Mercurial > illumos > illumos-gate
changeset 3998:e0575d2275f8
6538001 KDC, kadmind stack overflow in krb5_klog_syslog (CVE-2007-0957)
author | semery |
---|---|
date | Mon, 09 Apr 2007 16:04:26 -0700 |
parents | acd5a5a557ce |
children | 666384b31577 |
files | usr/src/cmd/krb5/kadmin/server/server_stubs.c usr/src/cmd/krb5/krb5kdc/do_tgs_req.c usr/src/cmd/krb5/krb5kdc/kdc_util.c usr/src/lib/krb5/kadm5/admin.h usr/src/lib/krb5/kadm5/clnt/logger.c usr/src/lib/krb5/kadm5/srv/chgpwd.c usr/src/lib/krb5/kadm5/srv/logger.c usr/src/lib/krb5/kadm5/srv/mapfile-vers usr/src/lib/krb5/kadm5/srv/server_misc.c |
diffstat | 9 files changed, 205 insertions(+), 149 deletions(-) [+] |
line wrap: on
line diff
--- a/usr/src/cmd/krb5/kadmin/server/server_stubs.c Mon Apr 09 14:01:48 2007 -0700 +++ b/usr/src/cmd/krb5/kadmin/server/server_stubs.c Mon Apr 09 16:04:26 2007 -0700 @@ -444,6 +444,61 @@ return 0; } +static int +log_unauth( + char *op, + char *target, + char *client, + char *server, + char *addr) +{ + size_t tlen, clen, slen; + char *tdots, *cdots, *sdots; + + tlen = strlen(target); + trunc_name(&tlen, &tdots); + clen = strlen(client); + trunc_name(&clen, &cdots); + slen = strlen(server); + trunc_name(&slen, &sdots); + + return krb5_klog_syslog(LOG_NOTICE, + "Unauthorized request: %s, %.*s%s, " + "client=%.*s%s, service=%.*s%s, addr=%s", + op, tlen, target, tdots, + clen, client, cdots, + slen, server, sdots, + addr); +} + +static int +log_done( + char *op, + char *target, + const char *errmsg, + char *client, + char *server, + char *addr) +{ + size_t tlen, clen, slen; + char *tdots, *cdots, *sdots; + + tlen = strlen(target); + trunc_name(&tlen, &tdots); + clen = strlen(client); + trunc_name(&clen, &cdots); + slen = strlen(server); + trunc_name(&slen, &sdots); + + return krb5_klog_syslog(LOG_NOTICE, + "Request: %s, %.*s%s, %s, " + "client=%.*s%s, service=%.*s%s, addr=%s", + op, tlen, target, tdots, errmsg, + clen, client, cdots, + slen, server, sdots, + addr); +} + generic_ret * create_principal_1_svc(cprinc_arg *arg, struct svc_req *rqstp) { @@ -497,9 +552,8 @@ audit_kadmind_unauth(rqstp->rq_xprt, l_port, "kadm5_create_principal", prime_arg, client_name); - krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_create_principal", - prime_arg, client_name, - service_name, client_addr(rqstp, buf)); + log_unauth("kadm5_create_principal", prime_arg, + client_name, service_name, client_addr(rqstp, buf)); } else { ret.code = kadm5_create_principal((void *)handle, &arg->rec, arg->mask, @@ -508,10 +562,9 @@ audit_kadmind_auth(rqstp->rq_xprt, l_port, "kadm5_create_principal", prime_arg, client_name, ret.code); - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_create_principal", - prime_arg,((ret.code == 0) ? "success" : - error_message(ret.code)), - client_name, service_name, client_addr(rqstp, buf)); + log_done("kadm5_create_principal", prime_arg, + ((ret.code == 0) ? "success" : error_message(ret.code)), + client_name, service_name, client_addr(rqstp, buf)); if (policy_migrate && (ret.code == 0)) { arg->rec.policy = strdup("default"); @@ -526,8 +579,7 @@ retval = kadm5_modify_principal((void *)handle, &arg->rec, arg->mask); - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, - "kadm5_modify_principal", + log_done("kadm5_modify_principal", prime_arg, ((retval == 0) ? "success" : error_message(retval)), client_name, service_name, client_addr(rqstp, buf)); @@ -596,20 +648,17 @@ || kadm5int_acl_impose_restrictions(handle->context, &arg->rec, &arg->mask, rp)) { ret.code = KADM5_AUTH_ADD; - krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_create_principal", - prime_arg, client_name, service_name, - client_addr(rqstp, buf)); + log_unauth("kadm5_create_principal", prime_arg, + client_name, service_name, client_addr(rqstp, buf)); } else { ret.code = kadm5_create_principal_3((void *)handle, &arg->rec, arg->mask, arg->n_ks_tuple, arg->ks_tuple, arg->passwd); - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_create_principal", - prime_arg,((ret.code == 0) ? "success" : - error_message(ret.code)), - client_name, service_name, - client_addr(rqstp, buf)); + log_done("kadm5_create_principal", prime_arg, + ((ret.code == 0) ? "success" : error_message(ret.code)), + client_name, service_name, client_addr(rqstp, buf)); if (policy_migrate && (ret.code == 0)) { arg->rec.policy = strdup("default"); @@ -624,11 +673,9 @@ retval = kadm5_modify_principal((void *)handle, &arg->rec, arg->mask); - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, - "kadm5_modify_principal", - prime_arg, ((retval == 0) ? "success" : - error_message(retval)), client_name, - service_name, client_addr(rqstp, buf)); + log_done("kadm5_modify_principal", prime_arg, + ((retval == 0) ? "success" : error_message(retval)), + client_name, service_name, client_addr(rqstp, buf)); } } @@ -685,8 +732,7 @@ audit_kadmind_unauth(rqstp->rq_xprt, l_port, "kadm5_delete_principal", prime_arg, client_name); - krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_delete_principal", - prime_arg, client_name, + log_unauth("kadm5_delete_principal", prime_arg, client_name, service_name, client_addr(rqstp, buf)); } else { ret.code = kadm5_delete_principal((void *)handle, arg->princ); @@ -694,7 +740,7 @@ audit_kadmind_auth(rqstp->rq_xprt, l_port, "kadm5_delete_principal", prime_arg, client_name, ret.code); - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_delete_principal", prime_arg, + log_done("kadm5_delete_principal", prime_arg, ((ret.code == 0) ? "success" : error_message(ret.code)), client_name, service_name, client_addr(rqstp, buf)); } @@ -753,8 +799,7 @@ audit_kadmind_unauth(rqstp->rq_xprt, l_port, "kadm5_modify_principal", prime_arg, client_name); - krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_modify_principal", - prime_arg, client_name, + log_unauth("kadm5_modify_principal", prime_arg, client_name, service_name, client_addr(rqstp, buf)); } else { ret.code = kadm5_modify_principal((void *)handle, &arg->rec, @@ -763,9 +808,8 @@ audit_kadmind_auth(rqstp->rq_xprt, l_port, "kadm5_modify_principal", prime_arg, client_name, ret.code); - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_modify_principal", - prime_arg, ((ret.code == 0) ? "success" : - error_message(ret.code)), + log_done("kadm5_modify_principal", prime_arg, + ((ret.code == 0) ? "success" : error_message(ret.code)), client_name, service_name, client_addr(rqstp, buf)); } @@ -838,8 +882,7 @@ audit_kadmind_unauth(rqstp->rq_xprt, l_port, "kadm5_rename_principal", prime_arg, client_name); - krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_rename_principal", - prime_arg, client_name, + log_unauth("kadm5_rename_principal", prime_arg, client_name, service_name, client_addr(rqstp, buf)); } else { ret.code = kadm5_rename_principal((void *)handle, arg->src, @@ -848,9 +891,8 @@ audit_kadmind_auth(rqstp->rq_xprt, l_port, "kadm5_rename_principal", prime_arg, client_name, ret.code); - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_rename_principal", - prime_arg, ((ret.code == 0) ? "success" : - error_message(ret.code)), + log_done("kadm5_rename_principal", prime_arg, + ((ret.code == 0) ? "success" : error_message(ret.code)), client_name, service_name, client_addr(rqstp, buf)); } @@ -916,8 +958,7 @@ audit_kadmind_unauth(rqstp->rq_xprt, l_port, funcname, prime_arg, client_name); - krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, funcname, - prime_arg, client_name, service_name, + log_unauth(funcname, prime_arg, client_name, service_name, client_addr(rqstp, buf)); } else { if (handle->api_version == KADM5_API_VERSION_1) { @@ -936,8 +977,7 @@ audit_kadmind_auth(rqstp->rq_xprt, l_port, funcname, prime_arg, client_name, ret.code); - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname, - prime_arg, + log_done(funcname, prime_arg, ((ret.code == 0) ? "success" : error_message(ret.code)), client_name, service_name, client_addr(rqstp, buf)); } @@ -997,8 +1037,7 @@ audit_kadmind_unauth(rqstp->rq_xprt, l_port, "kadm5_get_principals", prime_arg, client_name); - krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_get_principals", - prime_arg, client_name, + log_unauth("kadm5_get_principals", prime_arg, client_name, service_name, client_addr(rqstp, buf)); } else { ret.code = kadm5_get_principals((void *)handle, @@ -1008,8 +1047,7 @@ audit_kadmind_auth(rqstp->rq_xprt, l_port, "kadm5_get_principals", prime_arg, client_name, ret.code); - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_get_principals", - prime_arg, + log_done("kadm5_get_principals", prime_arg, ((ret.code == 0) ? "success" : error_message(ret.code)), client_name, service_name, client_addr(rqstp, buf)); } @@ -1069,8 +1107,7 @@ audit_kadmind_unauth(rqstp->rq_xprt, l_port, "kadm5_chpass_principal", prime_arg, client_name); - krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_chpass_principal", - prime_arg, client_name, + log_unauth("kadm5_chpass_principal", prime_arg, client_name, service_name, client_addr(rqstp, buf)); ret.code = KADM5_AUTH_CHANGEPW; } @@ -1079,10 +1116,9 @@ audit_kadmind_auth(rqstp->rq_xprt, l_port, "kadm5_chpass_principal", prime_arg, client_name, ret.code); - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_chpass_principal", - prime_arg, ((ret.code == 0) ? "success" : - error_message(ret.code)), - client_name, service_name, client_addr(rqstp, buf)); + log_done("kadm5_chpass_principal", prime_arg, + ((ret.code == 0) ? "success" : error_message(ret.code)), + client_name, service_name, client_addr(rqstp, buf)); } error: @@ -1146,18 +1182,15 @@ arg->ks_tuple, arg->pass); } else { - krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_chpass_principal", - prime_arg, client_name, service_name, - client_addr(rqstp, buf)); + log_unauth("kadm5_chpass_principal", prime_arg, + client_name, service_name, client_addr(rqstp, buf)); ret.code = KADM5_AUTH_CHANGEPW; } if(ret.code != KADM5_AUTH_CHANGEPW) { - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_chpass_principal", - prime_arg, ((ret.code == 0) ? "success" : - error_message(ret.code)), - client_name, service_name, - client_addr(rqstp, buf)); + log_done("kadm5_chpass_principal", prime_arg, + ((ret.code == 0) ? "success" : error_message(ret.code)), + client_name, service_name, client_addr(rqstp, buf)); } error: @@ -1213,18 +1246,15 @@ ret.code = kadm5_setv4key_principal((void *)handle, arg->princ, arg->keyblock); } else { - krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_setv4key_principal", - prime_arg, client_name, service_name, - client_addr(rqstp, buf)); + log_unauth("kadm5_setv4key_principal", prime_arg, + client_name, service_name, client_addr(rqstp, buf)); ret.code = KADM5_AUTH_SETKEY; } if(ret.code != KADM5_AUTH_SETKEY) { - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_setv4key_principal", - prime_arg, ((ret.code == 0) ? "success" : - error_message(ret.code)), - client_name, service_name, - client_addr(rqstp, buf)); + log_done("kadm5_setv4key_principal", prime_arg, + ((ret.code == 0) ? "success" : error_message(ret.code)), + client_name, service_name, client_addr(rqstp, buf)); } error: @@ -1279,18 +1309,15 @@ ret.code = kadm5_setkey_principal((void *)handle, arg->princ, arg->keyblocks, arg->n_keys); } else { - krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_setkey_principal", - prime_arg, client_name, service_name, - client_addr(rqstp, buf)); + log_unauth("kadm5_setkey_principal", prime_arg, + client_name, service_name, client_addr(rqstp, buf)); ret.code = KADM5_AUTH_SETKEY; } if(ret.code != KADM5_AUTH_SETKEY) { - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_setkey_principal", - prime_arg, ((ret.code == 0) ? "success" : - error_message(ret.code)), - client_name, service_name, - client_addr(rqstp, buf)); + log_done("kadm5_setkey_principal", prime_arg, + ((ret.code == 0) ? "success" : error_message(ret.code)), + client_name, service_name, client_addr(rqstp, buf)); } error: @@ -1348,18 +1375,15 @@ arg->ks_tuple, arg->keyblocks, arg->n_keys); } else { - krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_setkey_principal", - prime_arg, client_name, service_name, - client_addr(rqstp, buf)); + log_unauth("kadm5_setkey_principal", prime_arg, + client_name, service_name, client_addr(rqstp, buf)); ret.code = KADM5_AUTH_SETKEY; } if(ret.code != KADM5_AUTH_SETKEY) { - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_setkey_principal", - prime_arg, ((ret.code == 0) ? "success" : - error_message(ret.code)), - client_name, service_name, - client_addr(rqstp, buf)); + log_done("kadm5_setkey_principal", prime_arg, + ((ret.code == 0) ? "success" : error_message(ret.code)), + client_name, service_name, client_addr(rqstp, buf)); } error: @@ -1424,9 +1448,8 @@ } else { audit_kadmind_unauth(rqstp->rq_xprt, l_port, funcname, prime_arg, client_name); - krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, funcname, - prime_arg, client_name, service_name, - client_addr(rqstp, buf)); + log_unauth(funcname, prime_arg, + client_name, service_name, client_addr(rqstp, buf)); ret.code = KADM5_AUTH_CHANGEPW; } @@ -1443,10 +1466,9 @@ if(ret.code != KADM5_AUTH_CHANGEPW) { audit_kadmind_auth(rqstp->rq_xprt, l_port, funcname, prime_arg, client_name, ret.code); - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname, - prime_arg, ((ret.code == 0) ? "success" : - error_message(ret.code)), - client_name, service_name, client_addr(rqstp, buf)); + log_done(funcname, prime_arg, + ((ret.code == 0) ? "success" : error_message(ret.code)), + client_name, service_name, client_addr(rqstp, buf)); } error: @@ -1515,9 +1537,8 @@ arg->ks_tuple, &k, &nkeys); } else { - krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, funcname, - prime_arg, client_name, service_name, - client_addr(rqstp, buf)); + log_unauth(funcname, prime_arg, + client_name, service_name, client_addr(rqstp, buf)); ret.code = KADM5_AUTH_CHANGEPW; } @@ -1532,11 +1553,9 @@ } if(ret.code != KADM5_AUTH_CHANGEPW) { - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname, - prime_arg, ((ret.code == 0) ? "success" : - error_message(ret.code)), - client_name, service_name, - client_addr(rqstp, buf)); + log_done(funcname, prime_arg, + ((ret.code == 0) ? "success" : error_message(ret.code)), + client_name, service_name, client_addr(rqstp, buf)); } error: @@ -1591,9 +1610,8 @@ audit_kadmind_unauth(rqstp->rq_xprt, l_port, "kadm5_create_policy", prime_arg, client_name); - krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_create_policy", - prime_arg, client_name, - service_name, client_addr(rqstp, buf)); + log_unauth("kadm5_create_policy", prime_arg, + client_name, service_name, client_addr(rqstp, buf)); } else { ret.code = kadm5_create_policy((void *)handle, &arg->rec, @@ -1602,7 +1620,7 @@ audit_kadmind_auth(rqstp->rq_xprt, l_port, "kadm5_create_policy", prime_arg, client_name, ret.code); - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_create_policy", + log_done("kadm5_create_policy", ((prime_arg == NULL) ? "(null)" : prime_arg), ((ret.code == 0) ? "success" : error_message(ret.code)), client_name, service_name, client_addr(rqstp, buf)); @@ -1656,9 +1674,8 @@ audit_kadmind_unauth(rqstp->rq_xprt, l_port, "kadm5_delete_policy", prime_arg, client_name); - krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_delete_policy", - prime_arg, client_name, service_name, - client_addr(rqstp, buf)); + log_unauth("kadm5_delete_policy", prime_arg, + client_name, service_name, client_addr(rqstp, buf)); ret.code = KADM5_AUTH_DELETE; } else { ret.code = kadm5_delete_policy((void *)handle, arg->name); @@ -1666,7 +1683,7 @@ audit_kadmind_auth(rqstp->rq_xprt, l_port, "kadm5_delete_policy", prime_arg, client_name, ret.code); - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_delete_policy", + log_done("kadm5_delete_policy", ((prime_arg == NULL) ? "(null)" : prime_arg), ((ret.code == 0) ? "success" : error_message(ret.code)), client_name, service_name, client_addr(rqstp, buf)); @@ -1720,9 +1737,8 @@ audit_kadmind_unauth(rqstp->rq_xprt, l_port, "kadm5_modify_policy", prime_arg, client_name); - krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_modify_policy", - prime_arg, client_name, - service_name, client_addr(rqstp, buf)); + log_unauth("kadm5_modify_policy", prime_arg, + client_name, service_name, client_addr(rqstp, buf)); ret.code = KADM5_AUTH_MODIFY; } else { ret.code = kadm5_modify_policy((void *)handle, &arg->rec, @@ -1731,7 +1747,7 @@ audit_kadmind_auth(rqstp->rq_xprt, l_port, "kadm5_modify_policy", prime_arg, client_name, ret.code); - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_modify_policy", + log_done("kadm5_modify_policy", ((prime_arg == NULL) ? "(null)" : prime_arg), ((ret.code == 0) ? "success" : error_message(ret.code)), client_name, service_name, client_addr(rqstp, buf)); @@ -1821,15 +1837,13 @@ audit_kadmind_auth(rqstp->rq_xprt, l_port, funcname, prime_arg, client_name, ret.code); - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname, - ((prime_arg == NULL) ? "(null)" : prime_arg), + log_done(funcname, ((prime_arg == NULL) ? "(null)" : prime_arg), ((ret.code == 0) ? "success" : error_message(ret.code)), client_name, service_name, client_addr(rqstp, buf)); } else { audit_kadmind_unauth(rqstp->rq_xprt, l_port, funcname, prime_arg, client_name); - krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, funcname, - prime_arg, client_name, + log_unauth(funcname, prime_arg, client_name, service_name, client_addr(rqstp, buf)); } @@ -1886,9 +1900,8 @@ audit_kadmind_unauth(rqstp->rq_xprt, l_port, "kadm5_get_policies", prime_arg, client_name); - krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_get_policies", - prime_arg, client_name, service_name, - client_addr(rqstp, buf)); + log_unauth("kadm5_get_policies", prime_arg, + client_name, service_name, client_addr(rqstp, buf)); } else { ret.code = kadm5_get_policies((void *)handle, arg->exp, &ret.pols, @@ -1897,8 +1910,7 @@ audit_kadmind_auth(rqstp->rq_xprt, l_port, "kadm5_get_policies", prime_arg, client_name, ret.code); - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_get_policies", - prime_arg, + log_done("kadm5_get_policies", prime_arg, ((ret.code == 0) ? "success" : error_message(ret.code)), client_name, service_name, client_addr(rqstp, buf)); } @@ -1946,8 +1958,7 @@ audit_kadmind_auth(rqstp->rq_xprt, l_port, "kadm5_get_privs", NULL, client_name, ret.code); - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_get_privs", - client_name, + log_done("kadm5_get_privs", client_name, ((ret.code == 0) ? "success" : error_message(ret.code)), client_name, service_name, client_addr(rqstp, buf)); @@ -1965,8 +1976,10 @@ generic_ret *init_1_svc(krb5_ui_4 *arg, struct svc_req *rqstp) { static generic_ret ret; - char *client_name, *service_name; - kadm5_server_handle_t handle; + char *client_name, *service_name; + kadm5_server_handle_t handle; + size_t clen, slen; + char *cdots, *sdots; xdr_free(xdr_generic_ret, (char *) &ret); @@ -1987,12 +2000,21 @@ (ret.api_version == KADM5_API_VERSION_1 ? "kadm5_init (V1)" : "kadm5_init"), NULL, client_name, ret.code); - krb5_klog_syslog(LOG_NOTICE, LOG_DONE, + + clen = strlen(client_name); + trunc_name(&clen, &cdots); + slen = strlen(service_name); + trunc_name(&slen, &sdots); + krb5_klog_syslog(LOG_NOTICE, "Request %s, %.*s%s, %s, " + "client=%.*s%s, service=%.*s%s, addr=%s, flavor=%d", (ret.api_version == KADM5_API_VERSION_1 ? - "kadm5_init (V1)" : "kadm5_init"), - client_name, + "kadm5_init (V1)" : "kadm5_init"), + clen, client_name, cdots, (ret.code == 0) ? "success" : error_message(ret.code), - client_name, service_name, client_addr(rqstp, buf)); + clen, client_name, cdots, + slen, service_name, sdots, + client_addr(rqstp, buf), + rqstp->rq_cred.oa_flavor); free(client_name); free(service_name);
--- a/usr/src/cmd/krb5/krb5kdc/do_tgs_req.c Mon Apr 09 14:01:48 2007 -0700 +++ b/usr/src/cmd/krb5/krb5kdc/do_tgs_req.c Mon Apr 09 16:04:26 2007 -0700 @@ -1,5 +1,5 @@ /* - * Copyright 2006 Sun Microsystems, Inc. All rights reserved. + * Copyright 2007 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ @@ -519,27 +519,37 @@ newtransited = 1; } if (!isflagset (request->kdc_options, KDC_OPT_DISABLE_TRANSITED_CHECK)) { + unsigned int tlen; + char *tdots; + errcode = krb5_check_transited_list (kdc_context, &enc_tkt_reply.transited.tr_contents, krb5_princ_realm (kdc_context, header_ticket->enc_part2->client), krb5_princ_realm (kdc_context, request->server)); + tlen = enc_tkt_reply.transited.tr_contents.length; + tdots = tlen > 125 ? "..." : ""; + tlen = tlen > 125 ? 125 : tlen; + if (errcode == 0) { setflag (enc_tkt_reply.flags, TKT_FLG_TRANSIT_POLICY_CHECKED); } else if (errcode == KRB5KRB_AP_ERR_ILL_CR_TKT) krb5_klog_syslog (LOG_INFO, - "bad realm transit path from '%s' to '%s' via '%.*s'", + "bad realm transit path from '%s' to '%s' " + "via '%.*s%s'", cname ? cname : "<unknown client>", sname ? sname : "<unknown server>", - enc_tkt_reply.transited.tr_contents.length, - enc_tkt_reply.transited.tr_contents.data); + tlen, + enc_tkt_reply.transited.tr_contents.data, + tdots); else krb5_klog_syslog (LOG_ERR, - "unexpected error checking transit from '%s' to '%s' via '%.*s': %s", + "unexpected error checking transit from " + "'%s' to '%s' via '%.*s%s': %s", cname ? cname : "<unknown client>", sname ? sname : "<unknown server>", - enc_tkt_reply.transited.tr_contents.length, + tlen, enc_tkt_reply.transited.tr_contents.data, - error_message (errcode)); + tdots, error_message (errcode)); } else krb5_klog_syslog (LOG_INFO, "not checking transit path"); if (reject_bad_transit @@ -567,6 +577,8 @@ if (!krb5_principal_compare(kdc_context, request->server, client2)) { if ((errcode = krb5_unparse_name(kdc_context, client2, &tmp))) tmp = 0; + if (tmp != NULL) + limit_string(tmp); audit_krb5kdc_tgs_req_2ndtktmm( (struct in_addr *)from->address->contents, (in_port_t)from->port, @@ -850,6 +862,7 @@ krb5_klog_syslog(LOG_INFO, "TGS_REQ: issuing alternate <un-unparseable> TGT"); } else { + limit_string(sname); audit_krb5kdc_tgs_req_alt_tgt( (struct in_addr *)from->address->contents, (in_port_t)from->port,
--- a/usr/src/cmd/krb5/krb5kdc/kdc_util.c Mon Apr 09 14:01:48 2007 -0700 +++ b/usr/src/cmd/krb5/krb5kdc/kdc_util.c Mon Apr 09 16:04:26 2007 -0700 @@ -407,6 +407,7 @@ krb5_db_free_principal(kdc_context, &server, nprincs); if (!krb5_unparse_name(kdc_context, ticket->server, &sname)) { + limit_string(sname); krb5_klog_syslog(LOG_ERR,"TGS_REQ: UNKNOWN SERVER: server='%s'", sname); free(sname);
--- a/usr/src/lib/krb5/kadm5/admin.h Mon Apr 09 14:01:48 2007 -0700 +++ b/usr/src/lib/krb5/kadm5/admin.h Mon Apr 09 16:04:26 2007 -0700 @@ -1,5 +1,5 @@ /* - * Copyright 2006 Sun Microsystems, Inc. All rights reserved. + * Copyright 2007 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ @@ -817,6 +817,10 @@ #endif /* USE_KADM5_API_VERSION == 1 */ +#define MAXPRINCLEN 125 + +void trunc_name(size_t *len, char **dots); + krb5_chgpwd_prot _kadm5_get_kpasswd_protocol(void *server_handle); kadm5_ret_t kadm5_chpass_principal_v2(void *server_handle, krb5_principal princ,
--- a/usr/src/lib/krb5/kadm5/clnt/logger.c Mon Apr 09 14:01:48 2007 -0700 +++ b/usr/src/lib/krb5/kadm5/clnt/logger.c Mon Apr 09 16:04:26 2007 -0700 @@ -23,7 +23,7 @@ */ /* - * Copyright 2006 Sun Microsystems, Inc. All rights reserved. + * Copyright 2007 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ @@ -45,7 +45,7 @@ #include <stdarg.h> #include <libintl.h> -#define KRB5_KLOG_MAX_ERRMSG_SIZE 1024 +#define KRB5_KLOG_MAX_ERRMSG_SIZE 2048 #ifndef MAXHOSTNAMELEN #define MAXHOSTNAMELEN 256 #endif /* MAXHOSTNAMELEN */ @@ -371,8 +371,11 @@ /* If reporting an error message, separate it. */ if (code) { - strcat(outbuf, error_message(code)); - strcat(outbuf, " - "); + outbuf[sizeof(outbuf) - 1] = '\0'; + + strncat(outbuf, error_message(code), + sizeof(outbuf) - 1 - strlen(outbuf)); + strncat(outbuf, " - ", sizeof(outbuf) - 1 - strlen(outbuf)); } cp = &outbuf[strlen(outbuf)]; @@ -417,7 +420,7 @@ } /* Now format the actual message */ - vsprintf(cp, actual_format, ap); + vsnprintf(cp, sizeof (outbuf) - (cp - outbuf), actual_format, ap); /* * Now that we have the message formatted, perform the output to each @@ -992,7 +995,7 @@ syslogp = &outbuf[strlen(outbuf)]; /* Now format the actual message */ - vsprintf(syslogp, format, arglist); + vsnprintf(syslogp, sizeof (outbuf) - (syslogp - outbuf), format, arglist); /* * Now that we have the message formatted, perform the output to each
--- a/usr/src/lib/krb5/kadm5/srv/chgpwd.c Mon Apr 09 14:01:48 2007 -0700 +++ b/usr/src/lib/krb5/kadm5/srv/chgpwd.c Mon Apr 09 16:04:26 2007 -0700 @@ -1,5 +1,5 @@ /* - * Copyright 2006 Sun Microsystems, Inc. All rights reserved. + * Copyright 2007 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ @@ -67,6 +67,8 @@ int numresult; char strresult[1024]; char *clientstr; + size_t clen; + char *cdots; ret = 0; rep->length = 0; @@ -379,9 +381,11 @@ free(ptr); clear.length = 0; - krb5_klog_syslog(LOG_NOTICE, "chpw request from %s for %s: %s", + clen = strlen(clientstr); + trunc_name(&clen, &cdots); + krb5_klog_syslog(LOG_NOTICE, "chpw request from %s for %.*s%s: %s", inet_ntoa(((struct sockaddr_in *)&remote_addr)->sin_addr), - clientstr, ret ? error_message(ret) : "success"); + clen, clientstr, cdots, ret ? error_message(ret) : "success"); krb5_free_unparsed_name(context, clientstr); if (ret) {
--- a/usr/src/lib/krb5/kadm5/srv/logger.c Mon Apr 09 14:01:48 2007 -0700 +++ b/usr/src/lib/krb5/kadm5/srv/logger.c Mon Apr 09 16:04:26 2007 -0700 @@ -1,5 +1,5 @@ /* - * Copyright 2006 Sun Microsystems, Inc. All rights reserved. + * Copyright 2007 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ @@ -50,7 +50,7 @@ #include <sys/types.h> #include <sys/stat.h> -#define KRB5_KLOG_MAX_ERRMSG_SIZE 1024 +#define KRB5_KLOG_MAX_ERRMSG_SIZE 2048 #ifndef MAXHOSTNAMELEN #define MAXHOSTNAMELEN 256 #endif /* MAXHOSTNAMELEN */ @@ -380,7 +380,9 @@ /* If reporting an error message, separate it. */ if (code) { outbuf[sizeof(outbuf) - 1] = '\0'; - strncat(outbuf, error_message(code), sizeof(outbuf) - 1 - strlen(outbuf)); + + strncat(outbuf, error_message(code), + sizeof(outbuf) - 1 - strlen(outbuf)); strncat(outbuf, " - ", sizeof(outbuf) - 1 - strlen(outbuf)); } cp = &outbuf[strlen(outbuf)]; @@ -426,7 +428,7 @@ } /* Now format the actual message */ - vsprintf(cp, actual_format, ap); + vsnprintf(cp, sizeof (outbuf) - (cp - outbuf), actual_format, ap); /* * Now that we have the message formatted, perform the output to each @@ -995,7 +997,7 @@ syslogp = &outbuf[strlen(outbuf)]; /* Now format the actual message */ - vsprintf(syslogp, format, arglist); + vsnprintf(syslogp, sizeof (outbuf) - (syslogp - outbuf), format, arglist); /* * Now that we have the message formatted, perform the output to each
--- a/usr/src/lib/krb5/kadm5/srv/mapfile-vers Mon Apr 09 14:01:48 2007 -0700 +++ b/usr/src/lib/krb5/kadm5/srv/mapfile-vers Mon Apr 09 16:04:26 2007 -0700 @@ -18,8 +18,7 @@ # # CDDL HEADER END # -# -# Copyright 2006 Sun Microsystems, Inc. All rights reserved. +# Copyright 2007 Sun Microsystems, Inc. All rights reserved. # Use is subject to license terms. # # ident "%Z%%M% %I% %E% SMI" @@ -145,6 +144,7 @@ osa_free_policy_ent; osa_free_princ_ent; passwd_check; + trunc_name; xdr_chpass3_arg; xdr_chpass_arg; xdr_chrand3_arg;
--- a/usr/src/lib/krb5/kadm5/srv/server_misc.c Mon Apr 09 14:01:48 2007 -0700 +++ b/usr/src/lib/krb5/kadm5/srv/server_misc.c Mon Apr 09 16:04:26 2007 -0700 @@ -205,3 +205,10 @@ } return KADM5_OK; } + +void +trunc_name(size_t *len, char **dots) +{ + *dots = *len > MAXPRINCLEN ? "..." : ""; + *len = *len > MAXPRINCLEN ? MAXPRINCLEN : *len; +}