Fix spurious clock skew caused by gak_fct delay

In get_in_tkt.c, a time offset is computed between the KDC's auth_time
and the current system time after the reply is decrypted.  Time may
have elapsed between these events because of a gak_fct invocation
which blocks on user input.  The resulting spurious time offset can
cause subsequent TGS-REQs to fail and can also cause the end time of
the next AS request to be in the past (issue #889) in cases where the
old ccache is opened to find the default principal.

Use the system time, without offset, for the request time of an AS
request, for more predictable kinit behavior.  Use this request time,
rather than the current time, when computing the clock skew after the
reply is decrypted.

(cherry picked from commit 37b0e55e21926c7875b7176e24e13005920915a6)

ticket: 7610 (new)
version_fixed: 1.9.5
status: resolved
Don't return a host referral to the service realm

A host referral to the same realm we just looked up the principal in
is useless at best and confusing to the client at worst.  Don't
respond with one in the KDC.

(back ported from commit ee0d5eac353a13a194759b72cb44203fda1bf0fa)

(cherry picked from commit 745c0194ee93318cf4d44f6f8ccb7739523d448e)

ticket: 7609 (new)
version_fixed: 1.9.5
status: resolved
Ensure null termination of AFS salts

Use krb5int_copy_data_contents_add0 when copying a pa-pw-salt or
pa-afs3-salt value in pa_salt().  If it's an afs3-salt, we're going to
throw away the length and use strcspn in krb5int_des_string_to_key,
which isn't safe if the value is unterminated.

(cherry picked from commit f566fee75f2455d6e5e7ee4fcdf5a0d327808639)

ticket: 7611 (new)
version_fixed: 1.9.5
status: resolved
Make verify_init_creds work with existing ccache

As the file ccache implementation currently stands, we don't want to
turn off TC_OPENCLOSE on a file cache we're writing to, or it will be
opened read-only and stores to it will fail.  Reported by Russ
Allbery.

(cherry picked from commit 0ae663d35b7dcbf2c469ad0688a67f4d1c0e425e)

ticket: 7612 (new)
version_fixed: 1.9.5
status: resolved
Fail during configure if unable to find ar

Fail during configure time if the configure script can't locate the
"ar" program, instead of producing a delayed failure during build time
by running the "false" command.  Some Solaris releases have ar in
/usr/ccs/bin, which is not in the default path for some users.

(cherry picked from commit 2c990e6418cd7cee7ca178a3175b07ed6a01ffae)

ticket: 7613 (new)
version_fixed: 1.9.5
status: resolved
Avoid side effects in assert expressions

asserts may be compiled out with -DNDEBUG, so it's wrong to use an
assert expression with an important side effect.

(We also have scores of side-effecting asserts in test programs, but
those are less important and can be dealt with separately.)

(back ported from commit 221cd4a23691601a14500bc00146c265b50bdc94)

ticket: 7614 (new)
version_fixed: 1.9.5
status: resolved
PKINIT null pointer deref [CVE-2013-1415]

Don't dereference a null pointer when cleaning up.

The KDC plugin for PKINIT can dereference a null pointer when a
malformed packet causes processing to terminate early, leading to
a crash of the KDC process.  An attacker would need to have a valid
PKINIT certificate or have observed a successful PKINIT authentication,
or an unauthenticated attacker could execute the attack if anonymous
PKINIT is enabled.

CVSSv2 vector: AV:N/AC:M/Au:N/C:N/I:N/A:C/E:P/RL:O/RC:C

This is a minimal commit for pullup; style fixes in a followup.
[kaduk@mit.edu: reformat and edit commit message]

(cherry picked from commit c773d3c775e9b2d88bcdff5f8a8ba88d7ec4e8ed)

ticket: 7619 (new)
version_fixed: 1.9.5
status: resolved
Fix gss_str_to_oid for OIDs with zero-valued arcs

gss_str_to_oid wasn't outputting any bytes for a zero-valued arc.  It
should output one byte with value 0.

[ghudson@mit.edu: commit message]

(cherry picked from commit 54fa4433df7412267375240aba40959e97ac4fe2)

ticket: 7615 (new)
version_fixed: 1.9.5
status: resolved
Fix no_host_referral concatention in KDC

If no_host_referral is set in both [kdcdefaults] and the realm
subsection, we're supposed to concatenate their values.  But the logic
in handle_referral_params would overwrite the value with the
non-concatenated realm value.  Similar bugs of this nature were fixed
in 639c9d0f5a7c68dc98a2a452abc05ca32443cddf (r22037) but this one was
missed.

(cherry picked from commit 6338d039cbd0b138642e3b123ac58dc802d1d907)

ticket: 7616 (new)
version_fixed: 1.9.5
status: resolved
Fix kdb5_util dump.c uninitialized warnings

Some versions of clang report an uninitialized variable warning (which
we treat as an error) in process_k5beta_record.  Due to the if-ladder
style of the function, uninitialized tmpint values can be copied
around in certain error cases, although the garbage values would be
ultimately ignored.  As a minimal fix, initialize the tmpint
variables.

(cherry picked from commit 1b7f7eef8a95bda0135159b2c06a168b56d9f42b)

ticket: 7617 (new)
version_fixed: 1.9.5
status: resolved
Fix initial call to svcraw_create

gssrpc raw services could not work because svcraw_create did not set
svcraw_private after allocating memory for it.

[ghudson@mit.edu: commit message, patch splitting]

(cherry picked from commit 5e3bf4ac6cb02601c5f10c5b2804fd5028c80119)

ticket: 7618 (new)
Fix various result checks

Correct three cases where the wrong expression was checked to see if
an allocation function returned null.

[ghudson@mit.edu: commit message, patch splitting]
[tlyu@mit.edu: omit inapplicable lib/kadm/srv/svr_principal.c change]

(back ported from commit a9ee4a040eeacab1d410ff9e4c862484b531c401)
(cherry picked from commit 2ea07b055f1eb3abbb3a7b7206ab04ff190acf84)

ticket: 7618
version_fixed: 1.9.5
status: resolved
KDC TGS-REQ null deref [CVE-2013-1416]

By sending an unusual but valid TGS-REQ, an authenticated remote
attacker can cause the KDC process to crash by dereferencing a null
pointer.

prep_reprocess_req() can cause a null pointer dereference when
processing a service principal name.  Code in this function can
inappropriately pass a null pointer to strlcpy().  Unmodified client
software can trivially trigger this vulnerability, but the attacker
must have already authenticated and received a valid Kerberos ticket.

The vulnerable code was introduced by the implementation of new
service principal realm referral functionality in krb5-1.7, but was
corrected as a side effect of the KDC refactoring in krb5-1.11.

CVSSv2 vector: AV:N/AC:L/Au:S/C:N/I:N/A:C/E:H/RL:O/RC:C

(cherry picked from commit 8ee70ec63931d1e38567905387ab9b1d45734d81)

ticket: 7622 (new)
version_fixed: 1.9.5
status: resolved
Fix condition with empty body

Found by clang's warnings.

(cherry picked from commit 18796a2eb6c05706c6635453b3e425955aab93f4)

(cherry picked from commit 63b5902e83eb7d47f2eb061acde2566ec1d45bc8)

ticket: 7623 (new)
version_fixed: 1.9.5
status: resolved
Reset ulog if database load failed

If an iprop slave tries to load a dump from the master and it fails,
reset the ulog header so we take another full dump, instead of
reporting that the slave is current when it isn't.

[ghudson@mit.edu: commit message]
[tlyu@mit.edu: remove ulog_sync_header call]

(cherry picked from commit 74b3f961e15d2eee5bad93d2a224c10834bbaab8)

(cherry picked from commit 9fae7b50c7217e6aa88a97b762297e30040b2b86)

ticket: 7624 (new)
version_fixed: 1.9.5
status: resolved
Updates for krb5-1.9.5
Update for krb5-1.9.5-postrelease
Fix lock inconsistency in krb5_db2_unlock()

[ text below refers to new function names in krb5-1.10+ ]

The lock inconsistency fixed here is quite possibly the same as
described in https://bugzilla.redhat.com/show_bug.cgi?id=586032 .

The problem is that ctx_unlock() fails to unlock the principal DB if
it fails to unlock the policy DB, and this happens when ctx_lock()
fails to lock the policy DB (likely because the caller is racing
against a kdb5_util load, which will be using a "permanent" lock,
meaning that the lock file will be unlinked after acquiring the
lock).  The fix is to perform both unlock operations *then* handle
any errors that either or both might have returned.

(back ported from commit 29ee39baa919361ae08e26caab896890d5cb3eb4)

ticket: 7674 (new)
version_fixed: 1.9.6
status: resolved
Fix KDC lock persistence on error conditions

If k5db2_dbopen() returns an error, krb5_db2_lock() can return an
error without unlocking the lock file.  This lock will persist until
krb5_db2_lock() executes successfully, preventing kadmind from making
changes to the KDB.  One possible trigger is running out of file
descriptors.

ticket: 7717 (new)
version_fixed: 1.9.6