* replay.c (kdc_check_lookaside):

	(kdc_insert_lookaside): Add code to originating address of packet,
 	as krb4 initial ticket requests don't contain an address.  This
 	would cause a subtle problem wherein two simultaneous krb4 initial
 	ticket requests for the same principal originating from different
 	addresses would result in both replies containing the same
	address.

	* kdc_util.h: Modify prototype for lookaside functions.

	* dispatch.c (dispatch): Update to new calling conventions of the
	lookaside functions.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@10713 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/kdc/ChangeLog b/src/kdc/ChangeLog
index 6b9617d4eceb357bb1ca42b23ec07b31008b6ae3..30cf89bdd6babc307ef6e60dd467e7bfe101f0cb 100644 (file)
--- a/src/kdc/ChangeLog
+++ b/src/kdc/ChangeLog
@@ -1,3 +1,18 @@
+Tue Jul 21 20:29:38 1998  Tom Yu  <tlyu@mit.edu>
+
+       * replay.c (kdc_check_lookaside):
+       (kdc_insert_lookaside): Add code to originating address of packet,
+       as krb4 initial ticket requests don't contain an address.  This
+       would cause a subtle problem wherein two simultaneous krb4 initial
+       ticket requests for the same principal originating from different
+       addresses would result in both replies containing the same
+       address.
+
+       * kdc_util.h: Modify prototype for lookaside functions.
+
+       * dispatch.c (dispatch): Update to new calling conventions of the
+       lookaside functions.
+
 Wed Jul 15 18:32:07 1998  Tom Yu  <tlyu@mit.edu>
 
        * configure.in: Add CHECK_SIGNALS so that POSIX_SIGNALS gets

diff --git a/src/kdc/dispatch.c b/src/kdc/dispatch.c
index a94173ce4f5810459ba2380d67ed9c80876492af..7446ea5f88cdbfc9caed71c7195bab722739d78a 100644 (file)
--- a/src/kdc/dispatch.c
+++ b/src/kdc/dispatch.c
@@ -43,7 +43,7 @@ dispatch(pkt, from, portnum, response)
     /* decode incoming packet, and dispatch */
 
     /* try the replay lookaside buffer */
-    if (kdc_check_lookaside(pkt, response)) {
+    if (kdc_check_lookaside(pkt, from, response)) {
        /* a hit! */
        krb5_klog_syslog(LOG_INFO, "DISPATCH: replay found and re-transmitted");
        return 0;
@@ -72,7 +72,7 @@ dispatch(pkt, from, portnum, response)
        retval = KRB5KRB_AP_ERR_MSG_TYPE;
     /* put the response into the lookaside buffer */
     if (!retval)
-       kdc_insert_lookaside(pkt, *response);
+       kdc_insert_lookaside(pkt, from, *response);
 
     return retval;
 }

diff --git a/src/kdc/kdc_util.h b/src/kdc/kdc_util.h
index 2702e14d234c4a90751fa9fa1799b3a006229f91..6e8789239639686349904e28cc22478e116b1db6 100644 (file)
--- a/src/kdc/kdc_util.h
+++ b/src/kdc/kdc_util.h
@@ -149,8 +149,10 @@ krb5_error_code return_padata
               krb5_key_data *client_key, krb5_keyblock *encrypting_key));
     
 /* replay.c */
-krb5_boolean kdc_check_lookaside PROTOTYPE((krb5_data *, krb5_data **));
-void kdc_insert_lookaside PROTOTYPE((krb5_data *, krb5_data *));
+krb5_boolean kdc_check_lookaside PROTOTYPE((krb5_data *, krb5_fulladdr *,
+                                           krb5_data **));
+void kdc_insert_lookaside PROTOTYPE((krb5_data *, krb5_fulladdr *,
+                                    krb5_data *));
 
 /* which way to convert key? */
 #define CONVERT_INTO_DB        0

diff --git a/src/kdc/replay.c b/src/kdc/replay.c
index cf30c0784624decfe43438dfb9b099780e7021e5..a65ffb3eb77b974d2fc30ba8df73cc7a6d0d2dfa 100644 (file)
--- a/src/kdc/replay.c
+++ b/src/kdc/replay.c
@@ -36,6 +36,7 @@ typedef struct _krb5_kdc_replay_ent {
     time_t db_age;
     krb5_data *req_packet;
     krb5_data *reply_packet;
+    krb5_address *addr;                /* XXX should these not be pointers? */
 } krb5_kdc_replay_ent;
 
 static krb5_kdc_replay_ent root_ptr = {0};
@@ -46,13 +47,16 @@ static int max_hits_per_entry = 0;
 static int num_entries = 0;
 
 #define STALE_TIME     2*60            /* two minutes */
-#define STALE(ptr) ((abs((ptr)->timein - timenow) >= STALE_TIME) || \
+#define STALE(ptr) ((abs((ptr)->timein - timenow) >= STALE_TIME) ||    \
                    ((ptr)->db_age != db_age))
 
-#define MATCH(ptr) (((ptr)->req_packet->length == inpkt->length) && \
-                   !memcmp((ptr)->req_packet->data, inpkt->data, inpkt->length) && \
+#define MATCH(ptr) (((ptr)->req_packet->length == inpkt->length) &&    \
+                   !memcmp((ptr)->req_packet->data, inpkt->data,       \
+                           inpkt->length) &&                           \
+                   ((ptr)->addr->length == from->address->length) &&   \
+                   !memcmp((ptr)->addr->contents, from->address,       \
+                           from->address->length)&&                    \
                    ((ptr)->db_age == db_age))
-
 /* XXX
    Todo:  quench the size of the queue...
  */
@@ -61,9 +65,10 @@ static int num_entries = 0;
    FALSE if the caller should do the work */
 
 krb5_boolean
-kdc_check_lookaside(inpkt, outpkt)
-register krb5_data *inpkt;
-register krb5_data **outpkt;
+kdc_check_lookaside(inpkt, from, outpkt)
+    register krb5_data *inpkt;
+    register krb5_fulladdr *from;
+    register krb5_data **outpkt;
 {
     krb5_int32 timenow;
     register krb5_kdc_replay_ent *eptr, *last, *hold;
@@ -71,7 +76,7 @@ register krb5_data **outpkt;
 
     if (krb5_timeofday(kdc_context, &timenow) || 
        krb5_db_get_age(kdc_context, 0, &db_age))
-           return FALSE;
+       return FALSE;
 
     calls++;
 
@@ -98,6 +103,7 @@ register krb5_data **outpkt;
                max_hits_per_entry = max(max_hits_per_entry, eptr->num_hits);
                krb5_free_data(kdc_context, eptr->req_packet);
                krb5_free_data(kdc_context, eptr->reply_packet);
+               krb5_free_address(kdc_context, eptr->addr);
                hold = eptr;
                last->next = eptr->next;
                eptr = last;
@@ -115,9 +121,10 @@ register krb5_data **outpkt;
    already there, and can fail softly due to other weird errors. */
 
 void
-kdc_insert_lookaside(inpkt, outpkt)
-register krb5_data *inpkt;
-register krb5_data *outpkt;
+kdc_insert_lookaside(inpkt, from, outpkt)
+    register krb5_data *inpkt;
+    register krb5_fulladdr *from;
+    register krb5_data *outpkt;
 {
     register krb5_kdc_replay_ent *eptr;    
     krb5_int32 timenow;
@@ -125,7 +132,7 @@ register krb5_data *outpkt;
 
     if (krb5_timeofday(kdc_context, &timenow) || 
        krb5_db_get_age(kdc_context, 0, &db_age))
-           return;
+       return;
 
     /* this is a new entry */
     eptr = (krb5_kdc_replay_ent *)calloc(1, sizeof(*eptr));
@@ -133,6 +140,11 @@ register krb5_data *outpkt;
        return;
     eptr->timein = timenow;
     eptr->db_age = db_age;
+    /*
+     * This is going to hurt a lot malloc()-wise due to the need to
+     * allocate memory for the krb5_data and krb5_address elements.
+     * ARGH!
+     */
     if (krb5_copy_data(kdc_context, inpkt, &eptr->req_packet)) {
        free(eptr);
        return;
@@ -142,6 +154,12 @@ register krb5_data *outpkt;
        free(eptr);
        return;
     }
+    if (krb5_copy_addr(kdc_context, from->address, &eptr->addr)) {
+       krb5_free_data(kdc_context, eptr->req_packet);
+       krb5_free_data(kdc_context, eptr->reply_packet);
+       free(eptr);
+       return;
+    }
     eptr->next = root_ptr.next;
     root_ptr.next = eptr;
     num_entries++;