krb5/krb5-1.4.3-kdc_max_dgram_size.patch

Implement a "max_dgram_size" parameter for realms, which will control when/if
the server will respond with KRB_ERR_RESPONSE_TOO_BIG errors to requests from
its clients.

Because the reads settings by using libkadm5's krb5_read_realm_params function,
its returned structure type needs to be expanded to hold this information,
which breaks the ABI.

When processing AS or TGS requests, the server needs to keep track of whether
or not the client is issuing a request over a connected socket so that it
won't issue RESPONSE_TOO_BIG errors to connected clients.

The lookaside cache also needs to take note of the distinction so that it
doesn't replay error messages to clients who've switched from using a
connectionless socket to a connected socket and are sending the same request.

--- krb5-1.4.3/doc/definitions.texinfo	2006-01-05 15:12:12.000000000 -0500
+++ krb5-1.4.3/doc/definitions.texinfo	2006-01-05 15:12:50.000000000 -0500
@@ -97,6 +97,8 @@
 @set DefaultKDCRCache krb5kdc_rcache
 @comment KDCRCACHE
 @set DefaultRCTmpDirs /var/tmp, /usr/tmp, /var/usr/tmp, and /tmp
+@comment MAX_DGRAM_SIZE
+@set DefaultMaxDgramSize 4096
 
 @ignore
 the following defaults should be consistent with the numbers set in
--- krb5-1.4.3/doc/admin.texinfo	2006-01-05 15:13:04.000000000 -0500
+++ krb5-1.4.3/doc/admin.texinfo	2006-01-05 15:14:22.000000000 -0500
@@ -1264,6 +1264,14 @@
 valid ticket may be renewed in this realm.  The default value is
 @value{DefaultMaxRenewableLife}.
 
+@itemx max_dgram_size
+(Numeric value.)  Specifies the maximum allowed size for responses to
+client requests which are received over unconnected sockets (usually,
+UDP, as opposed to TCP).  If the response to a request would be larger
+than the specified size, a KRB_ERR_RESPONSE_TOO_BIG error is sent in
+its stead.  The default value is
+@value{DefaultMaxDgramSize}.
+
 @itemx supported_enctypes
 List of key:salt strings.  Specifies the default key/salt combinations of
 principals for this realm.  Any principals created through @code{kadmin}
--- krb5-1.4.3/src/lib/kadm5/srv/Makefile.in	2004-06-16 21:56:34.000000000 -0400
+++ krb5-1.4.3/src/lib/kadm5/srv/Makefile.in	2006-01-05 15:08:23.000000000 -0500
@@ -9,8 +9,8 @@
 ##DOSLIBNAME = libkadm5srv.lib
 
 LIBBASE=kadm5srv
-LIBMAJOR=5
-LIBMINOR=1
+LIBMAJOR=6
+LIBMINOR=0
 STOBJLISTS=../OBJS.ST OBJS.ST
 
 SHLIB_EXPDEPS=\
--- krb5-1.4.3/src/lib/kadm5/clnt/Makefile.in	2004-06-16 16:18:10.000000000 -0400
+++ krb5-1.4.3/src/lib/kadm5/clnt/Makefile.in	2006-01-05 15:08:23.000000000 -0500
@@ -5,8 +5,8 @@
 LOCALINCLUDES = -I$(BUILDTOP)/include/kadm5
 
 LIBBASE=kadm5clnt
-LIBMAJOR=5
-LIBMINOR=1
+LIBMAJOR=6
+LIBMINOR=0
 STOBJLISTS=../OBJS.ST OBJS.ST
 SHLIB_EXPDEPS=\
 	$(TOPLIBD)/libgssrpc$(SHLIBEXT) \
--- krb5-1.4.3/src/lib/kadm5/alt_prof.c	2004-06-24 16:08:30.000000000 -0400
+++ krb5-1.4.3/src/lib/kadm5/alt_prof.c	2006-01-05 15:08:23.000000000 -0500
@@ -936,6 +936,13 @@
 	krb5_xfree(svalue);
     }
 
+    /* Get the value for the maximum datagram response size */
+    hierarchy[2] = "max_dgram_size";
+    if (!krb5_aprof_get_int32(aprofile, hierarchy, TRUE, &ivalue)) {
+	rparams->realm_max_dgram_size = ivalue;
+	rparams->realm_max_dgram_size_valid = 1;
+    }
+	    
     hierarchy[2] = "reject_bad_transit";
     if (!krb5_aprof_get_boolean(aprofile, hierarchy, TRUE, &bvalue)) {
 	rparams->realm_reject_bad_transit = bvalue;
--- krb5-1.4.3/src/kdc/extern.h	2003-06-03 00:32:41.000000000 -0400
+++ krb5-1.4.3/src/kdc/extern.h	2006-01-05 15:08:23.000000000 -0500
@@ -64,6 +64,7 @@
     krb5_deltat		realm_maxlife;	/* Maximum ticket life for realm    */
     krb5_deltat		realm_maxrlife;	/* Maximum renewable life for realm */
     krb5_boolean	realm_reject_bad_transit; /* Accept unverifiable transited_realm ? */
+    int			realm_max_dgram_size; /* Maximum datagram response size */
 } kdc_realm_t;
 
 extern kdc_realm_t	**kdc_realmlist;
@@ -87,6 +88,7 @@
 #define	dbm_db_name			kdc_active_realm->realm_dbname
 #define	primary_port			kdc_active_realm->realm_pport
 #define reject_bad_transit		kdc_active_realm->realm_reject_bad_transit
+#define max_dgram_size			kdc_active_realm->realm_max_dgram_size
 
 /* various externs for KDC */
 extern krb5_data 	empty_string;	/* an empty string */
--- krb5-1.4.3/src/lib/kadm5/admin.h	2005-03-22 18:53:59.000000000 -0500
+++ krb5-1.4.3/src/lib/kadm5/admin.h	2006-01-05 15:08:23.000000000 -0500
@@ -263,6 +263,7 @@
     krb5_deltat		realm_max_rlife;
     krb5_timestamp	realm_expiration;
     krb5_flags		realm_flags;
+    int			realm_max_dgram_size;
     krb5_key_salt_tuple	*realm_keysalts;
     unsigned int	realm_reject_bad_transit:1;
     unsigned int	realm_kadmind_port_valid:1;
@@ -272,6 +273,7 @@
     unsigned int	realm_expiration_valid:1;
     unsigned int	realm_flags_valid:1;
     unsigned int	realm_reject_bad_transit_valid:1;
+    unsigned int	realm_max_dgram_size_valid:1;
     krb5_int32		realm_num_keysalts;
 } krb5_realm_params;
 
--- krb5-1.4.3/src/kdc/do_as_req.c	2005-07-12 16:59:52.000000000 -0400
+++ krb5-1.4.3/src/kdc/do_as_req.c	2006-01-05 15:08:23.000000000 -0500
@@ -52,7 +52,7 @@
 /*ARGSUSED*/
 krb5_error_code
 process_as_req(krb5_kdc_req *request, const krb5_fulladdr *from,
-	       krb5_data **response)
+	       krb5_boolean connected, krb5_data **response)
 {
     krb5_db_entry client, server;
     krb5_kdc_rep reply;
@@ -403,6 +403,13 @@
 	status = "ENCODE_KDC_REP";
 	goto errout;
     }
+
+    if (!connected && ((*response)->length > max_dgram_size)) {
+	errcode = KRB5KRB_ERR_RESPONSE_TOO_BIG;
+	krb5_free_data(kdc_context, *response);
+	*response = NULL;
+	goto errout;
+    }
     
     /* these parts are left on as a courtesy from krb5_encode_kdc_rep so we
        can use them in raw form if needed.  But, we don't... */
--- krb5-1.4.3/src/kdc/dispatch.c	2002-09-10 23:59:27.000000000 -0400
+++ krb5-1.4.3/src/kdc/dispatch.c	2006-01-05 15:08:23.000000000 -0500
@@ -39,7 +39,8 @@
 static krb5_int32 last_usec = 0, last_os_random = 0;
 
 krb5_error_code
-dispatch(krb5_data *pkt, const krb5_fulladdr *from, krb5_data **response)
+dispatch(krb5_data *pkt, const krb5_fulladdr *from, krb5_boolean connected,
+	 krb5_data **response)
 {
 
     krb5_error_code retval;
@@ -50,7 +51,7 @@
 
 #ifndef NOCACHE
     /* try the replay lookaside buffer */
-    if (kdc_check_lookaside(pkt, from, response)) {
+    if (kdc_check_lookaside(pkt, from, connected, response)) {
 	/* a hit! */
 	const char *name = 0;
 	char buf[46];
@@ -87,7 +88,7 @@
     /* try TGS_REQ first; they are more common! */
 
     if (krb5_is_tgs_req(pkt)) {
-	retval = process_tgs_req(pkt, from, response);
+	retval = process_tgs_req(pkt, from, connected, response);
     } else if (krb5_is_as_req(pkt)) {
 	if (!(retval = decode_krb5_as_req(pkt, &as_req))) {
 	    /*
@@ -95,7 +96,7 @@
 	     * pointer.
 	     */
 	    if (!(retval = setup_server_realm(as_req->server))) {
-		retval = process_as_req(as_req, from, response);
+		retval = process_as_req(as_req, from, connected, response);
 	    }
 	    krb5_free_kdc_req(kdc_context, as_req);
 	}
@@ -109,7 +110,7 @@
 #ifndef NOCACHE
     /* put the response into the lookaside buffer */
     if (!retval)
-	kdc_insert_lookaside(pkt, from, *response);
+	kdc_insert_lookaside(pkt, from, connected, *response);
 #endif
 
     return retval;
--- krb5-1.4.3/src/kdc/network.c	2005-07-12 16:59:52.000000000 -0400
+++ krb5-1.4.3/src/kdc/network.c	2006-01-05 15:08:23.000000000 -0500
@@ -744,7 +744,7 @@
     faddr.address = &addr;
     init_addr(&faddr, ss2sa(&saddr));
     /* this address is in net order */
-    if ((retval = dispatch(&request, &faddr, &response))) {
+    if ((retval = dispatch(&request, &faddr, FALSE, &response))) {
 	com_err(prog, retval, "while dispatching (udp)");
 	return;
     }
@@ -982,7 +982,7 @@
 	    /* have a complete message, and exactly one message */
 	    request.length = conn->u.tcp.msglen;
 	    request.data = conn->u.tcp.buffer + 4;
-	    err = dispatch(&request, &conn->u.tcp.faddr,
+	    err = dispatch(&request, &conn->u.tcp.faddr, TRUE,
 			   &conn->u.tcp.response);
 	    if (err) {
 		com_err(prog, err, "while dispatching (tcp)");
--- krb5-1.4.3/src/kdc/kdc_util.h	2004-09-23 22:19:42.000000000 -0400
+++ krb5-1.4.3/src/kdc/kdc_util.h	2006-01-05 15:08:23.000000000 -0500
@@ -107,15 +107,18 @@
 /* do_as_req.c */
 krb5_error_code process_as_req (krb5_kdc_req *,
 					  const krb5_fulladdr *,
+					  krb5_boolean,
 					  krb5_data ** );
 
 /* do_tgs_req.c */
 krb5_error_code process_tgs_req (krb5_data *,
 					   const krb5_fulladdr *,
+					   krb5_boolean,
 					   krb5_data ** );
 /* dispatch.c */
 krb5_error_code dispatch (krb5_data *,
 				    const krb5_fulladdr *,
+				    krb5_boolean,
 				    krb5_data **);
 
 /* main.c */
@@ -155,9 +158,9 @@
     
 /* replay.c */
 krb5_boolean kdc_check_lookaside (krb5_data *, const krb5_fulladdr *,
-					    krb5_data **);
-void kdc_insert_lookaside (krb5_data *, const krb5_fulladdr *,
-				     krb5_data *);
+			   krb5_boolean, krb5_data **);
+void kdc_insert_lookaside (krb5_data *, const krb5_fulladdr *, krb5_boolean,
+			   krb5_data *);
 void kdc_free_lookaside(krb5_context);
 
 /* which way to convert key? */
--- krb5-1.4.3/src/kdc/replay.c	2003-01-12 08:07:49.000000000 -0500
+++ krb5-1.4.3/src/kdc/replay.c	2006-01-05 15:08:23.000000000 -0500
@@ -42,6 +42,7 @@
     krb5_data *req_packet;
     krb5_data *reply_packet;
     krb5_address *addr;		/* XXX should these not be pointers? */
+    krb5_boolean connected;
 } krb5_kdc_replay_ent;
 
 static krb5_kdc_replay_ent root_ptr = {0};
@@ -62,6 +63,7 @@
 		    !memcmp((ptr)->addr->contents,			\
 			    from->address->contents,			\
 			    from->address->length)&&			\
+		    (ptr->connected == connected) &&		\
 		    ((ptr)->db_age == db_age))
 /* XXX
    Todo:  quench the size of the queue...
@@ -72,7 +74,7 @@
 
 krb5_boolean
 kdc_check_lookaside(krb5_data *inpkt, const krb5_fulladdr *from,
-		    krb5_data **outpkt)
+		    krb5_boolean connected, krb5_data **outpkt)
 {
     krb5_int32 timenow;
     register krb5_kdc_replay_ent *eptr, *last, *hold;
@@ -126,7 +128,7 @@
 
 void
 kdc_insert_lookaside(krb5_data *inpkt, const krb5_fulladdr *from,
-		     krb5_data *outpkt)
+		     krb5_boolean connected, krb5_data *outpkt)
 {
     register krb5_kdc_replay_ent *eptr;    
     krb5_int32 timenow;
@@ -142,6 +144,7 @@
 	return;
     eptr->timein = timenow;
     eptr->db_age = db_age;
+    eptr->connected = connected;
     /*
      * This is going to hurt a lot malloc()-wise due to the need to
      * allocate memory for the krb5_data and krb5_address elements.
--- krb5-1.4.3/src/kdc/main.c	2004-02-24 16:07:22.000000000 -0500
+++ krb5-1.4.3/src/kdc/main.c	2006-01-05 15:08:23.000000000 -0500
@@ -231,6 +231,10 @@
     rdp->realm_maxrlife = (rparams && rparams->realm_max_rlife_valid) ?
 	rparams->realm_max_rlife : KRB5_KDB_MAX_RLIFE;
 
+    /* Handle maximum datagram response size */
+    rdp->realm_max_dgram_size = (rparams && rparams->realm_max_dgram_size_valid) ?
+	rparams->realm_max_dgram_size : MAX_DGRAM_SIZE;
+
     if (rparams)
 	krb5_free_realm_params(rdp->realm_context, rparams);
 
--- krb5-1.4.3/src/kdc/do_tgs_req.c	2005-07-12 16:59:52.000000000 -0400
+++ krb5-1.4.3/src/kdc/do_tgs_req.c	2006-01-05 15:08:23.000000000 -0500
@@ -56,7 +56,7 @@
 /*ARGSUSED*/
 krb5_error_code
 process_tgs_req(krb5_data *pkt, const krb5_fulladdr *from,
-		krb5_data **response)
+		krb5_boolean connected, krb5_data **response)
 {
     krb5_keyblock * subkey;
     krb5_kdc_req *request = 0;
@@ -630,7 +630,13 @@
     if (errcode) {
 	status = "ENCODE_KDC_REP";
     } else {
-	status = "ISSUE";
+	if (!connected && ((*response)->length > max_dgram_size)) {
+	    errcode = KRB5KRB_ERR_RESPONSE_TOO_BIG;
+	    krb5_free_data(kdc_context, *response);
+	    *response = NULL;
+	} else {
+	    status = "ISSUE";
+	}
     }
 
     memset(ticket_reply.enc_part.ciphertext.data, 0,
--- krb5-1.4.3/src/config-files/kdc.conf.M	2006-01-05 15:06:30.000000000 -0500
+++ krb5-1.4.3/src/config-files/kdc.conf.M	2006-01-05 15:08:23.000000000 -0500
@@ -208,6 +208,14 @@
 .B key type string
 represents the master key's key type.
 
+.IP max_dgram_size
+This
+.B size
+specifes the maximum size for a response which the KDC will provide
+to clients which use datagrams to communicate with it.  Clients whose
+requests require larger responses will instead receive RESPONSE_TOO_BIG
+errors.
+
 .IP max_life
 This
 .B delta time string
--- krb5-1.4.3/src/include/krb5/adm.h	2002-09-18 16:45:36.000000000 -0400
+++ krb5-1.4.3/src/include/krb5/adm.h	2006-01-05 15:08:23.000000000 -0500
@@ -208,6 +208,7 @@
     krb5_deltat		realm_max_rlife;
     krb5_timestamp	realm_expiration;
     krb5_flags		realm_flags;
+    krb5_int32		realm_max_dgram_size;
     krb5_key_salt_tuple	*realm_keysalts;
     unsigned int	realm_reject_bad_transit:1;
     unsigned int	realm_kadmind_port_valid:1;
@@ -217,6 +218,7 @@
     unsigned int	realm_expiration_valid:1;
     unsigned int	realm_flags_valid:1;
     unsigned int	realm_reject_bad_transit_valid:1;
+    unsigned int	realm_max_dgram_size_valid:1;
     krb5_int32		realm_num_keysalts;
 } krb5_realm_params;
 #endif	/* KRB5_ADM_H__ */