From 12a34f31e72124879e09adae9b196f04d0daed98 Mon Sep 17 00:00:00 2001 From: Ken Raeburn Date: Sat, 29 Apr 2006 07:06:34 +0000 Subject: [PATCH] ipv4+ipv6 messages can trip up KDC replay detection The replay lookaside cache includes the sending address, but the krb5 library replay cache does not. So, if the same message arrives from two different source addresses, it is considered a replay by the KDC. If the client isn't receiving the replies for some reason, and the client has multiple addresses it uses to contact different addresses on the KDC (and trying to reach the KDC via both IPv4 and IPv6 is an obvious such case), this can cause errors to be returned by the KDC. * replay.c (krb5_kdc_replay_ent): Remove "addrs" field. (MATCH): Don't check it. (kdc_check_lookaside, kdc_insert_lookaside): Remove "from" argument. * kdc_util.h (kdc_check_lookaside, kdc_insert_lookaside): Update decls. * dispatch.c (dispatch): Update calls. ticket: new git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@17970 dc483132-0cff-0310-8789-dd5450dbe970 --- src/kdc/dispatch.c | 4 ++-- src/kdc/kdc_util.h | 6 ++---- src/kdc/replay.c | 19 ++----------------- 3 files changed, 6 insertions(+), 23 deletions(-) diff --git a/src/kdc/dispatch.c b/src/kdc/dispatch.c index 0432661d7..84cfe39ac 100644 --- a/src/kdc/dispatch.c +++ b/src/kdc/dispatch.c @@ -49,7 +49,7 @@ dispatch(krb5_data *pkt, const krb5_fulladdr *from, krb5_data **response) #ifndef NOCACHE /* try the replay lookaside buffer */ - if (kdc_check_lookaside(pkt, from, response)) { + if (kdc_check_lookaside(pkt, response)) { /* a hit! */ const char *name = 0; char buf[46]; @@ -108,7 +108,7 @@ dispatch(krb5_data *pkt, const krb5_fulladdr *from, krb5_data **response) #ifndef NOCACHE /* put the response into the lookaside buffer */ if (!retval) - kdc_insert_lookaside(pkt, from, *response); + kdc_insert_lookaside(pkt, *response); #endif return retval; diff --git a/src/kdc/kdc_util.h b/src/kdc/kdc_util.h index cd7a6ef75..b15d5d79c 100644 --- a/src/kdc/kdc_util.h +++ b/src/kdc/kdc_util.h @@ -156,10 +156,8 @@ krb5_error_code return_padata krb5_key_data *client_key, krb5_keyblock *encrypting_key); /* replay.c */ -krb5_boolean kdc_check_lookaside (krb5_data *, const krb5_fulladdr *, - krb5_data **); -void kdc_insert_lookaside (krb5_data *, const krb5_fulladdr *, - krb5_data *); +krb5_boolean kdc_check_lookaside (krb5_data *, krb5_data **); +void kdc_insert_lookaside (krb5_data *, krb5_data *); void kdc_free_lookaside(krb5_context); /* which way to convert key? */ diff --git a/src/kdc/replay.c b/src/kdc/replay.c index 736abb73b..e6c48a4ea 100644 --- a/src/kdc/replay.c +++ b/src/kdc/replay.c @@ -41,7 +41,6 @@ typedef struct _krb5_kdc_replay_ent { time_t db_age; krb5_data *req_packet; krb5_data *reply_packet; - krb5_address *addr; /* XXX should these not be pointers? */ } krb5_kdc_replay_ent; static krb5_kdc_replay_ent root_ptr = {0}; @@ -58,10 +57,6 @@ static int num_entries = 0; #define MATCH(ptr) (((ptr)->req_packet->length == inpkt->length) && \ !memcmp((ptr)->req_packet->data, inpkt->data, \ inpkt->length) && \ - ((ptr)->addr->length == from->address->length) && \ - !memcmp((ptr)->addr->contents, \ - from->address->contents, \ - from->address->length)&& \ ((ptr)->db_age == db_age)) /* XXX Todo: quench the size of the queue... @@ -71,8 +66,7 @@ static int num_entries = 0; FALSE if the caller should do the work */ krb5_boolean -kdc_check_lookaside(krb5_data *inpkt, const krb5_fulladdr *from, - krb5_data **outpkt) +kdc_check_lookaside(krb5_data *inpkt, krb5_data **outpkt) { krb5_int32 timenow; register krb5_kdc_replay_ent *eptr, *last, *hold; @@ -107,7 +101,6 @@ kdc_check_lookaside(krb5_data *inpkt, const krb5_fulladdr *from, max_hits_per_entry = max(max_hits_per_entry, eptr->num_hits); krb5_free_data(kdc_context, eptr->req_packet); krb5_free_data(kdc_context, eptr->reply_packet); - krb5_free_address(kdc_context, eptr->addr); hold = eptr; last->next = eptr->next; eptr = last; @@ -125,8 +118,7 @@ kdc_check_lookaside(krb5_data *inpkt, const krb5_fulladdr *from, already there, and can fail softly due to other weird errors. */ void -kdc_insert_lookaside(krb5_data *inpkt, const krb5_fulladdr *from, - krb5_data *outpkt) +kdc_insert_lookaside(krb5_data *inpkt, krb5_data *outpkt) { register krb5_kdc_replay_ent *eptr; krb5_int32 timenow; @@ -156,12 +148,6 @@ kdc_insert_lookaside(krb5_data *inpkt, const krb5_fulladdr *from, free(eptr); return; } - if (krb5_copy_addr(kdc_context, from->address, &eptr->addr)) { - krb5_free_data(kdc_context, eptr->req_packet); - krb5_free_data(kdc_context, eptr->reply_packet); - free(eptr); - return; - } eptr->next = root_ptr.next; root_ptr.next = eptr; num_entries++; @@ -178,7 +164,6 @@ kdc_free_lookaside(krb5_context kcontext) eptr; eptr = eptr->next) { krb5_free_data(kcontext, eptr->req_packet); krb5_free_data(kcontext, eptr->reply_packet); - krb5_free_address(kcontext, eptr->addr); hold = eptr; last->next = eptr->next; eptr = last; -- 2.26.2