Fix unlikely null dereference in mk_cred()

If krb5_encrypt_keyhelper() returns an error, the ciphertext structure
may contain a non-zero length, but it will already have freed the
pointer to its data, making encrypt_credencpart()'s subsequent attempt
to clear and free the memory fail.  Remove that logic.

Based on a patch from Jatin Nansi.

ticket: 7948 (new)
target_version: 1.12.2
tags: pullup
Load plugins with RTLD_NODELETE if possible

On platforms which support RTLD_NODELETE, use it to load plugin
modules.  While using this flag makes plugins stay in the process map
after libkrb5/libgssapi_krb5 are unloaded, it solves several problems:

1. It prevents plugin modules which link against OpenSSL (PKINIT and
k5tls) from repeatedly initializing instances of libssl or libcrypto,
leaking heap memory each time.  This is only an issue because we
cannot safely uninitialize OpenSSL.

2. It prevents finalization ordering issues from causing a process
crash when unloading libgssapi_krb5 (issue #7135).

3. It makes memory leak tracing with valgrind easier.

ticket: 7947 (new)
Handle invalid RFC 1964 tokens [CVE-2014-4341...]

Detect the following cases which would otherwise cause invalid memory
accesses and/or integer underflow:

* An RFC 1964 token being processed by an RFC 4121-only context
  [CVE-2014-4342]

* A header with fewer than 22 bytes after the token ID or an
  incomplete checksum [CVE-2014-4341 CVE-2014-4342]

* A ciphertext shorter than the confounder [CVE-2014-4341]

* A declared padding length longer than the plaintext [CVE-2014-4341]

If we detect a bad pad byte, continue on to compute the checksum to
avoid creating a padding oracle, but treat the checksum as invalid
even if it compares equal.

CVE-2014-4341:

In MIT krb5, an unauthenticated remote attacker with the ability to
inject packets into a legitimately established GSSAPI application
session can cause a program crash due to invalid memory references
when attempting to read beyond the end of a buffer.

    CVSSv2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C

CVE-2014-4342:

In MIT krb5 releases krb5-1.7 and later, an unauthenticated remote
attacker with the ability to inject packets into a legitimately
established GSSAPI application session can cause a program crash due
to invalid memory references when reading beyond the end of a buffer
or by causing a null pointer dereference.

    CVSSv2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C

[tlyu@mit.edu: CVE summaries, CVSS]

ticket: 7949 (new)
subject: Handle invalid RFC 1964 tokens [CVE-2014-4341 CVE-2014-4342]
taget_version: 1.12.2
tags: pullup
Add tests for invalid GSSAPI per-message tokens

ticket: 7949
Fix KDC worker process argument parsing

To create worker processes, the KDC shuts down realms, forks off the
worker processes, then reinitializes realms in each child.
Reinitializing realms requires making a second pass over the
command-line arguments.  To do this with getopt, optind must be
reinitialized to 1 for each pass; otherwise, no options will be seen
the second time around.

ticket: 7945
target_version: 1.12.2
tags: pullup
Add socket-utils.h helpers for ports

Add sa_setport, sa_getport, and sa_is_inet helpers for conveniently
manipulating port numbers on IPv4 and IPv6 socket addresses.
Use sa_setport and sa_getport where appropriate

Use sa_setport and sa_getport in place of existing static helpers or
open-coded switch statements in net-server.c, fake-addrinfo.c, and
svc_tcp.c.
Add a family-independent bindresvport_sa function

This functions allows you to pass IPv4 and IPv6 addresses.  If no
address is given, t will determine the family by checking the socket
with getsockname.

[ghudson@mit.edu: clarified commit message, split out setport helper,
squashed with next commit, minimized code changes from old
bindresvport, used socket-utils.h helpers]

ticket: 7935 (new)
Use binresvport_sa when creating RPC handles

Make clnttcp_create, clntudp_bufcreate, svctcp_create, and
svcudp_bufcreate work with unbound IPv6 sockets using bindresvport_sa
and other socket helpers.  For caller-supplied sockets, call
getsockname to determine the address family we should attempt to bind.

[ghudson@mit.edu: clarified commit message, minimized code changes,
used socket-utils.h helpers, fixed fallback find on bindresvport
failure, restored getsockaddr call to get port after binding]

ticket: 7935
Fix unlikely null dereference in TGS client code

If krb5_get_tgs_ktypes fails (due to an out-of-memory condition or an
error re-reading the profile), k5_make_tgs_req will dereference a null
pointer.  Check the return value before dereferencing defenctypes.

[ghudson@mit.edu: clarified commit message]

ticket: 7952 (new)
target_version: 1.12.2
tags: pullup
Remove indent workaround in man page RST sources

docutils 0.10 properly adds indentation to example blocks in man
pages, so we do not need to force an extra indentation level.  Get rid
of the workaround wherever we use it.

ticket: 7954 (new)
target_version: 1.12.2
tags: pullup
Fix bugs in bindresvport_sa() changes

In svctcp_create() and svcudp_bufcreate(), set sa->sa_len on platforms
where that field exists, so that a subsequent call to socklen() will
return the correct result.

To make the code more self-evidently correct, zero the entire struct
sockaddr_storage object, using the memset(&ss, 0, sizeof(ss)) idiom.

ticket: 7935
Fix build on systems without RTM_OLD*

For example, FreeBSD has removed RTM_OLDADD and RTM_OLDDEL from its API
in March 2014, with the message:
Garbage collect long time obsoleted (or never used) stuff from routing API

Only attempt to define behavior for these cases if they are defined.

ticket: 7955 (new)
tags: pullup
target_version: 1.12.2
Simplify net-server.c UDP listener setup

In setup_udp_port_1, remove the haddrbuf parameter and use paddr like
we already do for one of the log messages.  In setup_udp_port, remove
the long switch statement and just look for AF_INET/AF_INET6
addresses.  Split up udp_flags into two booleans for clarity.  Update
the comment in loop_setup_network since we did the "To do" item a long
time ago.
Don't depend on sa_len sockaddr field

In socket-utils.h, replace the socklen macro with an inline function
sa_socklen which always uses the address family, even on platforms
with the sa_len sockaddr field.  This removes the need to set sa_len
in socket addresses we construct.
Avoid using length fields in socket addresses

Remove code to set or reference the length fields of socket addresses
(sa_len/sin_len/sin6_len), since they aren't portable and setting them
is not required.  Remove autoconf tests for those fields which are no
longer used or which were never used.

There is one exception: in localaddr.c, we still neeed to reference
sa_len for the definition of ifreq_size on platforms which have
sa_len.  Leave that behind, along with the autoconf test which defines
SA_LEN.
Define k5-platform.h wrapper for strerror_r

On systems where strerror_r is not the POSIX version, define it to
k5_strerror_r.  Implement k5_strerror_r in libkrb5support using
strerror_s, strerror, or the GNU strerror_r as appropriate.

ticket: 7961
Simplify usage of strerror_r

Take advantage of the strerror_r portability wrapper to simplify code
using it.  Remove unused macros related to strerror_r in
ldap_service_stash.c and plugins.c.

ticket: 7961
Include autoconf.h before system headers

Include autoconf.h (either directly or via proxy) before system
headers, so that feature test macros defined there can affect the
system namespace.  Where include order was changed, eliminate some
redundant or unnecessary includes.

ticket: 7961
Define _GNU_SOURCE for glibc extensions

glibc does not declare a number of common, useful extensions such as
asprintf unless _GNU_SOURCE is defined.  Define it early in the
configure process so that it is available for autoconf tests.

Defining _GNU_SOURCE unfortunately causes glibc to use the non-POSIX
version of strerror_r, which we now handle using the k5-platform.h
wrapper.

ticket: 7961