{"push_id":641727561,"size":33,"distinct_size":33,"ref":"refs/heads/master","head":"527edfaadb648a0dd2a42cd39a5a02a4ac37d7e3","before":"b5143bdc766ad4819355ac2cd52f685ec5dafa16","commits":[{"sha":"5e54fa769d1b04ccf0d904164e897d081051647f","author":{"email":"228b81f375fb586ced770ca7f27c09213587c9a2@mit.edu","name":"Tom Yu"},"message":"Add configure checks for portability assumptions\n\nCheck a few portability assumptions:\n\n* Integers are two's complement.  Testing that the bitwise complement\n  of the representation of -1 is zero is sufficient, because C99\n  6.2.6.2 only allows sign and magnitude, one's complement, and two's\n  complement as representations.\n\n* Integer values with sign bit one and value bits zero are valid and\n  not trap representations.  C99 6.2.6.2 allows such a value to be a\n  trap representation.  Testing that the declared integer value bounds\n  are asymmetric in magnitude is sufficient.\n\n* Conversion of an unsigned integer value that is not representable in\n  the corresponding signed type preserves the bit pattern.  C99\n  6.3.1.3 says this is implementation-defined, or raises an\n  implementation-defined signal.  Exhaustively checking for the\n  desired behavior is prohibitive, so this spot check will have to do.\n\n* Bytes are 8 bits","distinct":true,"url":"https://api.github.com/repos/mmattioli/krb5/commits/5e54fa769d1b04ccf0d904164e897d081051647f"},{"sha":"102bb6ebf20f9174130c85c3b052ae104e5073ec","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Fix krb5_read_message handling [CVE-2014-5355]\n\nIn recvauth_common, do not use strcmp against the data fields of\nkrb5_data objects populated by krb5_read_message(), as there is no\nguarantee that they are C strings.  Instead, create an expected\nkrb5_data value and use data_eq().\n\nIn the sample user-to-user server application, check that the received\nclient principal name is null-terminated before using it with printf\nand krb5_parse_name.\n\nCVE-2014-5355:\n\nIn MIT krb5, when a server process uses the krb5_recvauth function, an\nunauthenticated remote attacker can cause a NULL dereference by\nsending a zero-byte version string, or a read beyond the end of\nallocated storage by sending a non-null-terminated version string.\nThe example user-to-user server application (uuserver) is similarly\nvulnerable to a zero-length or non-null-terminated principal name\nstring.\n\nThe krb5_recvauth function reads two version strings from the client\nusing krb5_read_message(), which produces a krb5_data structure\ncontaining a length and a pointer to an octet sequence.  krb5_recvauth\nassumes that the data pointer is a valid C string and passes it to\nstrcmp() to verify the versions.  If the client sends an empty octet\nsequence, the data pointer will be NULL and strcmp() will dereference\na NULL pointer, causing the process to crash.  If the client sends a\nnon-null-terminated octet sequence, strcmp() will read beyond the end\nof the allocated storage, possibly causing the process to crash.\n\nuuserver similarly uses krb5_read_message() to read a client principal\nname, and then passes it to printf() and krb5_parse_name() without\nverifying that it is a valid C string.\n\nThe krb5_recvauth function is used by kpropd and the Kerberized\nversions of the BSD rlogin and rsh daemons.  These daemons are usually\nrun out of inetd or in a mode which forks before processing incoming\nconnections, so a process crash will generally not result in a\ncomplete denial of service.\n\nThanks to Tim Uglow for discovering this issue.\n\nCVSSv2: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C\n\n[tlyu@mit.edu: CVSS score]\n\nticket: 8050 (new)\ntarget_version: 1.13.1\ntags: pullup","distinct":true,"url":"https://api.github.com/repos/mmattioli/krb5/commits/102bb6ebf20f9174130c85c3b052ae104e5073ec"},{"sha":"040fe97758bdf53b6c00815b0306410eb88ea5ec","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Support kadmin script mode\n\nAdd support for a command and argments to be specified on the kadmin\ncommand line, with script-friendly behavior.  kadmin_startup() now\nyields either a request string or a request argv array, and sets\nscript_mode in the argv array case.  Informational messages now go\nthrough info() and are suppressed if script_mode is set.  Prompts and\nwarning messages are also suppressed in script mode.  Error messages\nindicating a failure now go through error() and set exit_status if\nscript_mode is set.  The extended com_err() hook is always installed\nso that com_err messages go through error() and set exit_status.\n\ngetopt() is now invoked with a leading '+' to suppress Gnu getopt\nargument reordering behavior, so that invokers don't need to pass \"--\"\nto prevent query options from being treated as kadmin options.\nNon-Gnu getopt implementations should harmlessly treat '+' as a valid\nflag option, which has no effect as it will reach the same default\nlabel in the switch statement.\n\nticket: 7991","distinct":true,"url":"https://api.github.com/repos/mmattioli/krb5/commits/040fe97758bdf53b6c00815b0306410eb88ea5ec"},{"sha":"60516bb111ac68ce0d809043d46c0c1f815a7b30","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Use kadmin script mode in Python tests\n\nIn k5test, rename kadmin_local to kadminl and remove the run_kadminl()\nK5Realm method.  Update all scripts to use realm.run([kadminl, 'cmd',\n...]).  run_kadmin() still exists but takes an argument array instead\nof a query string.\n\nWhere we touch test code, rename \"output\" to \"out\" (since \"output\" is\na function name exported by k5test.py), elide \":normal\" from salt\nstrings, and use expressions like realm.krbtgt_princ instead of\nmanually composed principal names where appropriate.  In\nt_kadmin_acl.py, get rid of the delprinc() helper since the equivalent\nis now concise enough to be written out each time.  In t_policy.py,\nremove some inoperative getprinc invocations and reorder some tests\nwhich didn't correspond to their comment headers.","distinct":true,"url":"https://api.github.com/repos/mmattioli/krb5/commits/60516bb111ac68ce0d809043d46c0c1f815a7b30"},{"sha":"54984d618e01027abe73e6772fe7049c79938518","author":{"email":"442e7280fbb5597698e68ca0afb570b530c1f76f@ssi.gouv.fr","name":"Thomas Calderon"},"message":"Check timestamp in PKINIT kdcpreauth module\n\nRFC 4556 requires the KDC to check the PKAuthenticator timestamp in\norder to prevent replays after the five-minute clock skew window.  (A\nreplay attack has minimal value; it only causes the KDC to issue a\nticket which an attacker cannot decrypt.)\n\n[ghudson@mit.edu: rewrote commit message; squashed with typo fix;\nstyle fixes]\n\nticket: 8123 (new)","distinct":true,"url":"https://api.github.com/repos/mmattioli/krb5/commits/54984d618e01027abe73e6772fe7049c79938518"},{"sha":"fcc1076541a3bd9a5fa4db0be6f74888b3f5f193","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Use preauth timestamp in PKINIT clpreauth module\n\nUse the timestamp from the KDC's preauth-required error when\ngenerating a PKAuthenticator in pa_pkinit_gen_req(), to allow PKINIT\nauthentication to succeed despite client clock skew if kdc_timesync is\nset.\n\nBecause this timestamp is unauthenticated (unless FAST is used), an\nattacker could induce a legitimate client to generate a\nPKAuthenticator for a future timestamp.  But replaying this request in\nthe future would only cause the KDC to issue a ticket which the\nattacker cannot decrypt.\n\nticket: 8124 (new)","distinct":true,"url":"https://api.github.com/repos/mmattioli/krb5/commits/fcc1076541a3bd9a5fa4db0be6f74888b3f5f193"},{"sha":"68ac7ac1f1a1d2939a2c99fa49cecd734614d16d","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Add formats section to documentation\n\nAdd a new \"formats\" section to the RST documentation and populate it\nwith documentation of the credential cache and keytab file formats.\n\nticket: 8149 (new)\ntarget_version: 1.13.2\ntags: pullup","distinct":true,"url":"https://api.github.com/repos/mmattioli/krb5/commits/68ac7ac1f1a1d2939a2c99fa49cecd734614d16d"},{"sha":"9c491320f72f1e07f87c1cf5b7671505f3526891","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Fix kadmin script mode command-not-found error\n\nIn ss_wrapper.c, if ss_execute_command() returns an error, we should\ncall ss_perror() with *args as the third argument and not request\n(which is NULL).  Expand out the conditional into three commented\nbranches for greater clarity, since the error-handling is no longer\nidentical for the ss_execute_command() and ss_execute_line() cases.\n\nticket: 7991","distinct":true,"url":"https://api.github.com/repos/mmattioli/krb5/commits/9c491320f72f1e07f87c1cf5b7671505f3526891"},{"sha":"c8608c52646a10503b1a950f8df5072d0a583604","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Add test KDB module\n\nAdd a simple read-only KDB module which can be used to exercise KDB\nbehavior which the DB2 module cannot reach.  Right now it supports\nvery basic get_principal functionality, aliases, and delegation\npolicy; in the future it could issue referrals or sign authdata.","distinct":true,"url":"https://api.github.com/repos/mmattioli/krb5/commits/c8608c52646a10503b1a950f8df5072d0a583604"},{"sha":"e732d9dc3f2e7b01ff3c8305d58a3a754c9e9ec5","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Add successful S4U2Proxy test cases\n\nIn t_s4u.py, use the test KDB module to test successful S4U2Proxy\ndelegations.","distinct":true,"url":"https://api.github.com/repos/mmattioli/krb5/commits/e732d9dc3f2e7b01ff3c8305d58a3a754c9e9ec5"},{"sha":"29dec110c43ae9cebdcd935906a3131ca9ac0c99","author":{"email":"8ea548d7adacb6e81ce31e1ecef22dcd9af8f64b@redhat.com","name":"Solly Ross"},"message":"Import names immediately with COMPOSITE_EXPORT\n\nRFC 6680 specifies that GSS_Export_name_composite() \"outputs a token that\n\"can be imported with GSS_Import_name(), using GSS_C_NT_COMPOSITE_EXPORT\nas the name type...\".  Therefore, in the gss_import_name mechglue, we\nshould perform the import process imediately when either\nGSS_C_NT_COMPOSITE_EXPORT or GSS_C_NT_EXPORT_NAME are used (not just\nfor the later, as is the current functionality).\n\nThe naming extension test was also updated to display the result\nof importing with GSS_C_NT_COMPOSITE_EXPORT in addition to\nGSS_C_NT_EXPORT_NAME.\n\n[ghudson@mit.edu: minor style changes]\n\nticket: 8153 (new)\ntarget_version: 1.13.2\ntags: pullup","distinct":true,"url":"https://api.github.com/repos/mmattioli/krb5/commits/29dec110c43ae9cebdcd935906a3131ca9ac0c99"},{"sha":"d3d18b8d8d7a47766fd4e9667d045035f43d90ef","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Fix scope of kadmind ACL wildcard back-references\n\nIn kadm5int_acl_find_entry(), clear the wildcard back-references list\nfor each acl entry.  Otherwise the wildcards we process can affect\nback-references for later entries.\n\nticket: 8154\ntarget_version: 1.13.2\ntags: pullup","distinct":true,"url":"https://api.github.com/repos/mmattioli/krb5/commits/d3d18b8d8d7a47766fd4e9667d045035f43d90ef"},{"sha":"ef21069070c1eb2ab1ade1d1406f5cd3920c83a9","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Document correct flag names for kadm5.acl\n\nkadm5.acl entries can include restrictions which can force flag values\non or off.  These flag values are parsed with krb5_string_to_flags(),\nwhich means the flag names are the ones for default_principal_flags,\nnot the ones for kadmin addprinc/modprinc.\n\nticket: 8155\ntarget_version: 1.13.2\ntags: pullup","distinct":true,"url":"https://api.github.com/repos/mmattioli/krb5/commits/ef21069070c1eb2ab1ade1d1406f5cd3920c83a9"},{"sha":"e9eaafeab12b2b62595f4dff2fca3345b2d95b4a","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Log invalid restrictions strings\n\nIn kadm5int_acl_parse_restrictions(), output a log message if we break\nout of the parsing loop with an error.  The current structure of the\nloop makes it difficult to pinpoint the bad restrictions field, so\njust output the whole string.\n\nticket: 8155\ntarget_version: 1.13.2\ntags: pullup","distinct":true,"url":"https://api.github.com/repos/mmattioli/krb5/commits/e9eaafeab12b2b62595f4dff2fca3345b2d95b4a"},{"sha":"11f0cf7928b239be45c5d3cb7e2eccd2ff1e1bfc","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Extend kadmin client timeout to one hour\n\nRetrieving the list of principals can take a long time for some\ndatabases.  Extend the libkadm5 client timeout from two minutes to one\nhour.  (We can't easily remove the timeout entirely.)\n\nticket: 8027","distinct":true,"url":"https://api.github.com/repos/mmattioli/krb5/commits/11f0cf7928b239be45c5d3cb7e2eccd2ff1e1bfc"},{"sha":"e321a9d23c4475ba105a6e892624a65940e7aed2","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Clean up gssrpc timeout code\n\nRevert b8b7bd63231094a3583847853bf60cb002781161 (for #6120) now that\nwe are setting the kadmin client timeout the appropriate way.\n\nIn clnt_create(), do not set a timeout after creating the handle;\ndoing so defeats the purpose of keeping track of whether the caller\nhas set a handle timeout.","distinct":true,"url":"https://api.github.com/repos/mmattioli/krb5/commits/e321a9d23c4475ba105a6e892624a65940e7aed2"},{"sha":"3d9de684ea933c4887a7aebabc71287cbf5a3f3c","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Fix renewable ticket lifetimes\n\nCommit b0661f9176f5eb2644ba459e1b1e87d3dd502174 removed the starttime\nhack in the EncTicketPart decoder.  Take this into account when\ncomputing the old lifetime of a ticket we are renewing.  Without this\nfix, we compute an old lifetime equal to the ticket end time, add that\nto the current KDC time, and issue a ticket with a negative end time\ndue to wraparound.  Add a simple test to t_renew.py to detect this by\nmaking sure that a renewed ticket is usable.\n\nThis bug appeared only on master and not as part of any release, so\nthere is no associated ticket.","distinct":true,"url":"https://api.github.com/repos/mmattioli/krb5/commits/3d9de684ea933c4887a7aebabc71287cbf5a3f3c"},{"sha":"2dc19c3899a98e23378c19d91594470f7350756c","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Process TGS authdata after transited in KDC\n\nThe CAMMAC authorization data container requires a checksum over the\nencrypted part of the issued ticket, with the CAMMAC contents\nsubstituted for the authdata field.  For this to work, we must\nfinalize the non-authdata fields of the encrypted ticket part before\nadding authdata.  Call handle_authdata() after checking and modifying\nthe transited field and potentially setting the\ntransited-policy-checked flag.\n\nAlso remove a redundant and inoperative conditional change to\nenc_tkt_reply.times.starttime which happens after the ticket is\nencrypted.  We do the same thing right after setting up the ticket\ntimes.","distinct":true,"url":"https://api.github.com/repos/mmattioli/krb5/commits/2dc19c3899a98e23378c19d91594470f7350756c"},{"sha":"8483243664a289fea142d8a9de61eba30d713871","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Disable principal renames for LDAP\n\nThe current principal rename procedure does not work with the LDAP KDB\nmodule, instead having the effect of deleting the principal.  The fix\nis not easy and requires amending the DAL (see issue #8065).  For now,\ndetect LDAP and error out when a rename operation is attempted.\n\nticket: 8162 (new)\ntarget_version: 1.13.2\ntags: pullup","distinct":true,"url":"https://api.github.com/repos/mmattioli/krb5/commits/8483243664a289fea142d8a9de61eba30d713871"},{"sha":"b97b84de1a83bf615853facd42bfafab267e2e06","author":{"email":"5365cf2218f6cd43be3aaf2d94134e9b8e7d0479@mit.edu","name":"Greg Hudson"},"message":"Make all Python test scripts executable\n\nFor the convenience of developers manually running Python test\nscripts, set the executable bits on all of them, and make sure the\nfirst line is always \"#!/usr/bin/python\".\n\nticket: 8163","distinct":true,"url":"https://api.github.com/repos/mmattioli/krb5/commits/b97b84de1a83bf615853facd42bfafab267e2e06"}]}