From fc93ceabf746bb9b70de57781f4bdd4de57f787f Mon Sep 17 00:00:00 2001 From: Tom Yu Date: Fri, 14 Jan 2005 22:25:29 +0000 Subject: [PATCH] pullup from trunk ticket: 2877 version_fixed: 1.4 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-4@17040 dc483132-0cff-0310-8789-dd5450dbe970 --- src/lib/rpc/ChangeLog | 14 ++++++ src/lib/rpc/authgss_prot.c | 56 ++++++++------------- src/tests/dejagnu/krb-standalone/ChangeLog | 7 +++ src/tests/dejagnu/krb-standalone/kadmin.exp | 18 ++++++- 4 files changed, 58 insertions(+), 37 deletions(-) diff --git a/src/lib/rpc/ChangeLog b/src/lib/rpc/ChangeLog index 4c4628565..def5183a3 100644 --- a/src/lib/rpc/ChangeLog +++ b/src/lib/rpc/ChangeLog @@ -1,3 +1,17 @@ +2005-01-14 Tom Yu + + * xdr.c (xdr_bytes): Revert previous; the problem was actually in + xdr_rpc_gss_buf. + + * authgss_prot.c (xdr_rpc_gss_wrap_data): Use xdr_alloc to avoid + size limit issues. Use (unsigned int)-1 instead of MAX_NETOBJ_SZ. + (xdr_rpc_gss_unwrap_data): Use (unsigned int)-1 instead of + MAX_NETOBJ_SZ. + (xdr_rpc_gss_buf): Set tmplen even if doing XDR_FREE. + + * xdr.c (xdr_bytes): Don't assign from *sizep if XDR_FREE, since + it'll be uninitialized then. Shuts up Purify. + 2004-11-18 Tom Yu * Makefile.in (install-unix): Install into KRB5_INCDIR/gssrpc, diff --git a/src/lib/rpc/authgss_prot.c b/src/lib/rpc/authgss_prot.c index 0e8029abd..ab6e7fea0 100644 --- a/src/lib/rpc/authgss_prot.c +++ b/src/lib/rpc/authgss_prot.c @@ -52,7 +52,7 @@ xdr_rpc_gss_buf(XDR *xdrs, gss_buffer_t buf, u_int maxsize) bool_t xdr_stat; u_int tmplen; - if (xdrs->x_op == XDR_ENCODE) { + if (xdrs->x_op != XDR_DECODE) { if (buf->length > UINT_MAX) return (FALSE); else @@ -129,54 +129,37 @@ xdr_rpc_gss_wrap_data(XDR *xdrs, xdrproc_t xdr_func, caddr_t xdr_ptr, gss_ctx_id_t ctx, gss_qop_t qop, rpc_gss_svc_t svc, uint32_t seq) { + XDR tmpxdrs; gss_buffer_desc databuf, wrapbuf; OM_uint32 maj_stat, min_stat; - u_int start, end; int conf_state; bool_t xdr_stat; - u_int tmplen; - /* Skip databody length. */ - start = XDR_GETPOS(xdrs); - if (start > UINT_MAX - 4) - return (FALSE); - XDR_SETPOS(xdrs, start + 4); + xdralloc_create(&tmpxdrs, XDR_ENCODE); + + xdr_stat = FALSE; /* Marshal rpc_gss_data_t (sequence number + arguments). */ - if (!xdr_u_int32(xdrs, &seq) || !(*xdr_func)(xdrs, xdr_ptr)) - return (FALSE); - end = XDR_GETPOS(xdrs); - if (end < start + 4) - return (FALSE); + if (!xdr_u_int32(&tmpxdrs, &seq) || !(*xdr_func)(&tmpxdrs, xdr_ptr)) + goto errout; /* Set databuf to marshalled rpc_gss_data_t. */ - databuf.length = end - start - 4; - XDR_SETPOS(xdrs, start + 4); - databuf.value = XDR_INLINE(xdrs, (int)databuf.length); + databuf.length = xdr_getpos(&tmpxdrs); + databuf.value = xdralloc_getdata(&tmpxdrs); - xdr_stat = FALSE; - if (svc == RPCSEC_GSS_SVC_INTEGRITY) { - /* Marshal databody_integ length. */ - XDR_SETPOS(xdrs, start); - if (databuf.length > UINT_MAX) - return (FALSE); - else - tmplen = databuf.length; + if (!xdr_rpc_gss_buf(xdrs, &databuf, (unsigned int)-1)) + goto errout; - if (!xdr_u_int(xdrs, &tmplen)) - return (FALSE); - /* Checksum rpc_gss_data_t. */ maj_stat = gss_get_mic(&min_stat, ctx, qop, &databuf, &wrapbuf); if (maj_stat != GSS_S_COMPLETE) { log_debug("gss_get_mic failed"); - return (FALSE); + goto errout; } /* Marshal checksum. */ - XDR_SETPOS(xdrs, end); - xdr_stat = xdr_rpc_gss_buf(xdrs, &wrapbuf, MAX_NETOBJ_SZ); + xdr_stat = xdr_rpc_gss_buf(xdrs, &wrapbuf, (unsigned int)-1); gss_release_buffer(&min_stat, &wrapbuf); } else if (svc == RPCSEC_GSS_SVC_PRIVACY) { @@ -185,13 +168,14 @@ xdr_rpc_gss_wrap_data(XDR *xdrs, xdrproc_t xdr_func, caddr_t xdr_ptr, &conf_state, &wrapbuf); if (maj_stat != GSS_S_COMPLETE) { log_status("gss_wrap", maj_stat, min_stat); - return (FALSE); + goto errout; } /* Marshal databody_priv. */ - XDR_SETPOS(xdrs, start); - xdr_stat = xdr_rpc_gss_buf(xdrs, &wrapbuf, MAX_NETOBJ_SZ); + xdr_stat = xdr_rpc_gss_buf(xdrs, &wrapbuf, (unsigned int)-1); gss_release_buffer(&min_stat, &wrapbuf); } +errout: + xdr_destroy(&tmpxdrs); return (xdr_stat); } @@ -216,12 +200,12 @@ xdr_rpc_gss_unwrap_data(XDR *xdrs, xdrproc_t xdr_func, caddr_t xdr_ptr, if (svc == RPCSEC_GSS_SVC_INTEGRITY) { /* Decode databody_integ. */ - if (!xdr_rpc_gss_buf(xdrs, &databuf, MAX_NETOBJ_SZ)) { + if (!xdr_rpc_gss_buf(xdrs, &databuf, (unsigned int)-1)) { log_debug("xdr decode databody_integ failed"); return (FALSE); } /* Decode checksum. */ - if (!xdr_rpc_gss_buf(xdrs, &wrapbuf, MAX_NETOBJ_SZ)) { + if (!xdr_rpc_gss_buf(xdrs, &wrapbuf, (unsigned int)-1)) { gss_release_buffer(&min_stat, &databuf); log_debug("xdr decode checksum failed"); return (FALSE); @@ -239,7 +223,7 @@ xdr_rpc_gss_unwrap_data(XDR *xdrs, xdrproc_t xdr_func, caddr_t xdr_ptr, } else if (svc == RPCSEC_GSS_SVC_PRIVACY) { /* Decode databody_priv. */ - if (!xdr_rpc_gss_buf(xdrs, &wrapbuf, MAX_NETOBJ_SZ)) { + if (!xdr_rpc_gss_buf(xdrs, &wrapbuf, (unsigned int)-1)) { log_debug("xdr decode databody_priv failed"); return (FALSE); } diff --git a/src/tests/dejagnu/krb-standalone/ChangeLog b/src/tests/dejagnu/krb-standalone/ChangeLog index fe26d2abf..873c34b30 100644 --- a/src/tests/dejagnu/krb-standalone/ChangeLog +++ b/src/tests/dejagnu/krb-standalone/ChangeLog @@ -1,3 +1,10 @@ +2005-01-14 Tom Yu + + * kadmin.exp (kadmin_list): Check for communication failure. + (kadmin_test): Create a large number of principals, then attempt + to list, in order to check for fixed-size buffer problems in + RPCSEC_GSS. + 2004-12-20 Tom Yu * pwhist.exp: New file. Perform some sanity checking on password diff --git a/src/tests/dejagnu/krb-standalone/kadmin.exp b/src/tests/dejagnu/krb-standalone/kadmin.exp index ded386d3d..c72548114 100644 --- a/src/tests/dejagnu/krb-standalone/kadmin.exp +++ b/src/tests/dejagnu/krb-standalone/kadmin.exp @@ -402,6 +402,11 @@ proc kadmin_list { } { catch "expect_after" return 0 } + "Communication failure" { + fail "kadmin ldb got RPC error" + catch "expect_after" + return 0 + } timeout { fail "kadmin ldb" catch "expect_after" @@ -416,7 +421,7 @@ proc kadmin_list { } { expect -re "assword\[^\r\n\]*: *" { send "adminpass$KEY\r" } - expect -re "\(.*@$REALMNAME\r\n\)*" + expect -re "\(.*@$REALMNAME\r\n\)+" expect_after expect eof set k_stat [wait -i $spawn_id] @@ -1033,6 +1038,17 @@ proc kadmin_test { } { return } + # test retrieval of large number of principals + # bug [2877] + for { set i 0 } { $i < 200 } { incr i } { + if { ![kadmin_add "foo$i" foopass] } { + return + } + } + + if { ![kadmin_list] } { + return + } verbose "kadmin_test succeeded" } -- 2.26.2