svn rev #24464: trunk/ doc/ src/ src/kdc/
ghudson@MIT.EDU
ghudson at MIT.EDU
Tue Oct 19 15:08:38 EDT 2010
http://src.mit.edu/fisheye/changelog/krb5/?cs=24464
Commit By: ghudson
Log Message:
ticket: 6804
subject: Remove KDC replay cache
target_version: 1.9
tags: pullup
Now that SAM1 support has been removed, the KDC does not need a replay
replay cache. Remove all code within USE_RCACHE and associated support.
Rename --disable-kdc-replay-cache to --disable-kdc-lookaside-cache.
Changed Files:
U trunk/doc/build.texinfo
U trunk/src/configure.in
U trunk/src/kdc/Makefile.in
U trunk/src/kdc/extern.c
U trunk/src/kdc/extern.h
U trunk/src/kdc/kdc_util.c
U trunk/src/kdc/kdc_util.h
U trunk/src/kdc/main.c
Modified: trunk/doc/build.texinfo
===================================================================
--- trunk/doc/build.texinfo 2010-10-18 23:28:46 UTC (rev 24463)
+++ trunk/doc/build.texinfo 2010-10-19 19:08:38 UTC (rev 24464)
@@ -561,12 +561,10 @@
information about using DNS to determine the default realm. By default,
DNS lookups are enabled for the former but not for the latter.
- at item --enable-kdc-replay-cache
+ at item --disable-kdc-lookaside-cache
-Enable a cache in the KDC to detect retransmitted messages, and resend
-the previous responses to them. This protects against certain types of
-attempts to extract information from the KDC through some of the
-hardware preauthentication systems.
+Disables the cache in the KDC which detects retransmitted client
+requests and resends the previous responses to them.
@item --with-system-et
Modified: trunk/src/configure.in
===================================================================
--- trunk/src/configure.in 2010-10-18 23:28:46 UTC (rev 24463)
+++ trunk/src/configure.in 2010-10-19 19:08:38 UTC (rev 24464)
@@ -180,24 +180,12 @@
AC_DEFINE(KRBCONF_KDC_MODIFIES_KDB,1,[Define if KDC should update database with each request])
fi
-# Needed for hw-preauth replay detection on KDC.
-
-# USE_RCACHE enables the replay cache
-# NOCACHE disables the lookaside cache
-
-# The lookaside cache is checked first; if *exactly* the same message
-# comes in twice, e.g., because the (legitimate) client resent it,
-# the previous response will be resent. Otherwise, the replay cache
-# is used to check for attempts to fake out the KDC. Some hardware
-# preauth methods are weak enough that we *really* want to have this
-# checking turned on.
-
-AC_ARG_ENABLE([kdc-replay-cache],
-AC_HELP_STRING([--enable-kdc-replay-cache],[check for replayed/retransmitted KDC requests (recommended when hardware preauthentication is in use) @<:@disabled@:>@]), , enableval=yes)
-if test "$enableval" = yes ; then
- AC_DEFINE(USE_RCACHE,1,[Define if the KDC should use a replay cache])
-else
- AC_DEFINE(NOCACHE,1,[Define if the KDC should use no replay cache])
+AC_ARG_ENABLE([kdc-lookaside-cache],
+AC_HELP_STRING([--disable-kdc-lookaside-cache],
+ [Disable the cache which detects client retransmits]), ,
+ enableval=yes)
+if test "$enableval" = no ; then
+ AC_DEFINE(NOCACHE,1,[Define if the KDC should use no lookaside cache])
fi
KRB5_RUN_FLAGS
Modified: trunk/src/kdc/Makefile.in
===================================================================
--- trunk/src/kdc/Makefile.in 2010-10-18 23:28:46 UTC (rev 24463)
+++ trunk/src/kdc/Makefile.in 2010-10-19 19:08:38 UTC (rev 24464)
@@ -1,11 +1,6 @@
mydir=kdc
BUILDTOP=$(REL)..
-# -DUSE_RCACHE - enable replay cache for KDC
-# -DNOCACHE - disable lookaside cache, which is used to resend previous
-# response to replay (i.e., *don't* define this if you
-# define USE_RCACHE)
-# These are now set in configure.in.
-DEFINES = # -DNOCACHE
+DEFINES =
RUN_SETUP = @KRB5_RUN_ENV@
PROG_LIBPATH=-L$(TOPLIBD) $(KRB4_LIBPATH)
KDB5_LIB_DEPS=$(DL_LIB) $(THREAD_LINKOPTS)
Modified: trunk/src/kdc/extern.c
===================================================================
--- trunk/src/kdc/extern.c 2010-10-18 23:28:46 UTC (rev 24463)
+++ trunk/src/kdc/extern.c 2010-10-19 19:08:38 UTC (rev 24464)
@@ -37,6 +37,5 @@
kdc_realm_t *kdc_active_realm = (kdc_realm_t *) NULL;
krb5_data empty_string = {0, 0, ""};
krb5_timestamp kdc_infinity = KRB5_INT32_MAX; /* XXX */
-krb5_rcache kdc_rcache = (krb5_rcache) NULL;
krb5_keyblock psr_key;
krb5_int32 max_dgram_reply_size = MAX_DGRAM_SIZE;
Modified: trunk/src/kdc/extern.h
===================================================================
--- trunk/src/kdc/extern.h 2010-10-18 23:28:46 UTC (rev 24463)
+++ trunk/src/kdc/extern.h 2010-10-19 19:08:38 UTC (rev 24464)
@@ -99,7 +99,6 @@
/* various externs for KDC */
extern krb5_data empty_string; /* an empty string */
extern krb5_timestamp kdc_infinity; /* greater than all other timestamps */
-extern krb5_rcache kdc_rcache; /* replay cache */
extern krb5_keyblock psr_key; /* key for predicted sam response */
extern const int kdc_modifies_kdb;
extern krb5_int32 max_dgram_reply_size; /* maximum datagram size */
Modified: trunk/src/kdc/kdc_util.c
===================================================================
--- trunk/src/kdc/kdc_util.c 2010-10-18 23:28:46 UTC (rev 24463)
+++ trunk/src/kdc/kdc_util.c 2010-10-19 19:08:38 UTC (rev 24464)
@@ -66,59 +66,13 @@
#include "net-server.h"
#include <limits.h>
-#ifdef USE_RCACHE
-static char *kdc_current_rcname = (char *) NULL;
-krb5_deltat rc_lifetime; /* See kdc_initialize_rcache() */
-#endif
-
#ifdef KRBCONF_VAGUE_ERRORS
const int vague_errors = 1;
#else
const int vague_errors = 0;
#endif
-#ifdef USE_RCACHE
/*
- * initialize the replay cache.
- */
-krb5_error_code
-kdc_initialize_rcache(krb5_context kcontext, char *rcache_name)
-{
- krb5_error_code retval;
- char *rcname;
- char *sname;
-
- rcname = (rcache_name) ? rcache_name : kdc_current_rcname;
-
- /* rc_lifetime used elsewhere to verify we're not */
- /* replaying really old data */
- rc_lifetime = kcontext->clockskew;
-
- if (!rcname)
- rcname = KDCRCACHE;
- if (!(retval = krb5_rc_resolve_full(kcontext, &kdc_rcache, rcname))) {
- /* Recover or initialize the replay cache */
- if (!(retval = krb5_rc_recover(kcontext, kdc_rcache)) ||
- !(retval = krb5_rc_initialize(kcontext,
- kdc_rcache,
- kcontext->clockskew))
- ) {
- /* Expunge the replay cache */
- if (!(retval = krb5_rc_expunge(kcontext, kdc_rcache))) {
- sname = kdc_current_rcname;
- kdc_current_rcname = strdup(rcname);
- if (sname)
- free(sname);
- }
- }
- if (retval)
- krb5_rc_close(kcontext, kdc_rcache);
- }
- return(retval);
-}
-#endif
-
-/*
* concatenate first two authdata arrays, returning an allocated replacement.
* The replacement should be freed with krb5_free_authdata().
*/
@@ -298,11 +252,6 @@
if ((retval = krb5_auth_con_setaddrs(kdc_context, auth_context, NULL,
from->address)) )
goto cleanup_auth_context;
-#ifdef USE_RCACHE
- if ((retval = krb5_auth_con_setrcache(kdc_context, auth_context,
- kdc_rcache)))
- goto cleanup_auth_context;
-#endif
if ((retval = kdc_get_server_key(apreq->ticket, 0, foreign_server,
&krbtgt, tgskey, &kvno)))
@@ -317,36 +266,8 @@
if ((retval = krb5_rd_req_decoded_anyflag(kdc_context, &auth_context, apreq,
apreq->ticket->server,
kdc_active_realm->realm_keytab,
- NULL, ticket))) {
-#ifdef USE_RCACHE
- /*
- * I'm not so sure that this is right, but it's better than nothing
- * at all.
- *
- * If we choke in the rd_req because of the replay cache, then attempt
- * to reinitialize the replay cache because somebody could have deleted
- * it from underneath us (e.g. a cron job)
- */
- if ((retval == KRB5_RC_IO_IO) ||
- (retval == KRB5_RC_IO_UNKNOWN)) {
- (void) krb5_rc_close(kdc_context, kdc_rcache);
- kdc_rcache = (krb5_rcache) NULL;
- if (!(retval = kdc_initialize_rcache(kdc_context, (char *) NULL))) {
- if ((retval = krb5_auth_con_setrcache(kdc_context, auth_context,
- kdc_rcache)) ||
- (retval = krb5_rd_req_decoded_anyflag(kdc_context, &auth_context,
- apreq, apreq->ticket->server,
- kdc_active_realm->realm_keytab,
- NULL, ticket))
- )
- goto cleanup_auth_context;
- }
- } else
- goto cleanup_auth_context;
-#else
+ NULL, ticket)))
goto cleanup_auth_context;
-#endif
- }
/* "invalid flag" tickets can must be used to validate */
if (isflagset((*ticket)->enc_part2->flags, TKT_FLG_INVALID)
@@ -423,10 +344,6 @@
krb5_free_authenticator(kdc_context, authenticator);
cleanup_auth_context:
- /* We do not want the free of the auth_context to close the rcache */
-#ifdef USE_RCACHE
- (void) krb5_auth_con_setrcache(kdc_context, auth_context, 0);
-#endif
krb5_auth_con_free(kdc_context, auth_context);
cleanup:
Modified: trunk/src/kdc/kdc_util.h
===================================================================
--- trunk/src/kdc/kdc_util.h 2010-10-18 23:28:46 UTC (rev 24463)
+++ trunk/src/kdc/kdc_util.h 2010-10-19 19:08:38 UTC (rev 24464)
@@ -138,9 +138,6 @@
krb5_data **,
int);
-/* main.c */
-krb5_error_code kdc_initialize_rcache (krb5_context, char *);
-
krb5_error_code
setup_server_realm (krb5_principal);
void
Modified: trunk/src/kdc/main.c
===================================================================
--- trunk/src/kdc/main.c 2010-10-18 23:28:46 UTC (rev 24463)
+++ trunk/src/kdc/main.c 2010-10-19 19:08:38 UTC (rev 24464)
@@ -651,7 +651,6 @@
char *db_name = (char *) NULL;
char *lrealm = (char *) NULL;
char *mkey_name = (char *) NULL;
- char *rcname = KDCRCACHE;
krb5_error_code retval;
krb5_enctype menctype = ENCTYPE_UNKNOWN;
kdc_realm_t *rdatap = NULL;
@@ -805,7 +804,7 @@
com_err(argv[0], 0, "invalid enctype %s", optarg);
break;
case 'R':
- rcname = optarg;
+ /* Replay cache name; defunct since we don't use a replay cache. */
break;
case 'P':
pid_file = optarg;
@@ -860,17 +859,6 @@
}
}
-#ifdef USE_RCACHE
- /*
- * Now handle the replay cache.
- */
- if ((retval = kdc_initialize_rcache(kcontext, rcname))) {
- com_err(argv[0], retval, "while initializing KDC replay cache '%s'",
- rcname);
- exit(1);
- }
-#endif
-
/* Ensure that this is set for our first request. */
kdc_active_realm = kdc_realmlist[0];
if (default_udp_ports)
@@ -1080,9 +1068,6 @@
finish_realms();
if (kdc_realmlist)
free(kdc_realmlist);
-#ifdef USE_RCACHE
- (void) krb5_rc_close(kcontext, kdc_rcache);
-#endif
#ifndef NOCACHE
kdc_free_lookaside(kcontext);
#endif
More information about the cvs-krb5
mailing list