *dh = NULL; +- EVP_PKEY *pkey = NULL; ++ EVP_PKEY *pkey = NULL, *pkey_ret = NULL; + BIGNUM *pubkey_bn = NULL; ++ EC_KEY *params_eckey, *eckey = NULL; ++ const EC_GROUP *group; ++ ++ if (EVP_PKEY_id(params) == EVP_PKEY_EC) { ++ /* We would like to use EVP_PKEY_copy_parameters() and d2i_PublicKey(), ++ * but the latter is broken in OpenSSL 1.1.0-1.1.1a for EC keys. */ ++ params_eckey = EVP_PKEY_get0_EC_KEY(params); ++ if (params_eckey == NULL) ++ goto cleanup; ++ group = EC_KEY_get0_group(params_eckey); ++ eckey = EC_KEY_new(); ++ if (eckey == NULL) ++ goto cleanup; ++ if (!EC_KEY_set_group(eckey, group)) ++ goto cleanup; ++ if (o2i_ECPublicKey(&eckey, &pubkey_der, der_len) == NULL) ++ goto cleanup; ++ pkey = EVP_PKEY_new(); ++ if (pkey == NULL) ++ return NULL; ++ if (!EVP_PKEY_assign(pkey, EVP_PKEY_EC, eckey)) { ++ EVP_PKEY_free(pkey); ++ return NULL; ++ } ++ eckey = NULL; ++ } else { ++ pubkey_bn = decode_bn_der(pubkey_der, der_len); ++ if (pubkey_bn == NULL) ++ goto cleanup; + +- pubkey_bn = decode_bn_der(pubkey_der, der_len); +- if (pubkey_bn == NULL) +- goto cleanup; ++ dhparams = EVP_PKEY_get0_DH(params); ++ if (dhparams == NULL) ++ goto cleanup; ++ dh = dup_dh_params(dhparams); ++ if (dh == NULL) ++ goto cleanup; ++ if (!DH_set0_key(dh, pubkey_bn, NULL)) ++ goto cleanup; ++ pubkey_bn = NULL; + +- dhparams = EVP_PKEY_get0_DH(params); +- if (dhparams == NULL) +- goto cleanup; +- dh = dup_dh_params(dhparams); +- if (dh == NULL) +- goto cleanup; +- if (!DH_set0_key(dh, pubkey_bn, NULL)) +- goto cleanup; +- pubkey_bn = NULL; ++ pkey = dh_to_pkey(&dh); ++ } + +- pkey = dh_to_pkey(&dh); ++ pkey_ret = pkey; ++ pkey = NULL; + + cleanup: + BN_free(pubkey_bn); + DH_free(dh); +- return pkey; ++ EC_KEY_free(eckey); ++ EVP_PKEY_free(pkey); ++ return pkey_ret; + } + + #endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ +@@ -1032,7 +1132,6 @@ pkinit_init_req_crypto(pkinit_req_crypto_context *cryptoctx) + memset(ctx, 0, sizeof(*ctx)); + + ctx->client_pkey = NULL; +- ctx->received_params = NULL; + ctx->received_cert = NULL; + + *cryptoctx = ctx; +@@ -1054,7 +1153,6 @@ pkinit_fini_req_crypto(pkinit_req_crypto_context req_cryptoctx) + + pkiDebug("%s: freeing ctx at %p\n", __FUNCTION__, req_cryptoctx); + EVP_PKEY_free(req_cryptoctx->client_pkey); +- EVP_PKEY_free(req_cryptoctx->received_params); + X509_free(req_cryptoctx->received_cert); + + free(req_cryptoctx); +@@ -1258,9 +1356,9 @@ pkinit_fini_pkinit_oids(pkinit_plg_crypto_context ctx) + + static int + try_import_group(krb5_context context, const krb5_data *params, +- const char *name, EVP_PKEY **pkey_out) ++ const char *name, krb5_boolean ec, EVP_PKEY **pkey_out) + { +- *pkey_out = decode_dh_params(params); ++ *pkey_out = ec ? decode_ec_params(params) : decode_dh_params(params); + if (*pkey_out == NULL) + TRACE_PKINIT_DH_GROUP_UNAVAILABLE(context, name); + return (*pkey_out != NULL) ? 1 : 0; +@@ -1271,12 +1369,15 @@ pkinit_init_dh_params(krb5_context context, pkinit_plg_crypto_context plgctx) + { + int n = 0; + +- n += try_import_group(context, &oakley_1024, "MODP 2 (1024-bit)", ++ n += try_import_group(context, &oakley_1024, "MODP 2 (1024-bit)", FALSE, + &plgctx->dh_1024); +- n += try_import_group(context, &oakley_2048, "MODP 14 (2048-bit)", ++ n += try_import_group(context, &oakley_2048, "MODP 14 (2048-bit)", FALSE, + &plgctx->dh_2048); +- n += try_import_group(context, &oakley_4096, "MODP 16 (4096-bit)", ++ n += try_import_group(context, &oakley_4096, "MODP 16 (4096-bit)", FALSE, + &plgctx->dh_4096); ++ n += try_import_group(context, &ec_p256, "P-256", TRUE, &plgctx->ec_p256); ++ n += try_import_group(context, &ec_p384, "P-384", TRUE, &plgctx->ec_p384); ++ n += try_import_group(context, &ec_p521, "P-521", TRUE, &plgctx->ec_p521); + + if (n == 0) { + pkinit_fini_dh_params(plgctx); +@@ -1294,7 +1395,11 @@ pkinit_fini_dh_params(pkinit_plg_crypto_context plgctx) + EVP_PKEY_free(plgctx->dh_1024); + EVP_PKEY_free(plgctx->dh_2048); + EVP_PKEY_free(plgctx->dh_4096); ++ EVP_PKEY_free(plgctx->ec_p256); ++ EVP_PKEY_free(plgctx->ec_p384); ++ EVP_PKEY_free(plgctx->ec_p521); + plgctx->dh_1024 = plgctx->dh_2048 = plgctx->dh_4096 = NULL; ++ plgctx->ec_p256 = plgctx->ec_p384 = plgctx->ec_p521 = NULL; + } + + static krb5_error_code +@@ -2711,6 +2816,62 @@ cleanup: + return ret; + } + ++/* Return the equivalent finite-field bit strength of pkey if it matches a ++ * well-known group, or -1 if it doesn't. */ ++static int ++check_dh_wellknown(pkinit_plg_crypto_context cryptoctx, EVP_PKEY *pkey) ++{ ++ int nbits = EVP_PKEY_get_bits(pkey); ++ ++ if (nbits == 1024 && EVP_PKEY_parameters_eq(cryptoctx->dh_1024, pkey) == 1) ++ return nbits; ++ if (nbits == 2048 && EVP_PKEY_parameters_eq(cryptoctx->dh_2048, pkey) == 1) ++ return nbits; ++ if (nbits == 4096 && EVP_PKEY_parameters_eq(cryptoctx->dh_4096, pkey) == 1) ++ return nbits; ++ if (nbits == 256 && EVP_PKEY_parameters_eq(cryptoctx->ec_p256, pkey) == 1) ++ return PKINIT_DH_P256_BITS; ++ if (nbits == 384 && EVP_PKEY_parameters_eq(cryptoctx->ec_p384, pkey) == 1) ++ return PKINIT_DH_P384_BITS; ++ if (nbits == 521 && EVP_PKEY_parameters_eq(cryptoctx->ec_p521, pkey) == 1) ++ return PKINIT_DH_P521_BITS; ++ return -1; ++} ++ ++/* Return a short description of the Diffie-Hellman group with the given ++ * finite-field group size equivalent. */ ++static const char * ++group_desc(int dh_bits) ++{ ++ switch (dh_bits) { ++ case PKINIT_DH_P256_BITS: return "P-256"; ++ case PKINIT_DH_P384_BITS: return "P-384"; ++ case PKINIT_DH_P521_BITS: return "P-521"; ++ case 1024: return "1024-bit DH"; ++ case 2048: return "2048-bit DH"; ++ case 4096: return "4096-bit DH"; ++ } ++ return "(unknown)"; ++} ++ ++static EVP_PKEY * ++choose_dh_group(pkinit_plg_crypto_context plg_cryptoctx, int dh_size) ++{ ++ if (dh_size == 1024) ++ return plg_cryptoctx->dh_1024; ++ if (dh_size == 2048) ++ return plg_cryptoctx->dh_2048; ++ if (dh_size == 4096) ++ return plg_cryptoctx->dh_4096; ++ if (dh_size == PKINIT_DH_P256_BITS) ++ return plg_cryptoctx->ec_p256; ++ if (dh_size == PKINIT_DH_P384_BITS) ++ return plg_cryptoctx->ec_p384; ++ if (dh_size == PKINIT_DH_P521_BITS) ++ return plg_cryptoctx->ec_p521; ++ return NULL; ++} ++ + krb5_error_code + client_create_dh(krb5_context context, + pkinit_plg_crypto_context plg_cryptoctx, +@@ -2723,16 +2884,10 @@ client_create_dh(krb5_context context, + + *spki_out = empty_data(); + +- if (cryptoctx->received_params != NULL) +- params = cryptoctx->received_params; +- else if (plg_cryptoctx->dh_1024 != NULL && dh_size == 1024) +- params = plg_cryptoctx->dh_1024; +- else if (plg_cryptoctx->dh_2048 != NULL && dh_size == 2048) +- params = plg_cryptoctx->dh_2048; +- else if (plg_cryptoctx->dh_4096 != NULL && dh_size == 4096) +- params = plg_cryptoctx->dh_4096; +- else ++ params = choose_dh_group(plg_cryptoctx, dh_size); ++ if (params == NULL) + goto cleanup; ++ TRACE_PKINIT_DH_PROPOSING_GROUP(context, group_desc(dh_size)); + + pkey = generate_dh_pkey(params); + if (pkey == NULL) +@@ -2772,8 +2927,11 @@ client_process_dh(krb5_context context, + server_pkey = compose_dh_pkey(cryptoctx->client_pkey, + subjectPublicKey_data, + subjectPublicKey_length); +- if (server_pkey == NULL) ++ if (server_pkey == NULL) { ++ retval = KRB5_PREAUTH_FAILED; ++ k5_setmsg(context, retval, _("Cannot compose PKINIT KDC public key")); + goto cleanup; ++ } + + if (!dh_result(cryptoctx->client_pkey, server_pkey, + &client_key, &client_key_len)) +@@ -2797,20 +2955,6 @@ cleanup: + return retval; + } + +-/* Return 1 if dh is a permitted well-known group, otherwise return 0. */ +-static int +-check_dh_wellknown(pkinit_plg_crypto_context cryptoctx, EVP_PKEY *pkey, +- int nbits) +-{ +- if (nbits == 1024) +- return EVP_PKEY_parameters_eq(cryptoctx->dh_1024, pkey) == 1; +- else if (nbits == 2048) +- return EVP_PKEY_parameters_eq(cryptoctx->dh_2048, pkey) == 1; +- else if (nbits == 4096) +- return EVP_PKEY_parameters_eq(cryptoctx->dh_4096, pkey) == 1; +- return 0; +-} +- + krb5_error_code + server_check_dh(krb5_context context, + pkinit_plg_crypto_context cryptoctx, +@@ -2820,7 +2964,7 @@ server_check_dh(krb5_context context, + int minbits) + { + EVP_PKEY *client_pkey = NULL; +- int dh_prime_bits; ++ int dh_bits; + krb5_error_code retval = KRB5KDC_ERR_DH_KEY_PARAMETERS_NOT_ACCEPTED; + + client_pkey = decode_spki(client_spki); +@@ -2829,16 +2973,15 @@ server_check_dh(krb5_context context, + goto cleanup; + } + +- /* KDC SHOULD check to see if the key parameters satisfy its policy */ +- dh_prime_bits = EVP_PKEY_get_bits(client_pkey); +- if (minbits && dh_prime_bits < minbits) { +- pkiDebug("client sent dh params with %d bits, we require %d\n", +- dh_prime_bits, minbits); ++ dh_bits = check_dh_wellknown(cryptoctx, client_pkey); ++ if (dh_bits == -1 || dh_bits < minbits) { ++ TRACE_PKINIT_DH_REJECTING_GROUP(context, group_desc(dh_bits), ++ group_desc(minbits)); + goto cleanup; + } ++ TRACE_PKINIT_DH_RECEIVED_GROUP(context, group_desc(dh_bits)); + +- if (check_dh_wellknown(cryptoctx, client_pkey, dh_prime_bits)) +- retval = 0; ++ retval = 0; + + cleanup: + if (retval == 0) +@@ -3023,9 +3166,20 @@ pkinit_create_td_dh_parameters(krb5_context context, + krb5_algorithm_identifier alg_1024 = { dh_oid, oakley_1024 }; + krb5_algorithm_identifier alg_2048 = { dh_oid, oakley_2048 }; + krb5_algorithm_identifier alg_4096 = { dh_oid, oakley_4096 }; +- krb5_algorithm_identifier *alglist[4]; ++ krb5_algorithm_identifier alg_p256 = { ec_oid, ec_p256 }; ++ krb5_algorithm_identifier alg_p384 = { ec_oid, ec_p384 }; ++ krb5_algorithm_identifier alg_p521 = { ec_oid, ec_p521 }; ++ krb5_algorithm_identifier *alglist[7]; + + i = 0; ++ if (plg_cryptoctx->ec_p256 != NULL && ++ opts->dh_min_bits <= PKINIT_DH_P256_BITS) ++ alglist[i++] = &alg_p256; ++ if (plg_cryptoctx->ec_p384 != NULL && ++ opts->dh_min_bits <= PKINIT_DH_P384_BITS) ++ alglist[i++] = &alg_p384; ++ if (plg_cryptoctx->ec_p521 != NULL) ++ alglist[i++] = &alg_p521; + if (plg_cryptoctx->dh_2048 != NULL && opts->dh_min_bits <= 2048) + alglist[i++] = &alg_2048; + if (plg_cryptoctx->dh_4096 != NULL && opts->dh_min_bits <= 4096) +@@ -3110,13 +3264,10 @@ pkinit_process_td_dh_params(krb5_context context, + { + krb5_error_code retval = KRB5KDC_ERR_DH_KEY_PARAMETERS_NOT_ACCEPTED; + EVP_PKEY *params = NULL; +- int i, dh_prime_bits, old_dh_size; ++ int i, dh_bits, old_dh_size; + + pkiDebug("dh parameters\n"); + +- EVP_PKEY_free(req_cryptoctx->received_params); +- req_cryptoctx->received_params = NULL; +- + old_dh_size = *new_dh_size; + + for (i = 0; algId[i] != NULL; i++) { +@@ -3124,36 +3275,22 @@ pkinit_process_td_dh_params(krb5_context context, + EVP_PKEY_free(params); + params = NULL; + +- /* Skip any parameters for algorithms other than DH. */ +- if (algId[i]->algorithm.length != dh_oid.length || +- memcmp(algId[i]->algorithm.data, dh_oid.data, dh_oid.length)) +- continue; +- +- params = decode_dh_params(&algId[i]->parameters); ++ if (data_eq(algId[i]->algorithm, dh_oid)) ++ params = decode_dh_params(&algId[i]->parameters); ++ else if (data_eq(algId[i]->algorithm, ec_oid)) ++ params = decode_ec_params(&algId[i]->parameters); + if (params == NULL) + continue; +- dh_prime_bits = EVP_PKEY_get_bits(params); +- /* Skip any parameters shorter than the previous size. */ +- if (dh_prime_bits < old_dh_size) +- continue; +- pkiDebug("client sent %d DH bits server prefers %d DH bits\n", +- *new_dh_size, dh_prime_bits); + +- /* If this is one of our well-known groups, just save the new size; we +- * will use our own copy of the parameters. */ +- if (check_dh_wellknown(cryptoctx, params, dh_prime_bits)) { +- *new_dh_size = dh_prime_bits; +- retval = 0; +- goto cleanup; +- } ++ dh_bits = check_dh_wellknown(cryptoctx, params); ++ /* Skip any parameters shorter than the previous size or unknown. */ ++ if (dh_bits == -1 || dh_bits < old_dh_size) ++ continue; ++ TRACE_PKINIT_DH_NEGOTIATED_GROUP(context, group_desc(dh_bits)); + +- /* If the parameters aren't well-known but check out, save them. */ +- if (params_valid(params)) { +- req_cryptoctx->received_params = params; +- params = NULL; +- retval = 0; +- goto cleanup; +- } ++ *new_dh_size = dh_bits; ++ retval = 0; ++ goto cleanup; + } + + cleanup: +@@ -5329,3 +5466,40 @@ crypto_req_cert_matching_data(krb5_context context, + return get_matching_data(context, plgctx, reqctx, reqctx->received_cert, + md_out); + } ++ ++/* ++ * Historically, the strength of PKINIT key exchange has been determined by the ++ * pkinit_dh_min_bits variable, which gives a finite field size. With the ++ * addition of ECDH support, we allow the string values P-256, P-384, and P-521 ++ * for this config variable, represented with the rough equivalent bit ++ * strengths for finite fields. ++ */ ++int ++parse_dh_min_bits(krb5_context context, const char *str) ++{ ++ char *endptr; ++ long n; ++ ++ if (str == NULL) ++ return PKINIT_DEFAULT_DH_MIN_BITS; ++ ++ n = strtol(str, &endptr, 0); ++ if (endptr == str) { ++ if (strcasecmp(str, "P-256") == 0) ++ return PKINIT_DH_P256_BITS; ++ else if (strcasecmp(str, "P-384") == 0) ++ return PKINIT_DH_P384_BITS; ++ else if (strcasecmp(str, "P-521") == 0) ++ return PKINIT_DH_P521_BITS; ++ } else { ++ if (n == 1024) ++ return 1024; ++ else if (n > 1024 && n <= 2048) ++ return 2048; ++ else if (n > 2048 && n <= 4096) ++ return 4096; ++ } ++ ++ TRACE_PKINIT_DH_INVALID_MIN_BITS(context, str); ++ return PKINIT_DEFAULT_DH_MIN_BITS; ++} +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h +index c807f044ac..b7a3358800 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h +@@ -99,6 +99,9 @@ struct _pkinit_plg_crypto_context { + EVP_PKEY *dh_1024; + EVP_PKEY *dh_2048; + EVP_PKEY *dh_4096; ++ EVP_PKEY *ec_p256; ++ EVP_PKEY *ec_p384; ++ EVP_PKEY *ec_p521; + ASN1_OBJECT *id_pkinit_authData; + ASN1_OBJECT *id_pkinit_DHKeyData; + ASN1_OBJECT *id_pkinit_rkeyData; +@@ -113,7 +116,6 @@ struct _pkinit_plg_crypto_context { + struct _pkinit_req_crypto_context { + X509 *received_cert; + EVP_PKEY *client_pkey; +- EVP_PKEY *received_params; + }; + + #endif /* _PKINIT_CRYPTO_OPENSSL_H */ +diff --git a/src/plugins/preauth/pkinit/pkinit_lib.c b/src/plugins/preauth/pkinit/pkinit_lib.c +index 19db695a4d..25965eb5d2 100644 +--- a/src/plugins/preauth/pkinit/pkinit_lib.c ++++ b/src/plugins/preauth/pkinit/pkinit_lib.c +@@ -33,9 +33,6 @@ + + #define FAKECERT + +-const krb5_data dh_oid = { 0, 7, "\x2A\x86\x48\xce\x3e\x02\x01" }; +- +- + krb5_error_code + pkinit_init_req_opts(pkinit_req_opts **reqopts) + { +diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c +index aab21f951c..e22bcb195b 100644 +--- a/src/plugins/preauth/pkinit/pkinit_srv.c ++++ b/src/plugins/preauth/pkinit/pkinit_srv.c +@@ -988,7 +988,7 @@ static krb5_error_code + pkinit_init_kdc_profile(krb5_context context, pkinit_kdc_context plgctx) + { + krb5_error_code retval; +- char *eku_string = NULL, *ocsp_check = NULL; ++ char *eku_string = NULL, *ocsp_check = NULL, *minbits = NULL; + + pkiDebug("%s: entered for realm %s\n", __FUNCTION__, plgctx->realmname); + retval = pkinit_kdcdefault_string(context, plgctx->realmname, +@@ -1033,17 +1033,10 @@ pkinit_init_kdc_profile(krb5_context context, pkinit_kdc_context plgctx) + goto errout; + } + +- pkinit_kdcdefault_integer(context, plgctx->realmname, +- KRB5_CONF_PKINIT_DH_MIN_BITS, +- PKINIT_DEFAULT_DH_MIN_BITS, +- &plgctx->opts->dh_min_bits); +- if (plgctx->opts->dh_min_bits < PKINIT_DH_MIN_CONFIG_BITS) { +- pkiDebug("%s: invalid value (%d < %d) for pkinit_dh_min_bits, " +- "using default value (%d) instead\n", __FUNCTION__, +- plgctx->opts->dh_min_bits, PKINIT_DH_MIN_CONFIG_BITS, +- PKINIT_DEFAULT_DH_MIN_BITS); +- plgctx->opts->dh_min_bits = PKINIT_DEFAULT_DH_MIN_BITS; +- } ++ pkinit_kdcdefault_string(context, plgctx->realmname, ++ KRB5_CONF_PKINIT_DH_MIN_BITS, &minbits); ++ plgctx->opts->dh_min_bits = parse_dh_min_bits(context, minbits); ++ free(minbits); + + pkinit_kdcdefault_boolean(context, plgctx->realmname, + KRB5_CONF_PKINIT_ALLOW_UPN, +diff --git a/src/plugins/preauth/pkinit/pkinit_trace.h b/src/plugins/preauth/pkinit/pkinit_trace.h +index d385759145..1c1ceb5a41 100644 +--- a/src/plugins/preauth/pkinit/pkinit_trace.h ++++ b/src/plugins/preauth/pkinit/pkinit_trace.h +@@ -83,6 +83,17 @@ + + #define TRACE_PKINIT_DH_GROUP_UNAVAILABLE(c, name) \ + TRACE(c, "PKINIT key exchange group {str} unsupported", name) ++#define TRACE_PKINIT_DH_INVALID_MIN_BITS(c, str) \ ++ TRACE(c, "Invalid pkinit_dh_min_bits value {str}, using default", str) ++#define TRACE_PKINIT_DH_NEGOTIATED_GROUP(c, desc) \ ++ TRACE(c, "PKINIT accepting KDC key exchange group preference {str}", desc) ++#define TRACE_PKINIT_DH_PROPOSING_GROUP(c, desc) \ ++ TRACE(c, "PKINIT using {str} key exchange group", desc) ++#define TRACE_PKINIT_DH_RECEIVED_GROUP(c, desc) \ ++ TRACE(c, "PKINIT received {str} key from client for key exchange", desc) ++#define TRACE_PKINIT_DH_REJECTING_GROUP(c, desc, mindesc) \ ++ TRACE(c, "PKINIT client key has group {str}, need at least {str}", \ ++ desc, mindesc) + + #define TRACE_PKINIT_OPENSSL_ERROR(c, msg) \ + TRACE(c, "PKINIT OpenSSL error: {str}", msg) +diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py +index 62e6c426d3..f8f2debc1b 100755 +--- a/src/tests/t_pkinit.py ++++ b/src/tests/t_pkinit.py +@@ -172,6 +172,15 @@ realm.pkinit(realm.user_princ, expected_trace=msgs) + realm.klist(realm.user_princ) + realm.run([kvno, realm.host_princ]) + ++# Test each Diffie-Hellman group except 1024-bit (which doesn't work ++# in OpenSSL 3.0) and the default 2048-bit group. ++for g in ('4096', 'P-256', 'P-384', 'P-521'): ++ mark('Diffie-Hellman group ' + g) ++ group_conf = {'realms': {'$realm': {'pkinit_dh_min_bits': g}}} ++ group_env = realm.special_env(g, True, krb5_conf=group_conf) ++ realm.pkinit(realm.user_princ, expected_trace=('PKINIT using ' + g,), ++ env=group_env) ++ + # Try using multiple configured pkinit_identities, to make sure we + # fall back to the second one when the first one cannot be read. + id_conf = {'realms': {'$realm': {'pkinit_identities': [file_identity + 'X', +@@ -190,11 +199,14 @@ realm.start_kdc(env=minbits_env) + msgs = ('Sending unauthenticated request', + '/Additional pre-authentication required', + 'Preauthenticating using KDC method data', ++ 'PKINIT using 2048-bit DH key exchange group', + 'Preauth module pkinit (16) (real) returned: 0/Success', + ' preauth for next request: PA-FX-COOKIE (133), PA-PK-AS-REQ (16)', + '/Key parameters not accepted', + 'Preauth tryagain input types (16): 109, PA-FX-COOKIE (133)', ++ 'PKINIT accepting KDC key exchange group preference P-384', + 'trying again with KDC-provided parameters', ++ 'PKINIT using P-384 key exchange group', + 'Preauth module pkinit (16) tryagain returned: 0/Success', + ' preauth for next request: PA-PK-AS-REQ (16), PA-FX-COOKIE (133)') + realm.pkinit(realm.user_princ, expected_trace=msgs) +-- +2.47.1 + diff --git a/0027-Add-ecdsa-with-sha512-256-to-supportedCMSTypes.patch b/0027-Add-ecdsa-with-sha512-256-to-supportedCMSTypes.patch new file mode 100644 index 0000000..140a2e5 --- /dev/null +++ b/0027-Add-ecdsa-with-sha512-256-to-supportedCMSTypes.patch @@ -0,0 +1,78 @@ +From 43d10f1580c033fe706470e7588c720ac7854918 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Wed, 21 Jun 2023 18:27:11 +0200 +Subject: [PATCH] Add ecdsa-with-sha512/256 to supportedCMSTypes + +Elliptic curve certificates are already supported for PKINIT +pre-authentication, but their associated signature types aren't +advertized. Add ecdsa-with-sha512 and ecdsa-with-sha256 OIDs to the +supportedCMSTypes list sent by the client. + +[ghudson@mit.edu: edited commit message] + +ticket: 9100 (new) +(cherry picked from commit 9913e5c92c4e5cb76d6ae58386f744766d2e6454) +--- + src/plugins/preauth/pkinit/pkinit_constants.c | 38 +++++++++++++++++++ + 1 file changed, 38 insertions(+) + +diff --git a/src/plugins/preauth/pkinit/pkinit_constants.c b/src/plugins/preauth/pkinit/pkinit_constants.c +index 10f8688ec2..905e90d29c 100644 +--- a/src/plugins/preauth/pkinit/pkinit_constants.c ++++ b/src/plugins/preauth/pkinit/pkinit_constants.c +@@ -64,14 +64,52 @@ static char sha512WithRSAEncr_oid[9] = { + 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0d + }; + ++/* RFC 3279 ecdsa-with-SHA1: iso(1) member-body(2) us(840) ansi-X9-62(10045) ++ * signatures(4) 1 */ ++static char ecdsaWithSha1_oid[] = { ++ 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x01 ++}; ++ ++/* RFC 5758 ecdsa-with-SHA256: iso(1) member-body(2) us(840) ansi-X9-62(10045) ++ * signatures(4) ecdsa-with-SHA2(3) 2 */ ++static char ecdsaWithSha256_oid[] = { ++ 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02 ++}; ++ ++/* RFC 5758 ecdsa-with-SHA384: iso(1) member-body(2) us(840) ansi-X9-62(10045) ++ * signatures(4) ecdsa-with-SHA2(3) 3 */ ++static char ecdsaWithSha384_oid[] = { ++ 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x03 ++}; ++ ++/* RFC 5758 ecdsa-with-SHA512: iso(1) member-body(2) us(840) ansi-X9-62(10045) ++ * signatures(4) ecdsa-with-SHA2(3) 4 */ ++static char ecdsaWithSha512_oid[] = { ++ 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x04 ++}; ++ + const krb5_data sha256WithRSAEncr_id = { + KV5M_DATA, sizeof(sha256WithRSAEncr_oid), sha256WithRSAEncr_oid + }; + const krb5_data sha512WithRSAEncr_id = { + KV5M_DATA, sizeof(sha512WithRSAEncr_oid), sha512WithRSAEncr_oid + }; ++const krb5_data ecdsaWithSha1_id = { ++ KV5M_DATA, sizeof(ecdsaWithSha1_oid), ecdsaWithSha1_oid ++}; ++const krb5_data ecdsaWithSha256_id = { ++ KV5M_DATA, sizeof(ecdsaWithSha256_oid), ecdsaWithSha256_oid ++}; ++const krb5_data ecdsaWithSha384_id = { ++ KV5M_DATA, sizeof(ecdsaWithSha384_oid), ecdsaWithSha384_oid ++}; ++const krb5_data ecdsaWithSha512_id = { ++ KV5M_DATA, sizeof(ecdsaWithSha512_oid), ecdsaWithSha512_oid ++}; + + krb5_data const * const supported_cms_algs[] = { ++ &ecdsaWithSha512_id, ++ &ecdsaWithSha256_id, + &sha512WithRSAEncr_id, + &sha256WithRSAEncr_id, + NULL +-- +2.47.1 + diff --git a/0028-Get-rid-of-pkinit_crypto_openssl.h.patch b/0028-Get-rid-of-pkinit_crypto_openssl.h.patch new file mode 100644 index 0000000..993e823 --- /dev/null +++ b/0028-Get-rid-of-pkinit_crypto_openssl.h.patch @@ -0,0 +1,264 @@ +From fba4cbf0bc50569b8ea6d1e1c3303eaab84935e1 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Sun, 30 Jul 2023 01:07:38 -0400 +Subject: [PATCH] Get rid of pkinit_crypto_openssl.h + +Fold pkinit_crypto_openssl.h into the one source file where it was +used. Also clean up the include of , as htonl() is no +longer used after commit 1c87ce6c44a9de0824580a2d72a8a202237e01f4. + +(cherry picked from commit b3352945fb8836f8b4095e0b8aad04b54aca3152) +--- + src/plugins/preauth/pkinit/deps | 2 +- + .../preauth/pkinit/pkinit_crypto_openssl.c | 85 +++++++++++- + .../preauth/pkinit/pkinit_crypto_openssl.h | 121 ------------------ + 3 files changed, 83 insertions(+), 125 deletions(-) + delete mode 100644 src/plugins/preauth/pkinit/pkinit_crypto_openssl.h + +diff --git a/src/plugins/preauth/pkinit/deps b/src/plugins/preauth/pkinit/deps +index 58320aa801..b6f4476fe8 100644 +--- a/src/plugins/preauth/pkinit/deps ++++ b/src/plugins/preauth/pkinit/deps +@@ -112,4 +112,4 @@ pkinit_crypto_openssl.so pkinit_crypto_openssl.po $(OUTPRE)pkinit_crypto_openssl + $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ + $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ + pkcs11.h pkinit.h pkinit_accessor.h pkinit_crypto.h \ +- pkinit_crypto_openssl.c pkinit_crypto_openssl.h pkinit_trace.h ++ pkinit_crypto_openssl.c pkinit_trace.h +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index f6d494bd11..ae8599d5a2 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -30,20 +30,99 @@ + */ + + #include "k5-int.h" +-#include "pkinit_crypto_openssl.h" + #include "k5-buf.h" + #include "k5-err.h" + #include "k5-hex.h" +-#include ++#include "pkinit.h" + #include +-#include + ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include + #if OPENSSL_VERSION_NUMBER >= 0x30000000L + #include + #include ++#include + #include + #endif + ++#define DN_BUF_LEN 256 ++#define MAX_CREDS_ALLOWED 20 ++ ++struct _pkinit_cred_info { ++ char *name; ++ X509 *cert; ++ EVP_PKEY *key; ++#ifndef WITHOUT_PKCS11 ++ CK_BYTE_PTR cert_id; ++ int cert_id_len; ++#endif ++}; ++typedef struct _pkinit_cred_info *pkinit_cred_info; ++ ++struct _pkinit_identity_crypto_context { ++ pkinit_cred_info creds[MAX_CREDS_ALLOWED+1]; ++ STACK_OF(X509) *my_certs; /* available user certs */ ++ char *identity; /* identity name for user cert */ ++ int cert_index; /* cert to use out of available certs*/ ++ EVP_PKEY *my_key; /* available user keys if in filesystem */ ++ STACK_OF(X509) *trustedCAs; /* available trusted ca certs */ ++ STACK_OF(X509) *intermediateCAs; /* available intermediate ca certs */ ++ STACK_OF(X509_CRL) *revoked; /* available crls */ ++ int pkcs11_method; ++ krb5_prompter_fct prompter; ++ void *prompter_data; ++#ifndef WITHOUT_PKCS11 ++ char *p11_module_name; ++ CK_SLOT_ID slotid; ++ char *token_label; ++ char *cert_label; ++ /* These are crypto-specific. */ ++ struct plugin_file_handle *p11_module; ++ CK_SESSION_HANDLE session; ++ CK_FUNCTION_LIST_PTR p11; ++ uint8_t *cert_id; ++ size_t cert_id_len; ++ CK_MECHANISM_TYPE mech; ++#endif ++ krb5_boolean defer_id_prompt; ++ pkinit_deferred_id *deferred_ids; ++}; ++ ++struct _pkinit_plg_crypto_context { ++ EVP_PKEY *dh_1024; ++ EVP_PKEY *dh_2048; ++ EVP_PKEY *dh_4096; ++ EVP_PKEY *ec_p256; ++ EVP_PKEY *ec_p384; ++ EVP_PKEY *ec_p521; ++ ASN1_OBJECT *id_pkinit_authData; ++ ASN1_OBJECT *id_pkinit_DHKeyData; ++ ASN1_OBJECT *id_pkinit_rkeyData; ++ ASN1_OBJECT *id_pkinit_san; ++ ASN1_OBJECT *id_ms_san_upn; ++ ASN1_OBJECT *id_pkinit_KPClientAuth; ++ ASN1_OBJECT *id_pkinit_KPKdc; ++ ASN1_OBJECT *id_ms_kp_sc_logon; ++ ASN1_OBJECT *id_kp_serverAuth; ++}; ++ ++struct _pkinit_req_crypto_context { ++ X509 *received_cert; ++ EVP_PKEY *client_pkey; ++}; ++ + static krb5_error_code pkinit_init_pkinit_oids(pkinit_plg_crypto_context ); + static void pkinit_fini_pkinit_oids(pkinit_plg_crypto_context ); + +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h +deleted file mode 100644 +index b7a3358800..0000000000 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h ++++ /dev/null +@@ -1,121 +0,0 @@ +-/* +- * COPYRIGHT (C) 2006,2007 +- * THE REGENTS OF THE UNIVERSITY OF MICHIGAN +- * ALL RIGHTS RESERVED +- * +- * Permission is granted to use, copy, create derivative works +- * and redistribute this software and such derivative works +- * for any purpose, so long as the name of The University of +- * Michigan is not used in any advertising or publicity +- * pertaining to the use of distribution of this software +- * without specific, written prior authorization. If the +- * above copyright notice or any other identification of the +- * University of Michigan is included in any copy of any +- * portion of this software, then the disclaimer below must +- * also be included. +- * +- * THIS SOFTWARE IS PROVIDED AS IS, WITHOUT REPRESENTATION +- * FROM THE UNIVERSITY OF MICHIGAN AS TO ITS FITNESS FOR ANY +- * PURPOSE, AND WITHOUT WARRANTY BY THE UNIVERSITY OF +- * MICHIGAN OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING +- * WITHOUT LIMITATION THE IMPLIED WARRANTIES OF +- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE +- * REGENTS OF THE UNIVERSITY OF MICHIGAN SHALL NOT BE LIABLE +- * FOR ANY DAMAGES, INCLUDING SPECIAL, INDIRECT, INCIDENTAL, OR +- * CONSEQUENTIAL DAMAGES, WITH RESPECT TO ANY CLAIM ARISING +- * OUT OF OR IN CONNECTION WITH THE USE OF THE SOFTWARE, EVEN +- * IF IT HAS BEEN OR IS HEREAFTER ADVISED OF THE POSSIBILITY OF +- * SUCH DAMAGES. +- */ +- +-#ifndef _PKINIT_CRYPTO_OPENSSL_H +-#define _PKINIT_CRYPTO_OPENSSL_H +- +-#include "pkinit.h" +- +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#if OPENSSL_VERSION_NUMBER >= 0x30000000L +-#include +-#include +-#endif +- +-#define DN_BUF_LEN 256 +-#define MAX_CREDS_ALLOWED 20 +- +-struct _pkinit_cred_info { +- char *name; +- X509 *cert; +- EVP_PKEY *key; +-#ifndef WITHOUT_PKCS11 +- CK_BYTE_PTR cert_id; +- int cert_id_len; +-#endif +-}; +-typedef struct _pkinit_cred_info * pkinit_cred_info; +- +-struct _pkinit_identity_crypto_context { +- pkinit_cred_info creds[MAX_CREDS_ALLOWED+1]; +- STACK_OF(X509) *my_certs; /* available user certs */ +- char *identity; /* identity name for user cert */ +- int cert_index; /* cert to use out of available certs*/ +- EVP_PKEY *my_key; /* available user keys if in filesystem */ +- STACK_OF(X509) *trustedCAs; /* available trusted ca certs */ +- STACK_OF(X509) *intermediateCAs; /* available intermediate ca certs */ +- STACK_OF(X509_CRL) *revoked; /* available crls */ +- int pkcs11_method; +- krb5_prompter_fct prompter; +- void *prompter_data; +-#ifndef WITHOUT_PKCS11 +- char *p11_module_name; +- CK_SLOT_ID slotid; +- char *token_label; +- char *cert_label; +- /* These are crypto-specific */ +- struct plugin_file_handle *p11_module; +- CK_SESSION_HANDLE session; +- CK_FUNCTION_LIST_PTR p11; +- uint8_t *cert_id; +- size_t cert_id_len; +- CK_MECHANISM_TYPE mech; +-#endif +- krb5_boolean defer_id_prompt; +- pkinit_deferred_id *deferred_ids; +-}; +- +-struct _pkinit_plg_crypto_context { +- EVP_PKEY *dh_1024; +- EVP_PKEY *dh_2048; +- EVP_PKEY *dh_4096; +- EVP_PKEY *ec_p256; +- EVP_PKEY *ec_p384; +- EVP_PKEY *ec_p521; +- ASN1_OBJECT *id_pkinit_authData; +- ASN1_OBJECT *id_pkinit_DHKeyData; +- ASN1_OBJECT *id_pkinit_rkeyData; +- ASN1_OBJECT *id_pkinit_san; +- ASN1_OBJECT *id_ms_san_upn; +- ASN1_OBJECT *id_pkinit_KPClientAuth; +- ASN1_OBJECT *id_pkinit_KPKdc; +- ASN1_OBJECT *id_ms_kp_sc_logon; +- ASN1_OBJECT *id_kp_serverAuth; +-}; +- +-struct _pkinit_req_crypto_context { +- X509 *received_cert; +- EVP_PKEY *client_pkey; +-}; +- +-#endif /* _PKINIT_CRYPTO_OPENSSL_H */ +-- +2.47.1 + diff --git a/0029-Use-SoftHSMv2-for-PKCS11-PKINIT-tests.patch b/0029-Use-SoftHSMv2-for-PKCS11-PKINIT-tests.patch new file mode 100644 index 0000000..a328431 --- /dev/null +++ b/0029-Use-SoftHSMv2-for-PKCS11-PKINIT-tests.patch @@ -0,0 +1,157 @@ +From 1b01057df4c2223fbf92be44f1e764207208ef03 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Mon, 26 Feb 2024 19:03:38 -0500 +Subject: [PATCH] Use SoftHSMv2 for PKCS11 PKINIT tests + +Instead of softpkcs11, use SoftHSMv2 to mock the PKCS11 token for +PKINIT tests. Use pkcs11-tool from OpenSC to initialize the token and +import a certificate and key. SoftHSM does not support PIN-less +tokens (see https://github.com/opendnssec/SoftHSMv2/issues/480) so +remove that test for now. + +(cherry picked from commit 8ab61608236883fdc5c2d43f4bd1ff2094401d19) +--- + .github/workflows/build.yml | 2 +- + src/tests/t_pkinit.py | 82 ++++++++++++++++++++----------------- + 2 files changed, 45 insertions(+), 39 deletions(-) + +diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml +index 68a4788adb..d7ae86b150 100644 +--- a/.github/workflows/build.yml ++++ b/.github/workflows/build.yml +@@ -33,7 +33,7 @@ jobs: + if: startsWith(matrix.os, 'ubuntu') + run: | + sudo apt-get update -qq +- sudo apt-get install -y bison gettext keyutils ldap-utils libcmocka-dev libldap2-dev libkeyutils-dev libsasl2-dev libssl-dev python3-kdcproxy python3-pip slapd tcsh ++ sudo apt-get install -y bison gettext keyutils ldap-utils libcmocka-dev libldap2-dev libkeyutils-dev libsasl2-dev libssl-dev python3-kdcproxy python3-pip slapd tcsh softhsm2 opensc + pip3 install pyrad + - name: Build + env: +diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py +index f8f2debc1b..4435746429 100755 +--- a/src/tests/t_pkinit.py ++++ b/src/tests/t_pkinit.py +@@ -1,11 +1,10 @@ + from k5test import * ++import re + + # Skip this test if pkinit wasn't built. + if not pkinit_enabled: + skip_rest('PKINIT tests', 'PKINIT module not built') + +-soft_pkcs11 = os.path.join(buildtop, 'tests', 'softpkcs11', 'softpkcs11.so') +- + # Construct a krb5.conf fragment configuring pkinit. + user_pem = os.path.join(pkinit_certs, 'user.pem') + privkey_pem = os.path.join(pkinit_certs, 'privkey.pem') +@@ -55,9 +54,6 @@ p12_upn2_identity = 'PKCS12:%s' % user_upn2_p12 + p12_upn3_identity = 'PKCS12:%s' % user_upn3_p12 + p12_generic_identity = 'PKCS12:%s' % generic_p12 + p12_enc_identity = 'PKCS12:%s' % user_enc_p12 +-p11_identity = 'PKCS11:' + soft_pkcs11 +-p11_token_identity = ('PKCS11:module_name=' + soft_pkcs11 + +- ':slotid=1:token=SoftToken (token)') + + # Start a realm with the test kdb module for the following UPN SAN tests. + realm = K5Realm(kdc_conf=alias_kdc_conf, create_kdb=False, pkinit=True) +@@ -389,53 +385,63 @@ realm.klist(realm.user_princ) + realm.kinit(realm.user_princ, flags=['-X', 'X509_user_identity=,'], + expected_code=1, expected_msg='Preauthentication failed while') + +-softpkcs11rc = os.path.join(os.getcwd(), 'testdir', 'soft-pkcs11.rc') +-realm.env['SOFTPKCS11RC'] = softpkcs11rc ++softhsm2 = '/usr/lib/softhsm/libsofthsm2.so' ++if not os.path.exists(softhsm2): ++ skip_rest('PKCS11 tests', 'SoftHSMv2 required') ++pkcs11_tool = which('pkcs11-tool') ++if not pkcs11_tool: ++ skip_rest('PKCS11 tests', 'pkcs11-tool from OpenSC required') ++tool_cmd = [pkcs11_tool, '--module', softhsm2] ++ ++# Prepare a SoftHSM token. ++softhsm2_conf = os.path.join(realm.testdir, 'softhsm2.conf') ++softhsm2_tokens = os.path.join(realm.testdir, 'tokens') ++os.mkdir(softhsm2_tokens) ++realm.env['SOFTHSM2_CONF'] = softhsm2_conf ++with open(softhsm2_conf, 'w') as f: ++ f.write('directories.tokendir = %s\n' % softhsm2_tokens) ++realm.run(tool_cmd + ['--init-token', '--label', 'user', ++ '--so-pin', 'sopin', '--init-pin', '--pin', 'userpin']) ++realm.run(tool_cmd + ['-w', user_pem, '-y', 'cert']) ++realm.run(tool_cmd + ['-w', privkey_pem, '-y', 'privkey', ++ '-l', '--pin', 'userpin']) ++ ++# Extract the slot ID generated by SoftHSM. ++out = realm.run(tool_cmd + ['-L']) ++m = re.search(r'slot ID 0x([0-9a-f]+)\n', out) ++if not m: ++ fail('could not extract slot ID from SoftHSM token') ++slot_id = int(m.group(1), 16) ++ ++p11_attr = 'X509_user_identity=PKCS11:' + softhsm2 ++p11_token_identity = ('PKCS11:module_name=%s:slotid=%d:token=user' % ++ (softhsm2, slot_id)) + +-# PKINIT with PKCS11: identity, with no need for a PIN. +-mark('PKCS11 identity, no PIN') +-conf = open(softpkcs11rc, 'w') +-conf.write("%s\t%s\t%s\t%s\n" % ('user', 'user token', user_pem, privkey_pem)) +-conf.close() +-# Expect to succeed without having to supply any more information. +-realm.kinit(realm.user_princ, +- flags=['-X', 'X509_user_identity=%s' % p11_identity]) ++mark('PKCS11 identity, with PIN (prompter)') ++realm.kinit(realm.user_princ, flags=['-X', p11_attr], password='userpin') + realm.klist(realm.user_princ) + realm.run([kvno, realm.host_princ]) + +-# PKINIT with PKCS11: identity, with a PIN supplied by the prompter. +-mark('PKCS11 identity, with PIN (prompter)') +-os.remove(softpkcs11rc) +-conf = open(softpkcs11rc, 'w') +-conf.write("%s\t%s\t%s\t%s\n" % ('user', 'user token', user_pem, +- privkey_enc_pem)) +-conf.close() +-# Expect failure if the responder does nothing, and there's no prompter ++mark('PKCS11 identity, unavailable PIN') + realm.run(['./responder', '-x', 'pkinit={"%s": 0}' % p11_token_identity, +- '-X', 'X509_user_identity=%s' % p11_identity, realm.user_princ], +- expected_code=2) +-realm.kinit(realm.user_princ, +- flags=['-X', 'X509_user_identity=%s' % p11_identity], +- password='encrypted') +-realm.klist(realm.user_princ) +-realm.run([kvno, realm.host_princ]) ++ '-X', p11_attr, realm.user_princ], expected_code=2) + +-# Supply the wrong PIN. + mark('PKCS11 identity, wrong PIN') + expected_trace = ('PKINIT client has no configured identity; giving up',) + realm.kinit(realm.user_princ, +- flags=['-X', 'X509_user_identity=%s' % p11_identity], ++ flags=['-X', p11_attr], + password='wrong', expected_code=1, expected_trace=expected_trace) + + # PKINIT with PKCS11: identity, with a PIN supplied by the responder. +-# Supply the response in raw form. ++# Supply the response in raw form. Expect the PIN_COUNT_LOW flag (1) ++# to be set due to the previous test. + mark('PKCS11 identity, with PIN (responder)') +-realm.run(['./responder', '-x', 'pkinit={"%s": 0}' % p11_token_identity, +- '-r', 'pkinit={"%s": "encrypted"}' % p11_token_identity, +- '-X', 'X509_user_identity=%s' % p11_identity, realm.user_princ]) ++realm.run(['./responder', '-x', 'pkinit={"%s": 1}' % p11_token_identity, ++ '-r', 'pkinit={"%s": "userpin"}' % p11_token_identity, ++ '-X', p11_attr, realm.user_princ]) + # Supply the response through the convenience API. +-realm.run(['./responder', '-X', 'X509_user_identity=%s' % p11_identity, +- '-p', '%s=%s' % (p11_token_identity, 'encrypted'), ++realm.run(['./responder', '-X', p11_attr, ++ '-p', '%s=%s' % (p11_token_identity, 'userpin'), + realm.user_princ]) + realm.klist(realm.user_princ) + realm.run([kvno, realm.host_princ]) +-- +2.47.1 + diff --git a/0030-Simplify-PKINIT-cert-representation.patch b/0030-Simplify-PKINIT-cert-representation.patch new file mode 100644 index 0000000..1bd8d64 --- /dev/null +++ b/0030-Simplify-PKINIT-cert-representation.patch @@ -0,0 +1,202 @@ +From b0315d30f066c4241fcecc33dd9e4d1c7c28b9d8 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Fri, 9 Feb 2024 17:32:40 -0500 +Subject: [PATCH] Simplify PKINIT cert representation + +In the _pkinit_identity_crypto_context structure, the my_certs field +is a stack which only ever contains one cert and is only ever used to +retrieve that one cert. The cert_index field is always 0. Replace +these fields with a my_cert field pointing directly to the X509 +certificate. + +Simplify crypto_cert_select_default() by making it call +crypto_cert_select() with index 0 after verifying the certificate +count. + +(cherry picked from commit f95dfb7908456f9563cee66706216a21df8d791f) +--- + .../preauth/pkinit/pkinit_crypto_openssl.c | 74 +++++-------------- + 1 file changed, 20 insertions(+), 54 deletions(-) + +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index ae8599d5a2..da59cb1e02 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -73,10 +73,9 @@ typedef struct _pkinit_cred_info *pkinit_cred_info; + + struct _pkinit_identity_crypto_context { + pkinit_cred_info creds[MAX_CREDS_ALLOWED+1]; +- STACK_OF(X509) *my_certs; /* available user certs */ ++ X509 *my_cert; /* selected user or KDC cert */ + char *identity; /* identity name for user cert */ +- int cert_index; /* cert to use out of available certs*/ +- EVP_PKEY *my_key; /* available user keys if in filesystem */ ++ EVP_PKEY *my_key; /* selected cert key if in filesystem */ + STACK_OF(X509) *trustedCAs; /* available trusted ca certs */ + STACK_OF(X509) *intermediateCAs; /* available intermediate ca certs */ + STACK_OF(X509_CRL) *revoked; /* available crls */ +@@ -1489,8 +1488,7 @@ pkinit_init_certs(pkinit_identity_crypto_context ctx) + + for (i = 0; i < MAX_CREDS_ALLOWED; i++) + ctx->creds[i] = NULL; +- ctx->my_certs = NULL; +- ctx->cert_index = 0; ++ ctx->my_cert = NULL; + ctx->my_key = NULL; + ctx->trustedCAs = NULL; + ctx->intermediateCAs = NULL; +@@ -1506,8 +1504,8 @@ pkinit_fini_certs(pkinit_identity_crypto_context ctx) + if (ctx == NULL) + return; + +- if (ctx->my_certs != NULL) +- sk_X509_pop_free(ctx->my_certs, X509_free); ++ if (ctx->my_cert != NULL) ++ X509_free(ctx->my_cert); + + if (ctx->my_key != NULL) + EVP_PKEY_free(ctx->my_key); +@@ -1696,7 +1694,6 @@ cms_signeddata_create(krb5_context context, + ASN1_OCTET_STRING *digest = NULL; + unsigned int alg_len = 0, digest_len = 0; + unsigned char *y = NULL; +- X509 *cert = NULL; + ASN1_OBJECT *oid = NULL, *oid_copy; + + /* Start creating PKCS7 data. */ +@@ -1715,7 +1712,7 @@ cms_signeddata_create(krb5_context context, + if (oid == NULL) + goto cleanup; + +- if (id_cryptoctx->my_certs != NULL) { ++ if (id_cryptoctx->my_cert != NULL) { + X509_STORE *certstore = NULL; + X509_STORE_CTX *certctx; + STACK_OF(X509) *certstack = NULL; +@@ -1726,8 +1723,6 @@ cms_signeddata_create(krb5_context context, + if ((cert_stack = sk_X509_new_null()) == NULL) + goto cleanup; + +- cert = sk_X509_value(id_cryptoctx->my_certs, id_cryptoctx->cert_index); +- + certstore = X509_STORE_new(); + if (certstore == NULL) + goto cleanup; +@@ -1736,7 +1731,7 @@ cms_signeddata_create(krb5_context context, + certctx = X509_STORE_CTX_new(); + if (certctx == NULL) + goto cleanup; +- X509_STORE_CTX_init(certctx, certstore, cert, ++ X509_STORE_CTX_init(certctx, certstore, id_cryptoctx->my_cert, + id_cryptoctx->intermediateCAs); + X509_STORE_CTX_trusted_stack(certctx, id_cryptoctx->trustedCAs); + if (!X509_verify_cert(certctx)) { +@@ -1764,13 +1759,13 @@ cms_signeddata_create(krb5_context context, + if (!ASN1_INTEGER_set(p7si->version, 1)) + goto cleanup; + if (!X509_NAME_set(&p7si->issuer_and_serial->issuer, +- X509_get_issuer_name(cert))) ++ X509_get_issuer_name(id_cryptoctx->my_cert))) + goto cleanup; + /* because ASN1_INTEGER_set is used to set a 'long' we will do + * things the ugly way. */ + ASN1_INTEGER_free(p7si->issuer_and_serial->serial); + if (!(p7si->issuer_and_serial->serial = +- ASN1_INTEGER_dup(X509_get_serialNumber(cert)))) ++ ASN1_INTEGER_dup(X509_get_serialNumber(id_cryptoctx->my_cert)))) + goto cleanup; + + /* will not fill-out EVP_PKEY because it's on the smartcard */ +@@ -3311,7 +3306,7 @@ pkinit_check_kdc_pkid(krb5_context context, + PKCS7_ISSUER_AND_SERIAL *is = NULL; + const unsigned char *p = pdid_buf; + int status = 1; +- X509 *kdc_cert = sk_X509_value(id_cryptoctx->my_certs, id_cryptoctx->cert_index); ++ X509 *kdc_cert = id_cryptoctx->my_cert; + + *valid_kdcPkId = 0; + pkiDebug("found kdcPkId in AS REQ\n"); +@@ -4783,7 +4778,8 @@ cleanup: + } + + /* +- * Set the certificate in idctx->creds[cred_index] as the selected certificate. ++ * Set the certificate in idctx->creds[cred_index] as the selected certificate, ++ * stealing pointers from it. + */ + krb5_error_code + crypto_cert_select(krb5_context context, pkinit_identity_crypto_context idctx, +@@ -4795,20 +4791,17 @@ crypto_cert_select(krb5_context context, pkinit_identity_crypto_context idctx, + return ENOENT; + + ci = idctx->creds[cred_index]; +- /* copy the selected cert into our id_cryptoctx */ +- if (idctx->my_certs != NULL) +- sk_X509_pop_free(idctx->my_certs, X509_free); +- idctx->my_certs = sk_X509_new_null(); +- sk_X509_push(idctx->my_certs, ci->cert); +- free(idctx->identity); ++ ++ idctx->my_cert = ci->cert; ++ ci->cert = NULL; ++ + /* hang on to the selected credential name */ ++ free(idctx->identity); + if (ci->name != NULL) + idctx->identity = strdup(ci->name); + else + idctx->identity = NULL; + +- ci->cert = NULL; /* Don't free it twice */ +- idctx->cert_index = 0; + if (idctx->pkcs11_method != 1) { + idctx->my_key = ci->key; + ci->key = NULL; /* Don't free it twice */ +@@ -4837,41 +4830,14 @@ crypto_cert_select_default(krb5_context context, + + retval = crypto_cert_get_count(id_cryptoctx, &cert_count); + if (retval) +- goto errout; ++ return retval; + + if (cert_count != 1) { + TRACE_PKINIT_NO_DEFAULT_CERT(context, cert_count); +- retval = EINVAL; +- goto errout; +- } +- /* copy the selected cert into our id_cryptoctx */ +- if (id_cryptoctx->my_certs != NULL) { +- sk_X509_pop_free(id_cryptoctx->my_certs, X509_free); ++ return EINVAL; + } +- id_cryptoctx->my_certs = sk_X509_new_null(); +- sk_X509_push(id_cryptoctx->my_certs, id_cryptoctx->creds[0]->cert); +- id_cryptoctx->creds[0]->cert = NULL; /* Don't free it twice */ +- id_cryptoctx->cert_index = 0; +- /* hang on to the selected credential name */ +- if (id_cryptoctx->creds[0]->name != NULL) +- id_cryptoctx->identity = strdup(id_cryptoctx->creds[0]->name); +- else +- id_cryptoctx->identity = NULL; + +- if (id_cryptoctx->pkcs11_method != 1) { +- id_cryptoctx->my_key = id_cryptoctx->creds[0]->key; +- id_cryptoctx->creds[0]->key = NULL; /* Don't free it twice */ +- } +-#ifndef WITHOUT_PKCS11 +- else { +- id_cryptoctx->cert_id = id_cryptoctx->creds[0]->cert_id; +- id_cryptoctx->creds[0]->cert_id = NULL; /* Don't free it twice */ +- id_cryptoctx->cert_id_len = id_cryptoctx->creds[0]->cert_id_len; +- } +-#endif +- retval = 0; +-errout: +- return retval; ++ return crypto_cert_select(context, id_cryptoctx, 0); + } + + +-- +2.47.1 + diff --git a/0031-Support-PKCS11-EC-client-certs-in-PKINIT.patch b/0031-Support-PKCS11-EC-client-certs-in-PKINIT.patch new file mode 100644 index 0000000..920a6a8 --- /dev/null +++ b/0031-Support-PKCS11-EC-client-certs-in-PKINIT.patch @@ -0,0 +1,1768 @@ +From e7172ce0283b06f5208237535a086424d71d846b Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Wed, 21 Feb 2024 15:29:02 -0500 +Subject: [PATCH] Support PKCS11 EC client certs in PKINIT + +Move the digest computation and DigestInfo encoding from +cms_signeddata_create() to pkinit_sign_data_pkcs11(), and +conditionalize the DigestInfo encoding on the key type. Use CKM_ECDSA +instead of CKM_RSA_PKCS for EC keys, and convert the resulting +signature from the PKS11 encoding to the ASN.1 encoding required by +CMS. + +Regenerate the test certificates with an additional EC client cert. +Add test cases for EC client certs with and without PKCS11. + +ticket: 9112 (new) +(cherry picked from commit f745c9a9bd6c0c73b944182173f1ac305d03dc3a) +--- + .../preauth/pkinit/pkinit_crypto_openssl.c | 319 +++++++++++------- + src/tests/pkinit-certs/ca.pem | 32 +- + src/tests/pkinit-certs/eckey.pem | 5 + + src/tests/pkinit-certs/ecuser.pem | 24 ++ + src/tests/pkinit-certs/generic.p12 | Bin 2469 -> 2560 bytes + src/tests/pkinit-certs/generic.pem | 38 +-- + src/tests/pkinit-certs/kdc.pem | 32 +- + src/tests/pkinit-certs/make-certs.sh | 11 +- + src/tests/pkinit-certs/privkey-enc.pem | 60 ++-- + src/tests/pkinit-certs/privkey.pem | 55 +-- + src/tests/pkinit-certs/user-enc.p12 | Bin 2829 -> 2920 bytes + src/tests/pkinit-certs/user-upn.p12 | Bin 2821 -> 2912 bytes + src/tests/pkinit-certs/user-upn.pem | 32 +- + src/tests/pkinit-certs/user-upn2.p12 | Bin 2805 -> 2896 bytes + src/tests/pkinit-certs/user-upn2.pem | 34 +- + src/tests/pkinit-certs/user-upn3.p12 | Bin 2821 -> 2912 bytes + src/tests/pkinit-certs/user-upn3.pem | 32 +- + src/tests/pkinit-certs/user.p12 | Bin 2829 -> 2920 bytes + src/tests/pkinit-certs/user.pem | 30 +- + src/tests/t_pkinit.py | 20 ++ + 20 files changed, 437 insertions(+), 287 deletions(-) + create mode 100644 src/tests/pkinit-certs/eckey.pem + create mode 100644 src/tests/pkinit-certs/ecuser.pem + +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index da59cb1e02..4accfc2664 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -93,7 +93,6 @@ struct _pkinit_identity_crypto_context { + CK_FUNCTION_LIST_PTR p11; + uint8_t *cert_id; + size_t cert_id_len; +- CK_MECHANISM_TYPE mech; + #endif + krb5_boolean defer_id_prompt; + pkinit_deferred_id *deferred_ids; +@@ -283,7 +282,6 @@ compat_get0_EC(const EVP_PKEY *pkey) + #if OPENSSL_VERSION_NUMBER < 0x30000000L + /* OpenSSL 3.0 changes several preferred function names. */ + #define EVP_PKEY_parameters_eq EVP_PKEY_cmp_parameters +-#define EVP_MD_CTX_get0_md EVP_MD_CTX_md + #define EVP_PKEY_get_size EVP_PKEY_size + #define EVP_PKEY_get_bits EVP_PKEY_bits + +@@ -1683,17 +1681,12 @@ cms_signeddata_create(krb5_context context, + STACK_OF(X509) * cert_stack = NULL; + ASN1_OCTET_STRING *digest_attr = NULL; + EVP_MD_CTX *ctx; +- const EVP_MD *md_tmp = NULL; +- unsigned char md_data[EVP_MAX_MD_SIZE], md_data2[EVP_MAX_MD_SIZE]; +- unsigned char *digestInfo_buf = NULL, *abuf = NULL; +- unsigned int md_len, md_len2, alen, digestInfo_len; ++ unsigned char md_data[EVP_MAX_MD_SIZE], *abuf = NULL; ++ unsigned int md_len, alen; + STACK_OF(X509_ATTRIBUTE) * sk; + unsigned char *sig = NULL; + unsigned int sig_len = 0; + X509_ALGOR *alg = NULL; +- ASN1_OCTET_STRING *digest = NULL; +- unsigned int alg_len = 0, digest_len = 0; +- unsigned char *y = NULL; + ASN1_OBJECT *oid = NULL, *oid_copy; + + /* Start creating PKCS7 data. */ +@@ -1795,7 +1788,6 @@ cms_signeddata_create(krb5_context context, + goto cleanup; + EVP_DigestInit_ex(ctx, EVP_sha256(), NULL); + EVP_DigestUpdate(ctx, data, data_len); +- md_tmp = EVP_MD_CTX_get0_md(ctx); + EVP_DigestFinal_ex(ctx, md_data, &md_len); + EVP_MD_CTX_free(ctx); + +@@ -1820,63 +1812,8 @@ cms_signeddata_create(krb5_context context, + if (abuf == NULL) + goto cleanup2; + +-#ifndef WITHOUT_PKCS11 +- /* +- * Some tokens can only do RSAEncryption without a hash. To compute +- * sha256WithRSAEncryption, encode the algorithm ID for the hash +- * function and the hash value into an ASN.1 value of type DigestInfo: +- * DigestInfo ::= SEQUENCE { +- * digestAlgorithm AlgorithmIdentifier, +- * digest OCTET STRING +- * } +- */ +- if (id_cryptoctx->pkcs11_method == 1 && +- id_cryptoctx->mech == CKM_RSA_PKCS) { +- pkiDebug("mech = CKM_RSA_PKCS\n"); +- ctx = EVP_MD_CTX_new(); +- if (ctx == NULL) +- goto cleanup; +- EVP_DigestInit_ex(ctx, md_tmp, NULL); +- EVP_DigestUpdate(ctx, abuf, alen); +- EVP_DigestFinal_ex(ctx, md_data2, &md_len2); +- EVP_MD_CTX_free(ctx); +- +- alg = X509_ALGOR_new(); +- if (alg == NULL) +- goto cleanup2; +- X509_ALGOR_set0(alg, OBJ_nid2obj(NID_sha256), V_ASN1_NULL, NULL); +- alg_len = i2d_X509_ALGOR(alg, NULL); +- +- digest = ASN1_OCTET_STRING_new(); +- if (digest == NULL) +- goto cleanup2; +- ASN1_OCTET_STRING_set(digest, md_data2, (int)md_len2); +- digest_len = i2d_ASN1_OCTET_STRING(digest, NULL); +- +- digestInfo_len = ASN1_object_size(1, (int)(alg_len + digest_len), +- V_ASN1_SEQUENCE); +- y = digestInfo_buf = malloc(digestInfo_len); +- if (digestInfo_buf == NULL) +- goto cleanup2; +- ASN1_put_object(&y, 1, (int)(alg_len + digest_len), V_ASN1_SEQUENCE, +- V_ASN1_UNIVERSAL); +- i2d_X509_ALGOR(alg, &y); +- i2d_ASN1_OCTET_STRING(digest, &y); +-#ifdef DEBUG_SIG +- pkiDebug("signing buffer\n"); +- print_buffer(digestInfo_buf, digestInfo_len); +- print_buffer_bin(digestInfo_buf, digestInfo_len, "/tmp/pkcs7_tosign"); +-#endif +- retval = pkinit_sign_data(context, id_cryptoctx, digestInfo_buf, +- digestInfo_len, &sig, &sig_len); +- } else +-#endif +- { +- pkiDebug("mech = %s\n", +- id_cryptoctx->pkcs11_method == 1 ? "CKM_SHA256_RSA_PKCS" : "FS"); +- retval = pkinit_sign_data(context, id_cryptoctx, abuf, alen, +- &sig, &sig_len); +- } ++ retval = pkinit_sign_data(context, id_cryptoctx, abuf, alen, ++ &sig, &sig_len); + #ifdef DEBUG_SIG + print_buffer(sig, sig_len); + #endif +@@ -1930,14 +1867,6 @@ cms_signeddata_create(krb5_context context, + + cleanup2: + if (p7si) { +-#ifndef WITHOUT_PKCS11 +- if (id_cryptoctx->pkcs11_method == 1 && +- id_cryptoctx->mech == CKM_RSA_PKCS) { +- free(digestInfo_buf); +- if (digest != NULL) +- ASN1_OCTET_STRING_free(digest); +- } +-#endif + if (alg != NULL) + X509_ALGOR_free(alg); + } +@@ -3657,8 +3586,7 @@ cleanup: + * Look for a key that's: + * 1. private + * 2. capable of the specified operation (usually signing or decrypting) +- * 3. RSA (this may be wrong but it's all we can do for now) +- * 4. matches the id of the cert we chose ++ * 3. matches the id of the cert we chose + * + * You must call pkinit_get_certs before calling pkinit_find_private_key + * (that's because we need the ID of the private key) +@@ -3678,7 +3606,6 @@ pkinit_find_private_key(pkinit_identity_crypto_context id_cryptoctx, + CK_OBJECT_CLASS cls; + CK_ATTRIBUTE attrs[4]; + CK_ULONG count; +- CK_KEY_TYPE keytype; + unsigned int nattrs = 0; + int r; + #ifdef PKINIT_USE_KEY_USAGE +@@ -3705,12 +3632,6 @@ pkinit_find_private_key(pkinit_identity_crypto_context id_cryptoctx, + nattrs++; + #endif + +- keytype = CKK_RSA; +- attrs[nattrs].type = CKA_KEY_TYPE; +- attrs[nattrs].pValue = &keytype; +- attrs[nattrs].ulValueLen = sizeof keytype; +- nattrs++; +- + attrs[nattrs].type = CKA_ID; + attrs[nattrs].pValue = id_cryptoctx->cert_id; + attrs[nattrs].ulValueLen = id_cryptoctx->cert_id_len; +@@ -3749,6 +3670,116 @@ pkinit_sign_data_fs(krb5_context context, + } + + #ifndef WITHOUT_PKCS11 ++/* ++ * DER-encode a DigestInfo sequence containing the algorithm md and the digest ++ * mdbytes. ++ * ++ * DigestInfo ::= SEQUENCE { ++ * digestAlgorithm AlgorithmIdentifier, ++ * digest OCTET STRING ++ * } ++ */ ++static krb5_error_code ++encode_digestinfo(krb5_context context, const EVP_MD *md, ++ const uint8_t *mdbytes, size_t mdlen, ++ uint8_t **encoding_out, size_t *len_out) ++{ ++ krb5_boolean ok = FALSE; ++ X509_ALGOR *alg = NULL; ++ ASN1_OCTET_STRING *digest = NULL; ++ uint8_t *buf, *p; ++ int alg_len, digest_len, len; ++ ++ *encoding_out = NULL; ++ *len_out = 0; ++ ++ alg = X509_ALGOR_new(); ++ if (alg == NULL || ++ !X509_ALGOR_set0(alg, OBJ_nid2obj(EVP_MD_nid(md)), V_ASN1_NULL, NULL)) ++ goto cleanup; ++ alg_len = i2d_X509_ALGOR(alg, NULL); ++ if (alg_len < 0) ++ goto cleanup; ++ ++ digest = ASN1_OCTET_STRING_new(); ++ if (digest == NULL || !ASN1_OCTET_STRING_set(digest, mdbytes, mdlen)) ++ goto cleanup; ++ digest_len = i2d_ASN1_OCTET_STRING(digest, NULL); ++ if (digest_len < 0) ++ goto cleanup; ++ ++ len = ASN1_object_size(1, alg_len + digest_len, V_ASN1_SEQUENCE); ++ p = buf = malloc(len); ++ if (buf == NULL) ++ goto cleanup; ++ ASN1_put_object(&p, 1, alg_len + digest_len, V_ASN1_SEQUENCE, ++ V_ASN1_UNIVERSAL); ++ i2d_X509_ALGOR(alg, &p); ++ i2d_ASN1_OCTET_STRING(digest, &p); ++ ++ *encoding_out = buf; ++ *len_out = len; ++ ok = TRUE; ++ ++cleanup: ++ X509_ALGOR_free(alg); ++ ASN1_OCTET_STRING_free(digest); ++ if (!ok) ++ return oerr(context, 0, _("Failed to DER encode DigestInfo")); ++ return 0; ++} ++ ++/* Extract the r and s values from a PKCS11 ECDSA signature and re-encode them ++ * in the DER representation of an ECDSA-Sig-Value for use in CMS. */ ++static krb5_error_code ++convert_pkcs11_ecdsa_sig(krb5_context context, ++ const uint8_t *p11sig, unsigned int p11siglen, ++ uint8_t **sig_out, unsigned int *sig_len_out) ++{ ++ krb5_boolean ok = FALSE; ++ BIGNUM *r = NULL, *s = NULL; ++ ECDSA_SIG *sig = NULL; ++ int len; ++ uint8_t *p; ++ ++ *sig_out = NULL; ++ *sig_len_out = 0; ++ ++ if (p11siglen % 2 != 0) ++ return EINVAL; ++ ++ /* Extract the r and s values from the PKCS11 signature. */ ++ r = BN_bin2bn(p11sig, p11siglen / 2, NULL); ++ s = BN_bin2bn(p11sig + p11siglen / 2, p11siglen / 2, NULL); ++ if (r == NULL || s == NULL) ++ goto cleanup; ++ ++ /* Create an ECDSA-Sig-Value object and transfer ownership of r and s. */ ++ sig = ECDSA_SIG_new(); ++ if (sig == NULL || !ECDSA_SIG_set0(sig, r, s)) ++ goto cleanup; ++ r = s = NULL; ++ ++ /* DER-encode the ECDSA-Sig-Value object. */ ++ len = i2d_ECDSA_SIG(sig, NULL); ++ if (len < 0) ++ goto cleanup; ++ p = *sig_out = malloc(len); ++ if (*sig_out == NULL) ++ goto cleanup; ++ *sig_len_out = len; ++ i2d_ECDSA_SIG(sig, &p); ++ ok = TRUE; ++ ++cleanup: ++ BN_free(r); ++ BN_free(s); ++ ECDSA_SIG_free(sig); ++ if (!ok) ++ return oerr(context, 0, _("Failed to convert PKCS11 ECDSA signature")); ++ return 0; ++} ++ + static krb5_error_code + pkinit_sign_data_pkcs11(krb5_context context, + pkinit_identity_crypto_context id_cryptoctx, +@@ -3757,27 +3788,88 @@ pkinit_sign_data_pkcs11(krb5_context context, + unsigned char **sig, + unsigned int *sig_len) + { ++ krb5_error_code ret; + CK_OBJECT_HANDLE obj; + CK_ULONG len; + CK_MECHANISM mech; +- unsigned char *cp; ++ CK_SESSION_HANDLE session; ++ CK_FUNCTION_LIST_PTR p11; ++ CK_ATTRIBUTE attr; ++ CK_KEY_TYPE keytype; ++ EVP_MD_CTX *ctx; ++ const EVP_MD *md = EVP_sha256(); ++ unsigned int mdlen; ++ uint8_t mdbuf[EVP_MAX_MD_SIZE], *dinfo = NULL, *sigbuf = NULL, *input; ++ size_t dinfo_len, input_len; + int r; + ++ *sig = NULL; ++ *sig_len = 0; ++ + if (pkinit_open_session(context, id_cryptoctx)) { + pkiDebug("can't open pkcs11 session\n"); + return KRB5KDC_ERR_PREAUTH_FAILED; + } ++ p11 = id_cryptoctx->p11; ++ session = id_cryptoctx->session; + +- pkinit_find_private_key(id_cryptoctx, CKA_SIGN, &obj); ++ ret = pkinit_find_private_key(id_cryptoctx, CKA_SIGN, &obj); ++ if (ret) ++ return ret; ++ ++ attr.type = CKA_KEY_TYPE; ++ attr.pValue = &keytype; ++ attr.ulValueLen = sizeof(keytype); ++ r = p11->C_GetAttributeValue(session, obj, &attr, 1); ++ if (r) { ++ pkiDebug("C_GetAttributeValue: %s\n", pkcs11err(r)); ++ ret = KRB5KDC_ERR_PREAUTH_FAILED; ++ goto cleanup; ++ } ++ ++ /* ++ * We would ideally use CKM_SHA256_RSA_PKCS and CKM_ECDSA_SHA256, but ++ * historically many cards seem to be confused about whether they are ++ * capable of mechanisms or not. To be safe we compute the digest ++ * ourselves and use CKM_RSA_PKCS and CKM_ECDSA. ++ */ ++ ctx = EVP_MD_CTX_new(); ++ if (ctx == NULL) { ++ ret = KRB5KDC_ERR_PREAUTH_FAILED; ++ goto cleanup; ++ } ++ EVP_DigestInit_ex(ctx, EVP_sha256(), NULL); ++ EVP_DigestUpdate(ctx, data, data_len); ++ EVP_DigestFinal_ex(ctx, mdbuf, &mdlen); ++ EVP_MD_CTX_free(ctx); + +- mech.mechanism = id_cryptoctx->mech; ++ if (keytype == CKK_RSA) { ++ /* For RSA we must also encode the digest in a DigestInfo sequence. */ ++ mech.mechanism = CKM_RSA_PKCS; ++ ret = encode_digestinfo(context, md, mdbuf, mdlen, &dinfo, &dinfo_len); ++ if (ret) ++ goto cleanup; ++ input = dinfo; ++ input_len = dinfo_len; ++ } else if (keytype == CKK_EC) { ++ mech.mechanism = CKM_ECDSA; ++ input = mdbuf; ++ input_len = mdlen; ++ } else { ++ ret = KRB5KDC_ERR_PREAUTH_FAILED; ++ k5_setmsg(context, ret, ++ _("PKCS11 certificate has unsupported key type %lu"), ++ keytype); ++ goto cleanup; ++ } + mech.pParameter = NULL; + mech.ulParameterLen = 0; + +- if ((r = id_cryptoctx->p11->C_SignInit(id_cryptoctx->session, &mech, +- obj)) != CKR_OK) { ++ r = p11->C_SignInit(session, &mech, obj); ++ if (r != CKR_OK) { + pkiDebug("C_SignInit: %s\n", pkcs11err(r)); +- return KRB5KDC_ERR_PREAUTH_FAILED; ++ ret = KRB5KDC_ERR_PREAUTH_FAILED; ++ goto cleanup; + } + + /* +@@ -3785,28 +3877,38 @@ pkinit_sign_data_pkcs11(krb5_context context, + * get that. So guess, and if it's too small, re-malloc. + */ + len = PK_SIGLEN_GUESS; +- cp = malloc((size_t) len); +- if (cp == NULL) +- return ENOMEM; ++ sigbuf = k5alloc(len, &ret); ++ if (sigbuf == NULL) ++ goto cleanup; + +- r = id_cryptoctx->p11->C_Sign(id_cryptoctx->session, data, +- (CK_ULONG) data_len, cp, &len); ++ r = p11->C_Sign(session, input, input_len, sigbuf, &len); + if (r == CKR_BUFFER_TOO_SMALL || (r == CKR_OK && len >= PK_SIGLEN_GUESS)) { +- free(cp); ++ free(sigbuf); + pkiDebug("C_Sign realloc %d\n", (int) len); +- cp = malloc((size_t) len); +- r = id_cryptoctx->p11->C_Sign(id_cryptoctx->session, data, +- (CK_ULONG) data_len, cp, &len); ++ sigbuf = k5alloc(len, &ret); ++ if (sigbuf == NULL) ++ goto cleanup; ++ r = p11->C_Sign(session, input, input_len, sigbuf, &len); + } + if (r != CKR_OK) { + pkiDebug("C_Sign: %s\n", pkcs11err(r)); +- return KRB5KDC_ERR_PREAUTH_FAILED; ++ ret = KRB5KDC_ERR_PREAUTH_FAILED; ++ goto cleanup; + } +- pkiDebug("sign %d -> %d\n", (int) data_len, (int) len); +- *sig_len = len; +- *sig = cp; + +- return 0; ++ if (keytype == CKK_EC) { ++ /* PKCS11 ECDSA signatures must be re-encoded for CMS. */ ++ ret = convert_pkcs11_ecdsa_sig(context, sigbuf, len, sig, sig_len); ++ } else { ++ *sig_len = len; ++ *sig = sigbuf; ++ sigbuf = NULL; ++ } ++ ++cleanup: ++ free(dinfo); ++ free(sigbuf); ++ return ret; + } + #endif + +@@ -4388,15 +4490,6 @@ pkinit_get_certs_pkcs11(krb5_context context, + return 0; + } + +- /* +- * We'd like to use CKM_SHA256_RSA_PKCS for signing if it's available, but +- * historically many cards seem to be confused about whether they are +- * capable of mechanisms or not. The safe thing seems to be to ignore the +- * mechanism list, always use CKM_RSA_PKCS and calculate the sha256 digest +- * ourselves. +- */ +- id_cryptoctx->mech = CKM_RSA_PKCS; +- + cls = CKO_CERTIFICATE; + attrs[0].type = CKA_CLASS; + attrs[0].pValue = &cls; +diff --git a/src/tests/pkinit-certs/ca.pem b/src/tests/pkinit-certs/ca.pem +index 63d31c1f5f..6c782bcde5 100644 +--- a/src/tests/pkinit-certs/ca.pem ++++ b/src/tests/pkinit-certs/ca.pem +@@ -3,27 +3,27 @@ MIIE5TCCA82gAwIBAgIBATANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx + FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG + A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz + dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug +-b3RoZXJ3aXNlMB4XDTIxMTAwODIxMTEzMFoXDTMyMDkyMDIxMTEzMFowgacxCzAJ ++b3RoZXJ3aXNlMB4XDTI0MDIxNTA0NTkwN1oXDTM1MDEyODA0NTkwN1owgacxCzAJ + BgNVBAYTAlVTMRYwFAYDVQQIDA1NYXNzYWNodXNldHRzMRIwEAYDVQQHDAlDYW1i + cmlkZ2UxDDAKBgNVBAoMA01JVDEpMCcGA1UECwwgSW5zZWN1cmUgUEtJTklUIEtl + cmJlcm9zIHRlc3QgQ0ExMzAxBgNVBAMMKnBraW5pdCB0ZXN0IHN1aXRlIENBOyBk + byBub3QgdXNlIG90aGVyd2lzZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC +-ggEBAM+lV5iaVats0yBFN4FBe6bovloNe3d0F9qMuhKqlECv6cFra75gSGmHJz6t +-GTK8zITU7sni429azTZC9IQnUt/2lW8dWzpZD1T5Vt1DYvYFqVzjhNfzeEDK88ig +-ENfzaX/cY2P76arJr0cewGaauzaux8heYW1CjBxWmk6kWq4aD+5jggchvBeOGEE2 +-NkV3MPbXut8fu+3NzuuIG7Z0ilwQv+KUvQ8QQb9VCwdsDh/ERsQ4loC9P4jtuWCJ +-ikIE78GxDcOMoC1ftJtW/mBCS2iCHipXrp2BDDJMyHxZjHpl0VoDR7koWGtD3sos +-EwUkXVvWIuKs432h2dXQ+u8HaBsCAwEAAaOCARgwggEUMB0GA1UdDgQWBBT0F6X7 +-1QRftDiSeNSY3bks3nK0IzCB1AYDVR0jBIHMMIHJgBT0F6X71QRftDiSeNSY3bks +-3nK0I6GBraSBqjCBpzELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0 ++ggEBAJv9Sbc2QSbHWnZjk55JfeOdPGUsmKOcT/N7C0/0mOQq4tUCmha7ntpBoIJd ++UBDhMQayG3QHruQX7aogtOx8hoLoLUaNKgxzEZ0OLbDRMc2M+vTDpBROITGI1KPv ++QtthlS4ocqKvqBCze66N9LufzAju61CyKdB3pCykPrgDVVScfsZ1t2zCbK0SF2cf ++ZAdIyCLoGLeQ95/NL3SIx0CX9gU47AVmBkSQ+LExJRhbUSIg+puKbqJ0XVILR1B2 ++ezgik2ObFND0hsRUS4v8pKnIDz0HXR2AneTESY+atjbzzelGA2zH86p4tLg0PanQ ++4x4+gpkQhzSr5Cmi3QX4XahSrmUCAwEAAaOCARgwggEUMB0GA1UdDgQWBBSSP/pz ++leX5zVcZ9hpI5GG2eQ+pqjCB1AYDVR0jBIHMMIHJgBSSP/pzleX5zVcZ9hpI5GG2 ++eQ+pqqGBraSBqjCBpzELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0 + dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoGA1UECgwDTUlUMSkwJwYDVQQLDCBJ + bnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVzdCBDQTEzMDEGA1UEAwwqcGtpbml0 + IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ugb3RoZXJ3aXNlggEBMAsGA1UdDwQE +-AwIB/jAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBT2FJVPS+U +-0MXa1HUOETuUPrVff7VeIvyAPm9IgX1zNbCvktCc4d7ErNB3P5ng8aZz4MKqwzuX +-HVhUxbF7JKfyUI41lcixPG+k+U9mzBJaozWT+K1OhdUF//mGPxaxe5jyUhDiQArD +-/6vulX0/B+1iuIa1sCfoeelzqQcYHqhZdWn6bBdcDWNARHIXWs5zPeKA975+d5TW +-rofE7T8nNQJvcZoVjCSfcYXhP82D/0sA+wPCt3fgbBZdvJ89xwvIlzBtiwC++Zbe +-37Rt5av0+ykpR7nmh2jyG+ItzE73nYKdBrUI5J6JLSbUcQTw4jeXHwDULUHZ6fXg +-TBEM2v1VW4Df ++AwIB/jAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAfx04Uqh0D ++myOR1PSqEEbMWJxZXYoESnjjH4Co4doceVBTuKix/2lplD4wcvA7aMXpmkvGfP38 ++dPrN1jvGd4bi/djTuxab9qB7rOeswAt+NyVHReUmuIMwgcW1UD7HXErg4EsOMjGD ++2XGhJYxGnwdURmnFwoO3yLLwo5K+C4rqPm3PbnI3W0sCA+IXepQTxuXK3dSplMMm ++0Pejw3es2s3oI9WaD2JRXvFuylw4UWYX+cyFRb+wN55Gh0rPVdxDhKCkbWNt/gTi ++/DbC+5pyQXkmy07OEGrmh4+5ae9hwejr9AukF2IZJB+oFP4i1mt9xyAOXImnWOzB ++SdHD08WHl5Gq + -----END CERTIFICATE----- +diff --git a/src/tests/pkinit-certs/eckey.pem b/src/tests/pkinit-certs/eckey.pem +new file mode 100644 +index 0000000000..14c2efd2ac +--- /dev/null ++++ b/src/tests/pkinit-certs/eckey.pem +@@ -0,0 +1,5 @@ ++-----BEGIN PRIVATE KEY----- ++MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgSB3T7ihe3JUeIKZI ++PCDqATKN/dNugQsaC5AKiBPC6ymhRANCAAQy0E88e1CX16/2wL2T+nE0pmlb7wBM ++0hOh6m3m2uDbVsAIRJfhEjHWsT2ODCoBvGDV6vBeIOUjE/Ro9EwnYBW5 ++-----END PRIVATE KEY----- +diff --git a/src/tests/pkinit-certs/ecuser.pem b/src/tests/pkinit-certs/ecuser.pem +new file mode 100644 +index 0000000000..585e53d8c5 +--- /dev/null ++++ b/src/tests/pkinit-certs/ecuser.pem +@@ -0,0 +1,24 @@ ++-----BEGIN CERTIFICATE----- ++MIIECDCCAvCgAwIBAgIBBDANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx ++FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG ++A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz ++dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug ++b3RoZXJ3aXNlMB4XDTI0MDIxNTA0NTkwN1oXDTM1MDEyODA0NTkwN1owSjELMAkG ++A1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxFDASBgNVBAoMC0tSQlRF ++U1QuQ09NMQ0wCwYDVQQDDAR1c2VyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE ++MtBPPHtQl9ev9sC9k/pxNKZpW+8ATNIToept5trg21bACESX4RIx1rE9jgwqAbxg ++1erwXiDlIxP0aPRMJ2AVuaOCAWQwggFgMB0GA1UdDgQWBBR5MaRx7ub5YBwsS0CF ++Li18nsl49zCB1AYDVR0jBIHMMIHJgBSSP/pzleX5zVcZ9hpI5GG2eQ+pqqGBraSB ++qjCBpzELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNV ++BAcMCUNhbWJyaWRnZTEMMAoGA1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQ ++S0lOSVQgS2VyYmVyb3MgdGVzdCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3Vp ++dGUgQ0E7IGRvIG5vdCB1c2Ugb3RoZXJ3aXNlggEBMAsGA1UdDwQEAwID6DAMBgNV ++HRMBAf8EAjAAMDkGA1UdEQQyMDCgLgYGKwYBBQICoCQwIqANGwtLUkJURVNULkNP ++TaERMA+gAwIBAaEIMAYbBHVzZXIwEgYDVR0lBAswCQYHKwYBBQIDBDANBgkqhkiG ++9w0BAQsFAAOCAQEAfwlONLYPo0BNN2NyQZM3wkoldvFqidcoZiYALOcBcmllMP7H ++XQ/+en4TmbKR0RUJN6AjR9yEo92fHAYOB2L7AzR8AkOiRLjp/Pdg5kUHFTdKenTK ++DvpeiJELz9chk/vaMv1T9qvOwH2bVAyS8GrUc5n0ui5F61PrquLAmm+dpKyHDY60 ++DdFaebS2gYsmy4bBv0mgcMZ+ZXnzXYmLNtdVQ3SgVGO7M8eyCqPbe/o0Lw4Gz+l0 ++xgpFkptdlEogsOaJBzjrgWyBnWw6MkyyLiSY+iOxFpBGkwCxi1gtQwbcp4gMwaxc ++p5+JPM/JBfglBX1lpRhhxL8EGQvpryN9MT530w== ++-----END CERTIFICATE----- +diff --git a/src/tests/pkinit-certs/generic.p12 b/src/tests/pkinit-certs/generic.p12 +index 35c27415bcb07c479990133882655bce3fe3bd72..55a248137ca7b82654252808422e97337ed95a6a 100644 +GIT binary patch +delta 2529 +zcmV<72_E*P6Mz&VFoFsE0s#Xsf(fz)2`Yw2hW8Bt2LYgh38Msp37;^637e53JAbV+ +z63K|{jPm6S=lRhUG)C?|)hzs!}J6Z>esz%vM91VoEu)Pmv^_jw4QQ*{P;%zdH= +z8s3InWP5X2dL3JP%_r_AH_wr3!haB>cU&;sQHeY0h(*0{Urg+^g7yVKn`IE0+Y~a< +z<+xCb5BfX!dU%zZc~;wYZFOctxMS?Ch*eD^8-zy8#7*(m&=G8Yhq%X1&fk&#wqvO` +z_dV6f%Lq>$}y?fWJ0eZbaT_3xCB5v<1XX +zhesXP-h3le9uU$XQav@c@^ng6qjNOuTgo57tfg;nGUhmeDh5PY6l0w(`tmfVgVRd9 +zI*Dp$(4kaUY$_|u8*tJ)z~Krm!cf$))c$ks%D6w-z)!1oA_bqAdZA}A1PNl78+^by +zVRwaGflgdSeO1RqxQGi;-G4bE0H%>kz6g9{O9DNB5M5tLz%C?ula24llm} +zuabL^!h`a+uPu%ySk>~=QyaYKaBuM-cq;N~+Yx$45s+L!{%M=B-hZOqUNh4Z-0?vO-hD#{!>=(UZ$|e*T(Ppu?Da=)T;Z(vy(zB2AS5Op(0bOE%ijXo4T48j +zaWpTAg-^G1r}2Wp1*k*bZcWwf`iU-QS;py!e2L#5(1)IJP}}evf+~Y&;L^{uM-p#P +z$CG)Ic1TsdW7ZAj_9OvHhVSGr5Tr)o_wWooY?lqp0j8d)wxI&i!7%mWDC=nXromP*=gpE(B1cq6 +z@&j;>({0S<2hI|cciYPo@g%a*p@w1QGgUypb46QUs!RVP9)D=_dWE&lLg-u?xw~PV +z8h$a6Har0<@wSwfG;mYk()2u9489&2LgL1C(X*xX1j1|82eY!A`42Tp_64UG7SgBu +z%wrY}ctA8@Orn_s)L0sRiOYhfl{V{IX +zM*Nb94b`ZcV1L~qp38AGXFWP*5hp^{z@{c)LZAu9VXKJ{o5DhRdf!Y&dE}=hwC#io +zYZtdIiA~U5r(Up^;hSx%T>+Jy<}L55P1hamg|^{b1f$(AuO#g5sY1S!!RH0q+MJHB +z4KRWQga!#JhDe6@4FLxMpn?T;1cC)|FoFebFoFeX27e1GhDe6@4FL=a0Ro_c1u-y! +z1uZaF1_>&LNQUz5YzW6GvH2i8WJEF=@#Jf&|c95Qocq9uI_J +zuEKYIs(pnOmNhS39%39z*|>! +zQn!$n2&<*PQxpN5z%hjmlZIh7OhJBIERDLutbco%u}C>L6m-jbjU`E0z4N4hv7qv} +z^8gz +zK!5#Z(o{x~w1P9(r4Li1M%kTWTj4^9LM>3^D&+%>&>Wli9sfvq8guK6okCa1xutOKr6 +ze5ic%+9n`|zI{F%*l8Fr;ljDGAvLV0jf_)^F#+Z_s_@|PN(w%P!=LYJK87-dtKya2 +z-ou2tBdt^%>*Aqa4Oz$fR`pK-Kt1~8U({s7fQm9sgMRC|HbAW@!MkNsfz< +zs3^xE3`}tjOvaZ`mTy27G6T*&3x76}mvTS&uHM)V*>8 +zLvM!WSi)FK>L5EKYmVS=wl>j?$b4-)uQ5|+rMxsUIRUb~2(_i}gtCLG(Lj^DK^6HR +z9|Bvq^{Tc`3RDQ#EExyBL%EMeJ0A)4WmSkOXqfGF$5-3gA<;I^%nD!<^?!uBBky_h +zDtHZ3Hq?a{K8#>eqP`A1yryjk_q9*A{X2bwX11sbz$$Y)U2w$6y=G^r0u5K6r-Qq$ +zhmU#{eAbmCy5=l7y`BIj6sdNhVHC%_79bPl +ziqj1XqSWmBQHa9luW4F^7k`C(;)-1%xig{k$ZRTikT+J#^4~y14n$+@8>ZlRhjX@X +zGv{`|4XV@GM}bVDI$XXh4edI-nqiEw2@N*ip5xg23vTl~U@sV*_`HJxr#5B4$dV6v +zj=|^1mfn3wd(>scr_%*luv9D=!6_Jf0%mi@W8$z1!3`<@lUmc73wTM| +ztMxU2wp4lXT+wF?cD6j|rz=JhmfCBDAl-Ij#Q0W%F$P)3fwn}<2+d$G9GIQzMh!YN +zAmjmBVsnk6AgHmakbkjQY;aSX$`ujO5N8damZY7qviDEls~HZTCkILT#rJxJnsB*n +zR>-H**-OEFgmF#KsXF__e;4CL7kK-*wNi<+Exq~-VcGD9%`qh~BL)d7hDe6@4FL%i +zF%|?A!W!(19gkH}sK#VEJUUJdl+OXWFhMXeFbxI?V1`HmWi|r@0s#d81RywUr7PU4+J&7;H`yIZWU8rteK!mx%-j>llc3nny_xmpD&=el80aE%9m{fV68_AYFzhm@kKP%T=aiATz>)K7usww +z(0*{b68eczuAI2a3uHsb3Zn_F)9~g+LCvtun(x>N9_kuVVuYlA^cxgA()Q^}p{@VX +z(pQJ#h!L# +zvT%~2SR2lMq2|uvwt-65uo+g%PdM+yCR*0d3<~^2SWHuSkyu|U{2*phDUa6z^!f#K +z&e!gf!i)wC0}3Cr;t4QJ>qXxqtd29tYZ!QSIJXcb1=)#Zz@NztpMM)iLM4FN{(b4O +z7;Y8sDSuKgUUFZq^5D#5vcVSW7Jv7Yd(aBQZLxL`TMK);Odg}Pn?i_&$%=^rbRuT) +z1@-3i4P15rwSp}Q52aT>>NISAeYnh|qF(@TkGZY4j&#|GeCZ}Hv|Wo|3Ildq{En?` +z33W*|;8`HbhQf?M^M5j}nDMonW~5ihFn!pqa@$I}d3&;Sf_zYJf +zK3966V3l`s?KpMq7Xkws7rQ0uNx?O)nr5OZ&sjxPS8n6V!bbhl+S`tADP6n()KD|d +z-4;CP6oPK*x2YwH4h?UM!7FQ+S?s;2-TRK1t94vz+%<~h=YKH5b;L89yyIr-R20Xh +zS{BJAi-^$up9m8hh*-25HX~YLbxrHdA82beU_`X^W`y^J_2X$56A1j~=kc`==Z_+T +zu7n}%#;**bdW+$vg-Mi7)lR@16R`>eP+7#cXM{AT8(O1C6<8Jjm?oO_Dk+uOv3t&g +zP!zO+$`Utaxql8|%C$?vj}~CsWJnUybmONs+6V!t>=}LX3`Ea~#O_UYaY4adZ=6kJ +zWazr~1Ui&-TH9eCh?b{xL&MfNVV`KjC{9Nh#fgY%F57NeV`~Z=1e&f>y{fZPK8Y+& +z12BRGIR*(ThDe6@4FLxMpn?S|1cC)7FoFdlFoFdh27e1GhDe6@4FL=a0Ro_c1m-Y; +z1mZ9p1_~;MNQUxYm$0NS^prVcA%SO0uwo +zHTQ=?Wn+3w3*FrDC(OA-xz1k4gg0%e7 +zE|q{bGT1^9c;Po6)t2QAoislaez~##_3so3$~8c|6ThDALVuQ_`csrzZi7niVJ9&B&mxm=-_q))60k=1>ymZmg$D41NgWqT6$()f5qclF-{owN-!( +zDNM-9lt=)MEIj|1m8It)GAoJ%qaW@RZQc!WT>eKQbxMSUwCCXnn=J7dW==)=q%_QmbS-PsoBVmQ8#q>Z^57uw%&$COK#CU_J%s^HpCp-Pso +zsVG6ZqD#N95LV4&Mw?3o*)hrMz~EOMuzxqgdGzSOzDoDF?Pkop!&U7s;C7a9@Bi+r +zp!&vTiAsBFWBiz9fh!LHbIQHHOQPIy8weJzOs7nB3foOb*z7OelAz +zF$EsP@)6NmCAs=uFa;EVKna5xx0wGC#1`kHKO_2-y{6nHp9b*qZx8n~sZv2}KYy=9 +z;~-}X`6hf1FeQEp+V1&}(%k_e+XYC3sTNhk<2T!iAyy{PA(IYE9GAHj(LQE#V91#~ +zMpN1OiY)j(O~~5A3sooGn~qp$_FCm)P6?T^VJIP^FO{K4O+egG1sF_F)0>`OQOio4 +zjE6GDi!3W7g|OZ^z;M7OTLGbU+pY!hzrsCEIoUkENh3X5HhDb9>|ytO0Stc +z@^I;i)OpS|&hTxBQ&rT4S3nmdg~fDy@qjnF^LgIQbKcXMGfqm}?RX#B>Gf;lzxO}jM- +z^t@NcdY7+{Q-)q4=Ko$b^?&x{b!znTkhh!0ERCBt;t0ez_1?u1D*pnqDZ~gg>wdj_ +zDezCIv8*1y!-2=uWr$XJ4OSw>q5$^1c@yM?IK-sh^c19jqpxi*kgsE^^W-y_Nejad +zd3khp1|E-OCe?G*$q+&?|L(>VjwhpmXG}Pxk5vO(Qyn{y81;~`)PL~7xU*N-!)((Q +zs!t34$4XA5po!lQq66@%NADy&c}(Eg2(@_lQp3?MRq!|?PO=AXq;qSylg+*;=831x +zV?Dd^3!*hvgv4ud@Ta2hPE24|C@l*$Kh8kG4%2x!jBss%!yz?NiaKJR*V?l>TPY!I +zH_XRAWAxGcTje&~Pg*f0Fe3&DDuzgg_YDCF6)_eB6wv3{Iz-K-_+dQJ5g?!#l~?ug +zDljoHAutIB1uG5%0vZJX1QbP$4lejcX32OA_0p;gH()NMq7(!OS_-~il6^%c0s;sC +Dy- privkey.pem + openssl rsa -in privkey.pem -out privkey-enc.pem -des3 -passout pass:encrypted + ++# Generate an EC private key. ++openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 > eckey.pem ++ + # Generate a "CA" certificate. + SUBJECT=ca openssl req -config openssl.cnf -new -x509 -extensions exts_ca \ + -set_serial 1 -days $DAYS -key privkey.pem -out ca.pem + + serial=2 + gen_cert() { +- SUBJECT=$1 openssl req -config openssl.cnf -new -key privkey.pem -out csr ++ keyfile=${4-privkey.pem} ++ SUBJECT=$1 openssl req -config openssl.cnf -new -key $keyfile -out csr + SUBJECT=$1 openssl x509 -extfile openssl.cnf -extensions $2 \ + -set_serial $serial -days $DAYS -req -CA ca.pem -CAkey privkey.pem \ + -in csr -out $3 +@@ -152,6 +156,9 @@ gen_cert user exts_client user.pem + gen_pkcs12 user.pem user.p12 + gen_pkcs12 user.pem user-enc.p12 encrypted + ++# Generate an EC client certificate. ++gen_cert user exts_client ecuser.pem eckey.pem ++ + # Generate a client certificate and PKCS#12 bundle with a UPN SAN. + gen_cert user exts_upn_client user-upn.pem + gen_pkcs12 user-upn.pem user-upn.p12 +diff --git a/src/tests/pkinit-certs/privkey-enc.pem b/src/tests/pkinit-certs/privkey-enc.pem +index 29d2f3d38c..fd36246ed4 100644 +--- a/src/tests/pkinit-certs/privkey-enc.pem ++++ b/src/tests/pkinit-certs/privkey-enc.pem +@@ -1,30 +1,30 @@ +------BEGIN RSA PRIVATE KEY----- +-Proc-Type: 4,ENCRYPTED +-DEK-Info: DES-EDE3-CBC,5FFF1E71BFFB65E3 +- +-p89x5YEL+Mb6IPZXEkkr0KC4Wj+JtgE3VKdTT0wEcRD74QVv+dbbZt62WgmpJtId +-ph0Ial2z5Mws8L/aTkPdW2H/bEroApLu4TfUV+w67KcWgrc8gOg73d6gEObqx8li +-qGbs7FC1cI1WfDfnNOnCbD66e5+bTI8fDuchaieNRqzROd9RHhmlBHgylTmf55us +-laGuwLq2cZk/+Xz0M8PPx07uauGkAK0fyfifn/JR3PsGsE9s334osVQMjbjyT0VE +-rm8HGm3PvZHHDUnkOh7AGKyEtsIa5fJAULUjugp2lQJqOigC4HVn8a33xfLI0F1+ +-2nH9MZ+Ap1rtI1cJX8CDn/Ij9oFt01scLxynYekYej11zFiR6qHC0sspxu0Yi8l0 +-puBPXCI0GzyF9I53ukjGeibTtssz5yw1r+2oVasR4bvfXczPjqTQCBsPSUayNNhw +-RgT7k4QTY2OlrK/5XdILBzBlsvfndXgGOwEDw4YE7PMzMmz69vPMK7CfedUqtuXq +-bGBks58tzeOa4NSfVDOuFLI+LMkoYWMSjPGD/I0trX41xCU+O6PZOnDyt5ZWl1Tm +-klJpsB7rUcwsP8d4w4QGhyyV6Mo2MTlnTILr4CwwvmDMBch3yzwbfKdeywsFQh0S +-NMrG3aYNO7csRRTD6aGvYcBCbavWq7Ujsb/fV7SOIS26f4VEqewvOFlFEXm66zaz +-GJ0IcjtNHYNIIIW4690djxPqlGgbIZTblBSBlT+iOW5HrhXvrLeMmwAPxInU5dK+ +-ypk2MGc4SzemkDi8H9jDW3dwbgcvVD9wn0glhVLQKWvP6F73UUdVEXMCZ+960xnR +-gxeEwDdIpzXNadWdON1kRbqI2KesRY/XQErGHDOvf2gNSM9V2gPz+5humvcu3mXY +-r4537On4+IdzetEVtI7D0slgojs+jN8waigpkLFB5RVl8PnzblMuWOkHNA86rrp+ +-h6wNqv9kHLgPjpAyB1l/7w4VqXLXeC4PdaGc2fcpdNWOncUnHROmDmYvdTocqhIF +-bAsEFV7QZoTgDB7J6vLsmbtfawtHMSb81V/wTJWRrtY/gJCrkJXR2pTYAZlPX6vK +-aK7K2NuhJFMnrQD+kxsrloSEyfsZmHtk0mAVXJw4wSxlH3eGQ+Jphb/M2wtsnWV1 +-w0fehxL2Vd5SyBBctAGhUirhRngbOO/E8IioymrziQ88vJZs2DxvbuNG4WKTuTwj +-CIggXohCNKdqrwL2HAynm2FVEWhbKrQwe4kjZc64WjccR4cy9vv+dxFfrKl+vZ1o +-Wvb0WXND7fiSBrPo7OfaYM5HjrcvIRP1AtMuArhuQYVARmawUG0l7dFLN97Rh9M+ +-Ud9vBIfQYlubnTGVVm/5xrUh2isQbp2vrZLfMrUNXMQm0vSxKgGkAxqNUuklJC06 +-LvCtEWMYXiBmB1zP4khwCHmHB+/E1gHBAutCzhpPu86ayEtNHBHIFkqKvZSg/UuZ +-+ygDdTJV00I2neIdeQcyG+vPg6huIDIHpG5u6eQn5sLqVkhr+apeNcskMWpdkpFS +-Lo62KUZDR3yB83ne63c3IGex0hWhVojJOAxykpGp6OD9uFn6Xn7x2Q== +------END RSA PRIVATE KEY----- ++-----BEGIN ENCRYPTED PRIVATE KEY----- ++MIIFHDBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIBw7aG13XYxwCAggA ++MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECPWyEPoKz4WhBIIEyKHdx+pkDxax ++dCCUZHsJ54boZxh+7f7xmO9Rjm+6+3cE+WCjPsiGHPUDtOXLxWwcrG0RAmA1GmrE ++yZbclwEMF8LcWQ3EUDMCJXBs7CEtA4XDH+EW1KsZwP+cA53ZFFikGj3sW6Ix5GLi ++Df311Eumhp3GABU57siNn+tMZJAorInth5lXBJFQoE3KJbBrSN9iQKZTOpgr4G3B ++G+qzBwrUKnZrGIp42t8op4VkB8sA6xoHh/huJB5pNygt9OZUQ+xdxvNQq+5/kJ2I ++mP/JRPSuN4GtnNA4fBB6tPv8t0L8hActkWlQ1rSJwWnWge3t4r5/3FBcAbl+zq3k ++t8A0LWgjsiQRmlKRN7GrzorOUKFv+7YAq6rc1Ek79qitUgEiFkwZZySt5+yPstMW ++vpaq2V0yDHf5Ds9uXffprhSAjnfXdT4NTg5eMeH65OEedUpVVzHauoGfFkDGaq8L ++8XgWPZPaz6GQFpU5SGk8FZn0OLLJHnHQDYo+ViL2XSuuqY8Jd7fmpzqVoHOU8k9Q ++/ONKW+E6uvkpNH6NbknceA/ip1bcdfwA/uRBckXjCc5uR0oB18M4UQPuKlcGev39 ++mcdlvzQJxl2EWbB8ULazzuzOVfCAEwKc96qOkDAY94CB69f/KhBOd2QqHzdxrQ+3 +++K+YduhbfP49Vxaq4NIklS/kSSv4GEBHzEwtFxX4oqN4Er+UkBSB423nvlkSLd1g ++tR4M30lJyzmHtOEpSOZYLakviz36ZOCV/DsxrfziNG/0RB/mPLm/B5L+StqjJrTY ++Pjo3QHKb+6ShhTi+jZ8tqXa68+TZO3Q7eTgqrcn8mq9jfama0KQF/13kmUsrFXTS ++wk/nbSP10z+MhO68z7o3j+Q0Co/cXkQke4slvc3DqLNvpQdDMPLKQVxtkPBq5czr ++dbk5K2GYFLNWO5Tv2RgBGomznoAGSolz5ozIqxffVHAK4NGfhihgLO/6GujDANVz ++EX/2/IacRg0L0x7//O/GHomiFvWYnDbHhRNicERe/ji1TCxJ5glqntFjOXDumwi6 ++f+mQWNWlQWtKq0IOnlHrBB+vqykAj+e+FROqJjuNI6hu4CNnrBK3Hf+NY+rXdn7l ++iCTD3ojdufqo0JDZe8dXea+B7Zu7WNAxnpW8D018DJxR2hoBvT4Po1CBaHLfxAkT ++ZGeXMjp1vZ348xBSppFpIpYjFRQBeBgSezzA66o3YIcDeHu2bTzg73DiUXNgV3RG ++OyJHmsOmN9Gax/Cx4z6/Ff7seisXpIMRU9TDrRCFKAcPHXAl3R4L6guK0I5OGwz3 ++GSMxsx3PGitj0x+1ynW/Tf+EJQD33ognc+kuQfNL0XW2tNJoibZIs1WgdbDwD9RD ++X7rbb9GfSJlQUnBFG/EKU7SGmFZUVMz7we8vckZ1PfeIKfH7OWrZ2i1WxIF2WO1K ++BX4TXp0KKt+aCwf1GInQ/6aYgh5g8W2iKuz2HJeZIN+ohciNmpOynsFmHGXdbvnO ++Kw+msZEQb5AvhXf4ToiSwZLSwq3qAILN8fOQQ9ta1DjJuUtITpe6ys9xhlnriUkm ++KrY50GkimLdD6XszC2uNulAuh3o0nZplqxC9IOLh+uasEU/+xqtwTaaYBljTpH2C ++8FPAEFFUVy6lsngJEQvdjw== ++-----END ENCRYPTED PRIVATE KEY----- +diff --git a/src/tests/pkinit-certs/privkey.pem b/src/tests/pkinit-certs/privkey.pem +index 007b6275df..2a25dc19cf 100644 +--- a/src/tests/pkinit-certs/privkey.pem ++++ b/src/tests/pkinit-certs/privkey.pem +@@ -1,27 +1,28 @@ +------BEGIN RSA PRIVATE KEY----- +-MIIEoAIBAAKCAQEAz6VXmJpVq2zTIEU3gUF7pui+Wg17d3QX2oy6EqqUQK/pwWtr +-vmBIaYcnPq0ZMrzMhNTuyeLjb1rNNkL0hCdS3/aVbx1bOlkPVPlW3UNi9gWpXOOE +-1/N4QMrzyKAQ1/Npf9xjY/vpqsmvRx7AZpq7Nq7HyF5hbUKMHFaaTqRarhoP7mOC +-ByG8F44YQTY2RXcw9te63x+77c3O64gbtnSKXBC/4pS9DxBBv1ULB2wOH8RGxDiW +-gL0/iO25YImKQgTvwbENw4ygLV+0m1b+YEJLaIIeKleunYEMMkzIfFmMemXRWgNH +-uShYa0PeyiwTBSRdW9Yi4qzjfaHZ1dD67wdoGwIDAQABAoIBAEpnKYMR0h6xyNjo +-VGIpT6BYB1UHPbVo0N9Ly6TCoIqpPe5DioDVyTye5A4OQlgu1G3ISqPme6478ApA +-ZZMw7/42QgdlknnOzbKaAWkZK02Sa8RP9hrXL8CvuDisOjzXCHd7RdXevzSmPfsS +-5sgdK3YFnKqMPwbCcKf61CHXvHJjWGuTIHIRh8P7gJelA4ahO0kYQ8aRXv3ldquO +-ukSI5gyk9CN+aAHqt25kEmt9oOgk+8kfKpnk+5gkOCY2YOFDDckD7nL1VIIrDxwG +-SmU598qjVwycDairWUY8uSuPCOLgbvDM9N8cERDMsyNQL63GE8ZZyHZsJ3Pbwdfs +-JVHh5ekCgYEA/CwhaT9D0WQ49GQdeI7aqazHEYDmqPdE2/qbmr67tPMZzX8AAk9j +-r4aMT+oIdtIMPdoQNNcBP6NYZLlAoMbLoAzHmWJnF5/YWLnS2Wg9OuXUOBn3jk1l +-SWelJfAKGeBld5fpSLTdHjRAwJrNCX+mc0IZIiEw2IvGUPgKGX08bX8CgYEA0swx +-xCDgvfoaKueInw/rUIcKxrSxK3pDhaR01Dg2pwSo7Vj9W01zf33qe+mjma6+U2SB +-fk+/O2VXDuEOmVDLwvp6PkmUeRE5PyH7urTMEjy5ELNGiZd9zHoG/zJnRgPwTjuW +-yguvjVGJwI1IvmODuA7Xc7iHFlvGNuxXZjPkS2UCgYA0nFxoIdvbTsaXLl/7rAow +-xixOGY+GBvil0HYwZcSxrtpeRjXRRZDtqOuTLKeRaqdFLD6fV5AaH9EsSn4STQdk +-n+XwuVf61M2FTVeRJi9IH3UUM06zsLAGDYqmDJt+5JMmzVnNYnaTe6FazbEjXy9x +-8oNd3IDdXOQGNomc4cT+rwKBgBbABOr25Wp7cJGK1XrdO/c/69DQNYLMujbVLeqt +-enCCFz0uaoGNFVcAHutqpsZyToYvha49KxVc9Y1cirfPOX58i+7nAAgk7Lm8kC9x +-Tcj2Fr8PqiA1YlVMIi8uoGi1Ch1XXwnFQxgMYcKPPPeXQ+L8bxJFKwcltnm8/h3A +-ofXlAn9AW6fYZLSzOfNQTMnuukhuAtZcEW9NlJHbej305zK89J66S8wroQs5iOla +-5GG+S4YaZh5sVGw+mnS+FCw7cQCUk40kXwX3yTrxlX1qGSCFCQnFdJow+5NVg4D+ +-dzDKzniH71OZZFxTqiiz76XxiaW/rS1uOfP/WSVR9NBLpV5n +------END RSA PRIVATE KEY----- ++-----BEGIN PRIVATE KEY----- ++MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCb/Um3NkEmx1p2 ++Y5OeSX3jnTxlLJijnE/zewtP9JjkKuLVApoWu57aQaCCXVAQ4TEGsht0B67kF+2q ++ILTsfIaC6C1GjSoMcxGdDi2w0THNjPr0w6QUTiExiNSj70LbYZUuKHKir6gQs3uu ++jfS7n8wI7utQsinQd6QspD64A1VUnH7GdbdswmytEhdnH2QHSMgi6Bi3kPefzS90 ++iMdAl/YFOOwFZgZEkPixMSUYW1EiIPqbim6idF1SC0dQdns4IpNjmxTQ9IbEVEuL ++/KSpyA89B10dgJ3kxEmPmrY2883pRgNsx/OqeLS4ND2p0OMePoKZEIc0q+Qpot0F +++F2oUq5lAgMBAAECggEADwzB9vY6FPa46KE01dm7VqGN+SjzVR24rQIbFkzAD4t/ ++tRN6MGVLrz0TsmA0YFyJsV6vvWMcYY9Zc8eSDRr6k1i5PYxTGT5k3aVHjT6xsmY+ ++tCzIANmE5FWSRnrIFYh1ry1h2gZejbXzYeT6TrvdIKOEepWl6SIR6eiy0Ggp7G7C ++SjlpT96ZtdE2RnlvcxcACtwhe3vPbkLmTCOEqeZ6LHCHIHiK4KdJgJ08OjU7Kgsr +++vmnwTJsH5s0b5IIznfWajO4JNOpqjzFDjDctGYBwp5xF4zu3u4bKe9aleM0q/jl ++ZkibxLsFAh3Xkh89nxr3E6oBLm0F8r8M7PK5wpMShQKBgQDAipf6T6XUY+ugkKw+ ++301LyoAch6WV9oT6uOJsAttmcUpUr6NXhRT3OM4oqyYsAc5JW2wbz+n6lED3j6Ez ++QEKSIFrYpjrYr9D7hqvISI9JT0PhVSPXECfifEyIR9xmLvV9WQq7NRCJMi26X9ab ++Grqpw1HNlPA/rdcc/dY0p25DlwKBgQDPZqxSnwnTa6X+r0UdR8l6kc9VuESotpbE ++0ziF222bpXmZ2GKiEU1buFORHih/e3yDvKvq+p2apyUKnEEVQg/TL8/Jzya7fEOI ++lTXcNQ/f78ef+nwEAxdRVQkWXFWHvvKUHm1rGCIY7zeOLnQ9JjBQkgG8zhUamAP1 ++owLBBTstYwKBgQC+yNX9Du0HvpbdfF1g0025OwekvXiDV0m/UnHxiwcxxDJeJceZ ++0mHK8nu9apGha4ynvbIrAOMdC8gwRh76NMOCHhNGt7h5vAU9Jt2S0OtCPgvJ/N5N ++nVGYJ4iCRYqLqh5QvWlXxSYEfDc5hPuWp26tBsBJEDrbLnuH27JkbD9jMwKBgQCM ++f1VFMw+I9WehvEHpr/PA4H2/5/A7ClXgR+YGZ7s8sUBLA9btSyNIevnBWNi+Y3za ++ETm1GMkjNw9UvL0qFXJ68eylHXtzjp6BK/MslZWHcfudWCYi4aUuJ5jcWPhn2Oaj ++iGk/Hz4Z/hN4cee0dOZN7lrW+BQ7y7cC88at00lfWQKBgQC7YeW02aUPw9jMJh1x ++lDfBh+E5sdRwRQIvh3BuyTd+m/LI+3b9RSy+LIL2KFJucwKm9zR9fy33tHF2S5En ++Q+inhyXfOEygal5Rzxe3Pfx+pGZbzr6IXkhquHtjuFBwJJCrSeR66V2xDmzJfCj4 ++TY+CzwOJ/EltH4ZjPwEmE0S7+w== ++-----END PRIVATE KEY----- +diff --git a/src/tests/pkinit-certs/user-enc.p12 b/src/tests/pkinit-certs/user-enc.p12 +index 1cc3aa3da67160fd9298b9e2d624a80c5225245b..69780bf82d1452d5dcac91e5be550f5eee876583 100644 +GIT binary patch +delta 2892 +zcmV-S3$yf%7U&itFoFwY0s#Xsf(sf32`Yw2hW8Bt2LYgh3kw8-3kNWQ3j>iNJAYJI +zdvzN7hNA)k2mpYB1u&JU7+xCwe0Kqqz8d_+6eNN5bCxnq;S}(P;s|YSOhpyniUDCM +z$(1g#xF>v`h_!Z%^c0Yt!ew3_&P4(J0{#(9L7ePjfyd?bB;_QXFR7CVbnjKE +zff_LH>L^0?(6j~#3lev>bjhWkNPqvbKN_||)xXx>C4@AfTFlZU&lEHPKi4d4nj{f+ +zP!qS+8ibCntvC-FbX2Bh1;e5rJ^2HAbUA`MID37ixE)(i7Ff}3>6U!A7&UF;M}TrV +zs}FygKNP+*;c1FU9mKlF^p}|GEw>3l&8?f;h5;kVci=EJL){2P?KXfBQh!XdFp%kd +z*Ocb%wx_0U2R5IZ6yZz5d98E>a-~6_Nzx7S^X30+Efi5p^xb?~9+l&zoMeqIyzty9 +zzsz@?=R*_{cx2I*TK8_AuFLy??NA&|dO~=b>}Z8gy-$;V6$A;>=0#FrJ9Jh^u8)2W +zt?+rI1Fh%@eL0#j)BLG)A3wR#E)w3fN%6wZm#@DhR=+YxKGK(9yT*!=-Ns++Ssg0N3T2 +zKq%m4iv@P~LQo^`Mo(vF<$H-+DTiQc__AMQ#@XpYeg-&|lK+0f`+xn?YDUnk!*m-S +z;3?iZQ;n6bCF)Qt5(ITP`w+u&Ly;u}uQ1cMO&(bc!cfKO(a7W1_to~F^2+x*NgW)a +zRgZ@G)H!U6`FfcAt1chDfZQqj=#Y%;epbIDezJsIK-L+yD*p{<_X+yO+c(edMB^wL)S(YO~>7lcBt24a8iz +z>BqxgH5kvEzcWp$^y>%zfu0v_^AWYG6ydYCMdBu*~jpcY$>CJvKJs_U)yy}@2d4 +zseJR~7;BP{vz-tmn*ed*fv=l$4IYo;0VNXLW0o&Q!hbzT8q!Cnf0=w_#lXRiI)uQh +zV%mHI&J^p_;AT_-H)BKz?DO2vN05+sYJzW4{Ma%7L9plT_fE45Nv3yqwF;+zhVQTO +zpOQc^lLD9bh12?4t8>L1*vVNL%HEQGQ^g7Iqzw08Z-Z}ai+*rY33XPO~LIe+^&!Lx#pTd1JNYDu^}EZyH0 +z$TBU>AwxbT4nFscHMfohn3#mbtq1>m!CLz7(PkxiHtbu7bgqiuh(zg{?jAs}eZzI% +zFoFey1_>&LNQU+thDZTr0|Wso1Q7OWhVDa0j>1F2`SnsQsFehQ1kfy2Q!4pK76IBl` +z;zFNdALdBbb<1BjS7BgZ(Uvwb_x)%e2gv`eSYyFYtolD-;4XL1$)~RR)=d7Pt9XT2 +z;H%o^nkJ=d$#!Bj@GdAIKg$I2neN|tFeWg{;Q5)7zZpSn;T1olS+KVY_lBjjwSTe) +zb)VtP1PSkBMrT6Ioku_4UD?1eYXo!w@)n$E=yr0DHeN_iT)WQ6>M^o-i+u>O9PoIg +zAGit!#=pHqe(^&@p}lf=ph>TGzR7daU+;xp%fM56%$^@8^LiN>2W8{#gG*mrwrQTCXiGT6C0P}9P +zs|HR1en}U7kxre1`Zf~z=zusxmp&0{@$79lWY4|Pg;*&g_Oe+p8NJOzK_L!6qxHN1 +z?Wo5%?qF-5mPXn6j1@^xU2U4-hu3KNU$R*4M1)ga?HW~OZ>B1>f>cal_H>l{EfYi(x*>vJWha%>%~F<{Y3;G~g=5W0 +zNP;AzGh~ceJN%XEcgTUHj%>^4C#ZxH?6p$Mqsj%0UB(oLJ@l>MUVqg|)dT=|$YBt( +zu2-yM-d8h1I*-*B1twRw?8)`M&%5?ZL)4|XXI)mEAX@=CT2zIQ?xLXZbZ=q$w|RNc +zZ>3Z*V+x9d8*W<~L~B*X-R_HY{J-_qK&HaBE?`9LaGp#ZD$Om(@(Ey?#+yaX4a>b#%;z-;9V$w~Zhztczb-lw^6M1A3tw?M@RWNlUS#ne~ROieMk?E65E{^AK +z7h#?hzu<-)YhJC=Yew$y%NLL*@kQxtPEqNegvafKM+CXxV1H3%kxZd0Z?KMjenWP2 +zDEQZC;eP=48N|TQyell~0OIZYWa1A0K=#U@plX6Lw4tVn=FBwtcl==!VhSZ>7a#GL +zeLF|Y>4kb43XBgD=c(8lo0cmG5qOT1mNt)#aYl&g8eo(_C@x%x=Z0?)2V4r^U|~%j +zwef5hK?t&1Cx5gs-#K!O$Fo6@oZR^_4{UsI +z_6exMhy7&>jRUy#zp9Kzw!Qn~s3Tj;OJ%7vk6=QC$ObT%xXiHLaQjioZwiaA<0ClW +zwggOa)Wf1nmF08GoHj59|z3`)c&@iDicIM+kgJ +zRISnBfo4M)P>kfKHzfzj!^f^60#?=KX|!FK2seV>)(=(-F(oh~1_>&LNQU+@7L67nFoFvS0s#Xsf(p+D2`Yw2hW8Bt2LYgh3cv({3cN6a3b>IXJAYaW +zkCdOgiwFV&2mpYB1u!3O<&^}aGBO*zs#A~w5-^3s&_cc&jq;YL57~y$hvIsVoE;K_ +z@z;j^#4S|l0+R+;ItHJprmPBs9a_CK@fJSNtw`GPWz{liz2|+I@@I=qN +zd*k07Kk-OlQ37X@O=rz$K8j9)sDGPk-J>07oO@p^2gA5p`z!5za|7wrxe^F4OVF>Xh1Hq{RgYQb-)_;_0(RzORrqP +zH-6>9rCa#pY~43l3lM}D^Of?GJR5SgvoXe*9$n}6%d~(8ikvS`(#B<(zkf$~%Lonm +zNfw1+O)XYi?faC|BPm2d9_|?t7S{=Ai6*tpKfHTW$n&0tGKGpq#c70A92fv&u=zpl +zndE=f^VVig+2W8a6z{qV5}E0L^?@yQ(w=_afPb8CzW<$heOh7oL&Bp!JVA(4`j!s% +zx?fmOzd<+D;8wY*a3Q5ymw&$?>x3h&8^CM`GvEb?bI<46b@_&FrCy5mUzL7?O +z75ZMcP~PA0fwL>T(tjNAt}i#t^{zcGAz$K1>g*LjbfwlZDxSI=f3@WTNBRvsniHoJ +zrf`Aw?(*vKOp;T9&*{>E?K{SpwH17yQf5N|SCfKDNiq!E!Kg0z0xGTa87-U-d{!(c +zOck-NH6ki*cGdv_BJYIDt1zG2GRSfp(v|3ukshay-y5XaAb(9oViC?Tq3k5i`Feri +zttHdosBb8hps5^^GXj>(m2-YD;2H7o=p>1+rtl&MShE!M2?ed!cM9FV+zrx08{dcg +z$P_4=1NVpARU=pkQzG@(0n8E$!qClc>?KM@^_=a-tr@90VCRgJK0TybnLc+Qssc&Z +zXfn=HIBPvYFn0)M_`f4e;hA?uo%xSz0OeW +zNFM_sq}piLP@uBVmRVni#!=stFR|Ks&x8Q}?A;OK`2ejw&Tj(Xhx_g=L!>2WVRs-z +zGh6W&y&1fnPPNbM)lHyo;rWG^)bHE>E{|PL^ +zqx$n%KM`zvAgWp^r!U~!wxypufmE8|);fuwpKp5XXz~8Je^dVJD= +zOMjqU-55=b#50HSV6Y3_+?CRuZf!2M)0P$P%bi%ACPtPF;+gqmM41S)bV{HH*6?l7 +zFoFd+1_>&LNQU?#%Ea+EPCb^EOHXH_=gdD)Xp+~Q2LY2kYjfS}$1nj95o?56!tflz0;}d?$ieK^6&}s%L3Jl^~}=VgTY4GhW%*_#a|; +zj@K33^y1^ +zK#A=G{dRZu_!rdMFb6QVMS(Ip`>W|< +z4z!ekC+@j>Qjlx8(qW-9zHdj|;^B76#Ng{%EWjRq(IuJ6<)&awN4K+UwwNJ;UgX}E +zcaJ_73k>u#l9eP;Li?1Szkl)Oo#2|EAHYvAy25&G%=FCq2i{a!yl36`>q*b8T+*;s +zGejdSSpV~R13c(;mCzMMN6iU9ob!=eBh3r+awrj_y=yEp3JoOQx6Z$xK1o|4KRZDM +zQBnXVwZ>=c$&42g?R^ZF45)g&{)y-{_@gyo?dqxX9ErtT{JxI*8-G*_P}pLrW-1E$ +zHaN5nvDs*jbx_bgcL_D@$4QnDKIv6ws`(`gn9V-+tiycOjA@wP5X_WY$OELGX +z5KUX5YQ@_olJG;^oZ2yRmCnEb1D`a+vxyqG-vy~yGiouy808|&S{7?MV?BdI~5 +z$r$t9jm4bXD^b)>rkVn3#X)v{8>DuBwKbv=IxjOWC+r+8lMwH&{W6*4g#n;A; +zO4M7AXKtNumgi-Bj**jJ?fCr5H|=aBrlV9HN^WPkhM=+(yMNVi^GonVr&qU7AC9>b +z49|BZN0T}tH2DM}@daN982O;;XiJbw%m1(>&0zStXTCHiqL~wKB?P27Kz?h){H&yT +z0a6!f5zd}BisU?Bf9`(d956SlCT>3gvm?yLEEgOHleI(q&4=!s~U)JFb`+L~}IiD*+*g0&iUOsbSGYgzb>NdTp +zqqUpm?qjji{*LRy^gF1p#_?VHi4*L7pt_M9egYpb2L19^P%~?_Q6MTIso>1niUlBz +z&LNQUXqJJ21=NG&!mOU3kJ +zFflM8FbM_)D-Ht!8U+9Z6sQzP_9i;N@>ZIW53D_

e+>;wo&%Za_$K5C!>0tf)< +Cv^tIe + +diff --git a/src/tests/pkinit-certs/user-upn.p12 b/src/tests/pkinit-certs/user-upn.p12 +index bf47384a8a654fa77d9d9161c801292292ccf4ab..e91cc8a0c04869d6cf9d66f5b1b051e9f3f6ac58 100644 +GIT binary patch +delta 2884 +zcmV-K3%m4%7T^{lFoFwQ0s#Xsf(sG`2`Yw2hW8Bt2LYgh3j+j#3jZ*I3j2{FJAXS! +z*@zwch1miE2mpYB1t^994w-1MgeIP0Shaj_WdPD*<`ao4RB4%B;1!qUi4&p(CDJ;S)D+_sG5VV~ +zQ$)uegg-)nY>J@=`X=55yd*|FF1h2T?_^$o;jzHLsjhabCH_1ucm<4^|1)>iEPp)l +zr`fWM_jd&6^poG?mz%Xq#a40WKPFn(tA{`_dWfKHg0-O<52jv5Q93&va(_@T3CUj< +z0WY&G7%<~VqQ@)3_!$**I?b)=vizO@^WQRD>b+MudQ}{)4vvgomus3Di-i09fLtc+ +z-@6;hAFAv$JCwV0#Qwkzw4gup&uc9{IQXP*mmZ3|aHIBk1EhHL{5PG-IM}|iqFq*# +zTzie!)o?eYrcWJV8pynY)qg1cN-hb-i$7d|Xg&|At@X!`uGqu$VvXYj(63TzYiT*e +zzW?uzBT%#jm7P0PLD3XAQq9F4uLwUsBh?d!2y?u4^5CNAf!qRUU$VQVyK#iF_TP~B +z#onH-o7tzcO6Q^v7GcM`(gz_*e5VOL8@m5}KSnn=rP`yTs7AlY-G5#76XN2TW%<;| +zGoyMDsL9-cF4Xpe-W5T+Uth$S-ql98cUnVq>Fu!0m}q&99V|Vo@OB-Jqh;JGF3lTl +zvmeBJsI*#7V2pY%RTS&g!XUO!Vv>U!_Gxc&XQxd)6Vl|xvPV*NZcZ|!>8=+@_J^zd +z9wjwHLS)!-9u#h@0DrRg5ix4vy>8NYpgnyo-c>t$;4lh^dK4cFHi5Db5SD*&_r}nE +zb@WLfb~v1}6lu6hAY|QXKAGFH_e#O)?iYYb%+{9Gb~n3Lw910jG8+H1C+Si~eJNkt +zy{Cn@nO?tKx*Jc2CypM;3C5Z)4>l}6nPzpM+EoUGx1|H;+JBOrINg(y!@Qtu+=tKH +zmuO}7joP%Ttf`54n~u$-R@L^0b?dmZ8^S3-NKF-!Xh*$WxmaR*5M;R&u#Fl$H2hD{ +zwIM{B+CWT%(V?I^>XtmqmeR>KDCIFNHWpyaa|`t$5m}*g +zK>&|Ey{Z|rxBD#9Abq+Up(9cq2#O?&gp~B8mu@ +zAhNB4+O5c#8OB5Wub0v^LYpy+YvD>1~DmyCA^7g%D +zFAAxaq1oCJ*#e;kqPUvQB?{$)UCWtFos&tE6ngi`#J(zz5BT3#jp;8k^KwF}Mx&M%q=hNf(NuFoFey1_>&L +zNQU+thDZTr0|Wso1Q5U)0W`6LNiYv(7JIIJGrI(W1klCz!q3{|#X5KUyo}{Ke$8*4 +z&z8gsBnxa}BkX@Nu7*?GShxRsy(nf4M1NX$7U7f*_v;_v8QmAi1RA=90>Q6mk>K0H +z#oV_k5pRI;GVQ3j<_i&6FF@?OiYbr0)nN~B0s-eZp5E>oV_kZd6{)+kM5N6N?Ld3H +z)wfb0M94{)uRKzoHZUlqQQ{`;zEjVeTbOk-Mt}G& +z!k=6|Mjv480NzyfPdJIgH0@|a0zl$H>5Af0Dne8-zz4}2lHd!s3 +zxSf>)2GJi2L?K|q`h_O#om>P@(Vb=sW3vWx9xU|H8mxx +z6`(10w19d!;Gs`p2)_6Hl$RK`TEV!p)VPK! +zaxWY{)O03zer|)d_jRj(krvwkkSyN(Nh-WRmF#Qp>Jy!6>^RCj-Npj)j(_z>y@QU- +z@ZL#n!*Zsb&e&}8Rg@SJl5p|B7l(u1YJ(3tl-#D_t_yL08PNf15V2}X)#%GD2*o9PK3%fNCJ*_+= +z%xwkK;lE=s`le+~$?pnn34dok-|t4dj=d{~HrZq*Li94h5LRg+?=$WT*{8sh(pWO; +zx4S(^BW~+)O`Mt*c>{9;je)afv!lqC@}XAxj=mGhXt4NR2R;a7!SOWb$nSJCjeA_^ +z8`)x3k+zM~B(Pl+i3OFdw$_7b0uOA@8<-%=1$m2$wl7Ili8G~0T{II* +z)Mkvjg@Tuz5BIgMk9$ViI62{JqE>~?qz!0*3CZk477 +zouHyH@yBwvdw;FKYYH>yE~}|^QYs(;?8`w5)-WxH@SgoCFKDpSStZV*Oll+`gp&LNQU<5RG#b4BEJ^04G$AzyQk*SVS?I1uWrC}u~MGWb!KEd3HOLs +z1vIdCmj9fXy&snurXzgb$5TcD!>K45?spJD`)LcPDS6?a;V`RNpkjf`EoBh??RTlK +zh#hCXlH;295z7xk!RW`#2Q)Ldjem0>WbPylh7u9DMA``T!d19RnS;bk#uauLlP^WH +zKr2J}sUw8JM}#iNO|VH +zR4xW^b$*AM-mS+(-PO-kX_m@{K<)}Cx}IT^la`VVIVrkTV5%o6Ay#2R8Gm&i@n79z +zMbt?rY=qLv@A2$}MWsJj7#)`LB6Fc>iB5mgaDRksov6|o?YhvA=5QPUwqt8gPxXm@ +zR_v)ai(Uik*bb`DQSA(I#xt|$#v~V3ot*8sDww1rNSiodn=fVmod!NYECS3>?B`l4 +zC9_gt>z615h!;`Y)47ErO@DLZp?MNZ_5Ff_svYCM@Z87f#e9llSG=s7vqkKA{x@24 +zAVHwi9Lk{D(6=eEA%KS{p?QMBW;vLeF4d(a+;9T5J>N-hUruMt&Th(NZX; +zg;H3BzJdyILh*xPTJA$FnWa>4#A|v2o(ajRc^g2K@{+AKE$`~-#P(nh!v**PJe7C3 +z5_&Y5eczza5Qm@ocj@WYs%2J6H1Isdq_%)2l)_`knW#8;tT=){0p6uFqfI#J^T298IsQ +z>I$oO)gY?L%QiQOULxj$9;TxW2Y=Wjja17-rN}yw#1v{vNuhG1XVYTnq3NV0hn?>i +zO}u9T7vs~SBvUb7|BD&zbC>M(@O_=3VZdYIA-K57Xq{W +zgEb$eyZnkRT?lF3gg`Yn;`GqP_vCc{mR^{i!AHxKO^qcyAr#HKLym1G=Weg&=3^|K +z>rS<d`@~O{(9z`ZiTM?@dR*2yj!7Q3+L9Y=oJz%W-V7M76z? +z?R_NTw?*Y%k(hWGe-P+8Xyu18Tkzz-&8A65YgT>Eu^NU)aO;dKf+zvIh^!8ssUq`v +zG>S>q@Zu)SaYQJydZt+TmR>5$RB*L2L)*Iql1J@C5{SP9k06@-k=3HjQN5y=Z!6>M +z#MH3t|9_5JmWH8lzjUZp;8L7rnh;$az|w6Ql{t|{YprFA_j_1tr^r=ZC0*U&Vlo(SJ1cWrAPSUH^wc|vrE)kR +z?cXa(1TcEN!ANk0%zj|K^A`j$w&^r-JHUqN9e==jAPlP4|2}*i-^~N4H&WVuhuT%A +z4NMZ&L +zNQUwUr|R0tf&Ef&{?f0joUStwUh9&a46T=}L4X(YEZ)q{^&| +zq_O=fhFO=twxQ)i)ictPugP1)@GE?0LfiE&BG71HBSVhv4uLQHv@U5l-RAD{8y8ew +z$5lp>NU4?E)-f#wzD?C0;y)WCTktzeYkxwzZ6!-?eFHm^IZqD~<*I#5Nm>zFieKX4 +zO`ivDk`gO$>PnSjZ?5Mm(X-u4F30DqM2^|IdlXJ&GbBH20*}-6w#G^`AzC{)_^YHP +zYZO5Hp=lJ6h_}SZDxfLEq+N}72EF?itd)kRNzkGDZ$6hI%(z6HFW0v0u%S(N#D6-K +z^~oTy%zj-t7kvAJc2uses017pyZX<;A%Boo`8qmbTi-;1Y+P^ZT$r@+d$}-C_11}k +zfrtB;5(a*fFE1)5s&uvNSj+0tb8mv+xa%9e2KE^w+Ijx)k2w}!L7tY$fzGi}k&=h< +zHNO?Z#O9U!sJ_o|ao5U3273fijemRY*`f^vpTa)i2!~LXZU(As)(9D_7Y)|eqjCXJ +zH8YOtem%7=RzGk|{=Hx6<)X^22cHo>GlVeqnJ4Cx@&=xW$QMPWQH|mS>K3e?{2A4V +zo*wZS(hJ~bzc-m{j=qs!VdsL@a`-J2_N-Q!cSRq)_?OXZ9Cq+ +z&Ips&2Y!=ahQ?`+ayi9Cs0&Erow>HN1Zgtzvp0=9+&N9_eJYxc1dE89j*Yn +z)|1D*i0XXN?4up^9FyflGJn%K275);(YWZ@?;KEO!*;z)*ooRISbfMiBQXq+%Ya5T +zJ}?c3Bl?+2vj^j|HI{X2Bd}oimixhfqwh;U8G+h2>f0Q?OZ|!sc5U +zk@CXsqV9GQB7#ZXO#_4Tn4C|v7d;I#TrGIYR-@TSyxZGTI(6;mbh7%m!`Oh +zp?ib=*@9t{)p*Q@-+$p6e&>}M9yyg&uxh)h!YB_Wx&J(J9Zt>v*YcD7#86EfZ)P}{ +zCieiXHI$g@Tc?Mr?S&DO7lTDtTLZvS1~(hg>zX6ltsNC&M3bF!r(|O1P}3^VN`zT{ +zj0dB54PR&b<-8RtzF0iRs-tOYOm)n?zi-6OiEbwohaba|vVTXOL+zixO!r@D#@Cex +zyX_Fl^JboqR&${ijvoYRRO~gCD7Uux+4z?Z4iEO6kyED0K!0J(j;{pWhDVT)5y02p +z(W*ESKWz=@q+Gl;1SZiKkK*Ha*_1VSL(vd1!nf6TIjp87EpQ5&e%;PYJq4CDW2$Zw +zs|Uo6aqZ?yK!19mroKn~4oT|Yj&p^PpwjvlPv)oF(oKp%i`YpnX`Xl;*rBO(B|=NC +zcggoj46fA+7bww@VI%k0<Cb&LNQUZgIobWQ|@8X)gWKEkQls>5bGmj`vYHd#Y+?jX9h9+CF}@qc4jy(~E9 +zpC_weF&>28nIZ!*fA{&swafGQ*5rKdRYOSQdo8_GT-n@a>i2Yojm{FE2EOp-w)#9^ +z+aT%9DN95w(w!}IyA{L&Xyz6qPM(ESsd9zoJPs6@lICqC2}?Z4=_`B}1$DpDXlR6Z +zSTB419!46STDltqpl^sfG=FbYlwneSTp_q?8}f)xbZ9{O9-Wb>tHawa_MLqYC|2J( +zX)OGzDQLN~OEm}F`&j#osd(ZVMA*NvLxKFU0)G;xk^mpU!-s%mf}lN)*%Ltli!tr9 +zE2P3!^=Y1X$0i=iokHU795Xm8+ZSG3jrI$D6OR#Gi_?zXobn~Dh<^rWm1JEZEg?$5 +z2jamsVE$12jr9St4^>^4sZxh>LgApOHi}EckX77*F=0pDc-U~>y%iu+NFU#)8Rix% +zj&nnj7M?bw8Alfcj!W)BJm(gb?6>s(XYaUQ_e0D;+psl*K~&|egZI(KmpbQq0wwT9 +zu+AcxvTNZN-+??(+J80aN;}ltl455DT(q0J%D+wlDj+y7L=8bgAq=WQ>L{sB0*YzN +z^+)0y0b6gxGG?EN6$SD>CA-H2V0K*v!X1fNu4(}Oi)O+bk6x#Iq!&*=9o00PU5=iV +z9MlzT!gs3Lwxzi2AqC_9Br94g*UekyjX?7ZvMchRD&Y$WAyF$_0r*Rfw +zziFU*CGJps%QP4;8Fg?z(0J};G!9N(iOJ`lZqJ1!R)6#f9>qS&!Y@bPO-Ok?W#xQW +zfQA(`0ap?-cEq|o^9&yEt}k?4XkTLsZ#KZVcj^jx#{>xi(zUS;nlI2x9N{&<`LL++ +zcAEvFpE{Y%E#pxg!Od}^K)d-hGcmHExdQLw*v@q5`nes|RvFM|#ilZYbPU4$p^@y} +z&z#I@bANa=I5gyY{59I)|8d1yw6UzTq9rOIjx8o9I;El`(POGpLu=+>{f#2MwaY_3 +z7^25e>dIDS{ZBt#ai!_n5yXH~^tOBhr_@$CKi44oqzJAHl}~@&t0VqulbPSEcBF;k +z>2$wH5qqPbKawRqB4j9ttg?JOiH+o9>s|1qzke!$9d*3;%M7g +z29-{jz*kZ+Kcq{SjLN;n4Ber1K4yDXYzWr+FoFey1_>&LNQU+thDZTr0|Wso1Q6z? +zUxJolb~{rn@ALfyA$A0U1kj)Bvt1ZK@Ci6CVTSS$(6{2;mb9_6ogc%2c%FRB0Na)r +z*%_E<-(3CfoWq-JeM2LC3qAF09L +zg{J|A1^Xaq=epb>O)~!z=%%-`yOXl3%PjAvF)FBpL%PQ8wTn<)p=DR)-dB_0il)sdbjsGpBc)#n@$o$#SnZI(Vvx(l2?*rJ%SpcdNjjQlrd=@Beh+$_|6F +z8@Tz~KUJ!eZqW~?AV$XyLUVIO%YSv(JkC{tT#X%aYc-b9(YI*AI#| +z@MwIoBm5eVk#W`oKz6qodHvmIS>8*z%=9UmJ|M-{*v1k`kwThPN|G=ssmY6 +zdlK$V$NK_C^k`Q0!lno85{Vus_qos^`Lp0zfxv(h17en6C*u(a08qe@1AkqVn0)b} +z_Xt97qce$VS@%WK!5l~<&G+JOPggXM5_*(NH(7lp8{Jpo+{LndeBBFeK|Qn +z9UGVTdha8uxo_%X9MFciV&krC4;DpRftzbyI!nYxd{sPcCixi!0qFJckW+X*!~7dN +z#qLCJS{#C^lb%_p>cE3Gff5>B7@+UaH2G|x!e5o5P%R%B6vqemlYj0D+)w-FeI>(* +z0Z%64=+!6EARd(`dHMu&ZEii^ztJXgr@}do_>hq1`p{HS5F~=?zcN*LufsIudMT_~!-%1k2Z3CDO0m;OS8?o*&w56(0V%Y*=| +z&6KdgoIuBBWarFK(|-&5b6I2rue5K;BNY@TV|7>-A62B=7|2=;u_KME9kfRGO7R!8 +zk!=M>VYHe3w$voveBEaD`6q1-Cq1zx1)QL{#hAICUqkOdQrii@<%vvEX91z>D9Io3 +z3%c+cI9lYE^hh^AiBrSmRh~J=uQ6BwGHyUW)6{>GMKCjH$A4cY;o4ZsWe1;L-{B`) +zTrX5nB)#PSQGLx(y_osNPd*Bwj48Brqm=*ep +z7?tQkxb##(ZQ^)93Wc5!#dewm80kEjmklRcG6?}+1z!$p^Jk2Oe_JMX8L;k`RGGFE7$_Hv%ZKPxRiZAvez?hfXPXwNwRuE|3@d +zdj-&lv42j6S5hNDUC;L)_JH0QA@L78%wofg%ep^s#(#TzP%4Z8>ZGBHIXyyhuf+Yi +zM3xX3mKikVT7r?YF(oh~1_>&LNQU; +zK`=2e4F(BdhDZTr0|WvA1povfY+(!i_~~rbp^C#yt5i7iN(PLf-J39FdDrAamk=e% +S1PFt)bqU_LN^6M%0tf&&^grJK + +delta 2776 +zcmV;}3Mci@7WEY(FoFv40s#Xsf(o|=2`Yw2hW8Bt2LYgh3aA8v3ZyWC3ZRi9JAWcz +zf~^6)AbAJ`;A0$m*A;RX;&9P-0dy)<6ic +zG=h9$G2!QdbYEt*c?gO$3`@bOmrgFTNbozB-NlAbC*A{yONXB%C_apWVt=m9^0h7* +z*?3em;(mZ;7{UgE*^=bjWp>G~J#?Y+fR&bKOal3mkO%VC^-Ez^Tk8yxwt7m@$;k^;0mt_~ybp!1yQU@#i`pO1MtTs{ +zHabcX7Ry$2vhmv`Raz3Nzo_aqaaVrklIl$iB97R)5GILb_*Bm3(tkzSOZ)b5IhLV7 +z18HncR{#Q20j`Stv^2^zY5kap#QcGe)b@%+qc}wgP6{)5*#!`fl6PU3Upn+Y_>xI? +zfsjk#HF2&lV3}zfBU)o)!zbAoc4>XEe{teOdJ`-fdj_FqS(o2cJn=r>OJ5eFGs^UA +zapCv&3$#-VW8S6m_kSVO^*h@>eY1IxY_S>As<^a_01O26Sx}H}kyWj$CxawScc*|AAAe{9 +zE+JcamabwG8GPkvRP>l1i1{nU9ta}Wl71H(N-t0As?rI_ioj9#*!5o~ENbw6tO5hG +z$96!&YHs%wueZBZZw~*KH!_B$eD!={Sx&YtHN9{DcYo_^N`ke0kAu4+P79utHa89c +z)AD9LSXCcQk>ILDAq!Cfu$AR&MFu_)?2$ppSyA%@PB`#*g44cDw0%9-HQGd1v3Py +z!ce6Hu^TKIN5~#rt1B%m&$NZYd9MrmQl4b$k2uObMpm28DcZrrFKb0Ttm4Z2?`Q(F +zY^;>9Q8MHLYey(85vpj4+l32cdPWo+D)#OH>VIitq~FY;9jCJ6a<5avCVO;E08r5D +zSG1l{Im&na{@&BN_g=`GVh&oM-8}MDDtLe6FoFd+1_>&LNQUF0tf&Ef&{<-evNXlq#YlqN^2`ojQQ9HmKs6}GRF+G2Q)*HSg$iMnU<^r9LrFn +zxi_;d5j$8#-aZkrIi>3j7q|(a0XUem=tm>Nb}nNxMG>I*-+F&f%b8U(1IS|gXKI0z +zFqNT6(Uj?AS^2AJmXzFr2W;!B{>^Vx&VLDIh>r(e)E6P|2-iR>d>%7cst +z)|fk0e>A-5)~Ixb{jf)u9d~a@$;Ue2b^hwuq!?WlOW8*!jho)y!_O^q*bU7c_&t<0|Hy@G1@YR$7(n^F&19)$qXKz?Bqhq@W8l>{Q&u<#ZCP82KH)Zf>7(T?yuy +zXGoA2<9<3(Utt;Q&~`^Cg8(aT@!^O2o{iyARMlt@BwEh=#p{5sNEwe>u@1xM!xTPf +z{cjB@R6p(a@P3Tzkch>oX42R~BYzdsH}hF&%B1a4xaXUzQeob>0h-;WoL>f`C=2-_ +z+?HS_8A~=i`NAu?^bO3bj5;Q9@Gq7~^Ezf+@(rSg07VgwuECIbZu9FRm7ybGqUAL? +zR7yl-`Mf>i#7>75pi=AqG=Igf3~}5q2<2ovXnupwoF<{75Ez +zcV`RFb)ap&F4!IxgZ}Me7xPecHIT$;Q6FA-BMHlMvro#iGlRxRNtMA?I}Nif~s +z4xB9LTy+J=1(d(NNEkKNHx!^IF!m3CTL_mzG|Lm+qD#hqIO$qkUa<6w>vOZJ&Ak)9 +zN9Gi+Vr#_!jC`(#_W~`|?DPU%e!rq@$nOpuW~Fb(C(B{$pmqr(14Jj*1voMah#X2 +zmbl}dO-0R!J+{rgTo_kufNZGxL%bD_65DP2ItQG>BBz|#;LGers8fS6-vgfP3riv2 +zIZ5_@26Y$`o!RCwn1Axwp*XLPl>P=SHk2ynIw={bF+x}_sPmTws$a&G)P=(L9xEf; +zLPH|=&mn<~cDxN6=Po497XG1E?JW*UhV{X1RCR1iD1=jyWv0E3aE>pobEv=0<_32+ +zfoWJj=tC~)VmD*yV*N{+a=kfqsTn~yI}%5e#(gjwrk&Dk34dHu2g3JU_0P{wwL5KT +zZ@2G(NB2WIg(L2M;cy}50ifkZ_}n54Y{8^Ua&N;Qj_?d(r3t?4b6YK*80jMHh03Qu +zi&_K*!^0bGY=gwLu&4S_qj}z*{LmQ_iVGA~-#u+1D@-*0F=c?J48^)^MHR#YRH$6} +zb>a!@^}Ar-RDX?L8!uaR;urhhC76Vioep{Xi+w@7ilod#-zzV7IhLo*t)6x^n*!>% +z1_9G$)o=iRWiOWc!_9H_>^;Ksn0YIJakz9$%BFxPdh@PzCrU2PF(oh~1_>&LNQUgB +z!rN`BrcJ^Ohe`m!y#xb>NQ{#(`z%T5F!2#O*G>G~9Y1B$tAF^=D7^!~(#BjZx-F{G +z^x3%g?|7?Hkd{-0YH5t*Rdo2X?|+3mcuxvN;&S>5_1eT(qT(x52zq^KY|HMES@+&E +zp!Oqh18~73Vp*Jp3(0&@a@|uNWKk>z{D%AcItdZY^Q#tZFXI%q0IEm0FKXhy*5b$9 +z+GasSZ7Fl=*a3g~>TXLBMNrC1VdF*^x+r|ZH_Gzcqm)*qrnyv-YX?aX*MDZ~tFG0` +z^Ke2l!1Q9x;ujYQwbTgiZxgrgH`#P(qDO`2T*ft8T4RjoRc83{mS8JoxEB~7#0gjx +z+tive>B*VgSOs(>1U%w4T=s!cQ1y~?fv+v$>AJGg8w`s<(0GUVEe>-f_*GXPbEwZJ +z@TMDrtzx^BDv>4R!-4YvFn`WcgvasTcH1OTNqcoV8kt$B82tUtpRiX$PQ)wkp5{t} +z)?p3fYtv6h{E7BP@YDq^^hGRwEr+;3?2}{(tSvt7&zZ^>#H`F!949k<-xpr{{;9zp +zDtV?e)Ry1e!i7Jg&*k>7dmwW#q#n;eOt8Mx%Rd2aKpl4~ym)!RCx2F~-z|>d?Q54S +zbh=;Es8wX9H~AcxB!gd`Yv{dKYv3SYZtJFuhy-=%I~N%?7_12a2`8#qO9;)}q}s|? +z6Yq8WI{r_8M%lK?@{uRJ*8bV(rwV?^+S5(8saz4Wa{@(sx!?tewL#bxkvN$jInMZ<~N077QsX0f*s0n@MRO0ggV)O{+MYL52| +zD_Qu^Iq=$v;`lIbEE}^!yO4Pu2NTKNpCM~vyDd#ZW{_f=T68I`1G!n9V|6E;0xWK$ +zMVJJi5@$HHpOZKnrm+wnGJ%P0|5h5YAJ}NwwC8lGJ&%vDG=GT=v(9PE(Uw7P +z0!+ZeJmezUaISwf0TkR2jcE8>$`w#S7f_v0R974kk%QiJp8inpuCXe~j&U$j#DPM; +zvba{UI+?eG*q-}vzr1$h?MM(Ib!)FpJS;+BY&HpTa%DiJgy~x$CJp7`XQi8 +z*lml!5T65{Op0>wuHAP*c>)PwVIyE2gb)~?eZWlbJ!p2-RLHg)RE>m|lR|}Q{=U%0 +zo}D~Q!ZtM}jTp-co>k#HE^0ZnM*G{j*Xs{zpJAwD_6*z5T?7Wi +zypIqyqWoQX1?O<$Oww!WKN@+P0NUjRx;gnk&KISm<5rUiP7k`UFoFey1_>&L +zNQU+thDZTr0|Wso1P~jF*+0)PkEs!3QR2j6R$>H#1kglS1&YtSg;OpOm6~NrtV4vPWlld2Ews(yNbZxe(4nR+$T))-e8N?d$b$9^!ypWdooRD +z6pI1Qs15?;T?5@i>UJA=nyNu0m?ps+lm98_Zo0A+t+e}RpX+!f>G3{Hg^u6fo4LT1 +z4Y{a#T+mMYnY#W{qU{X@B!6T|m%Isc9UEo8>zV^Z9L9?17w>9Ujg30PUkpbf5*il) +z&|Zg>8MV)WoRDJd#ewUABq5SACj~6S38u#ULT-rG&N*DdJ@Hn+EX<9U)cEl5v2mVi +zmqUCjZU-u2d&A^l!nNL>Tjtf +zJkzy;9b{e}lVX%pscpa}CD|T&4_lG8*YS?dpSkncWepv2e&;2HS{*4*!|BT*m2A?f +zyjVW1HUQ(_M3rpp5R3I>q#~s-)|9FwJ%rOTwxl2FMp&4tsCFbTVXO2tVoG)vz`fmN +z)R<$E#pT35KAYbTw|@bcx$u3h{1odhts-|_3YJ4Ayla(y0OOI4`C7W%+BMtMu9DR +zLN@8T_7`usWF{4ezK+d|fuB@k4tw^8R!x#XZ^&}mz29aP_raW@!^P-{vLMa|@PF|S +zhs(}tr|&S{zJE{7YU?ak8oNr`=W`fgsS4~&^0h#~(VJRT +zNzH~lq@$yZ(W^@?`c_n0MVf0+f4^>KZJcWBRpBJ1NoZM-&i&-9Xoe! +zmv9edP|3x)fnY^m)?k@H>w04+$h`_@j98wtxMb_Y2{QVtv2Vhjf7qLrz^P +zzfCU6R%@{mG9Yn6kX(&PQbCcl4jzWK;LKYtF(oh~1_>&LNQUg +zWkVjqlI}v+>hWZNZUj*Kq67$ty|isR%^-9F0tf)%!(&YV + +delta 2792 +zcmV_>MN{htcbO{qC=J&uM?~NGanbgE-J*^bff< +zUL85U4k$LojjclJ{^#hk69ix0P=6p3{W=cW@;J}jXSEPY*K)tO5KXO= +zDp34gOZf$JI>T(od;fQLTl{d}D?LMSYm|boNM-&DpOI*gNxdhZ}bdPsP-V3jIx6 +zS#YC|Y%#Qcz2$cGZXgSwA( +zp^gh0BF&;oP;t5r`vDq}MSpv(oTT?XWo$BF3HTfG#Cm-G$X#COyar;r`l_yWRsuyp +zjrLZxM$trJR(FC|;&F1_fvv +zlT~jFp~Eovc#$rZ%#NJT+P;Ef80Oaf9R{ +zOpW_P@)6@t2VYKWW}3x8$#CYa;%anc&G^~Ur2V-rd#L>n7J)~*jORUD0N#m1LiDFl +zB&?Q*64N(fqjrGx*oF|qZ|R<>da*~kLSkj=XRG<@r3LG9Z`*3FTNX%lmC5B4T~(J> +zFv-n}iKXB3?7ZeYuYc&9GS74XBxDCRdBBF|yIE$fUxbe0K(Obu;3tumH)59PWVH*+ +zz+FmMZ^+~l+V!l1r0ZO}N2<6B_PMH&?VYqs=-LS%mX1X@sp)x{beSD;A)~7{YY~TU-k$-{C;hMVpNq;mVqC$gb{2Xtz#6@FT +z{VWSY?mme#0Q8+1Z2R$5&R0^uNckWNtn&l62raaz_Rv@fJ}H`6N6&t$-qmQZi`0V~WS +z!noU8xPAZ|(OodN!Y_ylW^%s>!I$n`^*O|{`Nql$VSjtzYgo;WtVGwfOGr;9?$|xB +zcs%xxE&&}izyxcgm)2gfVyWCAT`*z4tvURt&T~Yv;4D~@cMQ$sbGeT!7+;p0p5QBw +zMU{9IVf{eaHyT}&Q{kmv1!msC>y;CP;=8GdD!=>6MDu6%gpdLzN`zEs=jdV7SuMgm +zSef9I4u8xGa&@P0{hVpaizD*w9ysr@;s~)?UPY$$=xMStm%-8_cVQq(W*E)bMfTx~ +ztiPTUhk1JJr{K03MHZ?_uNADjS{qhZS>Plq2pIDcZSe +zpdVNTFx+6=J0GuhMj`dM%6hP&L +zNQUr;S>kF`=lUV`cN+L-;%3g5Ai66u6H%n +zyfg~`$Gs>R{QVz)tROl(k}JU-jqD62a~NzC212U{n)$nAgsnGjoPsM7R6NMA=VGH` +z1j%@$TqOIpqreVYF{_P#Ld?sZIQVS;Qh)J`TkyOxjU_HwSFW=@1+yU&O+4(~e1pZW +zdrC+`8zsTaGDfQt#7I&Pa#$O{DyBOl>_Jl1(9c*lL@BH;OO#5bXtm5nX3C~*Pn69s +z(^4r6qXFwhf*ZDy)ZtW;)ENRkjc|#NpZ6iLJ2cnU$Z46(*w{@+^tC{nR=N4%9T-0{S0Vv +zuITX0>W_bbsp#~8>rIdGj%n76kYuf?>yX)bEPeHczbHA2m#H;(n|w!Q4IVX6sU98{ +zOlrpj6Q_77iXS2=oFm3wmI_q=!GG|ZxMyJfm@W36)BqdDmFEysiCoWFs0h{Aeqqmk +z8T93$tHeqtTnPI#ZNj;&P@qq&2+!E8(q%k0HF{#(jwR}m)3Lz()!)7BPi*u-*p#b3 +zrLNe1(4tB%&d^e8d{#t$ImMt?Vq-)VFbRK@T_Yiahm~7)-B&pd8gxPtU4O8w+P>aQ +zP9X72&~lV9$Qpdl3;-#jyHYb%NM)NxL<$lo(9#%8c!mweqK8`i&|Ky0)}^G8PW(W%*6#;qkrM4%*TGa!?K +zU|cE2f76znLD#xzxyn;rmw)6%EH1ek2QS*J((#_RgTyYO#?@-CqoKDk8tM{t+BZ0R +zg9e9H38hKach1c+6Xf9Da}2?$V5Rk*R98)aLVp2^8bXx7{A@Q2pHfZvEV%u|jMOGg +z|5PWJ_$G1qmwVcOOVwerb<|Tx^TT^v%SaCo(O%3gTXbk?e!y16>VF;94g#dwH|PI- +z&D1MMKVRu0{ryL$acyjbc`LtxcnT{VX0HU%g2@&XrH+ZW=-~P-Jc7{3rh)|t*!EFi!P9*YBAtW +zbu`)yVVz9dAb+fy*IJEkVq7w={{*u3gh?3@!K+(YG^T3vjiU}7w=Z08`s6Gaw5p&LNQU^P7i4fG53N5i(Gig<+?Lnz6wQE*r&6Z2;KdIR$HEXY^tyJwjg4on9 +zMJuYqtgX~N&$;(J_uQAi7vJB@&r8m4oG3IN?nn)yLF3`vP&&~_t;i!r5G^PV4~K*C +za9T7TPLqI=2dt3wb?!M|9Ta8@$m(?5~;_Tn(<8A}joBO+BcSlahN)>Sb`>t=)-(^SR2L)txY=xAE~PHoHBCf4M{bH>2S9jw`4h +zp*y-jx&|=Tq_=vX$0AY-B-pr{O3}~!a^QKw^rZP3r!8E~<4%RzRnXkH>9XmKSZbP{ +zaaJ*AU$QA*L~%RS_EQGj1G`WJ7DmgunlvxDG={jJ?-epJse!y@ZR4+bx9Q?#sdYwy +z(7k9q)PNjgxszN|6iPwUknCR*%y^Qb?DE%DYvjQ3 +z;KupDH-(s?Jv+im0i-zOqS_h7X4{%q6B3|6&!@UWm^wW2r4xF|mkdExn4~66{`CzT4_Ik**^1`!x}fTzV|8m{TK6!0MWB(ZeY4tK0dLjcMvPD +z8=e*&*4XH*4v{Q1h2g%3Fjv;yT>}EoVd?9-HI&GSk%Pt~SySOzU&y5j-YW|H(ymTw +z1G_2NB0UR=mJj{oPOpv^O!d8MXu(!8&w(wML`8o+#dIfwKC>RJ9>RAeghupBEai$e +zDAKej36GGn{2TIG%!~-Q_PI^YR3oQST)AK%A#{^(z(2e>rf&a3&by;mOTa8+PRRHa +z-^wA_U+>r+QFr5+>p5s|pY~>EwSm#>qOt)Nqf@6CP_M$KA*G}bcej!gwJ3*zQPO)Q +zcE!oFOtiDpne0?jxphVJByH8c!ib0&g7|*$$1HXsrD_TFzB +zrG_#(dx(zjH@7`{%)6&?2CWGV#oyFiC}F9*)?V`SkA$n6*urPvef#ZVsuY@aE~mwi +zfLZVOxpYs34^{3ih{Iwt3J%MBwsDN@US3n{4IdSbxOu_vBq_M10eI@=J1FX`4=u}h +z7b!WZmn^TKx7NOwvR(EQJ?-AwVb|>(+HxQ(@}fss)htL6&IySIxFV|d4-b9Yvz_(c +zePf1g3;EKwCW`Pgu}r&Nwiw5>4p0$1R|F@Ad*9EUAwqU`H_$DzHS;+yy>Dy~SPv!$ +zmkq}>$Zz^V(#udwpnHpk)p-ziT_zvT@iwpeM(IX2bbCL*f55n1LQdori~D(0GUh8Zi4OfiR-)p|AgM +zGN5_DFy>1zgV-~8AVb3azHBo_up_yK-RX|#8f(whe3lu~8= +z>Rlx#>}5YmM^rEltM^1$Xx)9`wo{qb10o*m>Xy`;bHRtlM} +zZ;NN)^q}BNTvndhQ?@$yS|;Tr^u4BaFvdS%HZ>EM%wHSflx2KCj%7vqE=Pto+rN*9 +z21WA>{xOJ{T7d8o7MV7X>L|Ta>(!)@?25=6nd{r1Bn1O;w^^R6q@iNUl@~<5k`Grt +zt4cy_*okVY%WdtrNQM1KuBWpb4Qesv1*;K^T|9@TnSs3eA(Cz^54=Z((46M|;%oLh +zsGs_@Lgj^K@yCR&!=s>ti(hn0WJ!%oQvB59o(Pc&NTW!ES)k-IY(7i~q|CgZoa^hR +zQpq1!Sdc(15I4h>i5jn(4Ky68x6iUWOuL_jt-H+BCnoZ@!V6GiN0MNg=y}@`g*u-V +zC)cuzj#&nkk&<;b>Wyz$fnuR;6uI%S@#E=E`^qe-8I#gnaKxnOFO0(}fzq(wH~hi+ +zdekEzl#@Io`zB#+ajLT>%~{Ny&d-aFH~-)&gKw0$UWsSsw6{_YrsbR_+(F>MMOwP2 +zv?S-H0J1o)Pna!}jc7d%4wbSOX;bOs>ThE@)4%djgrNvZ>mhajjy`1?f&q|iuLRhg +zehh18kl}yP!G|X@Gm`KYlGDk1(~HZc=c<6J@dww{aY6Qrty97R-B72@4@2yDEvsVN +zO4TxnDDsD0ykJu8oaM>2W3)f`ZQz-jz(%KYh03WnD*OU=$~!l(X{Fk9?CXlr$jMxw +z&4YBg{$w3lr2MG!+jmk%$X#1C8hxEuGbq80I?zu!86*YbN3dx1@2fmAim6hvO+bIU +z#eRn3Ab^rg46S~M7s6vR<;i88WSP<^qe8v(HjtYp^i7<5*IA5%6fE#3@S1XdAl86m +zcpPdhk!Is}%eVyhaMQ}v|MGKVO_?U$M<;JZw1H8T)I+1KkgCQz*|>4xv5+eESa~~w +zV(ssuMzr>CN1hjN$@^xrtY35-fSQH~hi%0jk0IU8KN60+SAoZC8d-GF!Wx7^TelGeO~Jnmk|pA+8J`#v2b8;L#Ri&lNt +zFZi?Wu)s7TQiBF!^rGT_I1$NYEv&1L-zUwHU&}h&7dNZD3|-tI&0n9m0L_9i2rN6l +zDRGS|+@7L67nFoFvS0s#Xsf(p+D2`Yw2hW8Bt2LYgh3cv({3cN6a3b>IXJAc~$ +z04;L?h2;VQ2mpYB1u#k{e>HFuQb-0@)w8+8*DP{D$KG=;=xRl2uvKUP-SRRE%$NKP +z_D;2NCAhd^?|QhcbJ5E7c`-26TMzdlG-H?6^IBeoE0#e|QM2rw&&DIM3C+3&2a0ll +zpPL`9ji3aw?(A~Q_bH5QAB`HfT~I=G`cK>^k-~8=RAs!fh8npjTx1 +zio`$Z>ZF=$DSVbD4xi;!NC!?`eIqFD35= +zQc_8A~;(#IIWCvOKf`P&2)Js($WT +z1z-??Ow@SVupz2ChgP2^Y=0o#*~e?*$0TAcDclj?IADVt8o^gntLJZBu=o +zlRp{i%IZDaPfUE-$LP%)Ua~T(Bdt0G=DGbexi&hghHP;^^f<}zRlnJ3GgV60GtOPk +zcib>&Ab~e+Z6==732Fcs!<-3gh>(3UIWk_h>u`vv-;vJvM|KhjTN9G*@n5_xbZnmMK +zlqp0G!V*18sL0-95F*8PQnOybN@p#c%kb*&^aa55JSKbSAd@qO=Ht +z422L +zEQT%EbQpx1)#*Gv)47 +z!L`_0ZJB+>X&W4?m4Xpk&GUR45OCpS-Ac@br?bG$K5WOH27l@cvz6M|^4ikdCcj~? +z@A&ePKz3o=>_;pjNUjLI{a*i~A2Cm`&wy=Wnk}HZ!)%{@qd4Cdgv0g1#?}yCqq93|4$^$^+_&k +zJa~z}zH{53ynke+y3lMnjQq2xp0Aelu-HmWXLFfn2Zo%7n87xsG^uG}b2CZ*u1s9Z +zdy6l*(2{|l#uH(Fg~MQyrygWvH^>pmCkM|1n_(Oa%d6l_c*y)EJe|rcT48Q$4-q9{ +zd;$`4t5f-+&fM5}8vs44&d`E*VzZ!Kx~GhFv9KFoMt^WQmMpIlho1dt%_BO(+`2Lp +zatNwfJ+p4vZMjP*m8(};v7%^J>Z;rDPy{%kK4LhfuLy_D30LYt***zyVP-NnNeD<@ +zGY~g=yXsBrn_X=!tmk!)LM6?HS%;t(HMJ%Q_8-enJgcrn_sO6=M%6GmrDCuouDW~1p-LREA&0BHSeEKQnj3ME3_){Ru4kMWs9nx6eJ4`1vHrOoBO6WNZGR{?^ +zEfRoM=%swpDejYTaEFI0cJp^Ht@L%c+@lQy^nXs75zrK4$%sP!y)m<*xW9H%@fLjRzS +zFoFd+1_>&LNQUeJ7Gnm8p68cPkyaMp;ydm +z;5`lZ-8TBOTClg{8b2gEfR$AC$(l*<$HmjXkv +zk2XU*+fTwXqcsMYaZ3q-p;PK((PrSVUOgD!_f+ +zxEwhbf?;sTV9;{2qj=e+thVm4&q+rqRZvI3E$OXDELB<0qt8X4|WJgR& +zA;mly>0fgus?*HuYZkDa8&PzLYY`{)VN|6AD5DVz9hPB0H|cXeKd~iK$$60*1@6KW +z6781`Wt^~gq(V@LHV`!^8UF^$=qzP9Z~St~brXD2cffcLQ)%SW+3k{*m46rbsM@(z +zVmdvB5fH3}m=m^afNN7hu#6Tv465|&pl|0QVo8cOgDzsf96G6OAIc1>JH)_kiJ%CKS4>>XVItK +z0df&%Ir0A#%dzm{a-{xL-+y}K1k-jf%0*=Wi*tj00J0}10?%6)ypUZJ9ksJA^uCwA +zU5oo_6hE*n7H%zwo}j{S>kkC#VGo5P%uaH-y; +z9xeJ!zLp4E-us08h0F``IjL9Q%D-E<6S*Z@f^7;~n+PU-j1vc-W`Anul8%C=xSb5u +z7r0>5j^Of_V(=`5Jkb~jw{)rQzSz?lmA1B5fIF^AldA0&srn(q6$tx(<>kN35n4cE +z?Y`#QJY`_$YGKyHz0lTxyY@^*MkI>@K_P<$huaWnmtRl$s=QCNW>Q)%O~1b7x8OZa>s!LI}xafM3IiiEeV1X6v0v^m&_bRB7S;B9{kMdqBpB#o;WHIcK +zXZti{8yqh{hTB(4Q&s{4ZNd91F&>cQH%{n1i;7|BuXezD%73Buu9D%H$?>u=EQI*3@^(1e84N*6QZYbr+~cRYKueVXW#rd?}8~s6XVg0MS^}l +z>j!&zJjkZ0C0Bijh>6a2w@ocN@A@brXHXZn+AJ3kASY`zaQm-BZ>L{LVlV^$8R&lo +z$7k~Gs8nAN#(&H;;d!1sK~d&LNQUXqJJ21=NG&!mOU3kJ +zFflM8FbM_)D-Ht!8U+9Z6sSLOY_+{}*ZArxG2W!WZkmtKW&{Xzdz-Lrn>2+20tf&? +Cp*q$8 + +diff --git a/src/tests/pkinit-certs/user.pem b/src/tests/pkinit-certs/user.pem +index 182ea599ac..7493de52c1 100644 +--- a/src/tests/pkinit-certs/user.pem ++++ b/src/tests/pkinit-certs/user.pem +@@ -3,26 +3,26 @@ MIIE0zCCA7ugAwIBAgIBAzANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx + FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG + A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz + dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug +-b3RoZXJ3aXNlMB4XDTIxMTAwODIxMTEzMFoXDTMyMDkyMDIxMTEzMFowSjELMAkG ++b3RoZXJ3aXNlMB4XDTI0MDIxNTA0NTkwN1oXDTM1MDEyODA0NTkwN1owSjELMAkG + A1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxFDASBgNVBAoMC0tSQlRF + U1QuQ09NMQ0wCwYDVQQDDAR1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB +-CgKCAQEAz6VXmJpVq2zTIEU3gUF7pui+Wg17d3QX2oy6EqqUQK/pwWtrvmBIaYcn +-Pq0ZMrzMhNTuyeLjb1rNNkL0hCdS3/aVbx1bOlkPVPlW3UNi9gWpXOOE1/N4QMrz +-yKAQ1/Npf9xjY/vpqsmvRx7AZpq7Nq7HyF5hbUKMHFaaTqRarhoP7mOCByG8F44Y +-QTY2RXcw9te63x+77c3O64gbtnSKXBC/4pS9DxBBv1ULB2wOH8RGxDiWgL0/iO25 +-YImKQgTvwbENw4ygLV+0m1b+YEJLaIIeKleunYEMMkzIfFmMemXRWgNHuShYa0Pe +-yiwTBSRdW9Yi4qzjfaHZ1dD67wdoGwIDAQABo4IBZDCCAWAwHQYDVR0OBBYEFPQX +-pfvVBF+0OJJ41JjduSzecrQjMIHUBgNVHSMEgcwwgcmAFPQXpfvVBF+0OJJ41Jjd +-uSzecrQjoYGtpIGqMIGnMQswCQYDVQQGEwJVUzEWMBQGA1UECAwNTWFzc2FjaHVz ++CgKCAQEAm/1JtzZBJsdadmOTnkl94508ZSyYo5xP83sLT/SY5Cri1QKaFrue2kGg ++gl1QEOExBrIbdAeu5BftqiC07HyGgugtRo0qDHMRnQ4tsNExzYz69MOkFE4hMYjU ++o+9C22GVLihyoq+oELN7ro30u5/MCO7rULIp0HekLKQ+uANVVJx+xnW3bMJsrRIX ++Zx9kB0jIIugYt5D3n80vdIjHQJf2BTjsBWYGRJD4sTElGFtRIiD6m4puonRdUgtH ++UHZ7OCKTY5sU0PSGxFRLi/ykqcgPPQddHYCd5MRJj5q2NvPN6UYDbMfzqni0uDQ9 ++qdDjHj6CmRCHNKvkKaLdBfhdqFKuZQIDAQABo4IBZDCCAWAwHQYDVR0OBBYEFJI/ +++nOV5fnNVxn2GkjkYbZ5D6mqMIHUBgNVHSMEgcwwgcmAFJI/+nOV5fnNVxn2Gkjk ++YbZ5D6mqoYGtpIGqMIGnMQswCQYDVQQGEwJVUzEWMBQGA1UECAwNTWFzc2FjaHVz + ZXR0czESMBAGA1UEBwwJQ2FtYnJpZGdlMQwwCgYDVQQKDANNSVQxKTAnBgNVBAsM + IEluc2VjdXJlIFBLSU5JVCBLZXJiZXJvcyB0ZXN0IENBMTMwMQYDVQQDDCpwa2lu + aXQgdGVzdCBzdWl0ZSBDQTsgZG8gbm90IHVzZSBvdGhlcndpc2WCAQEwCwYDVR0P + BAQDAgPoMAwGA1UdEwEB/wQCMAAwOQYDVR0RBDIwMKAuBgYrBgEFAgKgJDAioA0b + C0tSQlRFU1QuQ09NoREwD6ADAgEBoQgwBhsEdXNlcjASBgNVHSUECzAJBgcrBgEF +-AgMEMA0GCSqGSIb3DQEBCwUAA4IBAQAOBeCDK6Eg6Cu8TZ7xeAw2AbTpaW04nNSV +-Fmm0aIskMgLl2a5KEmalG7rnArRXv5IZVYFjJ6X0MzjOx+BgaGUCvN8jz1fuO3Hp +-iGhxPDzKjFMWJeY/z5bQRueSI6RCC8DzH8iPdlPUQ8ZhnukhY1Vt47wqraf197uT +-0XP21qQr1uRY+ZcLSBKZuKe9ZP3ijh57MOLvYDdAFxVp77JLznpk+oU18ujAtYgZ +-7naIGYtSQRkIi970jk82hSpc9B/KN8UcDuo+DQHWPQaDf39s30qoxooZBoue5ipp +-LQHuVaX5Hoi83cWbsVluce/JsW8GfbuC8+8CosAmzJly183f8++9 ++AgMEMA0GCSqGSIb3DQEBCwUAA4IBAQBRWsxPb9miF9xf8rEIfVko0qBy8doEJsPE ++IVD9Jz/Ml/TBZRLbi1b94l15Fto/Z6XKf8jrnBs4krf6tU2D5PUZXZYZ6tr/2kkY ++IpmoOkEoQX8gtcZfaq2OJzsKHnAJT159EVydyYahHU66i4aNvho74oAafrVTyk8B ++PHCHFs0MUct8DoNwrbnfH0cjqEdVOmjjvBN0yA+RxOa543XnQqkSmCuIJKoD6pUa ++07rE372iERgIjDnzCogiEo9cCBBqDfgsbr0ah1QbWJTJvnsFuxT43tBNurRjNPoX ++Jj6xAzhQLCuvqtKtWlAUOHut18YbVGXVT+3tm7+C6iA44JvMl9m1 + -----END CERTIFICATE----- +diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py +index 4435746429..91d4630a0a 100755 +--- a/src/tests/t_pkinit.py ++++ b/src/tests/t_pkinit.py +@@ -7,8 +7,10 @@ if not pkinit_enabled: + + # Construct a krb5.conf fragment configuring pkinit. + user_pem = os.path.join(pkinit_certs, 'user.pem') ++ecuser_pem = os.path.join(pkinit_certs, 'ecuser.pem') + privkey_pem = os.path.join(pkinit_certs, 'privkey.pem') + privkey_enc_pem = os.path.join(pkinit_certs, 'privkey-enc.pem') ++privkey_ec_pem = os.path.join(pkinit_certs, 'eckey.pem') + user_p12 = os.path.join(pkinit_certs, 'user.p12') + user_enc_p12 = os.path.join(pkinit_certs, 'user-enc.p12') + user_upn_p12 = os.path.join(pkinit_certs, 'user-upn.p12') +@@ -42,6 +44,7 @@ alias_kdc_conf = {'realms': {'$realm': { + + file_identity = 'FILE:%s,%s' % (user_pem, privkey_pem) + file_enc_identity = 'FILE:%s,%s' % (user_pem, privkey_enc_pem) ++ec_identity = 'FILE:%s,%s' % (ecuser_pem, privkey_ec_pem) + dir_identity = 'DIR:%s' % path + dir_enc_identity = 'DIR:%s' % path_enc + dir_file_identity = 'FILE:%s,%s' % (os.path.join(path, 'user.crt'), +@@ -177,6 +180,11 @@ for g in ('4096', 'P-256', 'P-384', 'P-521'): + realm.pkinit(realm.user_princ, expected_trace=('PKINIT using ' + g,), + env=group_env) + ++# Test with an EC client cert. ++mark('EC client cert') ++realm.kinit(realm.user_princ, ++ flags=['-X', 'X509_user_identity=%s' % ec_identity]) ++ + # Try using multiple configured pkinit_identities, to make sure we + # fall back to the second one when the first one cannot be read. + id_conf = {'realms': {'$realm': {'pkinit_identities': [file_identity + 'X', +@@ -446,4 +454,16 @@ realm.run(['./responder', '-X', p11_attr, + realm.klist(realm.user_princ) + realm.run([kvno, realm.host_princ]) + ++mark('PKCS11 identity, EC client cert') ++shutil.rmtree(softhsm2_tokens) ++os.mkdir(softhsm2_tokens) ++realm.run(tool_cmd + ['--init-token', '--label', 'user', ++ '--so-pin', 'sopin', '--init-pin', '--pin', 'userpin']) ++realm.run(tool_cmd + ['-w', ecuser_pem, '-y', 'cert']) ++realm.run(tool_cmd + ['-w', privkey_ec_pem, '-y', 'privkey', ++ '-l', '--pin', 'userpin']) ++realm.kinit(realm.user_princ, flags=['-X', p11_attr], password='userpin') ++realm.klist(realm.user_princ) ++realm.run([kvno, realm.host_princ]) ++ + success('PKINIT tests') +-- +2.47.1 + diff --git a/0032-Improve-PKCS11-error-reporting-in-PKINIT.patch b/0032-Improve-PKCS11-error-reporting-in-PKINIT.patch new file mode 100644 index 0000000..b529921 --- /dev/null +++ b/0032-Improve-PKCS11-error-reporting-in-PKINIT.patch @@ -0,0 +1,599 @@ +From e43c05e7b0b93401dd68fc3ec3186c3a455b04ea Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Fri, 23 Feb 2024 13:51:26 -0500 +Subject: [PATCH] Improve PKCS11 error reporting in PKINIT + +Create a helper p11err() to set extended error message for failed +PKCS11 operations, and use it instead of pkiDebug() and pkcs11error(). + +ticket: 9113 (new) +(cherry picked from commit 98afb314d13939cbee19c69885dcb655db8460da) +--- + .../preauth/pkinit/pkinit_crypto_openssl.c | 262 ++++++++++-------- + src/plugins/preauth/pkinit/pkinit_trace.h | 9 - + 2 files changed, 142 insertions(+), 129 deletions(-) + +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index 4accfc2664..402bf1b9b3 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -161,9 +161,11 @@ static krb5_error_code pkinit_create_sequence_of_principal_identifiers + int type, krb5_pa_data ***e_data_out); + + #ifndef WITHOUT_PKCS11 +-static krb5_error_code pkinit_find_private_key +-(pkinit_identity_crypto_context, CK_ATTRIBUTE_TYPE usage, +- CK_OBJECT_HANDLE *objp); ++static krb5_error_code ++pkinit_find_private_key(krb5_context context, ++ pkinit_identity_crypto_context id_cryptoctx, ++ CK_ATTRIBUTE_TYPE usage, ++ CK_OBJECT_HANDLE *objp); + static krb5_error_code pkinit_login + (krb5_context context, pkinit_identity_crypto_context id_cryptoctx, + CK_TOKEN_INFO *tip, const char *password); +@@ -180,6 +182,8 @@ static krb5_error_code pkinit_sign_data_pkcs11 + (krb5_context context, pkinit_identity_crypto_context id_cryptoctx, + unsigned char *data, unsigned int data_len, + unsigned char **sig, unsigned int *sig_len); ++ ++static krb5_error_code p11err(krb5_context context, CK_RV rv, const char *op); + #endif /* WITHOUT_PKCS11 */ + + static krb5_error_code pkinit_sign_data_fs +@@ -197,9 +201,6 @@ create_krb5_invalidCertificates(krb5_context context, + static krb5_error_code + create_identifiers_from_stack(STACK_OF(X509) *sk, + krb5_external_principal_identifier *** ids); +-static const char * +-pkcs11err(int err); +- + + #if OPENSSL_VERSION_NUMBER < 0x10100000L + +@@ -944,8 +945,9 @@ cleanup: + + #endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ + ++#ifndef WITHOUT_PKC11 + static struct pkcs11_errstrings { +- short code; ++ CK_RV code; + char *text; + } pkcs11_errstrings[] = { + { 0x0, "ok" }, +@@ -1035,6 +1037,7 @@ static struct pkcs11_errstrings { + { 0x200, "function rejected" }, + { -1, NULL } + }; ++#endif + + MAKE_INIT_FUNCTION(pkinit_openssl_init); + +@@ -1563,6 +1566,8 @@ pkinit_fini_pkcs11(pkinit_identity_crypto_context ctx) + free(ctx->token_label); + free(ctx->cert_id); + free(ctx->cert_label); ++ ctx->p11_module_name = ctx->token_label = ctx->cert_label = NULL; ++ ctx->cert_id = NULL; + #endif + } + +@@ -3344,48 +3349,53 @@ pkinit_pkcs7type2oid(pkinit_plg_crypto_context cryptoctx, int pkcs7_type) + } + + #ifndef WITHOUT_PKCS11 +-static struct plugin_file_handle * ++static krb5_error_code + load_pkcs11_module(krb5_context context, const char *modname, +- CK_FUNCTION_LIST_PTR_PTR p11p) ++ struct plugin_file_handle **handle_out, ++ CK_FUNCTION_LIST_PTR_PTR p11_out) + { + struct plugin_file_handle *handle = NULL; +- CK_RV (*getflist)(CK_FUNCTION_LIST_PTR_PTR); ++ CK_RV rv, (*getflist)(CK_FUNCTION_LIST_PTR_PTR); + struct errinfo einfo = EMPTY_ERRINFO; +- const char *errmsg = NULL; ++ const char *errmsg = NULL, *failure; + void (*sym)(void); + long err; +- CK_RV rv; + + TRACE_PKINIT_PKCS11_OPEN(context, modname); + err = krb5int_open_plugin(modname, &handle, &einfo); + if (err) { +- errmsg = k5_get_error(&einfo, err); +- TRACE_PKINIT_PKCS11_OPEN_FAILED(context, errmsg); ++ failure = _("Cannot load PKCS11 module"); + goto error; + } + + err = krb5int_get_plugin_func(handle, "C_GetFunctionList", &sym, &einfo); + if (err) { +- errmsg = k5_get_error(&einfo, err); +- TRACE_PKINIT_PKCS11_GETSYM_FAILED(context, errmsg); ++ failure = _("Cannot find C_GetFunctionList in PKCS11 module"); + goto error; + } + + getflist = (CK_RV (*)(CK_FUNCTION_LIST_PTR_PTR))sym; +- rv = (*getflist)(p11p); ++ rv = (*getflist)(p11_out); + if (rv != CKR_OK) { +- TRACE_PKINIT_PKCS11_GETFLIST_FAILED(context, pkcs11err(rv)); ++ failure = _("Cannot retrieve function list in PKCS11 module"); + goto error; + } + +- return handle; ++ *handle_out = handle; ++ return 0; + + error: +- k5_free_error(&einfo, errmsg); ++ if (err) { ++ errmsg = k5_get_error(&einfo, err); ++ k5_setmsg(context, err, _("%s: %s"), failure, errmsg); ++ } else { ++ err = KRB5KDC_ERR_PREAUTH_FAILED; ++ k5_setmsg(context, err, "%s", failure); ++ } + k5_clear_error(&einfo); + if (handle != NULL) + krb5int_close_plugin(handle); +- return NULL; ++ return err; + } + + static krb5_error_code +@@ -3393,12 +3403,13 @@ pkinit_login(krb5_context context, + pkinit_identity_crypto_context id_cryptoctx, + CK_TOKEN_INFO *tip, const char *password) + { ++ krb5_error_code ret = 0; ++ CK_RV rv; + krb5_data rdat; + char *prompt; + const char *warning; + krb5_prompt kprompt; + krb5_prompt_type prompt_type; +- int r = 0; + + if (tip->flags & CKF_PROTECTED_AUTHENTICATION_PATH) { + rdat.data = NULL; +@@ -3407,7 +3418,7 @@ pkinit_login(krb5_context context, + rdat.data = strdup(password); + rdat.length = strlen(password); + } else if (id_cryptoctx->prompter == NULL) { +- r = KRB5_LIBOS_CANTREADPWD; ++ ret = KRB5_LIBOS_CANTREADPWD; + rdat.data = NULL; + } else { + if (tip->flags & CKF_USER_PIN_LOCKED) +@@ -3431,31 +3442,28 @@ pkinit_login(krb5_context context, + + /* PROMPTER_INVOCATION */ + k5int_set_prompt_types(context, &prompt_type); +- r = (*id_cryptoctx->prompter)(context, id_cryptoctx->prompter_data, +- NULL, NULL, 1, &kprompt); ++ ret = (*id_cryptoctx->prompter)(context, id_cryptoctx->prompter_data, ++ NULL, NULL, 1, &kprompt); + k5int_set_prompt_types(context, 0); + free(prompt); + } + +- if (r == 0) { +- r = id_cryptoctx->p11->C_Login(id_cryptoctx->session, CKU_USER, +- (u_char *) rdat.data, rdat.length); +- +- if (r != CKR_OK) { +- TRACE_PKINIT_PKCS11_LOGIN_FAILED(context, pkcs11err(r)); +- r = KRB5KDC_ERR_PREAUTH_FAILED; +- } ++ if (!ret) { ++ rv = id_cryptoctx->p11->C_Login(id_cryptoctx->session, CKU_USER, ++ (uint8_t *)rdat.data, rdat.length); ++ if (rv != CKR_OK) ++ ret = p11err(context, rv, "C_Login"); + } + free(rdat.data); + +- return r; ++ return ret; + } + + static krb5_error_code + pkinit_open_session(krb5_context context, + pkinit_identity_crypto_context cctx) + { +- CK_ULONG i, pret; ++ CK_ULONG i, rv; + unsigned char *cp; + size_t label_len; + CK_ULONG count = 0; +@@ -3469,30 +3477,35 @@ pkinit_open_session(krb5_context context, + return 0; /* session already open */ + + /* Load module */ +- cctx->p11_module = load_pkcs11_module(context, cctx->p11_module_name, +- &cctx->p11); +- if (cctx->p11_module == NULL) +- return KRB5KDC_ERR_PREAUTH_FAILED; ++ ret = load_pkcs11_module(context, cctx->p11_module_name, &cctx->p11_module, ++ &cctx->p11); ++ if (ret) ++ goto cleanup; + + /* Init */ +- pret = cctx->p11->C_Initialize(NULL); +- if (pret != CKR_OK) { +- pkiDebug("C_Initialize: %s\n", pkcs11err(pret)); +- return KRB5KDC_ERR_PREAUTH_FAILED; ++ rv = cctx->p11->C_Initialize(NULL); ++ if (rv != CKR_OK) { ++ ret = p11err(context, rv, "C_Initialize"); ++ goto cleanup; + } + + /* Get the list of available slots */ +- if (cctx->p11->C_GetSlotList(TRUE, NULL, &count) != CKR_OK) +- return KRB5KDC_ERR_PREAUTH_FAILED; ++ rv = cctx->p11->C_GetSlotList(TRUE, NULL, &count); ++ if (rv != CKR_OK) { ++ ret = p11err(context, rv, "C_GetSlotList"); ++ goto cleanup; ++ } + if (count == 0) { + TRACE_PKINIT_PKCS11_NO_TOKEN(context); +- return KRB5KDC_ERR_PREAUTH_FAILED; ++ ret = KRB5KDC_ERR_PREAUTH_FAILED; ++ goto cleanup; + } +- slotlist = calloc(count, sizeof(CK_SLOT_ID)); ++ slotlist = k5calloc(count, sizeof(CK_SLOT_ID), &ret); + if (slotlist == NULL) +- return ENOMEM; +- if (cctx->p11->C_GetSlotList(TRUE, slotlist, &count) != CKR_OK) { +- ret = KRB5KDC_ERR_PREAUTH_FAILED; ++ goto cleanup; ++ rv = cctx->p11->C_GetSlotList(TRUE, slotlist, &count); ++ if (rv != CKR_OK) { ++ ret = p11err(context, rv, "C_GetSlotList"); + goto cleanup; + } + +@@ -3503,19 +3516,17 @@ pkinit_open_session(krb5_context context, + continue; + + /* Open session */ +- pret = cctx->p11->C_OpenSession(slotlist[i], CKF_SERIAL_SESSION, +- NULL, NULL, &cctx->session); +- if (pret != CKR_OK) { +- pkiDebug("C_OpenSession: %s\n", pkcs11err(pret)); +- ret = KRB5KDC_ERR_PREAUTH_FAILED; ++ rv = cctx->p11->C_OpenSession(slotlist[i], CKF_SERIAL_SESSION, ++ NULL, NULL, &cctx->session); ++ if (rv != CKR_OK) { ++ ret = p11err(context, rv, "C_OpenSession"); + goto cleanup; + } + + /* Get token info */ +- pret = cctx->p11->C_GetTokenInfo(slotlist[i], &tinfo); +- if (pret != CKR_OK) { +- pkiDebug("C_GetTokenInfo: %s\n", pkcs11err(pret)); +- ret = KRB5KDC_ERR_PREAUTH_FAILED; ++ rv = cctx->p11->C_GetTokenInfo(slotlist[i], &tinfo); ++ if (rv != CKR_OK) { ++ ret = p11err(context, rv, "C_GetTokenInfo"); + goto cleanup; + } + +@@ -3577,6 +3588,10 @@ pkinit_open_session(krb5_context context, + + ret = 0; + cleanup: ++ /* On error, finalize the PKCS11 fields to ensure that we don't mistakenly ++ * short-circuit with success on the next call. */ ++ if (ret) ++ pkinit_fini_pkcs11(cctx); + free(slotlist); + free(p11name); + return ret; +@@ -3598,16 +3613,17 @@ cleanup: + * If there are more than one, we just take the first one. + */ + +-krb5_error_code +-pkinit_find_private_key(pkinit_identity_crypto_context id_cryptoctx, ++static krb5_error_code ++pkinit_find_private_key(krb5_context context, ++ pkinit_identity_crypto_context id_cryptoctx, + CK_ATTRIBUTE_TYPE usage, + CK_OBJECT_HANDLE *objp) + { + CK_OBJECT_CLASS cls; + CK_ATTRIBUTE attrs[4]; + CK_ULONG count; ++ CK_RV rv; + unsigned int nattrs = 0; +- int r; + #ifdef PKINIT_USE_KEY_USAGE + CK_BBOOL true_false; + #endif +@@ -3637,18 +3653,21 @@ pkinit_find_private_key(pkinit_identity_crypto_context id_cryptoctx, + attrs[nattrs].ulValueLen = id_cryptoctx->cert_id_len; + nattrs++; + +- r = id_cryptoctx->p11->C_FindObjectsInit(id_cryptoctx->session, attrs, nattrs); +- if (r != CKR_OK) { +- pkiDebug("krb5_pkinit_sign_data: C_FindObjectsInit: %s\n", +- pkcs11err(r)); +- return KRB5KDC_ERR_PREAUTH_FAILED; +- } ++ rv = id_cryptoctx->p11->C_FindObjectsInit(id_cryptoctx->session, attrs, ++ nattrs); ++ if (rv != CKR_OK) ++ return p11err(context, rv, _("C_FindObjectsInit")); + +- r = id_cryptoctx->p11->C_FindObjects(id_cryptoctx->session, objp, 1, &count); ++ rv = id_cryptoctx->p11->C_FindObjects(id_cryptoctx->session, objp, 1, ++ &count); + id_cryptoctx->p11->C_FindObjectsFinal(id_cryptoctx->session); +- pkiDebug("found %d private keys (%s)\n", (int)count, pkcs11err(r)); +- if (r != CKR_OK || count < 1) ++ if (rv != CKR_OK) ++ return p11err(context, rv, _("C_FindObjects")); ++ if (count < 1) { ++ k5_setmsg(context, KRB5KDC_ERR_PREAUTH_FAILED, ++ _("Found no private keys in PKCS11 token")); + return KRB5KDC_ERR_PREAUTH_FAILED; ++ } + return 0; + } + #endif +@@ -3796,34 +3815,32 @@ pkinit_sign_data_pkcs11(krb5_context context, + CK_FUNCTION_LIST_PTR p11; + CK_ATTRIBUTE attr; + CK_KEY_TYPE keytype; ++ CK_RV rv; + EVP_MD_CTX *ctx; + const EVP_MD *md = EVP_sha256(); + unsigned int mdlen; + uint8_t mdbuf[EVP_MAX_MD_SIZE], *dinfo = NULL, *sigbuf = NULL, *input; + size_t dinfo_len, input_len; +- int r; + + *sig = NULL; + *sig_len = 0; + +- if (pkinit_open_session(context, id_cryptoctx)) { +- pkiDebug("can't open pkcs11 session\n"); +- return KRB5KDC_ERR_PREAUTH_FAILED; +- } ++ ret = pkinit_open_session(context, id_cryptoctx); ++ if (ret) ++ return ret; + p11 = id_cryptoctx->p11; + session = id_cryptoctx->session; + +- ret = pkinit_find_private_key(id_cryptoctx, CKA_SIGN, &obj); ++ ret = pkinit_find_private_key(context, id_cryptoctx, CKA_SIGN, &obj); + if (ret) + return ret; + + attr.type = CKA_KEY_TYPE; + attr.pValue = &keytype; + attr.ulValueLen = sizeof(keytype); +- r = p11->C_GetAttributeValue(session, obj, &attr, 1); +- if (r) { +- pkiDebug("C_GetAttributeValue: %s\n", pkcs11err(r)); +- ret = KRB5KDC_ERR_PREAUTH_FAILED; ++ rv = p11->C_GetAttributeValue(session, obj, &attr, 1); ++ if (rv != CKR_OK) { ++ ret = p11err(context, rv, "C_GetAttributeValue"); + goto cleanup; + } + +@@ -3865,10 +3882,9 @@ pkinit_sign_data_pkcs11(krb5_context context, + mech.pParameter = NULL; + mech.ulParameterLen = 0; + +- r = p11->C_SignInit(session, &mech, obj); +- if (r != CKR_OK) { +- pkiDebug("C_SignInit: %s\n", pkcs11err(r)); +- ret = KRB5KDC_ERR_PREAUTH_FAILED; ++ rv = p11->C_SignInit(session, &mech, obj); ++ if (rv != CKR_OK) { ++ ret = p11err(context, rv, "C_SignInit"); + goto cleanup; + } + +@@ -3881,18 +3897,17 @@ pkinit_sign_data_pkcs11(krb5_context context, + if (sigbuf == NULL) + goto cleanup; + +- r = p11->C_Sign(session, input, input_len, sigbuf, &len); +- if (r == CKR_BUFFER_TOO_SMALL || (r == CKR_OK && len >= PK_SIGLEN_GUESS)) { ++ rv = p11->C_Sign(session, input, input_len, sigbuf, &len); ++ if (rv == CKR_BUFFER_TOO_SMALL || ++ (rv == CKR_OK && len >= PK_SIGLEN_GUESS)) { + free(sigbuf); +- pkiDebug("C_Sign realloc %d\n", (int) len); + sigbuf = k5alloc(len, &ret); + if (sigbuf == NULL) + goto cleanup; +- r = p11->C_Sign(session, input, input_len, sigbuf, &len); ++ rv = p11->C_Sign(session, input, input_len, sigbuf, &len); + } +- if (r != CKR_OK) { +- pkiDebug("C_Sign: %s\n", pkcs11err(r)); +- ret = KRB5KDC_ERR_PREAUTH_FAILED; ++ if (rv != CKR_OK) { ++ ret = p11err(context, rv, "C_Sign"); + goto cleanup; + } + +@@ -4348,13 +4363,14 @@ reassemble_pkcs11_name(pkinit_identity_opts *idopts) + } + + static krb5_error_code +-load_one_cert(CK_FUNCTION_LIST_PTR p11, CK_SESSION_HANDLE session, +- pkinit_identity_opts *idopts, pkinit_cred_info *cred_out) ++load_one_cert(krb5_context context, CK_FUNCTION_LIST_PTR p11, ++ CK_SESSION_HANDLE session, pkinit_identity_opts *idopts, ++ pkinit_cred_info *cred_out) + { + krb5_error_code ret; + CK_ATTRIBUTE attrs[2]; + CK_BYTE_PTR cert = NULL, cert_id = NULL; +- CK_RV pret; ++ CK_RV rv; + const unsigned char *cp; + CK_OBJECT_HANDLE obj; + CK_ULONG count; +@@ -4364,8 +4380,8 @@ load_one_cert(CK_FUNCTION_LIST_PTR p11, CK_SESSION_HANDLE session, + *cred_out = NULL; + + /* Look for X.509 cert. */ +- pret = p11->C_FindObjects(session, &obj, 1, &count); +- if (pret != CKR_OK || count <= 0) ++ rv = p11->C_FindObjects(session, &obj, 1, &count); ++ if (rv != CKR_OK || count <= 0) + return 0; + + /* Get cert and id len. */ +@@ -4375,10 +4391,9 @@ load_one_cert(CK_FUNCTION_LIST_PTR p11, CK_SESSION_HANDLE session, + attrs[1].type = CKA_ID; + attrs[1].pValue = NULL; + attrs[1].ulValueLen = 0; +- pret = p11->C_GetAttributeValue(session, obj, attrs, 2); +- if (pret != CKR_OK && pret != CKR_BUFFER_TOO_SMALL) { +- pkiDebug("C_GetAttributeValue: %s\n", pkcs11err(pret)); +- ret = KRB5KDC_ERR_PREAUTH_FAILED; ++ rv = p11->C_GetAttributeValue(session, obj, attrs, 2); ++ if (rv != CKR_OK && rv != CKR_BUFFER_TOO_SMALL) { ++ ret = p11err(context, rv, "C_GetAttributeValue"); + goto cleanup; + } + +@@ -4393,10 +4408,9 @@ load_one_cert(CK_FUNCTION_LIST_PTR p11, CK_SESSION_HANDLE session, + attrs[0].pValue = cert; + attrs[1].type = CKA_ID; + attrs[1].pValue = cert_id; +- pret = p11->C_GetAttributeValue(session, obj, attrs, 2); +- if (pret != CKR_OK) { +- pkiDebug("C_GetAttributeValue: %s\n", pkcs11err(pret)); +- ret = KRB5KDC_ERR_PREAUTH_FAILED; ++ rv = p11->C_GetAttributeValue(session, obj, attrs, 2); ++ if (rv != CKR_OK) { ++ ret = p11err(context, rv, "C_GetAttributeValue"); + goto cleanup; + } + +@@ -4406,7 +4420,8 @@ load_one_cert(CK_FUNCTION_LIST_PTR p11, CK_SESSION_HANDLE session, + cp = (unsigned char *)cert; + x = d2i_X509(NULL, &cp, (int)attrs[0].ulValueLen); + if (x == NULL) { +- ret = KRB5KDC_ERR_PREAUTH_FAILED; ++ ret = oerr(context, 0, ++ _("Failed to decode X509 certificate from PKCS11 token")); + goto cleanup; + } + +@@ -4444,7 +4459,7 @@ pkinit_get_certs_pkcs11(krb5_context context, + int i; + unsigned int nattrs; + krb5_error_code ret; +- CK_RV pret; ++ CK_RV rv; + + /* Copy stuff from idopts -> id_cryptoctx */ + if (idopts->p11_module_name != NULL) { +@@ -4516,16 +4531,16 @@ pkinit_get_certs_pkcs11(krb5_context context, + nattrs++; + } + +- pret = id_cryptoctx->p11->C_FindObjectsInit(id_cryptoctx->session, attrs, +- nattrs); +- if (pret != CKR_OK) { +- pkiDebug("C_FindObjectsInit: %s\n", pkcs11err(pret)); ++ rv = id_cryptoctx->p11->C_FindObjectsInit(id_cryptoctx->session, attrs, ++ nattrs); ++ if (rv != CKR_OK) { ++ ret = p11err(context, rv, "C_FindObjectsInit"); + return KRB5KDC_ERR_PREAUTH_FAILED; + } + + for (i = 0; i < MAX_CREDS_ALLOWED; i++) { +- ret = load_one_cert(id_cryptoctx->p11, id_cryptoctx->session, idopts, +- &id_cryptoctx->creds[i]); ++ ret = load_one_cert(context, id_cryptoctx->p11, id_cryptoctx->session, ++ idopts, &id_cryptoctx->creds[i]); + if (ret) + return ret; + if (id_cryptoctx->creds[i] == NULL) +@@ -5510,19 +5525,26 @@ print_pubkey(BIGNUM * key, char *msg) + } + #endif + +-static const char * +-pkcs11err(int err) ++#ifndef WITHOUT_PKCS11 ++static krb5_error_code ++p11err(krb5_context context, CK_RV rv, const char *op) + { ++ krb5_error_code code = KRB5KDC_ERR_PREAUTH_FAILED; + int i; ++ const char *msg; + +- for (i = 0; pkcs11_errstrings[i].text != NULL; i++) +- if (pkcs11_errstrings[i].code == err) ++ for (i = 0; pkcs11_errstrings[i].text != NULL; i++) { ++ if (pkcs11_errstrings[i].code == rv) + break; +- if (pkcs11_errstrings[i].text != NULL) +- return (pkcs11_errstrings[i].text); ++ } ++ msg = pkcs11_errstrings[i].text; ++ if (msg == NULL) ++ msg = "unknown PKCS11 error"; + +- return "unknown PKCS11 error"; ++ krb5_set_error_message(context, code, _("PKCS11 error (%s): %s"), op, msg); ++ return code; + } ++#endif + + /* + * Add an item to the pkinit_identity_crypto_context's list of deferred +diff --git a/src/plugins/preauth/pkinit/pkinit_trace.h b/src/plugins/preauth/pkinit/pkinit_trace.h +index 1c1ceb5a41..1faa6816d7 100644 +--- a/src/plugins/preauth/pkinit/pkinit_trace.h ++++ b/src/plugins/preauth/pkinit/pkinit_trace.h +@@ -98,21 +98,12 @@ + #define TRACE_PKINIT_OPENSSL_ERROR(c, msg) \ + TRACE(c, "PKINIT OpenSSL error: {str}", msg) + +-#define TRACE_PKINIT_PKCS11_GETFLIST_FAILED(c, errstr) \ +- TRACE(c, "PKINIT PKCS11 C_GetFunctionList failed: {str}", errstr) +-#define TRACE_PKINIT_PKCS11_GETSYM_FAILED(c, errstr) \ +- TRACE(c, "PKINIT unable to find PKCS11 plugin symbol " \ +- "C_GetFunctionList: {str}", errstr) +-#define TRACE_PKINIT_PKCS11_LOGIN_FAILED(c, errstr) \ +- TRACE(c, "PKINIT PKCS11 C_Login failed: {str}", errstr) + #define TRACE_PKINIT_PKCS11_NO_MATCH_TOKEN(c) \ + TRACE(c, "PKINIT PKCS#11 module has no matching tokens") + #define TRACE_PKINIT_PKCS11_NO_TOKEN(c) \ + TRACE(c, "PKINIT PKCS#11 module shows no slots with tokens") + #define TRACE_PKINIT_PKCS11_OPEN(c, name) \ + TRACE(c, "PKINIT opening PKCS#11 module \"{str}\"", name) +-#define TRACE_PKINIT_PKCS11_OPEN_FAILED(c, errstr) \ +- TRACE(c, "PKINIT PKCS#11 module open failed: {str}", errstr) + #define TRACE_PKINIT_PKCS11_SLOT(c, slot, len, label) \ + TRACE(c, "PKINIT PKCS#11 slotid {int} token {lenstr}", \ + slot, len, label) +-- +2.47.1 + diff --git a/0033-Set-missing-mask-flags-for-kdb5_util-operations.patch b/0033-Set-missing-mask-flags-for-kdb5_util-operations.patch new file mode 100644 index 0000000..71b30d1 --- /dev/null +++ b/0033-Set-missing-mask-flags-for-kdb5_util-operations.patch @@ -0,0 +1,61 @@ +From 946f7dba8cea3d2ed0e68c5e7594cbd7e1364609 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Thu, 1 Aug 2024 10:56:07 +0200 +Subject: [PATCH] Set missing mask flags for kdb5_util operations + +Set KADM5_TL_DATA for the use_mkey and update_princ_encryption +commands. (Commit c877f13c8985d820583b0d7ac1bb4c5dc36e677e did this +for the add_new_mkey and purge_mkeys commands.) Set appropriate flags +for the add_random_key command. + +[ghudson@mit.edu: combined two commits; pruned out proposed mask flag +additions for values represented within key data or tl-data (like +KADM5_MKVNO), as those flags are currently only used in the kadm5 +protocol, not to communicate with the KDB module] + +ticket: 9158 (new) +(cherry picked from commit 4ed7da378940198cf4415f86d4eb013de6ac6455) +--- + src/kadmin/dbutil/kdb5_mkey.c | 4 +++- + src/kadmin/dbutil/kdb5_util.c | 3 +++ + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/src/kadmin/dbutil/kdb5_mkey.c b/src/kadmin/dbutil/kdb5_mkey.c +index aceb0a9b80..ac5c51d05e 100644 +--- a/src/kadmin/dbutil/kdb5_mkey.c ++++ b/src/kadmin/dbutil/kdb5_mkey.c +@@ -525,6 +525,8 @@ kdb5_use_mkey(int argc, char *argv[]) + goto cleanup_return; + } + ++ master_entry->mask |= KADM5_TL_DATA; ++ + if ((retval = krb5_db_put_principal(util_context, master_entry))) { + com_err(progname, retval, + _("while adding master key entry to the database")); +@@ -814,7 +816,7 @@ update_princ_encryption_1(void *cb, krb5_db_entry *ent) + goto fail; + } + +- ent->mask |= KADM5_KEY_DATA; ++ ent->mask |= KADM5_KEY_DATA | KADM5_TL_DATA; + + if ((retval = krb5_db_put_principal(util_context, ent))) { + com_err(progname, retval, _("while updating principal '%s' key data " +diff --git a/src/kadmin/dbutil/kdb5_util.c b/src/kadmin/dbutil/kdb5_util.c +index 55d529fa4c..afc817891b 100644 +--- a/src/kadmin/dbutil/kdb5_util.c ++++ b/src/kadmin/dbutil/kdb5_util.c +@@ -600,6 +600,9 @@ add_random_key(int argc, char **argv) + exit_status++; + return; + } ++ ++ dbent->mask |= KADM5_ATTRIBUTES | KADM5_KEY_DATA | KADM5_TL_DATA; ++ + ret = krb5_db_put_principal(util_context, dbent); + krb5_db_free_principal(util_context, dbent); + if (ret) { +-- +2.47.1 + diff --git a/0034-Prevent-overflow-when-calculating-ulog-block-size.patch b/0034-Prevent-overflow-when-calculating-ulog-block-size.patch new file mode 100644 index 0000000..d288951 --- /dev/null +++ b/0034-Prevent-overflow-when-calculating-ulog-block-size.patch @@ -0,0 +1,64 @@ +From 9b669dd42b28e7900f5ccac2816204e7d04ea23c Mon Sep 17 00:00:00 2001 +From: Zoltan Borbely +Date: Tue, 28 Jan 2025 16:39:25 -0500 +Subject: [PATCH] Prevent overflow when calculating ulog block size + +In kdb_log.c:resize(), log an error and fail if the update size is +larger than the largest possible block size (2^16-1). + +CVE-2025-24528: + +In MIT krb5 release 1.7 and later with incremental propagation +enabled, an authenticated attacker can cause kadmind to write beyond +the end of the mapped region for the iprop log file, likely causing a +process crash. + +[ghudson@mit.edu: edited commit message and added CVE description] + +ticket: 9159 (new) +tags: pullup +target_version: 1.21-next + +(cherry picked from commit 78ceba024b64d49612375be4a12d1c066b0bfbd0) +--- + src/lib/kdb/kdb_log.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/src/lib/kdb/kdb_log.c b/src/lib/kdb/kdb_log.c +index e9b95fce59..c805ebd988 100644 +--- a/src/lib/kdb/kdb_log.c ++++ b/src/lib/kdb/kdb_log.c +@@ -183,7 +183,7 @@ extend_file_to(int fd, unsigned int new_size) + */ + static krb5_error_code + resize(kdb_hlog_t *ulog, uint32_t ulogentries, int ulogfd, +- unsigned int recsize) ++ unsigned int recsize, const kdb_incr_update_t *upd) + { + unsigned int new_block, new_size; + +@@ -195,6 +195,12 @@ resize(kdb_hlog_t *ulog, uint32_t ulogentries, int ulogfd, + new_block *= ULOG_BLOCK; + new_size += ulogentries * new_block; + ++ if (new_block > UINT16_MAX) { ++ syslog(LOG_ERR, _("ulog overflow caused by principal %.*s"), ++ upd->kdb_princ_name.utf8str_t_len, ++ upd->kdb_princ_name.utf8str_t_val); ++ return KRB5_LOG_ERROR; ++ } + if (new_size > MAXLOGLEN) + return KRB5_LOG_ERROR; + +@@ -291,7 +297,7 @@ store_update(kdb_log_context *log_ctx, kdb_incr_update_t *upd) + recsize = sizeof(kdb_ent_header_t) + upd_size; + + if (recsize > ulog->kdb_block) { +- retval = resize(ulog, ulogentries, log_ctx->ulogfd, recsize); ++ retval = resize(ulog, ulogentries, log_ctx->ulogfd, recsize, upd); + if (retval) + return retval; + } +-- +2.48.1 + diff --git a/krb5.spec b/krb5.spec index 12c9e25..963df35 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 4 +%global baserelease 5 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -84,6 +84,15 @@ Patch0022: 0022-Wait-indefinitely-on-KDC-TCP-connections.patch Patch0023: 0023-Remove-PKINIT-RSA-support.patch Patch0024: 0024-Fix-various-issues-detected-by-static-analysis.patch Patch0025: 0025-Generate-and-verify-message-MACs-in-libkrad.patch +Patch0026: 0026-PKINIT-ECDH-support.patch +Patch0027: 0027-Add-ecdsa-with-sha512-256-to-supportedCMSTypes.patch +Patch0028: 0028-Get-rid-of-pkinit_crypto_openssl.h.patch +Patch0029: 0029-Use-SoftHSMv2-for-PKCS11-PKINIT-tests.patch +Patch0030: 0030-Simplify-PKINIT-cert-representation.patch +Patch0031: 0031-Support-PKCS11-EC-client-certs-in-PKINIT.patch +Patch0032: 0032-Improve-PKCS11-error-reporting-in-PKINIT.patch +Patch0033: 0033-Set-missing-mask-flags-for-kdb5_util-operations.patch +Patch0034: 0034-Prevent-overflow-when-calculating-ulog-block-size.patch License: Brian-Gladman-2-Clause AND BSD-2-Clause AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-first-lines AND BSD-3-Clause AND BSD-4-Clause AND CMU-Mach-nodoc AND FSFULLRWD AND HPND AND HPND-export2-US AND HPND-export-US AND HPND-export-US-acknowledgement AND HPND-export-US-modify AND ISC AND MIT AND MIT-CMU AND OLDAP-2.8 AND OpenVision URL: https://web.mit.edu/kerberos/www/ @@ -117,6 +126,8 @@ BuildRequires: openssl-devel < 1:3.0.0 # Enable compilation of optional tests BuildRequires: resolv_wrapper BuildRequires: libcmocka-devel +BuildRequires: opensc +BuildRequires: softhsm %description Kerberos V5 is a trusted-third-party network authentication system, @@ -148,7 +159,7 @@ Requires: openssl-libs >= 1:3.0.0 Requires: openssl-libs >= 1:1.1.1d-4 Requires: openssl-libs < 1:3.0.0 %endif -Requires: coreutils, gawk, sed +Requires: coreutils Requires: keyutils-libs >= 1.5.8 Requires: /etc/crypto-policies/back-ends/krb5.config @@ -261,11 +272,16 @@ Requires: net-tools, rpcbind Requires: perl-interpreter Requires: procps-ng Requires: python3-kdcproxy -Requires: python3-pyrad Requires: resolv_wrapper Requires: /etc/crypto-policies/back-ends/krb5.config Requires: words -#Requires: openldap-servers, openldap-clients +Requires: opensc +Requires: softhsm +Recommends: python3-pyrad + +# Restore once openldap upstream tests are fixed +#Recommends: openldap-servers +#Recommends: openldap-clients %description tests FOR TESTING PURPOSE ONLY @@ -720,6 +736,18 @@ exit 0 %{_datarootdir}/%{name}-tests/%{_arch} %changelog +* Wed Jan 29 2025 Julien Rische - 1.21.3-5 +- Prevent overflow when calculating ulog block size (CVE-2025-24528) + Resolves: rhbz#2342798 +- Support PKCS11 EC client certs in PKINIT + Resolves: rhbz#2341962 +- kdb5_util: fix DB entry flags on modification + Resolves: rhbz#2336555 +- Add ECDH support for PKINIT (RFC5349) + Resolves: rhbz#2214326 +- Remove dependency of krb5-libs on gawk and sed + Resolves: rhbz#2323859 + * Fri Jan 17 2025 Fedora Release Engineering - 1.21.3-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From 5c0a0044940e427128ff060b4c03dd1246733f05 Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Thu, 3 Apr 2025 17:07:47 +0200 Subject: [PATCH 098/103] krb5 1.21.3-6 - Do not block HMAC-MD4/5 in FIPS mode Resolves: rhbz#2370259 - PKINIT: implement paChecksum2 from MS-PKCA v20230920 Resolves: rhbz#2357215 - Disallow RC4 HMAC-MD5 session keys by default (CVE-2025-3576) Resolves: rhbz#2359705 Signed-off-by: Julien Rische --- ...ession-keys-with-deprecated-enctypes.patch | 327 +++++++++ ...eam-Remove-3des-support-cumulative-1.patch | 260 +++++++ ...T-paChecksum2-from-MS-PKCA-v20230920.patch | 692 ++++++++++++++++++ ...Do-not-block-HMAC-MD4-5-in-FIPS-mode.patch | 381 ++++++++++ kdc.conf | 4 + krb5.spec | 22 +- 6 files changed, 1682 insertions(+), 4 deletions(-) create mode 100644 0035-Don-t-issue-session-keys-with-deprecated-enctypes.patch create mode 100644 0036-downstream-Remove-3des-support-cumulative-1.patch create mode 100644 0037-Add-PKINIT-paChecksum2-from-MS-PKCA-v20230920.patch create mode 100644 0038-downstream-Do-not-block-HMAC-MD4-5-in-FIPS-mode.patch diff --git a/0035-Don-t-issue-session-keys-with-deprecated-enctypes.patch b/0035-Don-t-issue-session-keys-with-deprecated-enctypes.patch new file mode 100644 index 0000000..4c2ba40 --- /dev/null +++ b/0035-Don-t-issue-session-keys-with-deprecated-enctypes.patch @@ -0,0 +1,327 @@ +From c617915958a5cb05463713adcf03b6a0e0512ac3 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Fri, 16 Dec 2022 18:31:07 -0500 +Subject: [PATCH] Don't issue session keys with deprecated enctypes + +A paper by Tom Tervoort noted that rc4-hmac pre-hashes the input for +its checksum and GSS operations before applying HMAC, and is therefore +potentially vulnerable to hash collision attacks if a protocol +contains a restricted signing oracle. + +In light of these potential attacks, begin the functional deprecation +of DES3 and RC4 by disallowing their use as session key enctypes by +default. Add the variables allow_des3 and allow_rc4 in case +negotiability of these enctypes for session keys needs to be turned +back on, with the expectation that in future releases the enctypes +will be more comprehensively deprecated. + +ticket: 9081 +(cherry picked from commit 1b57a4d134bbd0e7c52d5885a92eccc815726463) +--- + doc/admin/conf_files/krb5_conf.rst | 12 ++++++++++++ + doc/admin/enctypes.rst | 23 +++++++++++++++++++--- + src/include/k5-int.h | 4 ++++ + src/kdc/kdc_util.c | 10 ++++++++++ + src/lib/krb5/krb/get_in_tkt.c | 31 +++++++++++++++++++----------- + src/lib/krb5/krb/init_ctx.c | 10 ++++++++++ + src/tests/gssapi/t_enctypes.py | 5 +++-- + src/tests/t_etype_info.py | 5 +++-- + src/tests/t_sesskeynego.py | 28 +++++++++++++++++++++++++-- + src/util/k5test.py | 9 ++++++++- + 10 files changed, 116 insertions(+), 21 deletions(-) + +diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst +index dca52e1426..d51fd3ce7e 100644 +--- a/doc/admin/conf_files/krb5_conf.rst ++++ b/doc/admin/conf_files/krb5_conf.rst +@@ -95,6 +95,18 @@ Additionally, krb5.conf may include any of the relations described in + + The libdefaults section may contain any of the following relations: + ++**allow_des3** ++ Permit the KDC to issue tickets with des3-cbc-sha1 session keys. ++ In future releases, this flag will allow des3-cbc-sha1 to be used ++ at all. The default value for this tag is false. (Added in ++ release 1.21.) ++ ++**allow_rc4** ++ Permit the KDC to issue tickets with arcfour-hmac session keys. ++ In future releases, this flag will allow arcfour-hmac to be used ++ at all. The default value for this tag is false. (Added in ++ release 1.21.) ++ + **allow_weak_crypto** + If this flag is set to false, then weak encryption types (as noted + in :ref:`Encryption_types` in :ref:`kdc.conf(5)`) will be filtered +diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst +index c4d5499d3b..2b4ed7da0b 100644 +--- a/doc/admin/enctypes.rst ++++ b/doc/admin/enctypes.rst +@@ -48,12 +48,15 @@ Session key selection + The KDC chooses the session key enctype by taking the intersection of + its **permitted_enctypes** list, the list of long-term keys for the + most recent kvno of the service, and the client's requested list of +-enctypes. ++enctypes. Starting in krb5-1.21, all services are assumed to support ++aes256-cts-hmac-sha1-96; also, des3-cbc-sha1 and arcfour-hmac session ++keys will not be issued by default. + + Starting in krb5-1.11, it is possible to set a string attribute on a + service principal to control what session key enctypes the KDC may +-issue for service tickets for that principal. See :ref:`set_string` +-in :ref:`kadmin(1)` for details. ++issue for service tickets for that principal, overriding the service's ++long-term keys and the assumption of aes256-cts-hmac-sha1-96 support. ++See :ref:`set_string` in :ref:`kadmin(1)` for details. + + + Choosing enctypes for a service +@@ -87,6 +90,20 @@ affect how enctypes are chosen. + acceptable risk for your environment and the weak enctypes are + required for backward compatibility. + ++**allow_des3** ++ was added in release 1.21 and defaults to *false*. Unless this ++ flag is set to *true*, the KDC will not issue tickets with ++ des3-cbc-sha1 session keys. In a future release, this flag will ++ control whether des3-cbc-sha1 is permitted in similar fashion to ++ weak enctypes. ++ ++**allow_rc4** ++ was added in release 1.21 and defaults to *false*. Unless this ++ flag is set to *true*, the KDC will not issue tickets with ++ arcfour-hmac session keys. In a future release, this flag will ++ control whether arcfour-hmac is permitted in similar fashion to ++ weak enctypes. ++ + **permitted_enctypes** + controls the set of enctypes that a service will permit for + session keys and for ticket and authenticator encryption. The KDC +diff --git a/src/include/k5-int.h b/src/include/k5-int.h +index b7789a2dd8..d0a263aa7d 100644 +--- a/src/include/k5-int.h ++++ b/src/include/k5-int.h +@@ -181,6 +181,8 @@ typedef unsigned char u_char; + * matches the variable name. Keep these alphabetized. */ + #define KRB5_CONF_ACL_FILE "acl_file" + #define KRB5_CONF_ADMIN_SERVER "admin_server" ++#define KRB5_CONF_ALLOW_DES3 "allow_des3" ++#define KRB5_CONF_ALLOW_RC4 "allow_rc4" + #define KRB5_CONF_ALLOW_WEAK_CRYPTO "allow_weak_crypto" + #define KRB5_CONF_AUTH_TO_LOCAL "auth_to_local" + #define KRB5_CONF_AUTH_TO_LOCAL_NAMES "auth_to_local_names" +@@ -1241,6 +1243,8 @@ struct _krb5_context { + struct _kdb_log_context *kdblog_context; + + krb5_boolean allow_weak_crypto; ++ krb5_boolean allow_des3; ++ krb5_boolean allow_rc4; + krb5_boolean ignore_acceptor_hostname; + krb5_boolean enforce_ok_as_delegate; + enum dns_canonhost dns_canonicalize_hostname; +diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c +index 93415ba862..c7b6e4090d 100644 +--- a/src/kdc/kdc_util.c ++++ b/src/kdc/kdc_util.c +@@ -1108,6 +1108,16 @@ select_session_keytype(krb5_context context, krb5_db_entry *server, + if (!krb5_is_permitted_enctype(context, ktype[i])) + continue; + ++ /* ++ * Prevent these deprecated enctypes from being used as session keys ++ * unless they are explicitly allowed. In the future they will be more ++ * comprehensively disabled and eventually removed. ++ */ ++ if (ktype[i] == ENCTYPE_DES3_CBC_SHA1 && !context->allow_des3) ++ continue; ++ if (ktype[i] == ENCTYPE_ARCFOUR_HMAC && !context->allow_rc4) ++ continue; ++ + if (dbentry_supports_enctype(context, server, ktype[i])) + return ktype[i]; + } +diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c +index 1b420a3ac2..ea089f0fcc 100644 +--- a/src/lib/krb5/krb/get_in_tkt.c ++++ b/src/lib/krb5/krb/get_in_tkt.c +@@ -1582,22 +1582,31 @@ warn_pw_expiry(krb5_context context, krb5_get_init_creds_opt *options, + (*prompter)(context, data, 0, banner, 0, 0); + } + +-/* Display a warning via the prompter if des3-cbc-sha1 was used for either the +- * reply key or the session key. */ ++/* Display a warning via the prompter if a deprecated enctype was used for ++ * either the reply key or the session key. */ + static void +-warn_des3(krb5_context context, krb5_init_creds_context ctx, +- krb5_enctype as_key_enctype) ++warn_deprecated(krb5_context context, krb5_init_creds_context ctx, ++ krb5_enctype as_key_enctype) + { +- const char *banner; ++ krb5_enctype etype; ++ char encbuf[128], banner[256]; + +- if (as_key_enctype != ENCTYPE_DES3_CBC_SHA1 && +- ctx->cred.keyblock.enctype != ENCTYPE_DES3_CBC_SHA1) +- return; + if (ctx->prompter == NULL) + return; + +- banner = _("Warning: encryption type des3-cbc-sha1 used for " +- "authentication is weak and will be disabled"); ++ if (krb5int_c_deprecated_enctype(as_key_enctype)) ++ etype = as_key_enctype; ++ else if (krb5int_c_deprecated_enctype(ctx->cred.keyblock.enctype)) ++ etype = ctx->cred.keyblock.enctype; ++ else ++ return; ++ ++ if (krb5_enctype_to_name(etype, FALSE, encbuf, sizeof(encbuf)) != 0) ++ return; ++ snprintf(banner, sizeof(banner), ++ _("Warning: encryption type %s used for authentication is " ++ "deprecated and will be disabled"), encbuf); ++ + /* PROMPTER_INVOCATION */ + (*ctx->prompter)(context, ctx->prompter_data, NULL, banner, 0, NULL); + } +@@ -1848,7 +1857,7 @@ init_creds_step_reply(krb5_context context, + ctx->complete = TRUE; + warn_pw_expiry(context, ctx->opt, ctx->prompter, ctx->prompter_data, + ctx->in_tkt_service, ctx->reply); +- warn_des3(context, ctx, encrypting_key.enctype); ++ warn_deprecated(context, ctx, encrypting_key.enctype); + + cleanup: + krb5_free_pa_data(context, kdc_padata); +diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c +index 582a2945ff..a32f8dbf03 100644 +--- a/src/lib/krb5/krb/init_ctx.c ++++ b/src/lib/krb5/krb/init_ctx.c +@@ -220,6 +220,16 @@ krb5_init_context_profile(profile_t profile, krb5_flags flags, + goto cleanup; + ctx->allow_weak_crypto = tmp; + ++ retval = get_boolean(ctx, KRB5_CONF_ALLOW_DES3, 0, &tmp); ++ if (retval) ++ goto cleanup; ++ ctx->allow_des3 = tmp; ++ ++ retval = get_boolean(ctx, KRB5_CONF_ALLOW_RC4, 0, &tmp); ++ if (retval) ++ goto cleanup; ++ ctx->allow_rc4 = tmp; ++ + retval = get_boolean(ctx, KRB5_CONF_IGNORE_ACCEPTOR_HOSTNAME, 0, &tmp); + if (retval) + goto cleanup; +diff --git a/src/tests/gssapi/t_enctypes.py b/src/tests/gssapi/t_enctypes.py +index 2f95d89967..e6bde47afc 100755 +--- a/src/tests/gssapi/t_enctypes.py ++++ b/src/tests/gssapi/t_enctypes.py +@@ -10,8 +10,9 @@ d_rc4 = 'DEPRECATED:arcfour-hmac' + + # These tests make assumptions about the default enctype lists, so set + # them explicitly rather than relying on the library defaults. +-supp='aes256-cts:normal aes128-cts:normal rc4-hmac:normal' +-conf = {'libdefaults': {'permitted_enctypes': 'aes rc4'}, ++supp='aes256-cts:normal aes128-cts:normal des3-cbc-sha1:normal rc4-hmac:normal' ++conf = {'libdefaults': {'permitted_enctypes': 'aes des3 rc4', ++ 'allow_des3': 'true', 'allow_rc4': 'true'}, + 'realms': {'$realm': {'supported_enctypes': supp}}} + realm = K5Realm(krb5_conf=conf) + shutil.copyfile(realm.ccache, os.path.join(realm.testdir, 'save')) +diff --git a/src/tests/t_etype_info.py b/src/tests/t_etype_info.py +index a6f538b66d..75d9621dd6 100644 +--- a/src/tests/t_etype_info.py ++++ b/src/tests/t_etype_info.py +@@ -1,7 +1,8 @@ + from k5test import * + +-supported_enctypes = 'aes128-cts rc4-hmac' +-conf = {'realms': {'$realm': {'supported_enctypes': supported_enctypes}}} ++supported_enctypes = 'aes128-cts des3-cbc-sha1 rc4-hmac' ++conf = {'libdefaults': {'allow_des3': 'true', 'allow_rc4': 'true'}, ++ 'realms': {'$realm': {'supported_enctypes': supported_enctypes}}} + realm = K5Realm(create_host=False, get_creds=False, krb5_conf=conf) + + realm.run([kadminl, 'addprinc', '-pw', 'pw', '+requires_preauth', +diff --git a/src/tests/t_sesskeynego.py b/src/tests/t_sesskeynego.py +index 9024aee838..5a213617b5 100755 +--- a/src/tests/t_sesskeynego.py ++++ b/src/tests/t_sesskeynego.py +@@ -25,6 +25,8 @@ conf3 = {'libdefaults': { + 'default_tkt_enctypes': 'aes128-cts', + 'default_tgs_enctypes': 'rc4-hmac,aes128-cts'}} + conf4 = {'libdefaults': {'permitted_enctypes': 'aes256-cts'}} ++conf5 = {'libdefaults': {'allow_rc4': 'true'}} ++conf6 = {'libdefaults': {'allow_des3': 'true'}} + # Test with client request and session_enctypes preferring aes128, but + # aes256 long-term key. + realm = K5Realm(krb5_conf=conf1, create_host=False, get_creds=False) +@@ -54,10 +56,12 @@ realm.run([kadminl, 'setstr', 'server', 'session_enctypes', + 'aes128-cts,aes256-cts']) + test_kvno(realm, 'aes128-cts-hmac-sha1-96', 'aes256-cts-hmac-sha1-96') + +-# 3b: Negotiate rc4-hmac session key when principal only has aes256 long-term. ++# 3b: Skip RC4 (as the KDC does not allow it for session keys by ++# default) and negotiate aes128-cts session key, with only an aes256 ++# long-term service key. + realm.run([kadminl, 'setstr', 'server', 'session_enctypes', + 'rc4-hmac,aes128-cts,aes256-cts']) +-test_kvno(realm, 'DEPRECATED:arcfour-hmac', 'aes256-cts-hmac-sha1-96') ++test_kvno(realm, 'aes128-cts-hmac-sha1-96', 'aes256-cts-hmac-sha1-96') + realm.stop() + + # 4: Check that permitted_enctypes is a default for session key enctypes. +@@ -67,4 +71,24 @@ realm.run([kvno, 'user'], + expected_trace=('etypes requested in TGS request: aes256-cts',)) + realm.stop() + ++# 5: allow_rc4 permits negotiation of rc4-hmac session key. ++realm = K5Realm(krb5_conf=conf5, create_host=False, get_creds=False) ++realm.run([kadminl, 'addprinc', '-randkey', '-e', 'aes256-cts', 'server']) ++realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'rc4-hmac']) ++test_kvno(realm, 'DEPRECATED:arcfour-hmac', 'aes256-cts-hmac-sha1-96') ++realm.stop() ++ ++# 6: allow_des3 permits negotiation of des3-cbc-sha1 session key. ++realm = K5Realm(krb5_conf=conf6, create_host=False, get_creds=False) ++realm.run([kadminl, 'addprinc', '-randkey', '-e', 'aes256-cts', 'server']) ++realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'des3-cbc-sha1']) ++test_kvno(realm, 'DEPRECATED:des3-cbc-sha1', 'aes256-cts-hmac-sha1-96') ++realm.stop() ++ ++# 7: default config negotiates aes256-sha1 session key for RC4-only service. ++realm = K5Realm(create_host=False, get_creds=False) ++realm.run([kadminl, 'addprinc', '-randkey', '-e', 'rc4-hmac', 'server']) ++test_kvno(realm, 'aes256-cts-hmac-sha1-96', 'DEPRECATED:arcfour-hmac') ++realm.stop() ++ + success('sesskeynego') +diff --git a/src/util/k5test.py b/src/util/k5test.py +index d823653aa0..8e5f5ba8e9 100644 +--- a/src/util/k5test.py ++++ b/src/util/k5test.py +@@ -1338,9 +1338,16 @@ _passes = [ + # No special settings; exercises AES256. + ('default', None, None, None), + ++ # Exercise the DES3 enctype. ++ ('des3', None, ++ {'libdefaults': {'permitted_enctypes': 'des3 aes256-sha1'}}, ++ {'realms': {'$realm': { ++ 'supported_enctypes': 'des3-cbc-sha1:normal', ++ 'master_key_type': 'des3-cbc-sha1'}}}), ++ + # Exercise the arcfour enctype. + ('arcfour', None, +- {'libdefaults': {'permitted_enctypes': 'rc4'}}, ++ {'libdefaults': {'permitted_enctypes': 'rc4 aes256-sha1'}}, + {'realms': {'$realm': { + 'supported_enctypes': 'arcfour-hmac:normal', + 'master_key_type': 'arcfour-hmac'}}}), +-- +2.49.0 + diff --git a/0036-downstream-Remove-3des-support-cumulative-1.patch b/0036-downstream-Remove-3des-support-cumulative-1.patch new file mode 100644 index 0000000..4911619 --- /dev/null +++ b/0036-downstream-Remove-3des-support-cumulative-1.patch @@ -0,0 +1,260 @@ +From b0993b57dbe584f9308cc7773b930efe76e19ba3 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Fri, 4 Apr 2025 15:08:36 +0200 +Subject: [PATCH] [downstream] Remove 3des support (cumulative 1) + +Remove mentions for the triple-DES encryption type which were added +since the previous downstream patch. +--- + README | 15 +++++++-------- + doc/admin/conf_files/krb5_conf.rst | 6 ------ + doc/admin/enctypes.rst | 11 ++--------- + doc/mitK5features.rst | 5 ++--- + src/include/k5-int.h | 2 -- + src/kdc/kdc_util.c | 2 -- + src/lib/krb5/krb/init_ctx.c | 5 ----- + src/man/krb5.conf.man | 6 ------ + src/tests/gssapi/t_enctypes.py | 5 ++--- + src/tests/t_etype_info.py | 4 ++-- + src/tests/t_sesskeynego.py | 8 -------- + src/util/k5test.py | 7 ------- + 12 files changed, 15 insertions(+), 61 deletions(-) + +diff --git a/README b/README +index 6d6f7f16e3..9341bd3dd8 100644 +--- a/README ++++ b/README +@@ -81,11 +81,11 @@ Triple-DES and RC4 transitions + ------------------------------ + + Beginning with the krb5-1.21 release, the KDC will not issue tickets +-with triple-DES or RC4 session keys unless explicitly configured using +-the new allow_des3 and allow_rc4 variables in [libdefaults]. To +-facilitate the negotiation of session keys, the KDC will assume that +-all services can handle aes256-sha1 session keys unless the service +-principal has a session_enctypes string attribute. ++with RC4 session keys unless explicitly configured using the new ++allow_rc4 variable in [libdefaults]. To facilitate the negotiation of ++session keys, the KDC will assume that all services can handle ++aes256-sha1 session keys unless the service principal has a ++session_enctypes string attribute. + + Beginning with the krb5-1.19 release, a warning will be issued if + initial credentials are acquired using the des3-cbc-sha1 encryption +@@ -164,9 +164,8 @@ Developer experience: + + Protocol evolution: + +-* The KDC will no longer issue tickets with RC4 or triple-DES session +- keys unless explicitly configured with the new allow_rc4 or +- allow_des3 variables respectively. ++* The KDC will no longer issue tickets with RC4 session keys unless ++ explicitly configured with the new allow_rc4 variable. + + * The KDC will assume that all services can handle aes256-sha1 session + keys unless the service principal has a session_enctypes string +diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst +index d51fd3ce7e..d20dcf18e3 100644 +--- a/doc/admin/conf_files/krb5_conf.rst ++++ b/doc/admin/conf_files/krb5_conf.rst +@@ -95,12 +95,6 @@ Additionally, krb5.conf may include any of the relations described in + + The libdefaults section may contain any of the following relations: + +-**allow_des3** +- Permit the KDC to issue tickets with des3-cbc-sha1 session keys. +- In future releases, this flag will allow des3-cbc-sha1 to be used +- at all. The default value for this tag is false. (Added in +- release 1.21.) +- + **allow_rc4** + Permit the KDC to issue tickets with arcfour-hmac session keys. + In future releases, this flag will allow arcfour-hmac to be used +diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst +index 2b4ed7da0b..6ce4638d5e 100644 +--- a/doc/admin/enctypes.rst ++++ b/doc/admin/enctypes.rst +@@ -49,8 +49,8 @@ The KDC chooses the session key enctype by taking the intersection of + its **permitted_enctypes** list, the list of long-term keys for the + most recent kvno of the service, and the client's requested list of + enctypes. Starting in krb5-1.21, all services are assumed to support +-aes256-cts-hmac-sha1-96; also, des3-cbc-sha1 and arcfour-hmac session +-keys will not be issued by default. ++aes256-cts-hmac-sha1-96; also, arcfour-hmac session keys will not be ++issued by default. + + Starting in krb5-1.11, it is possible to set a string attribute on a + service principal to control what session key enctypes the KDC may +@@ -90,13 +90,6 @@ affect how enctypes are chosen. + acceptable risk for your environment and the weak enctypes are + required for backward compatibility. + +-**allow_des3** +- was added in release 1.21 and defaults to *false*. Unless this +- flag is set to *true*, the KDC will not issue tickets with +- des3-cbc-sha1 session keys. In a future release, this flag will +- control whether des3-cbc-sha1 is permitted in similar fashion to +- weak enctypes. +- + **allow_rc4** + was added in release 1.21 and defaults to *false*. Unless this + flag is set to *true*, the KDC will not issue tickets with +diff --git a/doc/mitK5features.rst b/doc/mitK5features.rst +index cad0855724..64d746b0af 100644 +--- a/doc/mitK5features.rst ++++ b/doc/mitK5features.rst +@@ -659,9 +659,8 @@ Release 1.21 + + * Protocol evolution: + +- - The KDC will no longer issue tickets with RC4 or triple-DES +- session keys unless explicitly configured with the new allow_rc4 +- or allow_des3 variables respectively. ++ - The KDC will no longer issue tickets with RC4 session keys unless ++ explicitly configured with the new allow_rc4 variable. + + - The KDC will assume that all services can handle aes256-sha1 + session keys unless the service principal has a session_enctypes +diff --git a/src/include/k5-int.h b/src/include/k5-int.h +index d0a263aa7d..82a763298d 100644 +--- a/src/include/k5-int.h ++++ b/src/include/k5-int.h +@@ -181,7 +181,6 @@ typedef unsigned char u_char; + * matches the variable name. Keep these alphabetized. */ + #define KRB5_CONF_ACL_FILE "acl_file" + #define KRB5_CONF_ADMIN_SERVER "admin_server" +-#define KRB5_CONF_ALLOW_DES3 "allow_des3" + #define KRB5_CONF_ALLOW_RC4 "allow_rc4" + #define KRB5_CONF_ALLOW_WEAK_CRYPTO "allow_weak_crypto" + #define KRB5_CONF_AUTH_TO_LOCAL "auth_to_local" +@@ -1243,7 +1242,6 @@ struct _krb5_context { + struct _kdb_log_context *kdblog_context; + + krb5_boolean allow_weak_crypto; +- krb5_boolean allow_des3; + krb5_boolean allow_rc4; + krb5_boolean ignore_acceptor_hostname; + krb5_boolean enforce_ok_as_delegate; +diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c +index c7b6e4090d..bafcf5f728 100644 +--- a/src/kdc/kdc_util.c ++++ b/src/kdc/kdc_util.c +@@ -1113,8 +1113,6 @@ select_session_keytype(krb5_context context, krb5_db_entry *server, + * unless they are explicitly allowed. In the future they will be more + * comprehensively disabled and eventually removed. + */ +- if (ktype[i] == ENCTYPE_DES3_CBC_SHA1 && !context->allow_des3) +- continue; + if (ktype[i] == ENCTYPE_ARCFOUR_HMAC && !context->allow_rc4) + continue; + +diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c +index a32f8dbf03..82aba64c5e 100644 +--- a/src/lib/krb5/krb/init_ctx.c ++++ b/src/lib/krb5/krb/init_ctx.c +@@ -220,11 +220,6 @@ krb5_init_context_profile(profile_t profile, krb5_flags flags, + goto cleanup; + ctx->allow_weak_crypto = tmp; + +- retval = get_boolean(ctx, KRB5_CONF_ALLOW_DES3, 0, &tmp); +- if (retval) +- goto cleanup; +- ctx->allow_des3 = tmp; +- + retval = get_boolean(ctx, KRB5_CONF_ALLOW_RC4, 0, &tmp); + if (retval) + goto cleanup; +diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man +index 6c0e9aff8c..4b53988712 100644 +--- a/src/man/krb5.conf.man ++++ b/src/man/krb5.conf.man +@@ -178,12 +178,6 @@ kdc.conf(5), but it is not a recommended practice. + The libdefaults section may contain any of the following relations: + .INDENT 0.0 + .TP +-\fBallow_des3\fP +-Permit the KDC to issue tickets with des3\-cbc\-sha1 session keys. +-In future releases, this flag will allow des3\-cbc\-sha1 to be used +-at all. The default value for this tag is false. (Added in +-release 1.21.) +-.TP + \fBallow_rc4\fP + Permit the KDC to issue tickets with arcfour\-hmac session keys. + In future releases, this flag will allow arcfour\-hmac to be used +diff --git a/src/tests/gssapi/t_enctypes.py b/src/tests/gssapi/t_enctypes.py +index e6bde47afc..1bb8c40b6b 100755 +--- a/src/tests/gssapi/t_enctypes.py ++++ b/src/tests/gssapi/t_enctypes.py +@@ -10,9 +10,8 @@ d_rc4 = 'DEPRECATED:arcfour-hmac' + + # These tests make assumptions about the default enctype lists, so set + # them explicitly rather than relying on the library defaults. +-supp='aes256-cts:normal aes128-cts:normal des3-cbc-sha1:normal rc4-hmac:normal' +-conf = {'libdefaults': {'permitted_enctypes': 'aes des3 rc4', +- 'allow_des3': 'true', 'allow_rc4': 'true'}, ++supp='aes256-cts:normal aes128-cts:normal rc4-hmac:normal' ++conf = {'libdefaults': {'permitted_enctypes': 'aes rc4', 'allow_rc4': 'true'}, + 'realms': {'$realm': {'supported_enctypes': supp}}} + realm = K5Realm(krb5_conf=conf) + shutil.copyfile(realm.ccache, os.path.join(realm.testdir, 'save')) +diff --git a/src/tests/t_etype_info.py b/src/tests/t_etype_info.py +index 75d9621dd6..e82ff7ff07 100644 +--- a/src/tests/t_etype_info.py ++++ b/src/tests/t_etype_info.py +@@ -1,7 +1,7 @@ + from k5test import * + +-supported_enctypes = 'aes128-cts des3-cbc-sha1 rc4-hmac' +-conf = {'libdefaults': {'allow_des3': 'true', 'allow_rc4': 'true'}, ++supported_enctypes = 'aes128-cts rc4-hmac' ++conf = {'libdefaults': {'allow_rc4': 'true'}, + 'realms': {'$realm': {'supported_enctypes': supported_enctypes}}} + realm = K5Realm(create_host=False, get_creds=False, krb5_conf=conf) + +diff --git a/src/tests/t_sesskeynego.py b/src/tests/t_sesskeynego.py +index 5a213617b5..c7dba0ff5b 100755 +--- a/src/tests/t_sesskeynego.py ++++ b/src/tests/t_sesskeynego.py +@@ -26,7 +26,6 @@ conf3 = {'libdefaults': { + 'default_tgs_enctypes': 'rc4-hmac,aes128-cts'}} + conf4 = {'libdefaults': {'permitted_enctypes': 'aes256-cts'}} + conf5 = {'libdefaults': {'allow_rc4': 'true'}} +-conf6 = {'libdefaults': {'allow_des3': 'true'}} + # Test with client request and session_enctypes preferring aes128, but + # aes256 long-term key. + realm = K5Realm(krb5_conf=conf1, create_host=False, get_creds=False) +@@ -78,13 +77,6 @@ realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'rc4-hmac']) + test_kvno(realm, 'DEPRECATED:arcfour-hmac', 'aes256-cts-hmac-sha1-96') + realm.stop() + +-# 6: allow_des3 permits negotiation of des3-cbc-sha1 session key. +-realm = K5Realm(krb5_conf=conf6, create_host=False, get_creds=False) +-realm.run([kadminl, 'addprinc', '-randkey', '-e', 'aes256-cts', 'server']) +-realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'des3-cbc-sha1']) +-test_kvno(realm, 'DEPRECATED:des3-cbc-sha1', 'aes256-cts-hmac-sha1-96') +-realm.stop() +- + # 7: default config negotiates aes256-sha1 session key for RC4-only service. + realm = K5Realm(create_host=False, get_creds=False) + realm.run([kadminl, 'addprinc', '-randkey', '-e', 'rc4-hmac', 'server']) +diff --git a/src/util/k5test.py b/src/util/k5test.py +index 8e5f5ba8e9..b953827018 100644 +--- a/src/util/k5test.py ++++ b/src/util/k5test.py +@@ -1338,13 +1338,6 @@ _passes = [ + # No special settings; exercises AES256. + ('default', None, None, None), + +- # Exercise the DES3 enctype. +- ('des3', None, +- {'libdefaults': {'permitted_enctypes': 'des3 aes256-sha1'}}, +- {'realms': {'$realm': { +- 'supported_enctypes': 'des3-cbc-sha1:normal', +- 'master_key_type': 'des3-cbc-sha1'}}}), +- + # Exercise the arcfour enctype. + ('arcfour', None, + {'libdefaults': {'permitted_enctypes': 'rc4 aes256-sha1'}}, +-- +2.49.0 + diff --git a/0037-Add-PKINIT-paChecksum2-from-MS-PKCA-v20230920.patch b/0037-Add-PKINIT-paChecksum2-from-MS-PKCA-v20230920.patch new file mode 100644 index 0000000..2d9a6cc --- /dev/null +++ b/0037-Add-PKINIT-paChecksum2-from-MS-PKCA-v20230920.patch @@ -0,0 +1,692 @@ +From 9d03713af124c2096d071ba36893018da8d71655 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Tue, 14 Jan 2025 13:31:11 +0100 +Subject: [PATCH] Add PKINIT paChecksum2 from MS-PKCA v20230920 + +In 2023, Microsoft updated MS-PKCA to add the optional paChecksum2 +element in the PKAuthenticator sequence. This checksum accepts SHA-1, +SHA-256, SHA-384, and SHA-512 digests. + +In Windows Server 2025, this checksum becomes mandatory when using +PKINIT with FFDH (but strangely not with ECDH if SHA-1 is configured as +allowed). + +[ghudson@mit.edu: refactored crypto interfaces to reduce complexity of +calling code] + +ticket: 9166 (new) +(cherry picked from commit 310793ba63782af5ffa3a95d20e41f8f03ca7e00) +--- + src/include/k5-int-pkinit.h | 25 ++-- + src/lib/krb5/asn.1/asn1_k_encode.c | 18 ++- + src/plugins/preauth/pkinit/pkinit.h | 1 + + src/plugins/preauth/pkinit/pkinit_clnt.c | 41 +++---- + src/plugins/preauth/pkinit/pkinit_constants.c | 42 +++++-- + src/plugins/preauth/pkinit/pkinit_crypto.h | 24 +++- + .../preauth/pkinit/pkinit_crypto_openssl.c | 116 +++++++++++++++++- + src/plugins/preauth/pkinit/pkinit_kdf_test.c | 4 +- + src/plugins/preauth/pkinit/pkinit_lib.c | 16 ++- + src/plugins/preauth/pkinit/pkinit_srv.c | 38 ++---- + src/plugins/preauth/pkinit/pkinit_trace.h | 5 +- + src/tests/asn.1/krb5_decode_test.c | 2 +- + src/tests/asn.1/ktest.c | 7 +- + src/tests/asn.1/ktest_equal.c | 2 +- + src/tests/asn.1/pkinit_encode.out | 2 +- + src/tests/asn.1/pkinit_trval.out | 2 +- + 16 files changed, 250 insertions(+), 95 deletions(-) + +diff --git a/src/include/k5-int-pkinit.h b/src/include/k5-int-pkinit.h +index 915904e518..cf6b1f99c5 100644 +--- a/src/include/k5-int-pkinit.h ++++ b/src/include/k5-int-pkinit.h +@@ -36,21 +36,28 @@ + * pkinit structures + */ + +-/* PKAuthenticator */ +-typedef struct _krb5_pk_authenticator { +- krb5_int32 cusec; /* (0..999999) */ +- krb5_timestamp ctime; +- krb5_int32 nonce; /* (0..4294967295) */ +- krb5_checksum paChecksum; +- krb5_data *freshnessToken; +-} krb5_pk_authenticator; +- + /* AlgorithmIdentifier */ + typedef struct _krb5_algorithm_identifier { + krb5_data algorithm; /* OID */ + krb5_data parameters; /* Optional */ + } krb5_algorithm_identifier; + ++/* PAChecksum2 */ ++typedef struct _krb5_pachecksum2 { ++ krb5_data checksum; ++ krb5_algorithm_identifier algorithmIdentifier; ++} krb5_pachecksum2; ++ ++/* PKAuthenticator */ ++typedef struct _krb5_pk_authenticator { ++ krb5_int32 cusec; /* (0..999999) */ ++ krb5_timestamp ctime; ++ krb5_int32 nonce; /* (0..4294967295) */ ++ krb5_data paChecksum; ++ krb5_data *freshnessToken; /* Optional */ ++ krb5_pachecksum2 *paChecksum2; /* Optional */ ++} krb5_pk_authenticator; ++ + /** AuthPack from RFC 4556*/ + typedef struct _krb5_auth_pack { + krb5_pk_authenticator pkAuthenticator; +diff --git a/src/lib/krb5/asn.1/asn1_k_encode.c b/src/lib/krb5/asn.1/asn1_k_encode.c +index 5378b5c23b..cf7b500837 100644 +--- a/src/lib/krb5/asn.1/asn1_k_encode.c ++++ b/src/lib/krb5/asn.1/asn1_k_encode.c +@@ -1394,20 +1394,30 @@ DEFSEQTYPE(pkinit_supp_pub_info, krb5_pkinit_supp_pub_info, + MAKE_ENCODER(encode_krb5_pkinit_supp_pub_info, pkinit_supp_pub_info); + MAKE_ENCODER(encode_krb5_sp80056a_other_info, sp80056a_other_info); + +-/* A krb5_checksum encoded as an OCTET STRING, for PKAuthenticator. */ +-DEFCOUNTEDTYPE(ostring_checksum, krb5_checksum, contents, length, octetstring); ++DEFFIELD(pachecksum2_0, krb5_pachecksum2, checksum, 0, ostring_data); ++DEFFIELD(pachecksum2_1, krb5_pachecksum2, algorithmIdentifier, 1, ++ algorithm_identifier); ++static const struct atype_info *pachecksum2_fields[] = { ++ &k5_atype_pachecksum2_0, &k5_atype_pachecksum2_1 ++}; ++DEFSEQTYPE(pachecksum2, krb5_pachecksum2, pachecksum2_fields); ++ ++DEFPTRTYPE(pachecksum2_ptr, pachecksum2); ++DEFOPTIONALZEROTYPE(opt_pachecksum2_ptr, pachecksum2_ptr); + + DEFFIELD(pk_authenticator_0, krb5_pk_authenticator, cusec, 0, int32); + DEFFIELD(pk_authenticator_1, krb5_pk_authenticator, ctime, 1, kerberos_time); + DEFFIELD(pk_authenticator_2, krb5_pk_authenticator, nonce, 2, int32); + DEFFIELD(pk_authenticator_3, krb5_pk_authenticator, paChecksum, 3, +- ostring_checksum); ++ ostring_data); + DEFFIELD(pk_authenticator_4, krb5_pk_authenticator, freshnessToken, 4, + opt_ostring_data_ptr); ++DEFFIELD(pk_authenticator_5, krb5_pk_authenticator, paChecksum2, 5, ++ opt_pachecksum2_ptr); + static const struct atype_info *pk_authenticator_fields[] = { + &k5_atype_pk_authenticator_0, &k5_atype_pk_authenticator_1, + &k5_atype_pk_authenticator_2, &k5_atype_pk_authenticator_3, +- &k5_atype_pk_authenticator_4 ++ &k5_atype_pk_authenticator_4, &k5_atype_pk_authenticator_5 + }; + DEFSEQTYPE(pk_authenticator, krb5_pk_authenticator, pk_authenticator_fields); + +diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h +index 7ba7155bb4..a1564b6df2 100644 +--- a/src/plugins/preauth/pkinit/pkinit.h ++++ b/src/plugins/preauth/pkinit/pkinit.h +@@ -338,6 +338,7 @@ void free_krb5_external_principal_identifier(krb5_external_principal_identifier + void free_krb5_algorithm_identifiers(krb5_algorithm_identifier ***in); + void free_krb5_algorithm_identifier(krb5_algorithm_identifier *in); + void free_krb5_kdc_dh_key_info(krb5_kdc_dh_key_info **in); ++void free_pachecksum2(krb5_context context, krb5_pachecksum2 **in); + krb5_error_code pkinit_copy_krb5_data(krb5_data *dst, const krb5_data *src); + + +diff --git a/src/plugins/preauth/pkinit/pkinit_clnt.c b/src/plugins/preauth/pkinit/pkinit_clnt.c +index b08022a214..433f477538 100644 +--- a/src/plugins/preauth/pkinit/pkinit_clnt.c ++++ b/src/plugins/preauth/pkinit/pkinit_clnt.c +@@ -56,10 +56,9 @@ use_content_info(krb5_context context, pkinit_req_context req, + static krb5_error_code + pkinit_as_req_create(krb5_context context, pkinit_context plgctx, + pkinit_req_context reqctx, krb5_timestamp ctsec, +- krb5_int32 cusec, krb5_ui_4 nonce, +- const krb5_checksum *cksum, +- krb5_principal client, krb5_principal server, +- krb5_data **as_req); ++ krb5_int32 cusec, krb5_ui_4 nonce, const krb5_data *cksum, ++ const krb5_pachecksum2 *cksum2, krb5_principal client, ++ krb5_principal server, krb5_data **as_req); + + static krb5_error_code + pkinit_as_rep_parse(krb5_context context, pkinit_context plgctx, +@@ -89,7 +88,8 @@ pa_pkinit_gen_req(krb5_context context, + krb5_timestamp ctsec = 0; + krb5_int32 cusec = 0; + krb5_ui_4 nonce = 0; +- krb5_checksum cksum; ++ krb5_data cksum = empty_data(); ++ krb5_pachecksum2 *cksum2 = NULL; + krb5_data *der_req = NULL; + krb5_pa_data **return_pa_data = NULL; + +@@ -118,15 +118,10 @@ pa_pkinit_gen_req(krb5_context context, + goto cleanup; + } + +- retval = krb5_c_make_checksum(context, CKSUMTYPE_SHA1, NULL, 0, der_req, +- &cksum); ++ retval = crypto_generate_checksums(context, der_req, &cksum, &cksum2); + if (retval) + goto cleanup; +- TRACE_PKINIT_CLIENT_REQ_CHECKSUM(context, &cksum); +-#ifdef DEBUG_CKSUM +- pkiDebug("calculating checksum on buf size (%d)\n", der_req->length); +- print_buffer(der_req->data, der_req->length); +-#endif ++ TRACE_PKINIT_CLIENT_REQ_CHECKSUMS(context, &cksum, cksum2); + + retval = cb->get_preauth_time(context, rock, TRUE, &ctsec, &cusec); + if (retval) +@@ -140,7 +135,8 @@ pa_pkinit_gen_req(krb5_context context, + nonce = request->nonce; + + retval = pkinit_as_req_create(context, plgctx, reqctx, ctsec, cusec, +- nonce, &cksum, request->client, request->server, &out_data); ++ nonce, &cksum, cksum2, request->client, ++ request->server, &out_data); + if (retval) { + pkiDebug("error %d on pkinit_as_req_create; aborting PKINIT\n", + (int) retval); +@@ -168,23 +164,19 @@ pa_pkinit_gen_req(krb5_context context, + + cleanup: + krb5_free_data(context, der_req); +- krb5_free_checksum_contents(context, &cksum); ++ krb5_free_data_contents(context, &cksum); ++ free_pachecksum2(context, &cksum2); + krb5_free_data(context, out_data); + krb5_free_pa_data(context, return_pa_data); + return retval; + } + + static krb5_error_code +-pkinit_as_req_create(krb5_context context, +- pkinit_context plgctx, +- pkinit_req_context reqctx, +- krb5_timestamp ctsec, +- krb5_int32 cusec, +- krb5_ui_4 nonce, +- const krb5_checksum * cksum, +- krb5_principal client, +- krb5_principal server, +- krb5_data ** as_req) ++pkinit_as_req_create(krb5_context context, pkinit_context plgctx, ++ pkinit_req_context reqctx, krb5_timestamp ctsec, ++ krb5_int32 cusec, krb5_ui_4 nonce, const krb5_data *cksum, ++ const krb5_pachecksum2 *cksum2, krb5_principal client, ++ krb5_principal server, krb5_data **as_req) + { + krb5_error_code retval = ENOMEM; + krb5_data spki = empty_data(), *coded_auth_pack = NULL; +@@ -202,6 +194,7 @@ pkinit_as_req_create(krb5_context context, + auth_pack.pkAuthenticator.paChecksum = *cksum; + if (!reqctx->opts->disable_freshness) + auth_pack.pkAuthenticator.freshnessToken = reqctx->freshness_token; ++ auth_pack.pkAuthenticator.paChecksum2 = (krb5_pachecksum2 *)cksum2; + auth_pack.clientDHNonce.length = 0; + auth_pack.supportedKDFs = (krb5_data **)supported_kdf_alg_ids; + +diff --git a/src/plugins/preauth/pkinit/pkinit_constants.c b/src/plugins/preauth/pkinit/pkinit_constants.c +index 905e90d29c..a32b373c32 100644 +--- a/src/plugins/preauth/pkinit/pkinit_constants.c ++++ b/src/plugins/preauth/pkinit/pkinit_constants.c +@@ -34,25 +34,49 @@ + + /* RFC 8636 id-pkinit-kdf-ah-sha1: iso(1) identified-organization(3) dod(6) + * internet(1) security(5) kerberosv5(2) pkinit(3) kdf(6) sha1(1) */ +-static char sha1_oid[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x01 }; ++static char kdf_sha1[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x01 }; + /* RFC 8636 id-pkinit-kdf-ah-sha256: iso(1) identified-organization(3) dod(6) + * internet(1) security(5) kerberosv5(2) pkinit(3) kdf(6) sha256(2) */ +-static char sha256_oid[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x02 }; ++static char kdf_sha256[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x02 }; + /* RFC 8636 id-pkinit-kdf-ah-sha512: iso(1) identified-organization(3) dod(6) + * internet(1) security(5) kerberosv5(2) pkinit(3) kdf(6) sha512(3) */ +-static char sha512_oid[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x03 }; ++static char kdf_sha512[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x03 }; + +-const krb5_data sha1_id = { KV5M_DATA, sizeof(sha1_oid), sha1_oid }; +-const krb5_data sha256_id = { KV5M_DATA, sizeof(sha256_oid), sha256_oid }; +-const krb5_data sha512_id = { KV5M_DATA, sizeof(sha512_oid), sha512_oid }; ++const krb5_data kdf_sha1_id = { KV5M_DATA, sizeof(kdf_sha1), kdf_sha1 }; ++const krb5_data kdf_sha256_id = { KV5M_DATA, sizeof(kdf_sha256), kdf_sha256 }; ++const krb5_data kdf_sha512_id = { KV5M_DATA, sizeof(kdf_sha512), kdf_sha512 }; + + krb5_data const * const supported_kdf_alg_ids[] = { +- &sha256_id, +- &sha1_id, +- &sha512_id, ++ &kdf_sha256_id, ++ &kdf_sha1_id, ++ &kdf_sha512_id, + NULL + }; + ++/* RFC 3370 sha-1: iso(1) identified-organization(3) oiw(14) secsig(3) ++ * algorithm(2) 26 */ ++static char cms_sha1[] = { 0x2b, 0x0e, 0x03, 0x02, 0x1a }; ++/* RFC 5754 id-sha256: joint-iso-itu-t(2) country(16) us(840) organization(1) ++ * gov(101) csor(3) nistalgorithm(4) hashalgs(2) 1 */ ++static char cms_sha256[] = { ++ 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01 ++}; ++/* RFC 5754 id-sha384: joint-iso-itu-t(2) country(16) us(840) organization(1) ++ * gov(101) csor(3) nistalgorithm(4) hashalgs(2) 2 */ ++static char cms_sha384[] = { ++ 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02 ++}; ++/* RFC 5754 id-sha512: joint-iso-itu-t(2) country(16) us(840) organization(1) ++ * gov(101) csor(3) nistalgorithm(4) hashalgs(2) 3 */ ++static char cms_sha512[] = { ++ 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03 ++}; ++ ++const krb5_data cms_sha1_id = { KV5M_DATA, sizeof(cms_sha1), cms_sha1 }; ++const krb5_data cms_sha256_id = { KV5M_DATA, sizeof(cms_sha256), cms_sha256 }; ++const krb5_data cms_sha384_id = { KV5M_DATA, sizeof(cms_sha384), cms_sha384 }; ++const krb5_data cms_sha512_id = { KV5M_DATA, sizeof(cms_sha512), cms_sha512 }; ++ + /* RFC 4055 sha256WithRSAEncryption: iso(1) member-body(2) us(840) + * rsadsi(113549) pkcs(1) 1 11 */ + static char sha256WithRSAEncr_oid[9] = { +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h +index fd876e4850..3b12e904b1 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto.h ++++ b/src/plugins/preauth/pkinit/pkinit_crypto.h +@@ -562,9 +562,13 @@ pkinit_alg_agility_kdf(krb5_context context, + krb5_data *pk_as_rep, + krb5_keyblock *key_block); + +-extern const krb5_data sha1_id; +-extern const krb5_data sha256_id; +-extern const krb5_data sha512_id; ++extern const krb5_data kdf_sha1_id; ++extern const krb5_data kdf_sha256_id; ++extern const krb5_data kdf_sha512_id; ++extern const krb5_data cms_sha1_id; ++extern const krb5_data cms_sha256_id; ++extern const krb5_data cms_sha384_id; ++extern const krb5_data cms_sha512_id; + extern const krb5_data oakley_1024; + extern const krb5_data oakley_2048; + extern const krb5_data oakley_4096; +@@ -597,4 +601,18 @@ crypto_req_cert_matching_data(krb5_context context, + + int parse_dh_min_bits(krb5_context context, const char *str); + ++/* Generate a SHA-1 checksum over body in *cksum1_out and a SHA-256 checksum ++ * over body in *cksum2_out with appropriate metadata. */ ++krb5_error_code ++crypto_generate_checksums(krb5_context context, const krb5_data *body, ++ krb5_data *cksum1_out, ++ krb5_pachecksum2 **cksum2_out); ++ ++/* Verify the SHA-1 checksum in cksum1 and the tagged checksum in cksum2. ++ * cksum2 may be NULL, in which case only cksum1 is verified. */ ++krb5_error_code ++crypto_verify_checksums(krb5_context context, krb5_data *body, ++ const krb5_data *cksum1, ++ const krb5_pachecksum2 *cksum2); ++ + #endif /* _PKINIT_CRYPTO_H */ +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index 402bf1b9b3..429b7d202c 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -2616,11 +2616,11 @@ cleanup: + static const EVP_MD * + algid_to_md(const krb5_data *alg_id) + { +- if (data_eq(*alg_id, sha1_id)) ++ if (data_eq(*alg_id, kdf_sha1_id)) + return EVP_sha1(); +- if (data_eq(*alg_id, sha256_id)) ++ if (data_eq(*alg_id, kdf_sha256_id)) + return EVP_sha256(); +- if (data_eq(*alg_id, sha512_id)) ++ if (data_eq(*alg_id, kdf_sha512_id)) + return EVP_sha512(); + return NULL; + } +@@ -5663,3 +5663,113 @@ parse_dh_min_bits(krb5_context context, const char *str) + TRACE_PKINIT_DH_INVALID_MIN_BITS(context, str); + return PKINIT_DEFAULT_DH_MIN_BITS; + } ++ ++/* Return the OpenSSL message digest type matching the given CMS OID, or NULL ++ * if it doesn't match any of the CMS OIDs we know about. */ ++static const EVP_MD * ++md_from_cms_oid(const krb5_data *alg_id) ++{ ++ if (data_eq(*alg_id, cms_sha1_id)) ++ return EVP_sha1(); ++ if (data_eq(*alg_id, cms_sha256_id)) ++ return EVP_sha256(); ++ if (data_eq(*alg_id, cms_sha384_id)) ++ return EVP_sha384(); ++ if (data_eq(*alg_id, cms_sha512_id)) ++ return EVP_sha512(); ++ return NULL; ++} ++ ++/* Compute a message digest of the given type over body, placing the result in ++ * *digest_out in allocated storage. Return true on success. */ ++static krb5_boolean ++make_digest(const krb5_data *body, const EVP_MD *md, krb5_data *digest_out) ++{ ++ krb5_error_code ret; ++ krb5_data d; ++ ++ if (md == NULL) ++ return FALSE; ++ ret = alloc_data(&d, EVP_MD_size(md)); ++ if (ret) ++ return FALSE; ++ if (!EVP_Digest(body->data, body->length, (uint8_t *)d.data, &d.length, md, ++ NULL)) { ++ free(d.data); ++ return FALSE; ++ } ++ *digest_out = d; ++ return TRUE; ++} ++ ++/* Return true if digest verifies for the given body and message digest ++ * type. */ ++static krb5_boolean ++check_digest(const krb5_data *body, const EVP_MD *md, const krb5_data *digest) ++{ ++ unsigned int digest_len; ++ uint8_t buf[EVP_MAX_MD_SIZE]; ++ ++ if (md == NULL) ++ return FALSE; ++ if (!EVP_Digest(body->data, body->length, buf, &digest_len, md, NULL)) ++ return FALSE; ++ return (digest->length == digest_len && ++ CRYPTO_memcmp(digest->data, buf, digest_len) == 0); ++} ++ ++krb5_error_code ++crypto_generate_checksums(krb5_context context, const krb5_data *body, ++ krb5_data *cksum1_out, krb5_pachecksum2 **cksum2_out) ++{ ++ krb5_data cksum1 = empty_data(); ++ krb5_pachecksum2 *cksum2 = NULL; ++ krb5_error_code ret; ++ ++ if (!make_digest(body, EVP_sha1(), &cksum1)) ++ goto fail; ++ ++ cksum2 = k5alloc(sizeof(*cksum2), &ret); ++ if (cksum2 == NULL) ++ goto fail; ++ ++ if (!make_digest(body, EVP_sha256(), &cksum2->checksum)) ++ goto fail; ++ ++ if (krb5int_copy_data_contents(context, &cms_sha256_id, ++ &cksum2->algorithmIdentifier.algorithm)) ++ goto fail; ++ ++ cksum2->algorithmIdentifier.parameters = empty_data(); ++ ++ *cksum1_out = cksum1; ++ *cksum2_out = cksum2; ++ return 0; ++ ++fail: ++ krb5_free_data_contents(context, &cksum1); ++ free_pachecksum2(context, &cksum2); ++ return KRB5_CRYPTO_INTERNAL; ++} ++ ++krb5_error_code ++crypto_verify_checksums(krb5_context context, krb5_data *body, ++ const krb5_data *cksum1, ++ const krb5_pachecksum2 *cksum2) ++{ ++ const EVP_MD *md; ++ ++ /* RFC 4556 doesn't say what error to return if the checksum doesn't match. ++ * Windows returns this one. */ ++ if (!check_digest(body, EVP_sha1(), cksum1)) ++ return KRB5KRB_AP_ERR_MODIFIED; ++ ++ if (cksum2 == NULL) ++ return 0; ++ ++ md = md_from_cms_oid(&cksum2->algorithmIdentifier.algorithm); ++ if (!check_digest(body, md, &cksum2->checksum)) ++ return KRB5KRB_AP_ERR_MODIFIED; ++ ++ return 0; ++} +diff --git a/src/plugins/preauth/pkinit/pkinit_kdf_test.c b/src/plugins/preauth/pkinit/pkinit_kdf_test.c +index 99c93ac128..dd6e8d7503 100644 +--- a/src/plugins/preauth/pkinit/pkinit_kdf_test.c ++++ b/src/plugins/preauth/pkinit/pkinit_kdf_test.c +@@ -126,7 +126,7 @@ main(int argc, char **argv) + + /* TEST 1: SHA-1/AES */ + /* set up algorithm id */ +- alg_id.algorithm = sha1_id; ++ alg_id.algorithm = kdf_sha1_id; + + enctype = enctype_aes; + +@@ -157,7 +157,7 @@ main(int argc, char **argv) + + /* TEST 2: SHA-256/AES */ + /* set up algorithm id */ +- alg_id.algorithm = sha256_id; ++ alg_id.algorithm = kdf_sha256_id; + + enctype = enctype_aes; + +diff --git a/src/plugins/preauth/pkinit/pkinit_lib.c b/src/plugins/preauth/pkinit/pkinit_lib.c +index 25965eb5d2..891f47fd26 100644 +--- a/src/plugins/preauth/pkinit/pkinit_lib.c ++++ b/src/plugins/preauth/pkinit/pkinit_lib.c +@@ -29,6 +29,7 @@ + * SUCH DAMAGES. + */ + ++#include "k5-int.h" + #include "pkinit.h" + + #define FAKECERT +@@ -119,8 +120,9 @@ free_krb5_auth_pack(krb5_auth_pack **in) + { + if ((*in) == NULL) return; + krb5_free_data_contents(NULL, &(*in)->clientPublicValue); +- free((*in)->pkAuthenticator.paChecksum.contents); ++ free((*in)->pkAuthenticator.paChecksum.data); + krb5_free_data(NULL, (*in)->pkAuthenticator.freshnessToken); ++ free_pachecksum2(NULL, &(*in)->pkAuthenticator.paChecksum2); + if ((*in)->supportedCMSTypes != NULL) + free_krb5_algorithm_identifiers(&((*in)->supportedCMSTypes)); + if ((*in)->supportedKDFs) { +@@ -196,6 +198,18 @@ free_krb5_kdc_dh_key_info(krb5_kdc_dh_key_info **in) + free(*in); + } + ++void ++free_pachecksum2(krb5_context context, krb5_pachecksum2 **in) ++{ ++ if (*in == NULL) ++ return; ++ krb5_free_data_contents(context, &(*in)->checksum); ++ krb5_free_data_contents(context, &(*in)->algorithmIdentifier.algorithm); ++ krb5_free_data_contents(context, &(*in)->algorithmIdentifier.parameters); ++ free(*in); ++ *in = NULL; ++} ++ + void + init_krb5_pa_pk_as_req(krb5_pa_pk_as_req **in) + { +diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c +index e22bcb195b..f558308483 100644 +--- a/src/plugins/preauth/pkinit/pkinit_srv.c ++++ b/src/plugins/preauth/pkinit/pkinit_srv.c +@@ -428,11 +428,12 @@ pkinit_server_verify_padata(krb5_context context, + krb5_data authp_data = {0, 0, NULL}, krb5_authz = {0, 0, NULL}; + krb5_pa_pk_as_req *reqp = NULL; + krb5_auth_pack *auth_pack = NULL; ++ krb5_pk_authenticator *pka; + pkinit_kdc_context plgctx = NULL; + pkinit_kdc_req_context reqctx = NULL; + krb5_checksum cksum = {0, 0, 0, NULL}; + krb5_data *der_req = NULL; +- krb5_data k5data, *ftoken; ++ krb5_data k5data; + int is_signed = 1; + krb5_pa_data **e_data = NULL; + krb5_kdcpreauth_modreq modreq = NULL; +@@ -524,8 +525,9 @@ pkinit_server_verify_padata(krb5_context context, + pkiDebug("failed to decode krb5_auth_pack\n"); + goto cleanup; + } ++ pka = &auth_pack->pkAuthenticator; + +- retval = krb5_check_clockskew(context, auth_pack->pkAuthenticator.ctime); ++ retval = krb5_check_clockskew(context, pka->ctime); + if (retval) + goto cleanup; + +@@ -548,36 +550,14 @@ pkinit_server_verify_padata(krb5_context context, + goto cleanup; + } + der_req = cb->request_body(context, rock); +- retval = krb5_c_make_checksum(context, CKSUMTYPE_SHA1, NULL, 0, der_req, +- &cksum); +- if (retval) { +- pkiDebug("unable to calculate AS REQ checksum\n"); +- goto cleanup; +- } +- if (cksum.length != auth_pack->pkAuthenticator.paChecksum.length || +- k5_bcmp(cksum.contents, auth_pack->pkAuthenticator.paChecksum.contents, +- cksum.length) != 0) { +- pkiDebug("failed to match the checksum\n"); +-#ifdef DEBUG_CKSUM +- pkiDebug("calculating checksum on buf size (%d)\n", req_pkt->length); +- print_buffer(req_pkt->data, req_pkt->length); +- pkiDebug("received checksum type=%d size=%d ", +- auth_pack->pkAuthenticator.paChecksum.checksum_type, +- auth_pack->pkAuthenticator.paChecksum.length); +- print_buffer(auth_pack->pkAuthenticator.paChecksum.contents, +- auth_pack->pkAuthenticator.paChecksum.length); +- pkiDebug("expected checksum type=%d size=%d ", +- cksum.checksum_type, cksum.length); +- print_buffer(cksum.contents, cksum.length); +-#endif + +- retval = KRB5KDC_ERR_PA_CHECKSUM_MUST_BE_INCLUDED; ++ retval = crypto_verify_checksums(context, der_req, &pka->paChecksum, ++ pka->paChecksum2); ++ if (retval) + goto cleanup; +- } + +- ftoken = auth_pack->pkAuthenticator.freshnessToken; +- if (ftoken != NULL) { +- retval = cb->check_freshness_token(context, rock, ftoken); ++ if (pka->freshnessToken != NULL) { ++ retval = cb->check_freshness_token(context, rock, pka->freshnessToken); + if (retval) + goto cleanup; + valid_freshness_token = TRUE; +diff --git a/src/plugins/preauth/pkinit/pkinit_trace.h b/src/plugins/preauth/pkinit/pkinit_trace.h +index 1faa6816d7..7b68d4b3b1 100644 +--- a/src/plugins/preauth/pkinit/pkinit_trace.h ++++ b/src/plugins/preauth/pkinit/pkinit_trace.h +@@ -58,8 +58,9 @@ + TRACE(c, "PKINIT client verified DH reply") + #define TRACE_PKINIT_CLIENT_REP_DH_FAIL(c) \ + TRACE(c, "PKINIT client could not verify DH reply") +-#define TRACE_PKINIT_CLIENT_REQ_CHECKSUM(c, cksum) \ +- TRACE(c, "PKINIT client computed kdc-req-body checksum {cksum}", cksum) ++#define TRACE_PKINIT_CLIENT_REQ_CHECKSUMS(c, ck1, ck2) \ ++ TRACE(c, "PKINIT client computed checksums: {hexdata} {hexdata}", \ ++ ck1, &(ck2)->checksum) + #define TRACE_PKINIT_CLIENT_REQ_DH(c) \ + TRACE(c, "PKINIT client making DH request") + #define TRACE_PKINIT_CLIENT_SAN_CONFIG_DNSNAME(c, host) \ +diff --git a/src/tests/asn.1/krb5_decode_test.c b/src/tests/asn.1/krb5_decode_test.c +index 2fa6dce8eb..f47849abad 100644 +--- a/src/tests/asn.1/krb5_decode_test.c ++++ b/src/tests/asn.1/krb5_decode_test.c +@@ -1174,7 +1174,7 @@ main(int argc, char **argv) + /* decode_krb5_auth_pack */ + { + setup(krb5_auth_pack,ktest_make_sample_auth_pack); +- decode_run("krb5_auth_pack","","30 81 85 A0 35 30 33 A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 06 04 04 31 32 33 34 A4 0A 04 08 6B 72 62 35 64 61 74 61 A1 08 04 06 70 76 61 6C 75 65 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61", ++ decode_run("krb5_auth_pack","","30 81 89 A0 39 30 37 A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 0A 04 08 6B 72 62 35 64 61 74 61 A1 08 04 06 70 76 61 6C 75 65 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61", + acc.decode_krb5_auth_pack, + ktest_equal_auth_pack,ktest_free_auth_pack); + ktest_empty_auth_pack(&ref); +diff --git a/src/tests/asn.1/ktest.c b/src/tests/asn.1/ktest.c +index d37e4fa7e6..7f54aa3184 100644 +--- a/src/tests/asn.1/ktest.c ++++ b/src/tests/asn.1/ktest.c +@@ -700,9 +700,7 @@ ktest_make_sample_pk_authenticator(krb5_pk_authenticator *p) + p->cusec = SAMPLE_USEC; + p->ctime = SAMPLE_TIME; + p->nonce = SAMPLE_NONCE; +- ktest_make_sample_checksum(&p->paChecksum); +- /* We don't encode the checksum type, only the contents. */ +- p->paChecksum.checksum_type = 0; ++ ktest_make_sample_data(&p->paChecksum); + p->freshnessToken = ealloc(sizeof(krb5_data)); + ktest_make_sample_data(p->freshnessToken); + } +@@ -1604,8 +1602,7 @@ ktest_empty_pa_otp_req(krb5_pa_otp_req *p) + static void + ktest_empty_pk_authenticator(krb5_pk_authenticator *p) + { +- ktest_empty_checksum(&p->paChecksum); +- p->paChecksum.contents = NULL; ++ ktest_empty_data(&p->paChecksum); + krb5_free_data(NULL, p->freshnessToken); + p->freshnessToken = NULL; + } +diff --git a/src/tests/asn.1/ktest_equal.c b/src/tests/asn.1/ktest_equal.c +index b48a0285d2..13786dd1e5 100644 +--- a/src/tests/asn.1/ktest_equal.c ++++ b/src/tests/asn.1/ktest_equal.c +@@ -844,7 +844,7 @@ ktest_equal_pk_authenticator(krb5_pk_authenticator *ref, + p = p && scalar_equal(cusec); + p = p && scalar_equal(ctime); + p = p && scalar_equal(nonce); +- p = p && struct_equal(paChecksum, ktest_equal_checksum); ++ p = p && data_eq(ref->paChecksum, var->paChecksum); + return p; + } + +diff --git a/src/tests/asn.1/pkinit_encode.out b/src/tests/asn.1/pkinit_encode.out +index 6ec7aaa36a..a764182e15 100644 +--- a/src/tests/asn.1/pkinit_encode.out ++++ b/src/tests/asn.1/pkinit_encode.out +@@ -1,7 +1,7 @@ + encode_krb5_pa_pk_as_req: 30 38 80 08 6B 72 62 35 64 61 74 61 A1 22 30 20 30 1E 80 08 6B 72 62 35 64 61 74 61 81 08 6B 72 62 35 64 61 74 61 82 08 6B 72 62 35 64 61 74 61 82 08 6B 72 62 35 64 61 74 61 + encode_krb5_pa_pk_as_rep(dhInfo): A0 28 30 26 80 08 6B 72 62 35 64 61 74 61 A1 0A 04 08 6B 72 62 35 64 61 74 61 A2 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61 + encode_krb5_pa_pk_as_rep(encKeyPack): 81 08 6B 72 62 35 64 61 74 61 +-encode_krb5_auth_pack: 30 81 85 A0 35 30 33 A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 06 04 04 31 32 33 34 A4 0A 04 08 6B 72 62 35 64 61 74 61 A1 08 04 06 70 76 61 6C 75 65 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61 ++encode_krb5_auth_pack: 30 81 89 A0 39 30 37 A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 0A 04 08 6B 72 62 35 64 61 74 61 A1 08 04 06 70 76 61 6C 75 65 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61 + encode_krb5_kdc_dh_key_info: 30 25 A0 0B 03 09 00 6B 72 62 35 64 61 74 61 A1 03 02 01 2A A2 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A + encode_krb5_reply_key_pack: 30 26 A0 13 30 11 A0 03 02 01 01 A1 0A 04 08 31 32 33 34 35 36 37 38 A1 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34 + encode_krb5_sp80056a_other_info: 30 81 81 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A0 32 04 30 30 2E A0 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A1 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A1 32 04 30 30 2E A0 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A1 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A2 0A 04 08 6B 72 62 35 64 61 74 61 +diff --git a/src/tests/asn.1/pkinit_trval.out b/src/tests/asn.1/pkinit_trval.out +index 46f4a34108..c47bd71f67 100644 +--- a/src/tests/asn.1/pkinit_trval.out ++++ b/src/tests/asn.1/pkinit_trval.out +@@ -38,7 +38,7 @@ encode_krb5_auth_pack: + . . [0] [Integer] 123456 + . . [1] [Generalized Time] "19940610060317Z" + . . [2] [Integer] 42 +-. . [3] [Octet String] "1234" ++. . [3] [Octet String] "krb5data" + . . [4] [Octet String] "krb5data" + . [1] [Octet String] "pvalue" + . [2] [Sequence/Sequence Of] +-- +2.49.0 + diff --git a/0038-downstream-Do-not-block-HMAC-MD4-5-in-FIPS-mode.patch b/0038-downstream-Do-not-block-HMAC-MD4-5-in-FIPS-mode.patch new file mode 100644 index 0000000..4b49867 --- /dev/null +++ b/0038-downstream-Do-not-block-HMAC-MD4-5-in-FIPS-mode.patch @@ -0,0 +1,381 @@ +From 33afd2a6cfdf87d153170b41fbabfb92be49c422 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Thu, 10 Apr 2025 10:04:22 +0200 +Subject: [PATCH] [downstream] Do not block HMAC-MD4/5 in FIPS mode + +To ensure RC4 HMAC-MD5 was not used in FIPS mode, access to HMAC-MD4/5 +was not allowed in this mode. However, since we provide the +"radius_md5_fips_override" configuration parameter to allow using RADIUS +regardless to the FIPS restrictions, we should allow HMAC-MD5 to be used +too in this case, because it is required for the newly supported +Message-Authenticator attribute. + +A FIPS mode check is added in calculate_mac() which will fail if +"radius_md5_fips_override" is not true. It will not affect interactions +between krb5kdc and ipa-otpd, because the Message-Authenticator +attribute is not generated in this case. +--- + src/lib/crypto/krb/crypto_int.h | 9 +++ + src/lib/crypto/openssl/Makefile.in | 9 ++- + src/lib/crypto/openssl/common.c | 80 +++++++++++++++++++ + .../crypto/openssl/hash_provider/hash_evp.c | 62 ++------------ + src/lib/crypto/openssl/hmac.c | 15 ++-- + src/lib/krad/packet.c | 19 +++-- + 6 files changed, 120 insertions(+), 74 deletions(-) + create mode 100644 src/lib/crypto/openssl/common.c + +diff --git a/src/lib/crypto/krb/crypto_int.h b/src/lib/crypto/krb/crypto_int.h +index 1ee4b30e02..ff67b6bd35 100644 +--- a/src/lib/crypto/krb/crypto_int.h ++++ b/src/lib/crypto/krb/crypto_int.h +@@ -36,6 +36,9 @@ + + #include + #if OPENSSL_VERSION_NUMBER >= 0x30000000L ++ ++#include ++ + /* + * OpenSSL 3.0 relegates MD4 and RC4 to the legacy provider, which must be + * explicitly loaded into a library context. Performing this loading within a +@@ -660,4 +663,10 @@ iov_cursor_advance(struct iov_cursor *c, size_t nblocks) + c->out_pos += nblocks * c->block_size; + } + ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++ ++krb5_error_code k5_get_ossl_legacy_libctx(OSSL_LIB_CTX **libctx); ++ ++#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */ ++ + #endif /* CRYPTO_INT_H */ +diff --git a/src/lib/crypto/openssl/Makefile.in b/src/lib/crypto/openssl/Makefile.in +index 8e4cdb8bbf..cc131000bd 100644 +--- a/src/lib/crypto/openssl/Makefile.in ++++ b/src/lib/crypto/openssl/Makefile.in +@@ -8,21 +8,24 @@ STLIBOBJS=\ + hmac.o \ + kdf.o \ + pbkdf2.o \ +- sha256.o ++ sha256.o \ ++ common.o + + OBJS=\ + $(OUTPRE)cmac.$(OBJEXT) \ + $(OUTPRE)hmac.$(OBJEXT) \ + $(OUTPRE)kdf.$(OBJEXT) \ + $(OUTPRE)pbkdf2.$(OBJEXT) \ +- $(OUTPRE)sha256.$(OBJEXT) ++ $(OUTPRE)sha256.$(OBJEXT) \ ++ $(OUTPRE)common.$(OBJEXT) + + SRCS=\ + $(srcdir)/cmac.c \ + $(srcdir)/hmac.c \ + $(srcdir)/kdf.c \ + $(srcdir)/pbkdf2.c \ +- $(srcdir)/sha256.c ++ $(srcdir)/sha256.c \ ++ $(srcdir)/common.c + + SUBDIROBJLISTS= md4/OBJS.ST \ + md5/OBJS.ST sha1/OBJS.ST sha2/OBJS.ST \ +diff --git a/src/lib/crypto/openssl/common.c b/src/lib/crypto/openssl/common.c +new file mode 100644 +index 0000000000..ced43fd54c +--- /dev/null ++++ b/src/lib/crypto/openssl/common.c +@@ -0,0 +1,80 @@ ++#include "crypto_int.h" ++ ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++ ++#include ++#include ++#include ++#include ++ ++typedef struct ossl_legacy_context { ++ bool initialized; ++ OSSL_LIB_CTX *libctx; ++ OSSL_PROVIDER *default_provider; ++ OSSL_PROVIDER *legacy_provider; ++} ossl_legacy_context_t; ++ ++static thread_local ossl_legacy_context_t g_ossl_legacy_ctx; ++ ++static krb5_error_code ++init_ossl_legacy_ctx(ossl_legacy_context_t *ctx) ++{ ++ ctx->libctx = OSSL_LIB_CTX_new(); ++ if (!ctx->libctx) ++ return KRB5_CRYPTO_INTERNAL; ++ ++ /* Load both legacy and default provider as both may be needed. */ ++ ctx->default_provider = OSSL_PROVIDER_load(ctx->libctx, "default"); ++ ctx->legacy_provider = OSSL_PROVIDER_load(ctx->libctx, "legacy"); ++ ++ if (!(ctx->default_provider && ctx->legacy_provider)) ++ return KRB5_CRYPTO_INTERNAL; ++ ++ ctx->initialized = true; ++ return 0; ++} ++ ++static void ++deinit_ossl_legacy_ctx(ossl_legacy_context_t *ctx) ++{ ++ if (ctx->legacy_provider) ++ OSSL_PROVIDER_unload(ctx->legacy_provider); ++ ++ if (ctx->default_provider) ++ OSSL_PROVIDER_unload(ctx->default_provider); ++ ++ if (ctx->libctx) ++ OSSL_LIB_CTX_free(ctx->libctx); ++ ++ ctx->initialized = false; ++} ++ ++krb5_error_code ++k5_get_ossl_legacy_libctx(OSSL_LIB_CTX **libctx) ++{ ++ krb5_error_code err; ++ ++ if (!FIPS_mode()) { ++ if (libctx) ++ *libctx = NULL; ++ err = 0; ++ goto end; ++ } ++ ++ if (!g_ossl_legacy_ctx.initialized) { ++ err = init_ossl_legacy_ctx(&g_ossl_legacy_ctx); ++ if (err) { ++ deinit_ossl_legacy_ctx(&g_ossl_legacy_ctx); ++ goto end; ++ } ++ } ++ ++ if (libctx) ++ *libctx = g_ossl_legacy_ctx.libctx; ++ err = 0; ++ ++end: ++ return err; ++} ++ ++#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */ +diff --git a/src/lib/crypto/openssl/hash_provider/hash_evp.c b/src/lib/crypto/openssl/hash_provider/hash_evp.c +index eb2e693e9f..2fd5d383d6 100644 +--- a/src/lib/crypto/openssl/hash_provider/hash_evp.c ++++ b/src/lib/crypto/openssl/hash_provider/hash_evp.c +@@ -44,48 +44,7 @@ + #define EVP_MD_CTX_free EVP_MD_CTX_destroy + #endif + +-#include + #include +-#include +- +-typedef struct ossl_lib_md_context { +- OSSL_LIB_CTX *libctx; +- OSSL_PROVIDER *default_provider; +- OSSL_PROVIDER *legacy_provider; +-} ossl_md_context_t; +- +-static thread_local ossl_md_context_t *ossl_md_ctx = NULL; +- +-static krb5_error_code +-init_ossl_md_ctx(ossl_md_context_t *ctx, const char *algo) +-{ +- ctx->libctx = OSSL_LIB_CTX_new(); +- if (!ctx->libctx) +- return KRB5_CRYPTO_INTERNAL; +- +- /* Load both legacy and default provider as both may be needed. */ +- ctx->default_provider = OSSL_PROVIDER_load(ctx->libctx, "default"); +- ctx->legacy_provider = OSSL_PROVIDER_load(ctx->libctx, "legacy"); +- +- if (!(ctx->default_provider && ctx->legacy_provider)) +- return KRB5_CRYPTO_INTERNAL; +- +- return 0; +-} +- +-static void +-deinit_ossl_ctx(ossl_md_context_t *ctx) +-{ +- if (ctx->legacy_provider) +- OSSL_PROVIDER_unload(ctx->legacy_provider); +- +- if (ctx->default_provider) +- OSSL_PROVIDER_unload(ctx->default_provider); +- +- if (ctx->libctx) +- OSSL_LIB_CTX_free(ctx->libctx); +-} +- + + static krb5_error_code + hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data, +@@ -120,25 +79,14 @@ hash_legacy_evp(const char *algo, const krb5_crypto_iov *data, size_t num_data, + krb5_data *output) + { + krb5_error_code err; ++ OSSL_LIB_CTX *ossl_libctx; + EVP_MD *md = NULL; + +- if (!ossl_md_ctx) { +- ossl_md_ctx = malloc(sizeof(ossl_md_context_t)); +- if (!ossl_md_ctx) { +- err = ENOMEM; +- goto end; +- } +- +- err = init_ossl_md_ctx(ossl_md_ctx, algo); +- if (err) { +- deinit_ossl_ctx(ossl_md_ctx); +- free(ossl_md_ctx); +- ossl_md_ctx = NULL; +- goto end; +- } +- } ++ err = k5_get_ossl_legacy_libctx(&ossl_libctx); ++ if (err) ++ goto end; + +- md = EVP_MD_fetch(ossl_md_ctx->libctx, algo, NULL); ++ md = EVP_MD_fetch(ossl_libctx, algo, NULL); + if (!md) { + err = KRB5_CRYPTO_INTERNAL; + goto end; +diff --git a/src/lib/crypto/openssl/hmac.c b/src/lib/crypto/openssl/hmac.c +index 25a419d73a..8f9e88fec9 100644 +--- a/src/lib/crypto/openssl/hmac.c ++++ b/src/lib/crypto/openssl/hmac.c +@@ -59,7 +59,6 @@ + #if OPENSSL_VERSION_NUMBER >= 0x30000000L + #include + #include +-#include + #else + #include + #endif +@@ -112,11 +111,7 @@ map_digest(const struct krb5_hash_provider *hash) + return EVP_sha256(); + else if (hash == &krb5int_hash_sha384) + return EVP_sha384(); +- +- if (FIPS_mode()) +- return NULL; +- +- if (hash == &krb5int_hash_md5) ++ else if (hash == &krb5int_hash_md5) + return EVP_md5(); + else if (hash == &krb5int_hash_md4) + return EVP_md4(); +@@ -138,13 +133,19 @@ krb5int_hmac_keyblock(const struct krb5_hash_provider *hash, + EVP_MAC_CTX *ctx = NULL; + OSSL_PARAM params[2], *p = params; + size_t i = 0, md_len; ++ OSSL_LIB_CTX *ossl_libctx; ++ krb5_error_code err; + + if (md == NULL || keyblock->length > hash->blocksize) + return KRB5_CRYPTO_INTERNAL; + if (output->length < hash->hashsize) + return KRB5_BAD_MSIZE; + +- mac = EVP_MAC_fetch(NULL, "HMAC", NULL); ++ err = k5_get_ossl_legacy_libctx(&ossl_libctx); ++ if (err) ++ return err; ++ ++ mac = EVP_MAC_fetch(ossl_libctx, "HMAC", NULL); + if (mac == NULL) + return KRB5_CRYPTO_INTERNAL; + +diff --git a/src/lib/krad/packet.c b/src/lib/krad/packet.c +index 3c1a4d507e..b95c99df65 100644 +--- a/src/lib/krad/packet.c ++++ b/src/lib/krad/packet.c +@@ -278,7 +278,7 @@ lookup_msgauth_addr(const krad_packet *pkt) + * auth, which may be from pkt or from a corresponding request. + */ + static krb5_error_code +-calculate_mac(const char *secret, const krad_packet *pkt, ++calculate_mac(krb5_context ctx, const char *secret, const krad_packet *pkt, + const uint8_t auth[AUTH_FIELD_SIZE], + uint8_t mac_out[MD5_DIGEST_SIZE]) + { +@@ -288,6 +288,10 @@ calculate_mac(const char *secret, const krad_packet *pkt, + krb5_crypto_iov input[5]; + krb5_data ksecr, mac; + ++ /* Do not use HMAC-MD5 if not explicitly allowed */ ++ if (kr_use_fips(ctx)) ++ return KRB5_CRYPTO_INTERNAL; ++ + msgauth_attr = lookup_msgauth_addr(pkt); + if (msgauth_attr == NULL) + return EINVAL; +@@ -393,7 +397,8 @@ krad_packet_new_request(krb5_context ctx, const char *secret, krad_code code, + + if (msgauth_required) { + /* Calculate and set the Message-Authenticator MAC. */ +- retval = calculate_mac(secret, pkt, pkt_auth(pkt), pkt_attr(pkt) + 2); ++ retval = calculate_mac(ctx, secret, pkt, pkt_auth(pkt), ++ pkt_attr(pkt) + 2); + if (retval != 0) + goto error; + } +@@ -454,7 +459,7 @@ krad_packet_new_response(krb5_context ctx, const char *secret, krad_code code, + * section 5.14, use the authenticator from the request, not from the + * response. + */ +- retval = calculate_mac(secret, pkt, pkt_auth(request), ++ retval = calculate_mac(ctx, secret, pkt, pkt_auth(request), + pkt_attr(pkt) + 2); + if (retval != 0) + goto error; +@@ -476,7 +481,7 @@ error: + /* Verify the Message-Authenticator value in pkt, using the provided + * authenticator (which may be from pkt or from a corresponding request). */ + static krb5_error_code +-verify_msgauth(const char *secret, const krad_packet *pkt, ++verify_msgauth(krb5_context ctx, const char *secret, const krad_packet *pkt, + const uint8_t auth[AUTH_FIELD_SIZE]) + { + uint8_t mac[MD5_DIGEST_SIZE]; +@@ -488,7 +493,7 @@ verify_msgauth(const char *secret, const krad_packet *pkt, + if (msgauth == NULL) + return ENODATA; + +- retval = calculate_mac(secret, pkt, auth, mac); ++ retval = calculate_mac(ctx, secret, pkt, auth, mac); + if (retval) + return retval; + +@@ -561,7 +566,7 @@ krad_packet_decode_request(krb5_context ctx, const char *secret, + + /* Verify Message-Authenticator if present. */ + if (has_pkt_msgauth(req)) { +- retval = verify_msgauth(secret, req, pkt_auth(req)); ++ retval = verify_msgauth(ctx, secret, req, pkt_auth(req)); + if (retval) { + krad_packet_free(req); + return retval; +@@ -613,7 +618,7 @@ krad_packet_decode_response(krb5_context ctx, const char *secret, + + /* Verify Message-Authenticator if present. */ + if (has_pkt_msgauth(*rsppkt)) { +- if (verify_msgauth(secret, *rsppkt, pkt_auth(tmp)) != 0) ++ if (verify_msgauth(ctx, secret, *rsppkt, pkt_auth(tmp)) != 0) + continue; + } + +-- +2.49.0 + diff --git a/kdc.conf b/kdc.conf index c504e58..7b788e5 100644 --- a/kdc.conf +++ b/kdc.conf @@ -1,3 +1,7 @@ +[libdefaults] +# Allow RC4 HMAC-MD5 for session keys (see CVE-2022-37966) +#allow_rc4 = true + [kdcdefaults] kdc_ports = 88 kdc_tcp_ports = 88 diff --git a/krb5.spec b/krb5.spec index 963df35..ee6f6bc 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 5 +%global baserelease 6 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -93,6 +93,10 @@ Patch0031: 0031-Support-PKCS11-EC-client-certs-in-PKINIT.patch Patch0032: 0032-Improve-PKCS11-error-reporting-in-PKINIT.patch Patch0033: 0033-Set-missing-mask-flags-for-kdb5_util-operations.patch Patch0034: 0034-Prevent-overflow-when-calculating-ulog-block-size.patch +Patch0035: 0035-Don-t-issue-session-keys-with-deprecated-enctypes.patch +Patch0036: 0036-downstream-Remove-3des-support-cumulative-1.patch +Patch0037: 0037-Add-PKINIT-paChecksum2-from-MS-PKCA-v20230920.patch +Patch0038: 0038-downstream-Do-not-block-HMAC-MD4-5-in-FIPS-mode.patch License: Brian-Gladman-2-Clause AND BSD-2-Clause AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-first-lines AND BSD-3-Clause AND BSD-4-Clause AND CMU-Mach-nodoc AND FSFULLRWD AND HPND AND HPND-export2-US AND HPND-export-US AND HPND-export-US-acknowledgement AND HPND-export-US-modify AND ISC AND MIT AND MIT-CMU AND OLDAP-2.8 AND OpenVision URL: https://web.mit.edu/kerberos/www/ @@ -527,14 +531,16 @@ install -pdm 755 $RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch} pushd src cp -p --parents -t "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}/" \ $(find . -type f -exec file -i "{}" + \ - | sed -ne 's|^\./\([^:]\+\): \+text/.\+$|\1|p' | grep -Ev '~$') + | sed -n \ + -e 's|^\./\([^:]\+\): \+text/.\+$|\1|p' \ + -e 's|^\./\([^:]\+\): \+application/x-pem-file.\+$|\1|p' \ + -e 's|^\./\([^:]\+\): \+application/json.\+$|\1|p' \ + | grep -Ev '~$') popd # Copy binary test files install -pm 644 src/tests/pkinit-certs/*.p12 \ "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}/tests/pkinit-certs/" -install -pm 644 src/tests/au_dict.json \ - "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}/tests/" # Unset executable bit if no shebang in script for f in $(find "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}/" -type f -executable) @@ -736,6 +742,14 @@ exit 0 %{_datarootdir}/%{name}-tests/%{_arch} %changelog +* Wed Jun 04 2025 Julien Rische - 1.21.3-6 +- Do not block HMAC-MD4/5 in FIPS mode + Resolves: rhbz#2370259 +- PKINIT: implement paChecksum2 from MS-PKCA v20230920 + Resolves: rhbz#2357215 +- Disallow RC4 HMAC-MD5 session keys by default (CVE-2025-3576) + Resolves: rhbz#2359705 + * Wed Jan 29 2025 Julien Rische - 1.21.3-5 - Prevent overflow when calculating ulog block size (CVE-2025-24528) Resolves: rhbz#2342798 From a0a34794e3406590da2b40a34e2a0f976a2fdbdc Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 18:57:33 +0000 Subject: [PATCH 099/103] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- krb5.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/krb5.spec b/krb5.spec index ee6f6bc..a40d0d6 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 6 +%global baserelease 7 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -742,6 +742,9 @@ exit 0 %{_datarootdir}/%{name}-tests/%{_arch} %changelog +* Thu Jul 24 2025 Fedora Release Engineering - 1.21.3-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Wed Jun 04 2025 Julien Rische - 1.21.3-6 - Do not block HMAC-MD4/5 in FIPS mode Resolves: rhbz#2370259 From fb94528750570f9ba4a7bba81780c37a329b1a16 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Sun, 21 Sep 2025 16:54:16 +0300 Subject: [PATCH 100/103] Test automated FAST channel acquisition during TGS-REQ Upstream PR: https://github.com/krb5/krb5/pull/1447 It can be tested by using fedora-packager-kerberos from Rawhide against Fedora KDC. If packagers have OTP tokens enabled, kinit will automatically propose to enter password+OTP token value. Signed-off-by: Alexander Bokovoy --- 0040-automated-fast.patch | 223 ++++++++++++++++++++++++++++++++++++++ krb5.spec | 8 +- 2 files changed, 230 insertions(+), 1 deletion(-) create mode 100644 0040-automated-fast.patch diff --git a/0040-automated-fast.patch b/0040-automated-fast.patch new file mode 100644 index 0000000..7094309 --- /dev/null +++ b/0040-automated-fast.patch @@ -0,0 +1,223 @@ +From 76d8eb3814067980cfad31b6c3cc653c5bfbbe9b Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Sun, 21 Sep 2025 11:14:51 +0300 +Subject: [PATCH] libkrb5: in case PKINIT is configured, attempt Anonymous + PKINIT for FAST + +If auto_fast_armor is configured for the realm or globally, optimistically +assume that Anonymous PKINIT is supported as well and try to obtain it for +FAST use in case no pre-made FAST channel was established by the caller. + +This behavior will automatically enable use of passwordless pre-authentication +methods which rely on FAST channel presence in deployments such as FreeIPA. + +Notably, Microsoft Active Directory KDCs do not support Anonymous PKINIT. For +these deployments only a machine account (host keytab) can be used to build a +FAST channel. However, libkrb5 does not have access to /etc/krb5.keytab in a +general case. + +Signed-off-by: Alexander Bokovoy +--- + src/lib/krb5/krb/fast.c | 118 ++++++++++++++++++++++++++++++++++++++++ + src/lib/krb5/krb/fast.h | 2 + + src/man/krb5.conf.man | 13 +++++ + 3 files changed, 133 insertions(+) + +diff --git a/src/lib/krb5/krb/fast.c b/src/lib/krb5/krb/fast.c +index 62c9f0841f6..ee2e0818929 100644 +--- a/src/lib/krb5/krb/fast.c ++++ b/src/lib/krb5/krb/fast.c +@@ -168,6 +168,109 @@ krb5int_fast_prep_req_body(krb5_context context, + return retval; + } + ++static krb5_boolean ++fast_is_pkinit_allowed(krb5_context context, krb5_data *realm) ++{ ++ int value; ++ krb5_error_code retval = EINVAL; ++ char realmstr[1024]; ++ const char *option = "auto_fast_armor"; ++ const int def_value = FALSE; ++ ++ if (realm != NULL && realm->length > sizeof(realmstr)-1) ++ return FALSE; ++ ++ if (realm != NULL) { ++ strncpy(realmstr, realm->data, realm->length); ++ realmstr[realm->length] = '\0'; ++ ++ retval = profile_get_boolean(context->profile, ++ KRB5_CONF_REALMS, realmstr, ++ option, def_value, &value); ++ } ++ ++ return retval ? FALSE : value; ++ ++} ++ ++static krb5_error_code ++fast_acquire_pkinit_armor(krb5_context context, ++ struct krb5int_fast_request_state *state, ++ krb5_get_init_creds_opt *opt, krb5_kdc_req *request) ++{ ++ krb5_context ctx; ++ krb5_get_init_creds_opt *options = NULL; ++ krb5_error_code retval = 0; ++ krb5_data *target_realm = &request->server->realm; ++ krb5_creds creds; ++ krb5_principal anon_princ = NULL; ++ krb5_ccache out_cc; ++ ++ /* short circuit, we are asked to perform Anonymous PKINIT already */ ++ if (opt->flags & KRB5_GET_INIT_CREDS_OPT_ANONYMOUS) { ++ return EINVAL; ++ } ++ ++ /* skip realms which do not allow use of automated FAST armor */ ++ if (!fast_is_pkinit_allowed(context, target_realm)) { ++ return EINVAL; ++ } ++ ++ retval = krb5_init_context(&ctx); ++ if (retval != 0) { ++ return retval; ++ } ++ retval = krb5_get_init_creds_opt_alloc(ctx, &options); ++ if (retval != 0) { ++ goto cleanup; ++ } ++ krb5_get_init_creds_opt_set_anonymous(options, 1); ++ retval = krb5_cc_new_unique(ctx, "MEMORY", NULL, &out_cc); ++ if (retval != 0) { ++ goto cleanup; ++ } ++ ++ retval = krb5_get_init_creds_opt_set_out_ccache(ctx, options, out_cc); ++ if (retval != 0) { ++ goto cleanup; ++ } ++ ++ retval = krb5_build_principal_ext(ctx, &anon_princ, ++ target_realm->length, target_realm->data, ++ strlen(KRB5_WELLKNOWN_NAMESTR), ++ KRB5_WELLKNOWN_NAMESTR, ++ strlen(KRB5_ANONYMOUS_PRINCSTR), ++ KRB5_ANONYMOUS_PRINCSTR, 0); ++ if (retval != 0) { ++ goto cleanup; ++ } ++ ++ retval = krb5_get_init_creds_password(ctx, &creds, anon_princ, 0, ++ NULL /* no prompter */, NULL, ++ 0, NULL /* service name */, ++ options); ++ if (retval == 0) { ++ state->fast_state_flags |= KRB5INT_FAST_OWN_ARMOR; ++ state->armor_ccache = out_cc; ++ } ++cleanup: ++ if (retval != 0 && out_cc != NULL) { ++ (void) krb5_cc_destroy(ctx, out_cc); ++ } ++ if (retval == 0) { ++ krb5_free_cred_contents(ctx, &creds); ++ } ++ if (options != NULL) { ++ krb5_get_init_creds_opt_free(ctx, options); ++ } ++ if (anon_princ != NULL) { ++ krb5_free_principal(ctx, anon_princ); ++ } ++ krb5_free_context(ctx); ++ ++ return retval; ++} ++ + krb5_error_code + krb5int_fast_as_armor(krb5_context context, + struct krb5int_fast_request_state *state, +@@ -178,10 +281,20 @@ krb5int_fast_as_armor(krb5_context context, + krb5_principal target_principal = NULL; + krb5_data *target_realm; + const char *ccname = k5_gic_opt_get_fast_ccache_name(opt); ++ char *fast_ccname = NULL; + krb5_flags fast_flags; + + krb5_clear_error_message(context); + target_realm = &request->server->realm; ++ if (ccname == NULL) { ++ retval = fast_acquire_pkinit_armor(context, state, opt, request); ++ if (retval == 0) { ++ retval = krb5_cc_get_full_name(context, state->armor_ccache, &fast_ccname); ++ if (retval == 0 && fast_ccname != NULL) ++ ccname = fast_ccname; ++ } ++ retval = 0; ++ } + if (ccname != NULL) { + TRACE_FAST_ARMOR_CCACHE(context, ccname); + state->fast_state_flags |= KRB5INT_FAST_ARMOR_AVAIL; +@@ -220,6 +333,8 @@ krb5int_fast_as_armor(krb5_context context, + krb5_cc_close(context, ccache); + if (target_principal) + krb5_free_principal(context, target_principal); ++ if (fast_ccname) ++ free(fast_ccname); + return retval; + } + +@@ -615,6 +730,9 @@ krb5int_fast_free_state(krb5_context context, + /*We are responsible for none of the store in the fast_outer_req*/ + krb5_free_keyblock(context, state->armor_key); + krb5_free_fast_armor(context, state->armor); ++ if (state->fast_state_flags & KRB5INT_FAST_OWN_ARMOR) { ++ krb5_cc_destroy(context, state->armor_ccache); ++ } + free(state); + } + +diff --git a/src/lib/krb5/krb/fast.h b/src/lib/krb5/krb/fast.h +index 7156ea203f1..e5fe8bd5443 100644 +--- a/src/lib/krb5/krb/fast.h ++++ b/src/lib/krb5/krb/fast.h +@@ -34,6 +34,7 @@ struct krb5int_fast_request_state { + krb5_kdc_req fast_outer_request; + krb5_keyblock *armor_key; /*non-null means fast is in use*/ + krb5_fast_armor *armor; ++ krb5_ccache armor_ccache; + krb5_ui_4 fast_state_flags; + krb5_ui_4 fast_options; + krb5_int32 nonce; +@@ -41,6 +42,7 @@ struct krb5int_fast_request_state { + + #define KRB5INT_FAST_DO_FAST (1l<<0) /* Perform FAST */ + #define KRB5INT_FAST_ARMOR_AVAIL (1l<<1) ++#define KRB5INT_FAST_OWN_ARMOR (1l<<2) + + krb5_error_code + krb5int_fast_prep_req_body(krb5_context context, +diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man +index 6c0e9aff8c4..fc6ebec03a9 100644 +--- a/src/man/krb5.conf.man ++++ b/src/man/krb5.conf.man +@@ -650,6 +650,19 @@ primary KDC, in case the user\(aqs password has just been changed, and + the updated database has not been propagated to the replica + servers yet. New in release 1.19. + .TP ++\fBauto_fast_armor\fP ++If this flag is true, then initial ticket request will use Anonymous ++PKINIT to protect the communication as a FAST channel in case an application ++did not provide its own FAST channel.This is useful for deployments where ++pre-authentication methods require use of the FAST channel, such as ++passwordless methods provided by FreeIPA. Microsoft Active Directory ++implementation of PKINIT does not support Anonymous PKINIT feature. ++As a result, \fIauto_fast_armor\fP defaults to false. ++.sp ++Use of \fIauto_fast_armor = true\fP requires properly configured PKINIT and ++WELLKNOWN/ANONYMOUS principal defined on the KDC side. Consult KDC documentation ++for details. ++.TP + \fBv4_instance_convert\fP + This subsection allows the administrator to configure exceptions + to the \fBdefault_domain\fP mapping rule. It contains V4 instances diff --git a/krb5.spec b/krb5.spec index a40d0d6..bfdfbe4 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 7 +%global baserelease 8 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -97,6 +97,7 @@ Patch0035: 0035-Don-t-issue-session-keys-with-deprecated-enctypes.patch Patch0036: 0036-downstream-Remove-3des-support-cumulative-1.patch Patch0037: 0037-Add-PKINIT-paChecksum2-from-MS-PKCA-v20230920.patch Patch0038: 0038-downstream-Do-not-block-HMAC-MD4-5-in-FIPS-mode.patch +Patch0040: 0040-automated-fast.patch License: Brian-Gladman-2-Clause AND BSD-2-Clause AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-first-lines AND BSD-3-Clause AND BSD-4-Clause AND CMU-Mach-nodoc AND FSFULLRWD AND HPND AND HPND-export2-US AND HPND-export-US AND HPND-export-US-acknowledgement AND HPND-export-US-modify AND ISC AND MIT AND MIT-CMU AND OLDAP-2.8 AND OpenVision URL: https://web.mit.edu/kerberos/www/ @@ -742,6 +743,11 @@ exit 0 %{_datarootdir}/%{name}-tests/%{_arch} %changelog +* Fri Sep 26 2025 Alexander Bokovoy - 1.21.3-8 +- Add automated FAST channel for kinit +- https://github.com/krb5/krb5/pull/1447 - work in progress + + * Thu Jul 24 2025 Fedora Release Engineering - 1.21.3-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From 53c3b9de3c1fdac923a38c41b46b6cd2728ea0bc Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 15 Oct 2025 08:44:31 +0300 Subject: [PATCH 101/103] Reject pre-authentication that requries a prompter if no prompter was provided Resolves: rhbz#2403513 Signed-off-by: Alexander Bokovoy --- 0040-automated-fast.patch | 64 +++++++++++++++++++++++++++++++++++---- krb5.spec | 6 +++- 2 files changed, 63 insertions(+), 7 deletions(-) diff --git a/0040-automated-fast.patch b/0040-automated-fast.patch index 7094309..e9665d5 100644 --- a/0040-automated-fast.patch +++ b/0040-automated-fast.patch @@ -1,7 +1,7 @@ -From 76d8eb3814067980cfad31b6c3cc653c5bfbbe9b Mon Sep 17 00:00:00 2001 +From 3baf9b93dc1dfe38585722c71d7268304cb4a01a Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Sun, 21 Sep 2025 11:14:51 +0300 -Subject: [PATCH] libkrb5: in case PKINIT is configured, attempt Anonymous +Subject: [PATCH 1/2] libkrb5: in case PKINIT is configured, attempt Anonymous PKINIT for FAST If auto_fast_armor is configured for the realm or globally, optimistically @@ -24,7 +24,7 @@ Signed-off-by: Alexander Bokovoy 3 files changed, 133 insertions(+) diff --git a/src/lib/krb5/krb/fast.c b/src/lib/krb5/krb/fast.c -index 62c9f0841f6..ee2e0818929 100644 +index 62c9f0841..ee2e08189 100644 --- a/src/lib/krb5/krb/fast.c +++ b/src/lib/krb5/krb/fast.c @@ -168,6 +168,109 @@ krb5int_fast_prep_req_body(krb5_context context, @@ -178,7 +178,7 @@ index 62c9f0841f6..ee2e0818929 100644 } diff --git a/src/lib/krb5/krb/fast.h b/src/lib/krb5/krb/fast.h -index 7156ea203f1..e5fe8bd5443 100644 +index 7156ea203..e5fe8bd54 100644 --- a/src/lib/krb5/krb/fast.h +++ b/src/lib/krb5/krb/fast.h @@ -34,6 +34,7 @@ struct krb5int_fast_request_state { @@ -198,7 +198,7 @@ index 7156ea203f1..e5fe8bd5443 100644 krb5_error_code krb5int_fast_prep_req_body(krb5_context context, diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man -index 6c0e9aff8c4..fc6ebec03a9 100644 +index d4caa2bd3..ac7649647 100644 --- a/src/man/krb5.conf.man +++ b/src/man/krb5.conf.man @@ -650,6 +650,19 @@ primary KDC, in case the user\(aqs password has just been changed, and @@ -208,7 +208,7 @@ index 6c0e9aff8c4..fc6ebec03a9 100644 +\fBauto_fast_armor\fP +If this flag is true, then initial ticket request will use Anonymous +PKINIT to protect the communication as a FAST channel in case an application -+did not provide its own FAST channel.This is useful for deployments where ++did not provide its own FAST channel. This is useful for deployments where +pre-authentication methods require use of the FAST channel, such as +passwordless methods provided by FreeIPA. Microsoft Active Directory +implementation of PKINIT does not support Anonymous PKINIT feature. @@ -221,3 +221,55 @@ index 6c0e9aff8c4..fc6ebec03a9 100644 \fBv4_instance_convert\fP This subsection allows the administrator to configure exceptions to the \fBdefault_domain\fP mapping rule. It contains V4 instances +-- +2.51.0 + + +From 0d23c5ddf61e8c4620e4af542079bbacf051fa12 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Wed, 15 Oct 2025 08:31:38 +0300 +Subject: [PATCH 2/2] otp: bail if prompter is not specified but required + +GSSAPI gss_init_sec_context() may trigger credential re-initialization +if the cred in ccache is expired. If automatic FAST armor is in use, +we'd request Anonymous PKINIT and use it as an armor and this will +enable seeing pre-authentication methods which require armor presence. + +OTP is one of such methods and its use requires prompter to be set, +but GSSAPI cannot specify a prompter and thus we should fail any +pre-auth where a prompter wasn't passed. + +Signed-off-by: Alexander Bokovoy +--- + src/lib/krb5/krb/preauth_otp.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/src/lib/krb5/krb/preauth_otp.c b/src/lib/krb5/krb/preauth_otp.c +index 07ffc15c2..070b1f74a 100644 +--- a/src/lib/krb5/krb/preauth_otp.c ++++ b/src/lib/krb5/krb/preauth_otp.c +@@ -1072,7 +1072,7 @@ otp_client_process(krb5_context context, krb5_clpreauth_moddata moddata, + krb5_keyblock *as_key = NULL; + krb5_pa_otp_req *req = NULL; + krb5_error_code retval = 0; +- krb5_data value, pin; ++ krb5_data value = {0}, pin = {0}; + const char *answer; + + if (modreq == NULL) +@@ -1094,6 +1094,12 @@ otp_client_process(krb5_context context, krb5_clpreauth_moddata moddata, + retval = codec_decode_answer(context, answer, chl->tokeninfo, &ti, &value, + &pin); + if (retval != 0) { ++ /* If caller didn't setup the prompter, bail out */ ++ if (prompter == NULL) { ++ retval = EINVAL; ++ goto error; ++ } ++ + /* If the responder doesn't have a token selection, + * we need to select the token via prompting. */ + retval = prompt_for_token(context, prompter, prompter_data, +-- +2.51.0 + diff --git a/krb5.spec b/krb5.spec index bfdfbe4..642f8f0 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 8 +%global baserelease 9 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -743,6 +743,10 @@ exit 0 %{_datarootdir}/%{name}-tests/%{_arch} %changelog +* Wed Oct 15 2025 Alexander Bokovoy - 1.21.3-9 +- do not crash when prompter is not available in GSSAPI + Resolves: rhbz#243513 + * Fri Sep 26 2025 Alexander Bokovoy - 1.21.3-8 - Add automated FAST channel for kinit - https://github.com/krb5/krb5/pull/1447 - work in progress From fe6911cd3d84b4d3078af1454a3fcec506d8c074 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Mon, 20 Oct 2025 10:32:09 +0300 Subject: [PATCH 102/103] Update prompter patch to the upstream version Move the prompter patch to a separate one to avoid rebasing the automated FAST one as it is context-dependent in the documentation area. Signed-off-by: Alexander Bokovoy --- 0040-automated-fast.patch | 51 +------------------ ...ompter-is-not-specified-but-required.patch | 40 +++++++++++++++ krb5.spec | 9 +++- 3 files changed, 48 insertions(+), 52 deletions(-) create mode 100644 0041-bail-if-prompter-is-not-specified-but-required.patch diff --git a/0040-automated-fast.patch b/0040-automated-fast.patch index e9665d5..5a64233 100644 --- a/0040-automated-fast.patch +++ b/0040-automated-fast.patch @@ -1,7 +1,7 @@ From 3baf9b93dc1dfe38585722c71d7268304cb4a01a Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Sun, 21 Sep 2025 11:14:51 +0300 -Subject: [PATCH 1/2] libkrb5: in case PKINIT is configured, attempt Anonymous +Subject: libkrb5: in case PKINIT is configured, attempt Anonymous PKINIT for FAST If auto_fast_armor is configured for the realm or globally, optimistically @@ -224,52 +224,3 @@ index d4caa2bd3..ac7649647 100644 -- 2.51.0 - -From 0d23c5ddf61e8c4620e4af542079bbacf051fa12 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Wed, 15 Oct 2025 08:31:38 +0300 -Subject: [PATCH 2/2] otp: bail if prompter is not specified but required - -GSSAPI gss_init_sec_context() may trigger credential re-initialization -if the cred in ccache is expired. If automatic FAST armor is in use, -we'd request Anonymous PKINIT and use it as an armor and this will -enable seeing pre-authentication methods which require armor presence. - -OTP is one of such methods and its use requires prompter to be set, -but GSSAPI cannot specify a prompter and thus we should fail any -pre-auth where a prompter wasn't passed. - -Signed-off-by: Alexander Bokovoy ---- - src/lib/krb5/krb/preauth_otp.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/src/lib/krb5/krb/preauth_otp.c b/src/lib/krb5/krb/preauth_otp.c -index 07ffc15c2..070b1f74a 100644 ---- a/src/lib/krb5/krb/preauth_otp.c -+++ b/src/lib/krb5/krb/preauth_otp.c -@@ -1072,7 +1072,7 @@ otp_client_process(krb5_context context, krb5_clpreauth_moddata moddata, - krb5_keyblock *as_key = NULL; - krb5_pa_otp_req *req = NULL; - krb5_error_code retval = 0; -- krb5_data value, pin; -+ krb5_data value = {0}, pin = {0}; - const char *answer; - - if (modreq == NULL) -@@ -1094,6 +1094,12 @@ otp_client_process(krb5_context context, krb5_clpreauth_moddata moddata, - retval = codec_decode_answer(context, answer, chl->tokeninfo, &ti, &value, - &pin); - if (retval != 0) { -+ /* If caller didn't setup the prompter, bail out */ -+ if (prompter == NULL) { -+ retval = EINVAL; -+ goto error; -+ } -+ - /* If the responder doesn't have a token selection, - * we need to select the token via prompting. */ - retval = prompt_for_token(context, prompter, prompter_data, --- -2.51.0 - diff --git a/0041-bail-if-prompter-is-not-specified-but-required.patch b/0041-bail-if-prompter-is-not-specified-but-required.patch new file mode 100644 index 0000000..d1a3dc7 --- /dev/null +++ b/0041-bail-if-prompter-is-not-specified-but-required.patch @@ -0,0 +1,40 @@ +From ff580d9cf86202d45454a6b6f53accc22cb40b62 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Sun, 19 Oct 2025 18:14:29 +0300 +Subject: [PATCH] bail if prompter is not specified but required + +GSSAPI gss_init_sec_context() may trigger credential re-initialization +if the cred in ccache is expired. If automatic FAST armor is in use, +we'd request Anonymous PKINIT and use it as an armor and this will +enable seeing pre-authentication methods which require armor presence. + +OTP is one of such methods and its use requires prompter to be set, +but GSSAPI cannot specify a prompter and thus we should fail any +pre-auth where a prompter wasn't passed. + +PKINIT PKCS11 and SAM-2 preauth methods use KRB5_LIBOS_CANTREADPWD while PKINIT +and gic_pwd.c use EIO. Use EIO here because we technically attempt to read a +PIN rather than a password. + +Signed-off-by: Alexander Bokovoy +--- + src/lib/krb5/krb/preauth_otp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/lib/krb5/krb/preauth_otp.c b/src/lib/krb5/krb/preauth_otp.c +index 07ffc15c2..48003da62 100644 +--- a/src/lib/krb5/krb/preauth_otp.c ++++ b/src/lib/krb5/krb/preauth_otp.c +@@ -479,6 +479,9 @@ doprompt(krb5_context context, krb5_prompter_fct prompter, void *prompter_data, + krb5_error_code retval; + krb5_prompt_type prompt_type = KRB5_PROMPT_TYPE_PREAUTH; + ++ if (prompter == NULL) ++ return EIO; ++ + if (prompttxt == NULL || out == NULL) + return EINVAL; + +-- +2.51.0 + diff --git a/krb5.spec b/krb5.spec index 642f8f0..2a08b01 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 9 +%global baserelease 10 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -98,6 +98,7 @@ Patch0036: 0036-downstream-Remove-3des-support-cumulative-1.patch Patch0037: 0037-Add-PKINIT-paChecksum2-from-MS-PKCA-v20230920.patch Patch0038: 0038-downstream-Do-not-block-HMAC-MD4-5-in-FIPS-mode.patch Patch0040: 0040-automated-fast.patch +Patch0041: 0041-bail-if-prompter-is-not-specified-but-required.patch License: Brian-Gladman-2-Clause AND BSD-2-Clause AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-first-lines AND BSD-3-Clause AND BSD-4-Clause AND CMU-Mach-nodoc AND FSFULLRWD AND HPND AND HPND-export2-US AND HPND-export-US AND HPND-export-US-acknowledgement AND HPND-export-US-modify AND ISC AND MIT AND MIT-CMU AND OLDAP-2.8 AND OpenVision URL: https://web.mit.edu/kerberos/www/ @@ -743,9 +744,13 @@ exit 0 %{_datarootdir}/%{name}-tests/%{_arch} %changelog +* Mon Oct 20 2025 Alexander Bokovoy - 1.21.3-10 +- Update the prompter patch to upstream version + Resolves: rhbz#2403513 + * Wed Oct 15 2025 Alexander Bokovoy - 1.21.3-9 - do not crash when prompter is not available in GSSAPI - Resolves: rhbz#243513 + Resolves: rhbz#2403513 * Fri Sep 26 2025 Alexander Bokovoy - 1.21.3-8 - Add automated FAST channel for kinit From c2ce5811ff90bf800aa4db73e08d3c4759c3007a Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Wed, 10 Dec 2025 13:12:53 +0100 Subject: [PATCH 103/103] krb5 1.21.3-11 - Fix strchr() conformance to C23 --- 0039-Fix-strchr-conformance-to-C23.patch | 189 +++++++++++++++++++++++ krb5.spec | 7 +- 2 files changed, 194 insertions(+), 2 deletions(-) create mode 100644 0039-Fix-strchr-conformance-to-C23.patch diff --git a/0039-Fix-strchr-conformance-to-C23.patch b/0039-Fix-strchr-conformance-to-C23.patch new file mode 100644 index 0000000..ed2cfa7 --- /dev/null +++ b/0039-Fix-strchr-conformance-to-C23.patch @@ -0,0 +1,189 @@ +From 1761e06398e4f043e4f540f57131c37fcc53a1b9 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Wed, 10 Dec 2025 10:42:02 +0200 +Subject: [PATCH] Fix strchr() conformance to C23 + +C23 7.28.5.1 specifies search functions such as strchr() as generic, +returning const char * if the first argument is of type const char *. +Fix uses of strchr() to conform to this change. + +[jrische@redhat.com: altered changes to avoid casts; fixed an +additional case] +[ghudson@mit.edu: condensed some declarations; rewrote commit message] + +ticket: 9191 (new) +(cherry picked from commit 6cd8580d823585d50ee4f30efd9f7e855823a369) +--- + src/lib/krb5/ccache/ccbase.c | 4 ++-- + src/lib/krb5/os/expand_path.c | 3 ++- + src/lib/krb5/os/locate_kdc.c | 15 +++++++-------- + src/plugins/preauth/pkinit/pkinit_crypto.h | 2 +- + .../preauth/pkinit/pkinit_crypto_openssl.c | 6 +++--- + src/plugins/preauth/pkinit/pkinit_identity.c | 2 +- + src/plugins/preauth/pkinit/pkinit_matching.c | 2 +- + src/tests/responder.c | 3 +-- + 8 files changed, 18 insertions(+), 19 deletions(-) + +diff --git a/src/lib/krb5/ccache/ccbase.c b/src/lib/krb5/ccache/ccbase.c +index 5a01320832..1aada91b5e 100644 +--- a/src/lib/krb5/ccache/ccbase.c ++++ b/src/lib/krb5/ccache/ccbase.c +@@ -201,8 +201,8 @@ krb5_cc_register(krb5_context context, const krb5_cc_ops *ops, + krb5_error_code KRB5_CALLCONV + krb5_cc_resolve (krb5_context context, const char *name, krb5_ccache *cache) + { +- char *pfx, *cp; +- const char *resid; ++ char *pfx; ++ const char *cp, *resid; + unsigned int pfxlen; + krb5_error_code err; + const krb5_cc_ops *ops; +diff --git a/src/lib/krb5/os/expand_path.c b/src/lib/krb5/os/expand_path.c +index 5cbccf08c8..6569b8820b 100644 +--- a/src/lib/krb5/os/expand_path.c ++++ b/src/lib/krb5/os/expand_path.c +@@ -454,7 +454,8 @@ k5_expand_path_tokens_extra(krb5_context context, const char *path_in, + { + krb5_error_code ret; + struct k5buf buf; +- char *tok_begin, *tok_end, *tok_val, **extra_tokens = NULL, *path; ++ const char *tok_begin, *tok_end; ++ char *tok_val, **extra_tokens = NULL, *path; + const char *path_left; + size_t nargs = 0, i; + va_list ap; +diff --git a/src/lib/krb5/os/locate_kdc.c b/src/lib/krb5/os/locate_kdc.c +index edca5ac7eb..47e15c849f 100644 +--- a/src/lib/krb5/os/locate_kdc.c ++++ b/src/lib/krb5/os/locate_kdc.c +@@ -188,8 +188,8 @@ oom: + } + + static void +-parse_uri_if_https(const char *host_or_uri, k5_transport *transport, +- const char **host, const char **uri_path) ++parse_uri_if_https(char *host_or_uri, k5_transport *transport, ++ char **host, const char **uri_path) + { + char *cp; + +@@ -229,8 +229,7 @@ locate_srv_conf_1(krb5_context context, const krb5_data *realm, + k5_transport transport, int udpport) + { + const char *realm_srv_names[4]; +- char **hostlist = NULL, *realmstr = NULL, *host = NULL; +- const char *hostspec; ++ char **hostlist = NULL, *realmstr = NULL, *host = NULL, *hostspec; + krb5_error_code code; + int i, default_port; + +@@ -535,8 +534,8 @@ prof_locate_server(krb5_context context, const krb5_data *realm, + * Return a NULL *host_out if there are any problems parsing the URI. + */ + static void +-parse_uri_fields(const char *uri, k5_transport *transport_out, +- const char **host_out, int *primary_out) ++parse_uri_fields(char *uri, k5_transport *transport_out, ++ char **host_out, int *primary_out) + + { + k5_transport transport; +@@ -604,8 +603,8 @@ locate_uri(krb5_context context, const krb5_data *realm, + krb5_error_code ret; + k5_transport transport, host_trans; + struct srv_dns_entry *answers, *entry; +- char *host; +- const char *host_field, *path; ++ char *host, *host_field; ++ const char *path; + int port, def_port, primary; + + ret = k5_make_uri_query(context, realm, req_service, &answers); +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h +index 3b12e904b1..99e2394040 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto.h ++++ b/src/plugins/preauth/pkinit/pkinit_crypto.h +@@ -456,7 +456,7 @@ krb5_error_code crypto_load_cas_and_crls + defines the storage type (file, directory, etc) */ + int catype, /* IN + defines the ca type (anchor, intermediate, crls) */ +- char *id); /* IN ++ const char *id); /* IN + defines the location (filename, directory name, etc) */ + + /* +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index 429b7d202c..6013080afc 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -4956,7 +4956,7 @@ load_cas_and_crls(krb5_context context, + pkinit_req_crypto_context req_cryptoctx, + pkinit_identity_crypto_context id_cryptoctx, + int catype, +- char *filename) ++ const char *filename) + { + STACK_OF(X509_INFO) *sk = NULL; + STACK_OF(X509) *ca_certs = NULL; +@@ -5114,7 +5114,7 @@ load_cas_and_crls_dir(krb5_context context, + pkinit_req_crypto_context req_cryptoctx, + pkinit_identity_crypto_context id_cryptoctx, + int catype, +- char *dirname) ++ const char *dirname) + { + krb5_error_code retval = EINVAL; + DIR *d = NULL; +@@ -5166,7 +5166,7 @@ crypto_load_cas_and_crls(krb5_context context, + pkinit_identity_crypto_context id_cryptoctx, + int idtype, + int catype, +- char *id) ++ const char *id) + { + switch (idtype) { + case IDTYPE_FILE: +diff --git a/src/plugins/preauth/pkinit/pkinit_identity.c b/src/plugins/preauth/pkinit/pkinit_identity.c +index a5a979f279..b06d519c66 100644 +--- a/src/plugins/preauth/pkinit/pkinit_identity.c ++++ b/src/plugins/preauth/pkinit/pkinit_identity.c +@@ -474,7 +474,7 @@ process_option_ca_crl(krb5_context context, + const char *value, + int catype) + { +- char *residual; ++ const char *residual; + unsigned int typelen; + int idtype; + +diff --git a/src/plugins/preauth/pkinit/pkinit_matching.c b/src/plugins/preauth/pkinit/pkinit_matching.c +index b42485a50a..5a7f2ba3fa 100644 +--- a/src/plugins/preauth/pkinit/pkinit_matching.c ++++ b/src/plugins/preauth/pkinit/pkinit_matching.c +@@ -263,7 +263,7 @@ parse_rule_component(krb5_context context, + char err_buf[128]; + int ret; + struct keyword_desc *kw, *nextkw; +- char *nk; ++ const char *nk; + int found_next_kw = 0; + char *value = NULL; + size_t len; +diff --git a/src/tests/responder.c b/src/tests/responder.c +index 82f870ea5d..4221a20283 100644 +--- a/src/tests/responder.c ++++ b/src/tests/responder.c +@@ -282,8 +282,7 @@ responder(krb5_context ctx, void *rawdata, krb5_responder_context rctx) + /* Provide a particular response for an OTP challenge. */ + if (data->otp_answer != NULL) { + if (krb5_responder_otp_get_challenge(ctx, rctx, &ochl) == 0) { +- key = strchr(data->otp_answer, '='); +- if (key != NULL) { ++ if (strchr(data->otp_answer, '=') != NULL) { + /* Make a copy of the answer that we can chop up. */ + key = strdup(data->otp_answer); + if (key == NULL) +-- +2.51.1 + diff --git a/krb5.spec b/krb5.spec index 2a08b01..4c5b542 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 10 +%global baserelease 11 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -97,6 +97,7 @@ Patch0035: 0035-Don-t-issue-session-keys-with-deprecated-enctypes.patch Patch0036: 0036-downstream-Remove-3des-support-cumulative-1.patch Patch0037: 0037-Add-PKINIT-paChecksum2-from-MS-PKCA-v20230920.patch Patch0038: 0038-downstream-Do-not-block-HMAC-MD4-5-in-FIPS-mode.patch +Patch0039: 0039-Fix-strchr-conformance-to-C23.patch Patch0040: 0040-automated-fast.patch Patch0041: 0041-bail-if-prompter-is-not-specified-but-required.patch @@ -744,6 +745,9 @@ exit 0 %{_datarootdir}/%{name}-tests/%{_arch} %changelog +* Mon Jan 05 2026 Julien Rische - 1.21.3-11 +- Fix strchr() conformance to C23 + * Mon Oct 20 2025 Alexander Bokovoy - 1.21.3-10 - Update the prompter patch to upstream version Resolves: rhbz#2403513 @@ -756,7 +760,6 @@ exit 0 - Add automated FAST channel for kinit - https://github.com/krb5/krb5/pull/1447 - work in progress - * Thu Jul 24 2025 Fedora Release Engineering - 1.21.3-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild