Document clock skew tolerance for ticket times

KDC and application server checks on ticket start and expiration times
are subject to clock skew tolerance.  Document this grace period.

[tlyu@mit.edu: edit commit message, adjust wording to conform to
existing style, document start time clock skew]

ticket: 8008 (new)
target_version: 1.13
tags: pullup
Try to scan_ccache() after leash picks a cache

We need to call scan_ccache() in order to notice that there
are credentials and read their expire time.

The call to scan_ccache() in the Leash case was inadvertently
removed as part of commit 8651f3339ccc5a623172a8edfb9cf522883acacd.

ticket: 7998 (new)
tags: pullup
target_version: 1.12.3
subject: gssapi.dll tries to get initial creds even when some are present
Add some KDC entries to the registry via WiX

Though our library happily uses DNS, I can't get Windows to
successfully contact KDCs found through the SRV records.
So, we do need to stay in the business of shipping around
KDC entries, after all.

ticket: 7999 (new)
queue: kfw
tags: pullup
target_version: 1.12.3
Let libgssapi see TGTs in the MSLSA cache

When the current user is a local administrator of a windows machine
where User Account Control (UAC) is enabled, the Windows LSA will
return a block of zeros as the session key for any TGT entry in the
MSLSA: cache.  The lcc_retrieve() implementation checks for such
"null" session keys and prevents them from escaping to callers (as
attempts to use them would encounger strange errors).  However,
when the TGT is the only entry in the cache, this filtering prevents
scan_ccache() from detecting that the cache contains non-expired
credentials (and that there is a TGT present).

Since scan_ccache() is only looking at metadata in the cache entries,
and does not need to actually use any tickets or session keys, set
the KRB5_TC_NOTICKET flag on the ccache before scanning it.  This
will allow the MSLSA implementation to return a cred for the TGT
entry and cause the GSSAPI credential selection algorithm to function
properly.

ticket: 8000 (new)
tags: pullup
target_version: 1.12.3
subject: gssapi.dll fails to detect TGTs in the MSLSA cache when UAC is enabled
Remove old Windows support from cc_mslsa.c

It is safe to remove is_windows_2000(), is_windows_xp(), and
is_windows_vista(), since the former two only check for very old
versions of windows which are no longer supported, and
is_windows_vista() was unused.  Note that the check being implemented
was whether the running OS was the named version or higher, not an
exact match.  The current Microsoft documentation recommends against
the sort of OS version checks that were employed here, in favor of
explicit feature tests.

Remove is_broken_wow64() as the problem it works around (Microsoft
Article ID 960077) is believed to have been fixed in subsequent
updates to Windows Server 2003 and XP.

Remove does_retrieve_ticket_cache_ticket() since support for the
KERB_RETRIEVE_TICKET_CACHE_TICKET flag in the
KERB_RETRIEVE_TKT_REQUEST structure was added in service packs for
Windows Server 2003 and XP.  Also remove buildtime fallbacks that
are no longer needed.

Remove the conditionals TRUST_ATTRIBUTE_TRUST_USES_AES_KEYS,
HAVE_CACHE_INFO_EX2, and KERB_SUBMIT_TICKET as all current SDK
versions have the relevant functionality.

In all cases, de-indent chunks that are no longer conditional.
Where indentation levels changed, update the style of the reindented
code to current practices.

ticket: 7989
comment some future cleanup for cc_mslsa.c

The function does_query_ticket_cache_ex2() will not be needed once
Windows Server 2003 drops out of support in approximately one year's
time.  Note the doom timer at its definition, to facilitate future
cleanup.

ticket: 7989
Remove unused code from cc_mslsa.c

Remove PreserveInitialTicketIdentity() and IsKerberosLogon(), as well
as the preprocessor conditionals ENABLE_PURGING and PURGE_ALL, which
have not been used in a very long time, if ever.

There was one potential callsite of IsKerberosLogon(), in
lcc_resolve(), which was disabled.  It is perfectly reasonable to want
to use the MSLSA cache on a non-domain-joined workstation, as it is
now a read-write cache type, so we need not concern ourselves whether
the logon was performed or may have been performed using kerberos.

ticket: 7989
Rename cc_mslsa.c routines to avoid OS versions

We don't care about XP versus non-XP; just indicate which
revision of the data type is being used.

Standardize on the lowercase 'x' in "Ex", for both the "Ex" and
"Ex2" forms.

While here, adjust the function definition prototypes to match
current style.

ticket: 7989
Move realm conversion into helper in cc_mslsa.c

All the callers of UnicodeStringToMITPrinc() were already converting
a UnicodeString into a wchar* just to pass it in as the realm.

Simplify everyone's life by making the helper do the conversion.

ticket: 7989
Avoid unneeded GetMSTGT() calls in cc_mslsa.c

Both lcc_resolve() and lcc_get_principal() were using GetMSTGT()
to fetch a ticket from which to obtain the client principal name
of the credentials cache.  However, that name is contained in
the results of the the cache information query; there is no need
to retrieve a full ticket of any sort to get it.  Since there
may sometimes be difficulties obtaining a TGT when UAC is enabled,
avoid these unneeded calls.

ticket: 7989
Enable KDC TCP listener by default

Make the KDC default to listening on TCP.

ticket: 6731
target_version: 1.13
tags: pullup
Document KDC TCP listener change

Update documentation to reflect the change in the default KDC TCP
listener behavior, new in 1.13.

ticket: 6731
target_version: 1.13
tags: pullup
Fix ksu crash in cases where it obtains the TGT

In order to allow ksu to use any locally-present service key for
verifying creds, the previous change to ksu switched from using a
retrieved or obtained TGT to fetch creds for the local "host" service,
and then passing those creds to krb5_verify_init_creds(), to passing the
retrieved TGT directly to krb5_verify_init_creds().

It did not take care to retrieve the TGT from the temporary ccache if it
had obtained them, and in those cases it would attempt to verify NULL
creds.

Modify the krb5_get_tkt_via_passwd() function to call
krb5_get_init_creds_password(), to pass back the freshly-obtained creds,
to take a "krb5_get_init_creds_opt" pointer instead of a locally-defined
options structure, and rename it to ksu_get_tgt_via_passwd().

ticket: 8015 (new)
target_version: 1.13
tags: pullup
Restore providing password TGTs for the ksu target

The use of "stored" was originally for marking whether or not creds
had been found in the source cache and copied to the target. If it was
false, the obtain-a-TGT-using-a-password path would be triggered and
it would populate the target ccache directly.

When the intermediate cache was introduced (in commit dccc80a), the
variable started marking whether or not creds had been copied to the
intermediate cache, and this was then used to decide whether or not to
copy creds to the target cache.

The obtain-a-TGT-using-a-password path began storing its creds in the
temporary cache as well, but neglected to set the flag so that the
creds would be copied to the target cache later, so the target ccache
would never be created and populated with the newly-obtained TGT.

ticket: 8016 (new)
target_version: 1.13
tags: pullup
Work around replay cache creation race

If two processes try to initialize the same replay cache at the same
time, krb5_rc_io_creat can race between unlink and open, leading to a
KRB5_RC_IO_PERM error.  When this happens, make the losing process
retry so that it can continue.

This does not solve the replay cache creation race, nor is that the
only replay cache race issue.  It simply prevents the race from
causing a spurious failure.

ticket: 3498
target_version: 1.13
tags: pullup
Fix krb5 gss_acquire_cred_impersonate_name crash

If gss_acquire_cred_impersonate_name is called using an
impersonator_cred_handle acquired with GSS_C_ACCEPT, we could
dereference null fields of the cred handle and crash.  Fix this by
checking the impersonator_cred_handle usage and returning
GSS_S_NO_CRED if it isn't what we expect, just as we do in
init_sec_context.

Based on a patch from Solly Ross <sross@redhat.com>.

ticket: 8017 (new)
target_version: 1.13
tags: pullup