[Heimdal-source-changes] [heimdal/heimdal] 830112: kdc: adjust flags passed to hdb_fetch_kvno()

Sat Mars 14 21:09:13 CET 2015

  Branch: refs/heads/master
  Home:   https://github.com/heimdal/heimdal
  Commit: 83011252d7be71d60aa23df8648c516a6148203e
      https://github.com/heimdal/heimdal/commit/83011252d7be71d60aa23df8648c516a6148203e
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2015-03-14 (Sat, 14 Mar 2015)

  Changed paths:
    M kdc/misc.c

  Log Message:
  -----------
  kdc: adjust flags passed to hdb_fetch_kvno()

The KDC's _kdc_db_fetch() cals the database's hdb_fetch_kvno() to obtain
one or more decrypted versioned key sets.  The KDC either requires one
specific key set if a non-zero key version number is provided or all key sets.
The key version zero indicates that the latest key version should be used.

Prior to this change the KDC called hdb_fetch_kvno() with the
HDB_F_KVNO_SPECIFIED flag when the kvno is zero breaking cross-realm
with Active Directory.

As of this change, HDB_F_KVNO_SPECIFIED is set for a non-zero kvno and
HDB_F_ALL_KVNOS is set otherwise.

Change-Id: I32f4d8da9b601d7bbec7d80cc34d0ff94f6670be

  Commit: 95e56fa3aea1f1b7c7acd8bced6aba8d30efb2a0
      https://github.com/heimdal/heimdal/commit/95e56fa3aea1f1b7c7acd8bced6aba8d30efb2a0
  Author: Nicolas Williams <nico at cryptonector.com>
  Date:   2015-03-14 (Sat, 14 Mar 2015)

  Changed paths:
    M lib/hdb/mkey.c

  Log Message:
  -----------
  hdb: fix hdb_unseal_keys_kvno return when no history

Prior to this change hdb_unseal_keys_kvno() could return successfully (0)
if the choice_HDB_extension_data_hist_keys extension was found but the
hist_keys list was empty.  As a side effect callers would believe that the
provide hdb_entry keys were unsealed when they weren't.  This could cause
the KDC or kadmin to report invalid key size errors.

If the extension is present and the history list is empty attempt to
unseal the provided hdb_entry using hdb_unseal_keys_mkey().

Change-Id: I9218b02bccdbcf22133a9464a677374db53ade85

  Commit: d9e3e376a364024b11e4705949aaa507714b3979
      https://github.com/heimdal/heimdal/commit/d9e3e376a364024b11e4705949aaa507714b3979
  Author: Nicolas Williams <nico at cryptonector.com>
  Date:   2015-03-14 (Sat, 14 Mar 2015)

  Changed paths:
    M tests/kdc/check-kdc.in

  Log Message:
  -----------
  tests: Add simple key history test for kdc

Use kadmin cpw with the --keepold parameter to create a history list.

Change-Id: I21811c840be0bd1b8dd8dc66e63f88f8da6fac7e

  Commit: c37f1b3e4f8793b24582bfd0aac3a5a1e36841e1
      https://github.com/heimdal/heimdal/commit/c37f1b3e4f8793b24582bfd0aac3a5a1e36841e1
  Author: Nicolas Williams <nico at cryptonector.com>
  Date:   2015-03-14 (Sat, 14 Mar 2015)

  Changed paths:
    M lib/krb5/get_cred.c

  Log Message:
  -----------
  krb5: Don't cache/reuse referral TGTs

Prior to this change _krb5_get_cred_kdc_any() would include TGTs obtained
via KDC referrals in the "*ret_tgts" array returned to the caller.  The
caller typically stores these TGTs in the active credential cache.

However, referrals TGTs must not be cached or reused for any request
beyond the one it was issued for.  The referral is for a specific service
principal and the resulting TGT could include service specific AuthData.
The referral might also direct the client along a transitive path that
is specific to this service and not applicable in the general case.

This change removes the *ret_tgts parameter from get_cred_kdc_referral()
so that the obtained TGTs are never returned to its caller.   This also
prevents these TGTs from being used by any subsequent call to
get_cred_kdc_capath().

Change-Id: Iacc76c5b1639af3cf6bf277966cfd1535dd1e84d

  Commit: e13c0946f699019da133e9deefd07271b9cad42f
      https://github.com/heimdal/heimdal/commit/e13c0946f699019da133e9deefd07271b9cad42f
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2015-03-14 (Sat, 14 Mar 2015)

  Changed paths:
    M lib/krb5/get_cred.c

  Log Message:
  -----------
  krb5: refactor get_cred_kdc_capath_worker

This change adds a common out: path for all cleanup.

It also adjusts whitespace for consistency.

Change-Id: Ic90d6568a44aebc0c0adb64fad641e5420ea8e27

  Commit: 4f074487b46e95c96530405950d51b950814c52c
      https://github.com/heimdal/heimdal/commit/4f074487b46e95c96530405950d51b950814c52c
  Author: Nicolas Williams <nico at cryptonector.com>
  Date:   2015-03-14 (Sat, 14 Mar 2015)

  Changed paths:
    M lib/krb5/get_cred.c

  Log Message:
  -----------
  krb5: reject referrals in capath code paths

In get_cred_kdc_capath_worker() if the credentials obtained by
get_cred_kdc_address() does not exactly match the requested service
principal discard them and return KRB5KC_ERR_S_PRINCIPAL_UNKNOWN.

Change-Id: Iaeacd07f87374f64e3a7bb860adfeb2dc9550fd1

  Commit: b84bdf213d9d2c62fb942c09729cf7276557374a
      https://github.com/heimdal/heimdal/commit/b84bdf213d9d2c62fb942c09729cf7276557374a
  Author: Nicolas Williams <nico at cryptonector.com>
  Date:   2015-03-14 (Sat, 14 Mar 2015)

  Changed paths:
    M lib/krb5/get_cred.c

  Log Message:
  -----------
  krb5: improve comments in get_cred_kdc_capath_worker

Change-Id: I0d47ada32fdc9f7938d69d93022f1daac80d4e88

  Commit: 8a5d50a328f294e95b1bd73775820448ae0d301d
      https://github.com/heimdal/heimdal/commit/8a5d50a328f294e95b1bd73775820448ae0d301d
  Author: Nicolas Williams <nico at cryptonector.com>
  Date:   2015-03-14 (Sat, 14 Mar 2015)

  Changed paths:
    M lib/krb5/get_cred.c

  Log Message:
  -----------
  krb5: do not store TGTs if GC_NO_STORE

krb5_get_credentials_with_flags() and krb5_get_creds() do not store
obtained TGTs if the KRB5_GC_NO_STORE flag is set.

Change-Id: Ie999ec4e985463ff60e9d499c3e870880033dfa7

  Commit: cfdf6d5cbe3e9d664709f28676eeabf4f38ae591
      https://github.com/heimdal/heimdal/commit/cfdf6d5cbe3e9d664709f28676eeabf4f38ae591
  Author: Viktor Dukhovni <viktor at twosigma.com>
  Date:   2015-03-14 (Sat, 14 Mar 2015)

  Changed paths:
    M lib/gssapi/krb5/acquire_cred.c
    M lib/gssapi/krb5/canonicalize_name.c
    M lib/gssapi/krb5/gsskrb5_locl.h
    M lib/gssapi/krb5/import_name.c
    M lib/gssapi/krb5/init_sec_context.c
    M lib/krb5/get_cred.c
    M lib/krb5/principal.c

  Log Message:
  -----------
  gsskrb5: Make krb5 mech use referrals

Modify the gss krb5 mech to always use referrals unless the
KRB5_NCRO_NO_REFERRALS flag is set.

Change-Id: I7efd873ac922a43adafa2c492703b576847a885f

  Commit: db72e66eb93689706b91b66c69d0c4f214b9f16c
      https://github.com/heimdal/heimdal/commit/db72e66eb93689706b91b66c69d0c4f214b9f16c
  Author: Nicolas Williams <nico at cryptonector.com>
  Date:   2015-03-14 (Sat, 14 Mar 2015)

  Changed paths:
    M lib/kadm5/libkadm5srv-exports.def
    M lib/kadm5/marshall.c
    M lib/kadm5/version-script-client.map
    M lib/kadm5/version-script.map

  Log Message:
  -----------
  kadm5: Add functions to check for bogus keys

Introduce kadm5_all_keys_are_bogus() and kadm5_some_keys_are_bogus()
which will be used in later changes.

Change-Id: I3a07ffe07bee7d6eb17c3d2eae91c107e0bac255

  Commit: 668365033778c02724053652930749f74d48c585
      https://github.com/heimdal/heimdal/commit/668365033778c02724053652930749f74d48c585
  Author: Nicolas Williams <nico at cryptonector.com>
  Date:   2015-03-14 (Sat, 14 Mar 2015)

  Changed paths:
    M kadmin/add_enctype.c

  Log Message:
  -----------
  kadmin: add_enctype fix whitespace

Correct whitespace in add_enctype()

Change-Id: Iebc1df46496b0340c418d7a44a6071b48f44f828

  Commit: edb6c1b07527e3412de8b9297cf166dba5299ba7
      https://github.com/heimdal/heimdal/commit/edb6c1b07527e3412de8b9297cf166dba5299ba7
  Author: Nicolas Williams <nico at cryptonector.com>
  Date:   2015-03-14 (Sat, 14 Mar 2015)

  Changed paths:
    M kadmin/del_enctype.c

  Log Message:
  -----------
  kadmin: del_enctype whitespace

Fix whitespace and bracing in del_enctype().

No functional change.

Change-Id: I4e70b381aa54a6b0965c88713fbfb4d29bc4495e

  Commit: 7ab1e01d75eb5776cbc384d677dc3530024d108e
      https://github.com/heimdal/heimdal/commit/7ab1e01d75eb5776cbc384d677dc3530024d108e
  Author: Nicolas Williams <nico at cryptonector.com>
  Date:   2015-03-14 (Sat, 14 Mar 2015)

  Changed paths:
    M kadmin/add_enctype.c

  Log Message:
  -----------
  kadmin: add_enctype check for bogus keys

If kadmind returned bogus keys it means that the user lacks the
get-keys permission.   Generate a warning and exit.

Also use calloc() to allocate the new_key_data.

Change-Id: I21b697e2ff5adf753b1cfe698877b3f593bbea9e

  Commit: 14195658a4e6e2390eeb28bf72cb11bce2e08f6d
      https://github.com/heimdal/heimdal/commit/14195658a4e6e2390eeb28bf72cb11bce2e08f6d
  Author: Nicolas Williams <nico at cryptonector.com>
  Date:   2015-03-14 (Sat, 14 Mar 2015)

  Changed paths:
    M kadmin/del_enctype.c

  Log Message:
  -----------
  kadmin: del_enctype check for bogus keys

If kadmind returned bogus keys it means that the user lacks the
get-keys permission.   Generate a warning and exit.

Change-Id: Ib76dd86b65bd84a00f3e27c245b9cfc0173fff56

  Commit: 1bfb759a646cbb627c0bde5af2396030ac6b912d
      https://github.com/heimdal/heimdal/commit/1bfb759a646cbb627c0bde5af2396030ac6b912d
  Author: Jeffrey Altman <jaltman at secure-endpoints.com>
  Date:   2015-03-14 (Sat, 14 Mar 2015)

  Changed paths:
    M kadmin/ext.c

  Log Message:
  -----------
  kadmin: refactor do_ext_keytab for common cleanup

Refactor do_ext_keytab() so that all cleanup is performed by jumping
to the out label on error.

Change-Id: Ic0c0f57e8ebabf30b49519f14743370d1c1672d2

  Commit: dcbe8ae73baab2f019d2d87ee668e432dabd3e0c
      https://github.com/heimdal/heimdal/commit/dcbe8ae73baab2f019d2d87ee668e432dabd3e0c
  Author: Nicolas Williams <nico at cryptonector.com>
  Date:   2015-03-14 (Sat, 14 Mar 2015)

  Changed paths:
    M kadmin/ext.c

  Log Message:
  -----------
  kadmin: do_ext_keytab add bogus key warnings

If any of the keys returned by kadmin are the magic bogus key
generate a warning to the user that they are missing the git-keys
privilege.

Change-Id: I235b87eeb2f81e8fd8c8481154d613e92a7e11e2

  Commit: 69b0a8f4eb0a5b47db65f3427530903fb2238b35
      https://github.com/heimdal/heimdal/commit/69b0a8f4eb0a5b47db65f3427530903fb2238b35
  Author: Nicolas Williams <nico at cryptonector.com>
  Date:   2015-03-14 (Sat, 14 Mar 2015)

  Changed paths:
    M lib/kadm5/modify_s.c

  Log Message:
  -----------
  kadm5: kadmin modify must refuse bogus keys

kadmin should not permit a modify that stores invalid keys into the
database.  Accepting bad key data into the database will result in
errors when those keys are eventually used.

This change does not address the general case.  It does address the
specific case of the kadmin client attempting to store the magic
bogus key since that is trivial to check for and can be unintentionally
returned to kadmind by a 1.6rc2 or prior client.  This can happen when
a user has get privilege but lacks the new get-keys privilege.

Change-Id: I44795e6428472b75ab1e4257ce7cb9160f0299f5

Compare: https://github.com/heimdal/heimdal/compare/fca6363307d0...69b0a8f4eb0a