svn rev #24491: branches/krb5-1-9/ doc/ src/ src/kdc/

tlyu@MIT.EDU tlyu at MIT.EDU
Mon Nov 1 15:49:30 EDT 2010


http://src.mit.edu/fisheye/changelog/krb5/?cs=24491
Commit By: tlyu
Log Message:
ticket: 6804
version_fixed: 1.9
status: resolved

pull up r24464 from trunk

 ------------------------------------------------------------------------
 r24464 | ghudson | 2010-10-19 15:08:38 -0400 (Tue, 19 Oct 2010) | 9 lines

 ticket: 6804
 subject: Remove KDC replay cache
 target_version: 1.9
 tags: pullup

 Now that SAM1 support has been removed, the KDC does not need a replay
 replay cache.  Remove all code within USE_RCACHE and associated support.
 Rename --disable-kdc-replay-cache to --disable-kdc-lookaside-cache.


Changed Files:
U   branches/krb5-1-9/doc/build.texinfo
U   branches/krb5-1-9/src/configure.in
U   branches/krb5-1-9/src/kdc/Makefile.in
U   branches/krb5-1-9/src/kdc/extern.c
U   branches/krb5-1-9/src/kdc/extern.h
U   branches/krb5-1-9/src/kdc/kdc_util.c
U   branches/krb5-1-9/src/kdc/kdc_util.h
U   branches/krb5-1-9/src/kdc/main.c
Modified: branches/krb5-1-9/doc/build.texinfo
===================================================================
--- branches/krb5-1-9/doc/build.texinfo	2010-11-01 19:21:45 UTC (rev 24490)
+++ branches/krb5-1-9/doc/build.texinfo	2010-11-01 19:49:29 UTC (rev 24491)
@@ -561,12 +561,10 @@
 information about using DNS to determine the default realm.  By default,
 DNS lookups are enabled for the former but not for the latter.
 
- at item --enable-kdc-replay-cache
+ at item --disable-kdc-lookaside-cache
 
-Enable a cache in the KDC to detect retransmitted messages, and resend
-the previous responses to them.  This protects against certain types of
-attempts to extract information from the KDC through some of the
-hardware preauthentication systems.
+Disables the cache in the KDC which detects retransmitted client
+requests and resends the previous responses to them.
 
 @item --with-system-et
 

Modified: branches/krb5-1-9/src/configure.in
===================================================================
--- branches/krb5-1-9/src/configure.in	2010-11-01 19:21:45 UTC (rev 24490)
+++ branches/krb5-1-9/src/configure.in	2010-11-01 19:49:29 UTC (rev 24491)
@@ -180,24 +180,12 @@
 	AC_DEFINE(KRBCONF_KDC_MODIFIES_KDB,1,[Define if KDC should update database with each request])
 fi
 
-# Needed for hw-preauth replay detection on KDC.
-
-# USE_RCACHE enables the replay cache
-# NOCACHE disables the lookaside cache
-
-# The lookaside cache is checked first; if *exactly* the same message
-# comes in twice, e.g., because the (legitimate) client resent it,
-# the previous response will be resent.  Otherwise, the replay cache
-# is used to check for attempts to fake out the KDC.  Some hardware
-# preauth methods are weak enough that we *really* want to have this
-# checking turned on.
-
-AC_ARG_ENABLE([kdc-replay-cache],
-AC_HELP_STRING([--enable-kdc-replay-cache],[check for replayed/retransmitted KDC requests (recommended when hardware preauthentication is in use) @<:@disabled@:>@]), , enableval=yes)
-if test "$enableval" = yes ; then
-	AC_DEFINE(USE_RCACHE,1,[Define if the KDC should use a replay cache])
-else
-	AC_DEFINE(NOCACHE,1,[Define if the KDC should use no replay cache])
+AC_ARG_ENABLE([kdc-lookaside-cache],
+AC_HELP_STRING([--disable-kdc-lookaside-cache],
+               [Disable the cache which detects client retransmits]), ,
+               enableval=yes)
+if test "$enableval" = no ; then
+	AC_DEFINE(NOCACHE,1,[Define if the KDC should use no lookaside cache])
 fi
 KRB5_RUN_FLAGS
 

Modified: branches/krb5-1-9/src/kdc/Makefile.in
===================================================================
--- branches/krb5-1-9/src/kdc/Makefile.in	2010-11-01 19:21:45 UTC (rev 24490)
+++ branches/krb5-1-9/src/kdc/Makefile.in	2010-11-01 19:49:29 UTC (rev 24491)
@@ -1,11 +1,6 @@
 mydir=kdc
 BUILDTOP=$(REL)..
-# -DUSE_RCACHE - enable replay cache for KDC
-# -DNOCACHE    - disable lookaside cache, which is used to resend previous
-#                response to replay (i.e., *don't* define this if you
-#                define USE_RCACHE)
-# These are now set in configure.in.
-DEFINES = # -DNOCACHE
+DEFINES =
 RUN_SETUP = @KRB5_RUN_ENV@
 PROG_LIBPATH=-L$(TOPLIBD) $(KRB4_LIBPATH)
 KDB5_LIB_DEPS=$(DL_LIB) $(THREAD_LINKOPTS)

Modified: branches/krb5-1-9/src/kdc/extern.c
===================================================================
--- branches/krb5-1-9/src/kdc/extern.c	2010-11-01 19:21:45 UTC (rev 24490)
+++ branches/krb5-1-9/src/kdc/extern.c	2010-11-01 19:49:29 UTC (rev 24491)
@@ -37,6 +37,5 @@
 kdc_realm_t     *kdc_active_realm = (kdc_realm_t *) NULL;
 krb5_data empty_string = {0, 0, ""};
 krb5_timestamp kdc_infinity = KRB5_INT32_MAX; /* XXX */
-krb5_rcache     kdc_rcache = (krb5_rcache) NULL;
 krb5_keyblock   psr_key;
 krb5_int32      max_dgram_reply_size = MAX_DGRAM_SIZE;

Modified: branches/krb5-1-9/src/kdc/extern.h
===================================================================
--- branches/krb5-1-9/src/kdc/extern.h	2010-11-01 19:21:45 UTC (rev 24490)
+++ branches/krb5-1-9/src/kdc/extern.h	2010-11-01 19:49:29 UTC (rev 24491)
@@ -99,7 +99,6 @@
 /* various externs for KDC */
 extern krb5_data        empty_string;   /* an empty string */
 extern krb5_timestamp   kdc_infinity;   /* greater than all other timestamps */
-extern krb5_rcache      kdc_rcache;     /* replay cache */
 extern krb5_keyblock    psr_key;        /* key for predicted sam response */
 extern const int        kdc_modifies_kdb;
 extern krb5_int32       max_dgram_reply_size; /* maximum datagram size */

Modified: branches/krb5-1-9/src/kdc/kdc_util.c
===================================================================
--- branches/krb5-1-9/src/kdc/kdc_util.c	2010-11-01 19:21:45 UTC (rev 24490)
+++ branches/krb5-1-9/src/kdc/kdc_util.c	2010-11-01 19:49:29 UTC (rev 24491)
@@ -66,59 +66,13 @@
 #include "net-server.h"
 #include <limits.h>
 
-#ifdef USE_RCACHE
-static char *kdc_current_rcname = (char *) NULL;
-krb5_deltat rc_lifetime; /* See kdc_initialize_rcache() */
-#endif
-
 #ifdef KRBCONF_VAGUE_ERRORS
 const int vague_errors = 1;
 #else
 const int vague_errors = 0;
 #endif
 
-#ifdef USE_RCACHE
 /*
- * initialize the replay cache.
- */
-krb5_error_code
-kdc_initialize_rcache(krb5_context kcontext, char *rcache_name)
-{
-    krb5_error_code     retval;
-    char                *rcname;
-    char                *sname;
-
-    rcname = (rcache_name) ? rcache_name : kdc_current_rcname;
-
-    /* rc_lifetime used elsewhere to verify we're not */
-    /*  replaying really old data                     */
-    rc_lifetime = kcontext->clockskew;
-
-    if (!rcname)
-        rcname = KDCRCACHE;
-    if (!(retval = krb5_rc_resolve_full(kcontext, &kdc_rcache, rcname))) {
-        /* Recover or initialize the replay cache */
-        if (!(retval = krb5_rc_recover(kcontext, kdc_rcache)) ||
-            !(retval = krb5_rc_initialize(kcontext,
-                                          kdc_rcache,
-                                          kcontext->clockskew))
-        ) {
-            /* Expunge the replay cache */
-            if (!(retval = krb5_rc_expunge(kcontext, kdc_rcache))) {
-                sname = kdc_current_rcname;
-                kdc_current_rcname = strdup(rcname);
-                if (sname)
-                    free(sname);
-            }
-        }
-        if (retval)
-            krb5_rc_close(kcontext, kdc_rcache);
-    }
-    return(retval);
-}
-#endif
-
-/*
  * concatenate first two authdata arrays, returning an allocated replacement.
  * The replacement should be freed with krb5_free_authdata().
  */
@@ -298,11 +252,6 @@
     if ((retval = krb5_auth_con_setaddrs(kdc_context, auth_context, NULL,
                                          from->address)) )
         goto cleanup_auth_context;
-#ifdef USE_RCACHE
-    if ((retval = krb5_auth_con_setrcache(kdc_context, auth_context,
-                                          kdc_rcache)))
-        goto cleanup_auth_context;
-#endif
 
     if ((retval = kdc_get_server_key(apreq->ticket, 0, foreign_server,
                                      &krbtgt, tgskey, &kvno)))
@@ -317,36 +266,8 @@
     if ((retval = krb5_rd_req_decoded_anyflag(kdc_context, &auth_context, apreq,
                                               apreq->ticket->server,
                                               kdc_active_realm->realm_keytab,
-                                              NULL, ticket))) {
-#ifdef USE_RCACHE
-        /*
-         * I'm not so sure that this is right, but it's better than nothing
-         * at all.
-         *
-         * If we choke in the rd_req because of the replay cache, then attempt
-         * to reinitialize the replay cache because somebody could have deleted
-         * it from underneath us (e.g. a cron job)
-         */
-        if ((retval == KRB5_RC_IO_IO) ||
-            (retval == KRB5_RC_IO_UNKNOWN)) {
-            (void) krb5_rc_close(kdc_context, kdc_rcache);
-            kdc_rcache = (krb5_rcache) NULL;
-            if (!(retval = kdc_initialize_rcache(kdc_context, (char *) NULL))) {
-                if ((retval = krb5_auth_con_setrcache(kdc_context, auth_context,
-                                                      kdc_rcache)) ||
-                    (retval = krb5_rd_req_decoded_anyflag(kdc_context, &auth_context,
-                                                          apreq, apreq->ticket->server,
-                                                          kdc_active_realm->realm_keytab,
-                                                          NULL, ticket))
-                )
-                    goto cleanup_auth_context;
-            }
-        } else
-            goto cleanup_auth_context;
-#else
+                                              NULL, ticket)))
         goto cleanup_auth_context;
-#endif
-    }
 
     /* "invalid flag" tickets can must be used to validate */
     if (isflagset((*ticket)->enc_part2->flags, TKT_FLG_INVALID)
@@ -423,10 +344,6 @@
     krb5_free_authenticator(kdc_context, authenticator);
 
 cleanup_auth_context:
-    /* We do not want the free of the auth_context to close the rcache */
-#ifdef USE_RCACHE
-    (void)  krb5_auth_con_setrcache(kdc_context, auth_context, 0);
-#endif
     krb5_auth_con_free(kdc_context, auth_context);
 
 cleanup:

Modified: branches/krb5-1-9/src/kdc/kdc_util.h
===================================================================
--- branches/krb5-1-9/src/kdc/kdc_util.h	2010-11-01 19:21:45 UTC (rev 24490)
+++ branches/krb5-1-9/src/kdc/kdc_util.h	2010-11-01 19:49:29 UTC (rev 24491)
@@ -138,9 +138,6 @@
           krb5_data **,
           int);
 
-/* main.c */
-krb5_error_code kdc_initialize_rcache (krb5_context, char *);
-
 krb5_error_code
 setup_server_realm (krb5_principal);
 void

Modified: branches/krb5-1-9/src/kdc/main.c
===================================================================
--- branches/krb5-1-9/src/kdc/main.c	2010-11-01 19:21:45 UTC (rev 24490)
+++ branches/krb5-1-9/src/kdc/main.c	2010-11-01 19:49:29 UTC (rev 24491)
@@ -651,7 +651,6 @@
     char                *db_name = (char *) NULL;
     char                *lrealm = (char *) NULL;
     char                *mkey_name = (char *) NULL;
-    char                *rcname = KDCRCACHE;
     krb5_error_code     retval;
     krb5_enctype        menctype = ENCTYPE_UNKNOWN;
     kdc_realm_t         *rdatap = NULL;
@@ -805,7 +804,7 @@
                 com_err(argv[0], 0, "invalid enctype %s", optarg);
             break;
         case 'R':
-            rcname = optarg;
+            /* Replay cache name; defunct since we don't use a replay cache. */
             break;
         case 'P':
             pid_file = optarg;
@@ -860,17 +859,6 @@
         }
     }
 
-#ifdef USE_RCACHE
-    /*
-     * Now handle the replay cache.
-     */
-    if ((retval = kdc_initialize_rcache(kcontext, rcname))) {
-        com_err(argv[0], retval, "while initializing KDC replay cache '%s'",
-                rcname);
-        exit(1);
-    }
-#endif
-
     /* Ensure that this is set for our first request. */
     kdc_active_realm = kdc_realmlist[0];
     if (default_udp_ports)
@@ -1080,9 +1068,6 @@
     finish_realms();
     if (kdc_realmlist)
         free(kdc_realmlist);
-#ifdef USE_RCACHE
-    (void) krb5_rc_close(kcontext, kdc_rcache);
-#endif
 #ifndef NOCACHE
     kdc_free_lookaside(kcontext);
 #endif




More information about the cvs-krb5 mailing list