Compare commits
3 commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
532fe5902b | ||
|
|
f60be36f6a | ||
|
|
9b4fed7f56 |
9 changed files with 8 additions and 672 deletions
|
|
@ -1,189 +0,0 @@
|
|||
From 1761e06398e4f043e4f540f57131c37fcc53a1b9 Mon Sep 17 00:00:00 2001
|
||||
From: Alexander Bokovoy <abokovoy@redhat.com>
|
||||
Date: Wed, 10 Dec 2025 10:42:02 +0200
|
||||
Subject: [PATCH] Fix strchr() conformance to C23
|
||||
|
||||
C23 7.28.5.1 specifies search functions such as strchr() as generic,
|
||||
returning const char * if the first argument is of type const char *.
|
||||
Fix uses of strchr() to conform to this change.
|
||||
|
||||
[jrische@redhat.com: altered changes to avoid casts; fixed an
|
||||
additional case]
|
||||
[ghudson@mit.edu: condensed some declarations; rewrote commit message]
|
||||
|
||||
ticket: 9191 (new)
|
||||
(cherry picked from commit 6cd8580d823585d50ee4f30efd9f7e855823a369)
|
||||
---
|
||||
src/lib/krb5/ccache/ccbase.c | 4 ++--
|
||||
src/lib/krb5/os/expand_path.c | 3 ++-
|
||||
src/lib/krb5/os/locate_kdc.c | 15 +++++++--------
|
||||
src/plugins/preauth/pkinit/pkinit_crypto.h | 2 +-
|
||||
.../preauth/pkinit/pkinit_crypto_openssl.c | 6 +++---
|
||||
src/plugins/preauth/pkinit/pkinit_identity.c | 2 +-
|
||||
src/plugins/preauth/pkinit/pkinit_matching.c | 2 +-
|
||||
src/tests/responder.c | 3 +--
|
||||
8 files changed, 18 insertions(+), 19 deletions(-)
|
||||
|
||||
diff --git a/src/lib/krb5/ccache/ccbase.c b/src/lib/krb5/ccache/ccbase.c
|
||||
index 5a01320832..1aada91b5e 100644
|
||||
--- a/src/lib/krb5/ccache/ccbase.c
|
||||
+++ b/src/lib/krb5/ccache/ccbase.c
|
||||
@@ -201,8 +201,8 @@ krb5_cc_register(krb5_context context, const krb5_cc_ops *ops,
|
||||
krb5_error_code KRB5_CALLCONV
|
||||
krb5_cc_resolve (krb5_context context, const char *name, krb5_ccache *cache)
|
||||
{
|
||||
- char *pfx, *cp;
|
||||
- const char *resid;
|
||||
+ char *pfx;
|
||||
+ const char *cp, *resid;
|
||||
unsigned int pfxlen;
|
||||
krb5_error_code err;
|
||||
const krb5_cc_ops *ops;
|
||||
diff --git a/src/lib/krb5/os/expand_path.c b/src/lib/krb5/os/expand_path.c
|
||||
index 5cbccf08c8..6569b8820b 100644
|
||||
--- a/src/lib/krb5/os/expand_path.c
|
||||
+++ b/src/lib/krb5/os/expand_path.c
|
||||
@@ -454,7 +454,8 @@ k5_expand_path_tokens_extra(krb5_context context, const char *path_in,
|
||||
{
|
||||
krb5_error_code ret;
|
||||
struct k5buf buf;
|
||||
- char *tok_begin, *tok_end, *tok_val, **extra_tokens = NULL, *path;
|
||||
+ const char *tok_begin, *tok_end;
|
||||
+ char *tok_val, **extra_tokens = NULL, *path;
|
||||
const char *path_left;
|
||||
size_t nargs = 0, i;
|
||||
va_list ap;
|
||||
diff --git a/src/lib/krb5/os/locate_kdc.c b/src/lib/krb5/os/locate_kdc.c
|
||||
index edca5ac7eb..47e15c849f 100644
|
||||
--- a/src/lib/krb5/os/locate_kdc.c
|
||||
+++ b/src/lib/krb5/os/locate_kdc.c
|
||||
@@ -188,8 +188,8 @@ oom:
|
||||
}
|
||||
|
||||
static void
|
||||
-parse_uri_if_https(const char *host_or_uri, k5_transport *transport,
|
||||
- const char **host, const char **uri_path)
|
||||
+parse_uri_if_https(char *host_or_uri, k5_transport *transport,
|
||||
+ char **host, const char **uri_path)
|
||||
{
|
||||
char *cp;
|
||||
|
||||
@@ -229,8 +229,7 @@ locate_srv_conf_1(krb5_context context, const krb5_data *realm,
|
||||
k5_transport transport, int udpport)
|
||||
{
|
||||
const char *realm_srv_names[4];
|
||||
- char **hostlist = NULL, *realmstr = NULL, *host = NULL;
|
||||
- const char *hostspec;
|
||||
+ char **hostlist = NULL, *realmstr = NULL, *host = NULL, *hostspec;
|
||||
krb5_error_code code;
|
||||
int i, default_port;
|
||||
|
||||
@@ -535,8 +534,8 @@ prof_locate_server(krb5_context context, const krb5_data *realm,
|
||||
* Return a NULL *host_out if there are any problems parsing the URI.
|
||||
*/
|
||||
static void
|
||||
-parse_uri_fields(const char *uri, k5_transport *transport_out,
|
||||
- const char **host_out, int *primary_out)
|
||||
+parse_uri_fields(char *uri, k5_transport *transport_out,
|
||||
+ char **host_out, int *primary_out)
|
||||
|
||||
{
|
||||
k5_transport transport;
|
||||
@@ -604,8 +603,8 @@ locate_uri(krb5_context context, const krb5_data *realm,
|
||||
krb5_error_code ret;
|
||||
k5_transport transport, host_trans;
|
||||
struct srv_dns_entry *answers, *entry;
|
||||
- char *host;
|
||||
- const char *host_field, *path;
|
||||
+ char *host, *host_field;
|
||||
+ const char *path;
|
||||
int port, def_port, primary;
|
||||
|
||||
ret = k5_make_uri_query(context, realm, req_service, &answers);
|
||||
diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h
|
||||
index 3b12e904b1..99e2394040 100644
|
||||
--- a/src/plugins/preauth/pkinit/pkinit_crypto.h
|
||||
+++ b/src/plugins/preauth/pkinit/pkinit_crypto.h
|
||||
@@ -456,7 +456,7 @@ krb5_error_code crypto_load_cas_and_crls
|
||||
defines the storage type (file, directory, etc) */
|
||||
int catype, /* IN
|
||||
defines the ca type (anchor, intermediate, crls) */
|
||||
- char *id); /* IN
|
||||
+ const char *id); /* IN
|
||||
defines the location (filename, directory name, etc) */
|
||||
|
||||
/*
|
||||
diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
|
||||
index 429b7d202c..6013080afc 100644
|
||||
--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
|
||||
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
|
||||
@@ -4956,7 +4956,7 @@ load_cas_and_crls(krb5_context context,
|
||||
pkinit_req_crypto_context req_cryptoctx,
|
||||
pkinit_identity_crypto_context id_cryptoctx,
|
||||
int catype,
|
||||
- char *filename)
|
||||
+ const char *filename)
|
||||
{
|
||||
STACK_OF(X509_INFO) *sk = NULL;
|
||||
STACK_OF(X509) *ca_certs = NULL;
|
||||
@@ -5114,7 +5114,7 @@ load_cas_and_crls_dir(krb5_context context,
|
||||
pkinit_req_crypto_context req_cryptoctx,
|
||||
pkinit_identity_crypto_context id_cryptoctx,
|
||||
int catype,
|
||||
- char *dirname)
|
||||
+ const char *dirname)
|
||||
{
|
||||
krb5_error_code retval = EINVAL;
|
||||
DIR *d = NULL;
|
||||
@@ -5166,7 +5166,7 @@ crypto_load_cas_and_crls(krb5_context context,
|
||||
pkinit_identity_crypto_context id_cryptoctx,
|
||||
int idtype,
|
||||
int catype,
|
||||
- char *id)
|
||||
+ const char *id)
|
||||
{
|
||||
switch (idtype) {
|
||||
case IDTYPE_FILE:
|
||||
diff --git a/src/plugins/preauth/pkinit/pkinit_identity.c b/src/plugins/preauth/pkinit/pkinit_identity.c
|
||||
index a5a979f279..b06d519c66 100644
|
||||
--- a/src/plugins/preauth/pkinit/pkinit_identity.c
|
||||
+++ b/src/plugins/preauth/pkinit/pkinit_identity.c
|
||||
@@ -474,7 +474,7 @@ process_option_ca_crl(krb5_context context,
|
||||
const char *value,
|
||||
int catype)
|
||||
{
|
||||
- char *residual;
|
||||
+ const char *residual;
|
||||
unsigned int typelen;
|
||||
int idtype;
|
||||
|
||||
diff --git a/src/plugins/preauth/pkinit/pkinit_matching.c b/src/plugins/preauth/pkinit/pkinit_matching.c
|
||||
index b42485a50a..5a7f2ba3fa 100644
|
||||
--- a/src/plugins/preauth/pkinit/pkinit_matching.c
|
||||
+++ b/src/plugins/preauth/pkinit/pkinit_matching.c
|
||||
@@ -263,7 +263,7 @@ parse_rule_component(krb5_context context,
|
||||
char err_buf[128];
|
||||
int ret;
|
||||
struct keyword_desc *kw, *nextkw;
|
||||
- char *nk;
|
||||
+ const char *nk;
|
||||
int found_next_kw = 0;
|
||||
char *value = NULL;
|
||||
size_t len;
|
||||
diff --git a/src/tests/responder.c b/src/tests/responder.c
|
||||
index 82f870ea5d..4221a20283 100644
|
||||
--- a/src/tests/responder.c
|
||||
+++ b/src/tests/responder.c
|
||||
@@ -282,8 +282,7 @@ responder(krb5_context ctx, void *rawdata, krb5_responder_context rctx)
|
||||
/* Provide a particular response for an OTP challenge. */
|
||||
if (data->otp_answer != NULL) {
|
||||
if (krb5_responder_otp_get_challenge(ctx, rctx, &ochl) == 0) {
|
||||
- key = strchr(data->otp_answer, '=');
|
||||
- if (key != NULL) {
|
||||
+ if (strchr(data->otp_answer, '=') != NULL) {
|
||||
/* Make a copy of the answer that we can chop up. */
|
||||
key = strdup(data->otp_answer);
|
||||
if (key == NULL)
|
||||
--
|
||||
2.51.1
|
||||
|
||||
|
|
@ -1,226 +0,0 @@
|
|||
From 3baf9b93dc1dfe38585722c71d7268304cb4a01a Mon Sep 17 00:00:00 2001
|
||||
From: Alexander Bokovoy <abokovoy@redhat.com>
|
||||
Date: Sun, 21 Sep 2025 11:14:51 +0300
|
||||
Subject: libkrb5: in case PKINIT is configured, attempt Anonymous
|
||||
PKINIT for FAST
|
||||
|
||||
If auto_fast_armor is configured for the realm or globally, optimistically
|
||||
assume that Anonymous PKINIT is supported as well and try to obtain it for
|
||||
FAST use in case no pre-made FAST channel was established by the caller.
|
||||
|
||||
This behavior will automatically enable use of passwordless pre-authentication
|
||||
methods which rely on FAST channel presence in deployments such as FreeIPA.
|
||||
|
||||
Notably, Microsoft Active Directory KDCs do not support Anonymous PKINIT. For
|
||||
these deployments only a machine account (host keytab) can be used to build a
|
||||
FAST channel. However, libkrb5 does not have access to /etc/krb5.keytab in a
|
||||
general case.
|
||||
|
||||
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
|
||||
---
|
||||
src/lib/krb5/krb/fast.c | 118 ++++++++++++++++++++++++++++++++++++++++
|
||||
src/lib/krb5/krb/fast.h | 2 +
|
||||
src/man/krb5.conf.man | 13 +++++
|
||||
3 files changed, 133 insertions(+)
|
||||
|
||||
diff --git a/src/lib/krb5/krb/fast.c b/src/lib/krb5/krb/fast.c
|
||||
index 62c9f0841..ee2e08189 100644
|
||||
--- a/src/lib/krb5/krb/fast.c
|
||||
+++ b/src/lib/krb5/krb/fast.c
|
||||
@@ -168,6 +168,109 @@ krb5int_fast_prep_req_body(krb5_context context,
|
||||
return retval;
|
||||
}
|
||||
|
||||
+static krb5_boolean
|
||||
+fast_is_pkinit_allowed(krb5_context context, krb5_data *realm)
|
||||
+{
|
||||
+ int value;
|
||||
+ krb5_error_code retval = EINVAL;
|
||||
+ char realmstr[1024];
|
||||
+ const char *option = "auto_fast_armor";
|
||||
+ const int def_value = FALSE;
|
||||
+
|
||||
+ if (realm != NULL && realm->length > sizeof(realmstr)-1)
|
||||
+ return FALSE;
|
||||
+
|
||||
+ if (realm != NULL) {
|
||||
+ strncpy(realmstr, realm->data, realm->length);
|
||||
+ realmstr[realm->length] = '\0';
|
||||
+
|
||||
+ retval = profile_get_boolean(context->profile,
|
||||
+ KRB5_CONF_REALMS, realmstr,
|
||||
+ option, def_value, &value);
|
||||
+ }
|
||||
+
|
||||
+ return retval ? FALSE : value;
|
||||
+
|
||||
+}
|
||||
+
|
||||
+static krb5_error_code
|
||||
+fast_acquire_pkinit_armor(krb5_context context,
|
||||
+ struct krb5int_fast_request_state *state,
|
||||
+ krb5_get_init_creds_opt *opt, krb5_kdc_req *request)
|
||||
+{
|
||||
+ krb5_context ctx;
|
||||
+ krb5_get_init_creds_opt *options = NULL;
|
||||
+ krb5_error_code retval = 0;
|
||||
+ krb5_data *target_realm = &request->server->realm;
|
||||
+ krb5_creds creds;
|
||||
+ krb5_principal anon_princ = NULL;
|
||||
+ krb5_ccache out_cc;
|
||||
+
|
||||
+ /* short circuit, we are asked to perform Anonymous PKINIT already */
|
||||
+ if (opt->flags & KRB5_GET_INIT_CREDS_OPT_ANONYMOUS) {
|
||||
+ return EINVAL;
|
||||
+ }
|
||||
+
|
||||
+ /* skip realms which do not allow use of automated FAST armor */
|
||||
+ if (!fast_is_pkinit_allowed(context, target_realm)) {
|
||||
+ return EINVAL;
|
||||
+ }
|
||||
+
|
||||
+ retval = krb5_init_context(&ctx);
|
||||
+ if (retval != 0) {
|
||||
+ return retval;
|
||||
+ }
|
||||
+ retval = krb5_get_init_creds_opt_alloc(ctx, &options);
|
||||
+ if (retval != 0) {
|
||||
+ goto cleanup;
|
||||
+ }
|
||||
+ krb5_get_init_creds_opt_set_anonymous(options, 1);
|
||||
+ retval = krb5_cc_new_unique(ctx, "MEMORY", NULL, &out_cc);
|
||||
+ if (retval != 0) {
|
||||
+ goto cleanup;
|
||||
+ }
|
||||
+
|
||||
+ retval = krb5_get_init_creds_opt_set_out_ccache(ctx, options, out_cc);
|
||||
+ if (retval != 0) {
|
||||
+ goto cleanup;
|
||||
+ }
|
||||
+
|
||||
+ retval = krb5_build_principal_ext(ctx, &anon_princ,
|
||||
+ target_realm->length, target_realm->data,
|
||||
+ strlen(KRB5_WELLKNOWN_NAMESTR),
|
||||
+ KRB5_WELLKNOWN_NAMESTR,
|
||||
+ strlen(KRB5_ANONYMOUS_PRINCSTR),
|
||||
+ KRB5_ANONYMOUS_PRINCSTR, 0);
|
||||
+ if (retval != 0) {
|
||||
+ goto cleanup;
|
||||
+ }
|
||||
+
|
||||
+ retval = krb5_get_init_creds_password(ctx, &creds, anon_princ, 0,
|
||||
+ NULL /* no prompter */, NULL,
|
||||
+ 0, NULL /* service name */,
|
||||
+ options);
|
||||
+ if (retval == 0) {
|
||||
+ state->fast_state_flags |= KRB5INT_FAST_OWN_ARMOR;
|
||||
+ state->armor_ccache = out_cc;
|
||||
+ }
|
||||
+cleanup:
|
||||
+ if (retval != 0 && out_cc != NULL) {
|
||||
+ (void) krb5_cc_destroy(ctx, out_cc);
|
||||
+ }
|
||||
+ if (retval == 0) {
|
||||
+ krb5_free_cred_contents(ctx, &creds);
|
||||
+ }
|
||||
+ if (options != NULL) {
|
||||
+ krb5_get_init_creds_opt_free(ctx, options);
|
||||
+ }
|
||||
+ if (anon_princ != NULL) {
|
||||
+ krb5_free_principal(ctx, anon_princ);
|
||||
+ }
|
||||
+ krb5_free_context(ctx);
|
||||
+
|
||||
+ return retval;
|
||||
+}
|
||||
+
|
||||
krb5_error_code
|
||||
krb5int_fast_as_armor(krb5_context context,
|
||||
struct krb5int_fast_request_state *state,
|
||||
@@ -178,10 +281,20 @@ krb5int_fast_as_armor(krb5_context context,
|
||||
krb5_principal target_principal = NULL;
|
||||
krb5_data *target_realm;
|
||||
const char *ccname = k5_gic_opt_get_fast_ccache_name(opt);
|
||||
+ char *fast_ccname = NULL;
|
||||
krb5_flags fast_flags;
|
||||
|
||||
krb5_clear_error_message(context);
|
||||
target_realm = &request->server->realm;
|
||||
+ if (ccname == NULL) {
|
||||
+ retval = fast_acquire_pkinit_armor(context, state, opt, request);
|
||||
+ if (retval == 0) {
|
||||
+ retval = krb5_cc_get_full_name(context, state->armor_ccache, &fast_ccname);
|
||||
+ if (retval == 0 && fast_ccname != NULL)
|
||||
+ ccname = fast_ccname;
|
||||
+ }
|
||||
+ retval = 0;
|
||||
+ }
|
||||
if (ccname != NULL) {
|
||||
TRACE_FAST_ARMOR_CCACHE(context, ccname);
|
||||
state->fast_state_flags |= KRB5INT_FAST_ARMOR_AVAIL;
|
||||
@@ -220,6 +333,8 @@ krb5int_fast_as_armor(krb5_context context,
|
||||
krb5_cc_close(context, ccache);
|
||||
if (target_principal)
|
||||
krb5_free_principal(context, target_principal);
|
||||
+ if (fast_ccname)
|
||||
+ free(fast_ccname);
|
||||
return retval;
|
||||
}
|
||||
|
||||
@@ -615,6 +730,9 @@ krb5int_fast_free_state(krb5_context context,
|
||||
/*We are responsible for none of the store in the fast_outer_req*/
|
||||
krb5_free_keyblock(context, state->armor_key);
|
||||
krb5_free_fast_armor(context, state->armor);
|
||||
+ if (state->fast_state_flags & KRB5INT_FAST_OWN_ARMOR) {
|
||||
+ krb5_cc_destroy(context, state->armor_ccache);
|
||||
+ }
|
||||
free(state);
|
||||
}
|
||||
|
||||
diff --git a/src/lib/krb5/krb/fast.h b/src/lib/krb5/krb/fast.h
|
||||
index 7156ea203..e5fe8bd54 100644
|
||||
--- a/src/lib/krb5/krb/fast.h
|
||||
+++ b/src/lib/krb5/krb/fast.h
|
||||
@@ -34,6 +34,7 @@ struct krb5int_fast_request_state {
|
||||
krb5_kdc_req fast_outer_request;
|
||||
krb5_keyblock *armor_key; /*non-null means fast is in use*/
|
||||
krb5_fast_armor *armor;
|
||||
+ krb5_ccache armor_ccache;
|
||||
krb5_ui_4 fast_state_flags;
|
||||
krb5_ui_4 fast_options;
|
||||
krb5_int32 nonce;
|
||||
@@ -41,6 +42,7 @@ struct krb5int_fast_request_state {
|
||||
|
||||
#define KRB5INT_FAST_DO_FAST (1l<<0) /* Perform FAST */
|
||||
#define KRB5INT_FAST_ARMOR_AVAIL (1l<<1)
|
||||
+#define KRB5INT_FAST_OWN_ARMOR (1l<<2)
|
||||
|
||||
krb5_error_code
|
||||
krb5int_fast_prep_req_body(krb5_context context,
|
||||
diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man
|
||||
index d4caa2bd3..ac7649647 100644
|
||||
--- a/src/man/krb5.conf.man
|
||||
+++ b/src/man/krb5.conf.man
|
||||
@@ -650,6 +650,19 @@ primary KDC, in case the user\(aqs password has just been changed, and
|
||||
the updated database has not been propagated to the replica
|
||||
servers yet. New in release 1.19.
|
||||
.TP
|
||||
+\fBauto_fast_armor\fP
|
||||
+If this flag is true, then initial ticket request will use Anonymous
|
||||
+PKINIT to protect the communication as a FAST channel in case an application
|
||||
+did not provide its own FAST channel. This is useful for deployments where
|
||||
+pre-authentication methods require use of the FAST channel, such as
|
||||
+passwordless methods provided by FreeIPA. Microsoft Active Directory
|
||||
+implementation of PKINIT does not support Anonymous PKINIT feature.
|
||||
+As a result, \fIauto_fast_armor\fP defaults to false.
|
||||
+.sp
|
||||
+Use of \fIauto_fast_armor = true\fP requires properly configured PKINIT and
|
||||
+WELLKNOWN/ANONYMOUS principal defined on the KDC side. Consult KDC documentation
|
||||
+for details.
|
||||
+.TP
|
||||
\fBv4_instance_convert\fP
|
||||
This subsection allows the administrator to configure exceptions
|
||||
to the \fBdefault_domain\fP mapping rule. It contains V4 instances
|
||||
--
|
||||
2.51.0
|
||||
|
||||
|
|
@ -1,40 +0,0 @@
|
|||
From ff580d9cf86202d45454a6b6f53accc22cb40b62 Mon Sep 17 00:00:00 2001
|
||||
From: Alexander Bokovoy <abokovoy@redhat.com>
|
||||
Date: Sun, 19 Oct 2025 18:14:29 +0300
|
||||
Subject: [PATCH] bail if prompter is not specified but required
|
||||
|
||||
GSSAPI gss_init_sec_context() may trigger credential re-initialization
|
||||
if the cred in ccache is expired. If automatic FAST armor is in use,
|
||||
we'd request Anonymous PKINIT and use it as an armor and this will
|
||||
enable seeing pre-authentication methods which require armor presence.
|
||||
|
||||
OTP is one of such methods and its use requires prompter to be set,
|
||||
but GSSAPI cannot specify a prompter and thus we should fail any
|
||||
pre-auth where a prompter wasn't passed.
|
||||
|
||||
PKINIT PKCS11 and SAM-2 preauth methods use KRB5_LIBOS_CANTREADPWD while PKINIT
|
||||
and gic_pwd.c use EIO. Use EIO here because we technically attempt to read a
|
||||
PIN rather than a password.
|
||||
|
||||
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
|
||||
---
|
||||
src/lib/krb5/krb/preauth_otp.c | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/src/lib/krb5/krb/preauth_otp.c b/src/lib/krb5/krb/preauth_otp.c
|
||||
index 07ffc15c2..48003da62 100644
|
||||
--- a/src/lib/krb5/krb/preauth_otp.c
|
||||
+++ b/src/lib/krb5/krb/preauth_otp.c
|
||||
@@ -479,6 +479,9 @@ doprompt(krb5_context context, krb5_prompter_fct prompter, void *prompter_data,
|
||||
krb5_error_code retval;
|
||||
krb5_prompt_type prompt_type = KRB5_PROMPT_TYPE_PREAUTH;
|
||||
|
||||
+ if (prompter == NULL)
|
||||
+ return EIO;
|
||||
+
|
||||
if (prompttxt == NULL || out == NULL)
|
||||
return EINVAL;
|
||||
|
||||
--
|
||||
2.51.0
|
||||
|
||||
49
krb5.spec
49
krb5.spec
|
|
@ -10,7 +10,7 @@
|
|||
#
|
||||
# baserelease is what we have standardized across Fedora and what
|
||||
# rpmdev-bumpspec knows how to handle.
|
||||
%global baserelease 11
|
||||
%global baserelease 5
|
||||
|
||||
# This should be e.g. beta1 or %%nil
|
||||
%global pre_release %nil
|
||||
|
|
@ -97,9 +97,6 @@ Patch0035: 0035-Don-t-issue-session-keys-with-deprecated-enctypes.patch
|
|||
Patch0036: 0036-downstream-Remove-3des-support-cumulative-1.patch
|
||||
Patch0037: 0037-Add-PKINIT-paChecksum2-from-MS-PKCA-v20230920.patch
|
||||
Patch0038: 0038-downstream-Do-not-block-HMAC-MD4-5-in-FIPS-mode.patch
|
||||
Patch0039: 0039-Fix-strchr-conformance-to-C23.patch
|
||||
Patch0040: 0040-automated-fast.patch
|
||||
Patch0041: 0041-bail-if-prompter-is-not-specified-but-required.patch
|
||||
|
||||
License: Brian-Gladman-2-Clause AND BSD-2-Clause AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-first-lines AND BSD-3-Clause AND BSD-4-Clause AND CMU-Mach-nodoc AND FSFULLRWD AND HPND AND HPND-export2-US AND HPND-export-US AND HPND-export-US-acknowledgement AND HPND-export-US-modify AND ISC AND MIT AND MIT-CMU AND OLDAP-2.8 AND OpenVision
|
||||
URL: https://web.mit.edu/kerberos/www/
|
||||
|
|
@ -133,8 +130,6 @@ BuildRequires: openssl-devel < 1:3.0.0
|
|||
# Enable compilation of optional tests
|
||||
BuildRequires: resolv_wrapper
|
||||
BuildRequires: libcmocka-devel
|
||||
BuildRequires: opensc
|
||||
BuildRequires: softhsm
|
||||
|
||||
%description
|
||||
Kerberos V5 is a trusted-third-party network authentication system,
|
||||
|
|
@ -166,7 +161,7 @@ Requires: openssl-libs >= 1:3.0.0
|
|||
Requires: openssl-libs >= 1:1.1.1d-4
|
||||
Requires: openssl-libs < 1:3.0.0
|
||||
%endif
|
||||
Requires: coreutils
|
||||
Requires: coreutils, gawk, sed
|
||||
Requires: keyutils-libs >= 1.5.8
|
||||
Requires: /etc/crypto-policies/back-ends/krb5.config
|
||||
|
||||
|
|
@ -279,16 +274,11 @@ Requires: net-tools, rpcbind
|
|||
Requires: perl-interpreter
|
||||
Requires: procps-ng
|
||||
Requires: python3-kdcproxy
|
||||
Requires: python3-pyrad
|
||||
Requires: resolv_wrapper
|
||||
Requires: /etc/crypto-policies/back-ends/krb5.config
|
||||
Requires: words
|
||||
Requires: opensc
|
||||
Requires: softhsm
|
||||
Recommends: python3-pyrad
|
||||
|
||||
# Restore once openldap upstream tests are fixed
|
||||
#Recommends: openldap-servers
|
||||
#Recommends: openldap-clients
|
||||
#Requires: openldap-servers, openldap-clients
|
||||
|
||||
%description tests
|
||||
FOR TESTING PURPOSE ONLY
|
||||
|
|
@ -745,46 +735,23 @@ exit 0
|
|||
%{_datarootdir}/%{name}-tests/%{_arch}
|
||||
|
||||
%changelog
|
||||
* Mon Jan 05 2026 Julien Rische <jrische@redhat.com> - 1.21.3-11
|
||||
- Fix strchr() conformance to C23
|
||||
|
||||
* Mon Oct 20 2025 Alexander Bokovoy <abokovoy@redhat.com> - 1.21.3-10
|
||||
- Update the prompter patch to upstream version
|
||||
Resolves: rhbz#2403513
|
||||
|
||||
* Wed Oct 15 2025 Alexander Bokovoy <abokovoy@redhat.com> - 1.21.3-9
|
||||
- do not crash when prompter is not available in GSSAPI
|
||||
Resolves: rhbz#2403513
|
||||
|
||||
* Fri Sep 26 2025 Alexander Bokovoy <abokovoy@redhat.com> - 1.21.3-8
|
||||
- Add automated FAST channel for kinit
|
||||
- https://github.com/krb5/krb5/pull/1447 - work in progress
|
||||
|
||||
* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.21.3-7
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
|
||||
|
||||
* Wed Jun 04 2025 Julien Rische <jrische@redhat.com> - 1.21.3-6
|
||||
* Fri Jun 06 2025 Julien Rische <jrische@redhat.com> - 1.21.3-5
|
||||
- Do not block HMAC-MD4/5 in FIPS mode
|
||||
Resolves: rhbz#2370259
|
||||
- PKINIT: implement paChecksum2 from MS-PKCA v20230920
|
||||
Resolves: rhbz#2357215
|
||||
- Disallow RC4 HMAC-MD5 session keys by default (CVE-2025-3576)
|
||||
Resolves: rhbz#2359705
|
||||
Resolves: rhbz#2359673
|
||||
|
||||
* Wed Jan 29 2025 Julien Rische <jrische@redhat.com> - 1.21.3-5
|
||||
* Tue Feb 11 2025 Julien Rische <jrische@redhat.com> - 1.21.3-4
|
||||
- Prevent overflow when calculating ulog block size (CVE-2025-24528)
|
||||
Resolves: rhbz#2342798
|
||||
Resolves: rhbz#2342811
|
||||
- Support PKCS11 EC client certs in PKINIT
|
||||
Resolves: rhbz#2341962
|
||||
- kdb5_util: fix DB entry flags on modification
|
||||
Resolves: rhbz#2336555
|
||||
- Add ECDH support for PKINIT (RFC5349)
|
||||
Resolves: rhbz#2214326
|
||||
- Remove dependency of krb5-libs on gawk and sed
|
||||
Resolves: rhbz#2323859
|
||||
|
||||
* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.21.3-4
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
|
||||
|
||||
* Wed Oct 30 2024 Julien Rische <jrische@redhat.com> - 1.21.3-3
|
||||
- libkrad: implement support for Message-Authenticator (CVE-2024-3596)
|
||||
|
|
|
|||
|
|
@ -1,2 +0,0 @@
|
|||
gef config gef.disable_color True
|
||||
got-audit --all
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
[kdcdefaults]
|
||||
kdc_ports = 88
|
||||
kdc_tcp_ports = 88
|
||||
|
||||
[realms]
|
||||
${krb5REALM1} = {
|
||||
#master_key_type = aes256-cts
|
||||
acl_file = /var/kerberos/krb5kdc/kadm5.acl
|
||||
dict_file = /usr/share/dict/words
|
||||
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
|
||||
supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
|
||||
}
|
||||
|
|
@ -1,29 +0,0 @@
|
|||
# To opt out of the system crypto-policies configuration of krb5, remove the
|
||||
# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
|
||||
includedir /etc/krb5.conf.d/
|
||||
|
||||
[logging]
|
||||
default = FILE:/var/log/krb5libs.log
|
||||
kdc = FILE:/var/log/krb5kdc.log
|
||||
admin_server = FILE:/var/log/kadmind.log
|
||||
|
||||
[libdefaults]
|
||||
default_realm = ${krb5REALM1}
|
||||
dns_lookup_realm = false
|
||||
ticket_lifetime = 24h
|
||||
renew_lifetime = 7d
|
||||
forwardable = true
|
||||
rdns = false
|
||||
default_ccache_name = KEYRING:persistent:%{uid}
|
||||
|
||||
[realms]
|
||||
${krb5REALM1} = {
|
||||
kdc = localhost.localdomain
|
||||
admin_server = localhost.localdomain
|
||||
}
|
||||
|
||||
[domain_realm]
|
||||
${krb5HostName} = ${krb5REALM1}
|
||||
|
||||
[capaths]
|
||||
${krb5REALM1} = .
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
summary: Audit the GOT for signs of tampering
|
||||
description: |
|
||||
Pointers in the server process GOT will be checked to ensure that
|
||||
each function pointer's value is within a shared object file
|
||||
that exports a symbol of that name, and that no shared object
|
||||
files export conflicting symbols.
|
||||
contact: Gordon Messmer <gordon.messmer@gmail.com>
|
||||
require+:
|
||||
- gdb-gef # needed to test got-audit
|
||||
- krb5-server
|
||||
test: ./runtest.sh
|
||||
framework: beakerlib
|
||||
|
|
@ -1,121 +0,0 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/openssh/Sanity/got-audit
|
||||
# Description: Check pointers in the server process GOT for signs of tampering
|
||||
# Author: Gordon Messmer <gordon.messmer@gmail.com>
|
||||
#
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
krb5REALM1='TEST1.REDHAT.COM'
|
||||
krb5HostName=`hostname`
|
||||
krb5DomainName=`hostname -d`
|
||||
krb5User='alice'
|
||||
krb5UserPass='alice'
|
||||
krb5UserKrbPass='aaa'
|
||||
krb5User2='bob'
|
||||
krb5User3='carl'
|
||||
krb5KDCPass='qwe'
|
||||
krb5RootPass='rrr'
|
||||
|
||||
krb5conf="/etc/krb5.conf"
|
||||
krb5confdir="/etc/krb5.conf.d"
|
||||
krb5kdcconf="/var/kerberos/krb5kdc/kdc.conf"
|
||||
krb5kadmacl="/var/kerberos/krb5kdc/kadm5.acl"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlServiceStart sshd
|
||||
rlRun "TestDir=\$(pwd)"
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
rlRun "auditfile=\$(mktemp --tmpdir=${TmpDir})"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartSetup "KDC and kadmind setup"
|
||||
# Stop and backup
|
||||
rlRun "rlServiceStop kadmin krb5kdc"
|
||||
rlRun "rm -f /var/kerberos/krb5kdc/principal* /var/kerberos/krb5kdc/.k5*"
|
||||
rlFileBackup $krb5conf /var/kerberos/krb5kdc /etc/sysconfig/{kadmin,krb5kdc} /etc/hosts
|
||||
rlFileBackup --clean /root/.k5login
|
||||
[ -e /etc/krb5.keytab ] && rlFileBackup /etc/krb5.keytab
|
||||
[ -e $krb5confdir ] && rlFileBackup $krb5confdir
|
||||
# Basic setup of KDC and krb5.conf
|
||||
rlRun "sed -i \"s/\[libdefaults\]/[libdefaults]\n default_realm = $krb5REALM1/\" $krb5conf"
|
||||
rlRun "sed -i \"s/\[realms\]/[realms]\n $krb5REALM1 = {\n kdc = $krb5HostName\n admin_server = $krb5HostName\n }/\" $krb5conf"
|
||||
if [ "$krb5DomainName" ]; then
|
||||
rlRun "sed -i \"s/\[domain_realm\]/[domain_realm]\n .$krb5DomainName = $krb5REALM1\n $krb5DomainName = $krb5REALM1/\" $krb5conf"
|
||||
else
|
||||
rlRun "sed -i \"s/\[domain_realm\]/[domain_realm]\n $krb5HostName = $krb5REALM1/\" $krb5conf"
|
||||
fi
|
||||
rlRun "sed -i s/EXAMPLE.COM/$krb5REALM1/ $krb5kdcconf"
|
||||
# Configure the kadmin ACL
|
||||
rlRun "echo \"*/master@$krb5REALM1 *\" > $krb5kadmacl"
|
||||
if rlIsFedora '>=31';then
|
||||
rlLog "Modify supported_enctypes for Fedora >=31. Remove *DES ciphers."
|
||||
rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal/\" /var/kerberos/krb5kdc/kdc.conf"
|
||||
elif rlIsRHEL '8' && [ `rpm -q --qf '%{VERSION}' krb5-server | cut -d"." -f2` -lt 18 ];then
|
||||
rlLog "Modify supported_enctypes for RHEL-8."
|
||||
rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal/\" /var/kerberos/krb5kdc/kdc.conf"
|
||||
else
|
||||
#RHEL-8 Bug 1802334 - [Rebase] krb5: rebase to 1.18:
|
||||
#- Removal of *DES encryption types
|
||||
#https://bugzilla.redhat.com/show_bug.cgi?id=1802334
|
||||
rlLog "Modify supported_enctypes for RHEL-8 with krb-1.18. Remove *DES ciphers."
|
||||
rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal/\" /var/kerberos/krb5kdc/kdc.conf"
|
||||
fi
|
||||
# Create the realm databases
|
||||
rlRun "rngd -r /dev/urandom"
|
||||
rlRun "kdb5_util create -s -r $krb5REALM1 -P $krb5KDCPass"
|
||||
rlRun "rlServiceStart kadmin krb5kdc"
|
||||
rlRun "kadmin.local -r $krb5REALM1 -q \"addprinc -pw $krb5RootPass root/master\""
|
||||
rlRun "kadmin.local -r $krb5REALM1 -q \"addprinc -pw $krb5UserKrbPass $krb5User\""
|
||||
rlRun "kadmin.local -r $krb5REALM1 -q \"addprinc -randkey host/$krb5HostName\""
|
||||
rlRun "kadmin.local -r $krb5REALM1 -q \"ktadd host/$krb5HostName\""
|
||||
# Create test system user
|
||||
[ $krb5User != "root" ] && rlRun "useradd $krb5User"
|
||||
rlRun "echo $krb5UserPass | passwd --stdin $krb5User"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest "Run GEF got-audit"
|
||||
rlRun "systemctl restart krb5kdc.service"
|
||||
rlRun "systemctl restart kadmin.service"
|
||||
rlRun "systemctl --no-pager status krb5kdc.service"
|
||||
rlRun "systemctl --no-pager status kadmin.service"
|
||||
|
||||
rlRun "SERVICE_PID=\$( systemctl show --property=MainPID krb5kdc.service | cut -f2 -d= )"
|
||||
rlRun "echo SERVICE_PID is '$SERVICE_PID'"
|
||||
[ -n "$SERVICE_PID" ] || rlFail "No service pid was found"
|
||||
rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'"
|
||||
# Basic test: ensure that at least one symbol is found in libc.so,
|
||||
# to verify that the report looks plausible.
|
||||
rlAssertGrep " : /.*/libc.so" "$auditfile"
|
||||
# Ensure the got-audit did not report any errors
|
||||
rlAssertNotGrep " :: ERROR" "$auditfile"
|
||||
rlRun "cp '$auditfile' '$TMT_TEST_DATA'/krb5kdc-got-audit.txt"
|
||||
|
||||
rlRun "SERVICE_PID=\$( systemctl show --property=MainPID kadmin.service | cut -f2 -d= )"
|
||||
rlRun "echo SERVICE_PID is '$SERVICE_PID'"
|
||||
[ -n "$SERVICE_PID" ] || rlFail "No service pid was found"
|
||||
rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'"
|
||||
# Basic test: ensure that at least one symbol is found in libc.so,
|
||||
# to verify that the report looks plausible.
|
||||
rlAssertGrep " : /.*/libc.so" "$auditfile"
|
||||
# Ensure the got-audit did not report any errors
|
||||
rlAssertNotGrep " :: ERROR" "$auditfile"
|
||||
rlRun "cp '$auditfile' '$TMT_TEST_DATA'/kadmin-got-audit.txt"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "rm -rf /var/kerberos/krb5kdc/* /var/kerberos/krb5kdc/.k5* /etc/krb5* /etc/sysconfig/{kadmin,krb5kdc}"
|
||||
rlFileRestore
|
||||
rlServiceRestore krb5kdc kadmin
|
||||
[ $krb5User != "root" ] && rlRun "userdel -r -f $krb5User"
|
||||
rlRun "popd"
|
||||
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||
rlPhaseEnd
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
Loading…
Add table
Add a link
Reference in a new issue