In cred_delete(), sp is freed after returning from krb5_storage_to_data().
Between this point and the subsequent assignment to sp via krb_storage_emem()
there are two jumps to out, both are executed in an ENOMEM scenario: malloc fail
for cred_data_in_file and krb5_principal_set_realm() fail. In out, sp is freed
again.
This patch fixes the issue by freeing sp right before the krb5_storage_emem()
call.
Signed-off-by: Linar Galimov <galimovlz@sgu.ru>
Signed-off-by: Dmitry Mikhalchenko <tascad@altlinux.org>
Use krb5_time_abs() rather than subtracting time_t values before passing the result to labs(). On signed 32-bit time_t platforms, subtracting far-apart times can overflow before labs() sees the value.
The function _krb5_usage2arcfour() is only declared if Heimdal is built with
RC4. Put calls to this function behind #ifdef guards so that the build can
succeed.
Currently the Directional host address type is pretty useless,
since it's only useful in application protocols that a) use
KRB-PRIV/KRB-SAFE messages (so: not GSS-API applications), and b)
state in their specs to use Directional, or otherwise provide for
negotiation of host address types. There are no such protocols
that we care about except -since we control it- iprop. But even
for iprop it'd be better to switch to GSS-API.
The read() in readall() to read the SOCKS4a request was sometimes
failing with EAGAIN, which it wasn't prepared for, causing the
request to be rejected and the test to fail.
I wrote this code specifically under the assumption the fd would be
in blocking mode, and in the original draft I wrote with stdin/stdout
under socat that was true. But when I adapted this to do its own
bind/listen/accept logic, I broke it, because POSIX leaves it
unspecified whether accept() inherits the O_NONBLOCK setting or not:
https://pubs.opengroup.org/onlinepubs/9799919799/functions/accept4.html
And the traditional BSD semantics is to inherit O_NONBLOCK.
So, just explicitly clear O_NONBLOCK on the fd returned by accept().
All network traffic to KDC goes through the SOCKS4a proxy if it is
configured.
This is deliberately kept simple -- and is not generalized to SOCKS4
or SOCKS5 or other types of proxies -- so it is easy to audit for
network and DNS leaks. (SOCKS4 works in IP addresses, and so invites
DNS leaks. SOCKS5 can be OK, if used judiciously, but takes more
work to implement.)
This only affects krb5_sendto -- the other initiator of network
traffic in libkrb5, krb5_change_password, will be fixed to respect
socks4a_proxy in a subsequent commit.
XXX Need to figure out where the socks4a.c code should go.
fix https://github.com/heimdal/heimdal/issues/1151
Acording to POSIX <poll.h> should be used instead of <sys/poll.h>.
Libcs like musl libc added a redict due maintain compat with older
glibcs and added the following warning:
/usr/include/sys/poll.h:1:2: warning: #warning redirecting incorrect #include <sys/poll.h> to <poll.h> [-Wcpp]
1 | #warning redirecting incorrect #include <sys/poll.h> to <poll.h>
| ^~~~~~~
Ref: https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/poll.h.html
We must switch to OpenSSL 3.x, and getting lib/hcrypto to provide
OpenSSL 3.x APIs is too large an undertaking. Plus the hcrypto backend
is not safe, not secure (probably has timing leaks galore), and no one
has the resources to make it a world-class crypto library, so it just
has to go.
Linar Galimov