STABLE12-kaserver-disable-krb4-crossrealm-20030317

to deal with krb4 security advisory

====================
This delta was composed from multiple commits as part of the CVS->Git migration.
The checkin message with each commit was inconsistent.
The following are the additional commit messages.
====================

to deal with krb4 security advisory
type mismatch for krb4_cross pointed out by Jack Neely <slack@quackmaster.net>

(cherry picked from commit 1312d1179d4a97e9c62eb26ef55f60007cd35872)

diff --git a/src/kauth/kaprocs.c b/src/kauth/kaprocs.c
index 2b557fdcf7d383c7c312016fd8fd6f4049bae1a4..b20d5a9944f317fab187309112f4bcfb5c9dcf74 100644 (file)
--- a/src/kauth/kaprocs.c
+++ b/src/kauth/kaprocs.c
@@ -1707,6 +1707,11 @@ static afs_int32 GetTicket (version, call, kvno, authDomain, aticket,
     if (import && (celllen == 0)) {code = KABADTICKET; goto abort;}
     if (export && (celllen == 0)) strcpy (cell, lrealm);
 
+    if (!krb4_cross && celllen && strcmp(lrealm, cell) != 0) {
+      code = KABADUSER;
+      goto abort;
+    }
+
     des_ecb_encrypt (atimes->SeqBody, &times, schedule, DECRYPT);
     times.start = ntohl(times.start);
     times.end = ntohl(times.end);

diff --git a/src/kauth/kaserver.c b/src/kauth/kaserver.c
index 74ea4ff0065956399008f44baa1bf434af0d2686..eeefa219937313549a337da98f202cbf46752b6d 100644 (file)
--- a/src/kauth/kaserver.c
+++ b/src/kauth/kaserver.c
@@ -56,6 +56,8 @@ struct kadstats dynamic_statistics;
 struct ubik_dbase *KA_dbase;
 afs_int32 myHost = 0;
 afs_int32 verbose_track = 1;
+afs_int32 krb4_cross = 0;
+
 struct afsconf_dir *KA_conf;           /* for getting cell info */
 
 extern afs_int32 ubik_lastYesTime;
@@ -194,6 +196,7 @@ main (argc, argv)
       usage:
         printf("Usage: kaserver [-noAuth] [-fastKeys] [-database <dbpath>] "
               "[-localfiles <lclpath>] [-minhours <n>] [-servers <serverlist>] "
+              "[-crossrealm]"
               /*" [-enable_peer_stats] [-enable_process_stats] " */
               "[-help]\n");
        exit(1);
@@ -251,6 +254,7 @@ main (argc, argv)
        else if (IsArg("-clear")) level = rxkad_clear;
        else if (IsArg("-sorry")) level = rxkad_clear;
        else if (IsArg("-debug")) verbose_track = 0;
+       else if (IsArg("-crossrealm")) krb4_cross = 1;
        else if (IsArg("-minhours")) {
              MinHours = atoi(argv[++a]);
         }

diff --git a/src/kauth/kaserver.h b/src/kauth/kaserver.h
index dfc0e341590a34e8b680f2fc1d69f1085e01668a..ef7580545b8909c70a858f797b4e5a5947525a8c 100644 (file)
--- a/src/kauth/kaserver.h
+++ b/src/kauth/kaserver.h
@@ -179,6 +179,7 @@ extern int kaux_islocked(
   u_int   locktime
 );
 
+extern afs_int32 krb4_cross;
 
 #define LOCKPW
 

diff --git a/src/kauth/krb_udp.c b/src/kauth/krb_udp.c
index 137cd7dd188286c3c9d31b6f0a6cc34e8d0c32fb..6f3ba8ff7b5d1cf34f1c4ff82a36eec3507e6eb6 100644 (file)
--- a/src/kauth/krb_udp.c
+++ b/src/kauth/krb_udp.c
@@ -462,6 +462,11 @@ afs_int32 UDP_GetTicket (ksoc, pkt, kvno, authDomain, ticket, ticketLen, auth, a
        cell[MAXKTCREALMLEN-1] = 0;
     };
 
+    if (!krb4_cross && strcmp(lrealm, cell) != 0) {
+       code = KERB_ERR_PRINCIPAL_UNKNOWN;
+       goto abort;
+    }
+
     if (krb_udp_debug) {
        printf ("UGetTicket: got ticket from '%s'.'%s'@'%s'\n",
                name, inst, cell);