oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

gssapi: Sequence errors should not be fatal

Browse Source 
Sequence errors are supplemental information in GSSAPI. This means
that they are not fatal, unless they are returned alongside a failure
error code. This change makes our behaviour the same as MIT's - sequence
errors are non-fatal, and return valid output information.
This commit is contained in:
Simon Wilkinson
2024-06-15 09:33:21 +01:00
committed by Jeffrey Altman
parent 1b57b62d82
commit 05e292e1af
4 changed files with 45 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
lib/gssapi/krb5/arcfour.c
View File

@@ -740,15 +740,15 @@ OM_uint32 _gssapi_unwrap_arcfour(OM_uint32 *minor_status,
return GSS_S_BAD_MIC;
}
if (conf_state)
*conf_state = conf_flag;
HEIMDAL_MUTEX_lock(&context_handle->ctx_id_mutex);
omret = _gssapi_msg_order_check(context_handle->order, seq_number);
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
if (omret)
return omret;
if (conf_state)
*conf_state = conf_flag;
*minor_status = 0;
return GSS_S_COMPLETE;
}
@@ -1375,6 +1375,10 @@ _gssapi_unwrap_iov_arcfour(OM_uint32 *minor_status,
}
}
if (pconf_state) {
*pconf_state = conf_state;
}
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
ret = _gssapi_msg_order_check(ctx->order, seq_number);
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
@@ -1382,10 +1386,6 @@ _gssapi_unwrap_iov_arcfour(OM_uint32 *minor_status,
return ret;
}
if (pconf_state) {
*pconf_state = conf_state;
}
*minor_status = 0;
return GSS_S_COMPLETE;
}

52
lib/gssapi/krb5/cfx.c
View File

@@ -748,7 +748,7 @@ _gssapi_unwrap_cfx_iov(OM_uint32 *minor_status,
gss_iov_buffer_desc *header, *trailer, *padding;
gss_cfx_wrap_token token, ttoken;
u_char token_flags;
krb5_error_code ret;
krb5_error_code ret, seq_err;
unsigned usage;
uint16_t ec, rrc;
krb5_crypto_iov *data = NULL;
@@ -818,17 +818,16 @@ _gssapi_unwrap_cfx_iov(OM_uint32 *minor_status,
if (seq_number_hi) {
/* no support for 64-bit sequence numbers */
*minor_status = ERANGE;
return GSS_S_UNSEQ_TOKEN;
return GSS_S_FAILURE | GSS_S_UNSEQ_TOKEN;
}
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
ret = _gssapi_msg_order_check(ctx->order, seq_number_lo);
if (ret != 0) {
*minor_status = 0;
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
return ret;
}
seq_err = _gssapi_msg_order_check(ctx->order, seq_number_lo);
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
if (seq_err == GSS_S_FAILURE) {
*minor_status = 0;
return seq_err;
}
/*
* Decrypt and/or verify checksum
@@ -1025,7 +1024,7 @@ _gssapi_unwrap_cfx_iov(OM_uint32 *minor_status,
free(data);
*minor_status = 0;
return GSS_S_COMPLETE;
return GSS_S_COMPLETE | seq_err;
failure:
if (data)
@@ -1401,7 +1400,7 @@ OM_uint32 _gssapi_unwrap_cfx(OM_uint32 *minor_status,
{
gss_cfx_wrap_token token;
u_char token_flags;
krb5_error_code ret;
krb5_error_code ret, seq_err;
unsigned usage;
krb5_data data;
uint16_t ec, rrc;
@@ -1459,18 +1458,16 @@ OM_uint32 _gssapi_unwrap_cfx(OM_uint32 *minor_status,
if (seq_number_hi) {
/* no support for 64-bit sequence numbers */
*minor_status = ERANGE;
return GSS_S_UNSEQ_TOKEN;
return GSS_S_FAILURE | GSS_S_UNSEQ_TOKEN;
}
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
ret = _gssapi_msg_order_check(ctx->order, seq_number_lo);
if (ret != 0) {
*minor_status = 0;
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
_gsskrb5_release_buffer(minor_status, output_message_buffer);
return ret;
}
seq_err = _gssapi_msg_order_check(ctx->order, seq_number_lo);
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
if (seq_err == GSS_S_FAILURE) {
*minor_status = 0;
return seq_err;
}
/*
* Decrypt and/or verify checksum
@@ -1594,7 +1591,7 @@ OM_uint32 _gssapi_unwrap_cfx(OM_uint32 *minor_status,
}
*minor_status = 0;
return GSS_S_COMPLETE;
return GSS_S_COMPLETE | seq_err;
}
OM_uint32 _gssapi_mic_cfx(OM_uint32 *minor_status,
@@ -1690,7 +1687,7 @@ OM_uint32 _gssapi_verify_mic_cfx(OM_uint32 *minor_status,
{
gss_cfx_mic_token token;
u_char token_flags;
krb5_error_code ret;
krb5_error_code ret, seq_err;
unsigned usage;
OM_uint32 seq_number_lo, seq_number_hi;
u_char *buf, *p;
@@ -1736,17 +1733,16 @@ OM_uint32 _gssapi_verify_mic_cfx(OM_uint32 *minor_status,
_gss_mg_decode_be_uint32(&token->SND_SEQ[4], &seq_number_lo);
if (seq_number_hi) {
*minor_status = ERANGE;
return GSS_S_UNSEQ_TOKEN;
return GSS_S_UNSEQ_TOKEN | GSS_S_FAILURE;
}
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
ret = _gssapi_msg_order_check(ctx->order, seq_number_lo);
if (ret != 0) {
*minor_status = 0;
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
return ret;
}
seq_err = _gssapi_msg_order_check(ctx->order, seq_number_lo);
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
if (seq_err == GSS_S_FAILURE) {
*minor_status = 0;
return seq_err;
}
/*
* Verify checksum
@@ -1793,5 +1789,5 @@ OM_uint32 _gssapi_verify_mic_cfx(OM_uint32 *minor_status,
*qop_state = GSS_C_QOP_DEFAULT;
}
return GSS_S_COMPLETE;
return GSS_S_COMPLETE | seq_err;
}

20
lib/gssapi/krb5/unwrap.c
View File

@@ -57,7 +57,7 @@ unwrap_des
size_t i;
uint32_t seq_number;
size_t padlength;
OM_uint32 ret;
OM_uint32 ret, seq_err;
int cstate;
int cmp;
int token_len;
@@ -175,10 +175,10 @@ unwrap_des
return GSS_S_BAD_MIC;
}
ret = _gssapi_msg_order_check(context_handle->order, seq_number);
if (ret) {
seq_err = _gssapi_msg_order_check(context_handle->order, seq_number);
if (seq_err == GSS_S_FAILURE) {
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
return ret;
return seq_err;
}
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
@@ -194,7 +194,7 @@ unwrap_des
memcpy (output_message_buffer->value,
p + 24,
output_message_buffer->length);
return GSS_S_COMPLETE;
return GSS_S_COMPLETE | seq_err;
}
#endif
@@ -217,7 +217,7 @@ unwrap_des3
u_char cksum[20];
uint32_t seq_number;
size_t padlength;
OM_uint32 ret;
OM_uint32 ret, seq_err;
int cstate;
krb5_crypto crypto;
Checksum csum;
@@ -349,11 +349,11 @@ unwrap_des3
return GSS_S_BAD_MIC;
}
ret = _gssapi_msg_order_check(context_handle->order, seq_number);
if (ret) {
seq_err = _gssapi_msg_order_check(context_handle->order, seq_number);
if (seq_err == GSS_S_FAILURE) {
*minor_status = 0;
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
return ret;
return seq_err;
}
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
@@ -396,7 +396,7 @@ unwrap_des3
memcpy (output_message_buffer->value,
p + 36,
output_message_buffer->length);
return GSS_S_COMPLETE;
return GSS_S_COMPLETE | seq_err;
}
OM_uint32 GSSAPI_CALLCONV _gsskrb5_unwrap

8
lib/gssapi/krb5/verify_mic.c
View File

@@ -148,7 +148,7 @@ verify_mic_des3
u_char *p;
u_char *seq;
uint32_t seq_number;
OM_uint32 ret;
OM_uint32 ret, seq_err;
krb5_crypto crypto;
krb5_data seq_data;
int cmp, docompat;
@@ -226,8 +226,8 @@ retry:
return GSS_S_BAD_MIC;
}
ret = _gssapi_msg_order_check(context_handle->order, seq_number);
if (ret) {
seq_err = _gssapi_msg_order_check(context_handle->order, seq_number);
if (seq_err == GSS_S_FAILURE) {
krb5_crypto_destroy (context, crypto);
*minor_status = 0;
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
@@ -269,7 +269,7 @@ retry:
HEIMDAL_MUTEX_unlock(&context_handle->ctx_id_mutex);
krb5_crypto_destroy (context, crypto);
return GSS_S_COMPLETE;
return GSS_S_COMPLETE | seq_err;
}
OM_uint32