From owner-svn-src-all@FreeBSD.ORG Mon Dec 16 02:30:57 2013 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id E0FDA6DC; Mon, 16 Dec 2013 02:30:57 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id CCFBE1749; Mon, 16 Dec 2013 02:30:57 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id rBG2UvDg008667; Mon, 16 Dec 2013 02:30:57 GMT (envelope-from bjk@svn.freebsd.org) Received: (from bjk@localhost) by svn.freebsd.org (8.14.7/8.14.7/Submit) id rBG2UvH5008664; Mon, 16 Dec 2013 02:30:57 GMT (envelope-from bjk@svn.freebsd.org) Message-Id: <201312160230.rBG2UvH5008664@svn.freebsd.org> From: Benjamin Kaduk Date: Mon, 16 Dec 2013 02:30:57 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-8@freebsd.org Subject: svn commit: r259449 - in stable/8: . crypto/heimdal/lib/gssapi/krb5 sys/sys X-SVN-Group: stable-8 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Dec 2013 02:30:58 -0000 Author: bjk (doc committer) Date: Mon Dec 16 02:30:56 2013 New Revision: 259449 URL: http://svnweb.freebsd.org/changeset/base/259449 Log: MFC r259286,259424,259425: Apply patch from upstream Heimdal for encoding fix RFC 4402 specifies the implementation of the gss_pseudo_random() function for the krb5 mechanism (and the C bindings therein). The implementation uses a PRF+ function that concatenates the output of individual krb5 pseudo-random operations produced with a counter and seed. The original implementation of this function in Heimdal incorrectly encoded the counter as a little-endian integer, but the RFC specifies the counter encoding as big-endian. The implementation initializes the counter to zero, so the first block of output (16 octets, for the modern AES enctypes 17 and 18) is unchanged. (RFC 4402 specifies that the counter should begin at 1, but both existing implementations begin with zero and it looks like the standard will be re-issued, with test vectors, to begin at zero.) This is upstream's commit f85652af868e64811f2b32b815d4198e7f9017f6, from 13 October, 2013: % Fix krb5's gss_pseudo_random() (n is big-endian) % % The first enctype RFC3961 prf output length's bytes are correct because % the little- and big-endian representations of unsigned zero are the % same. The second block of output was wrong because the counter was not % being encoded as big-endian. % % This change could break applications. But those applications would not % have been interoperating with other implementations anyways (in % particular: MIT's). Bump __FreeBSD_version accordingly and add a note in UPDATING. Approved by: hrs (mentor, src committer) Modified: stable/8/UPDATING (contents, props changed) stable/8/crypto/heimdal/lib/gssapi/krb5/prf.c stable/8/sys/sys/param.h Directory Properties: stable/8/crypto/heimdal/ (props changed) stable/8/sys/ (props changed) stable/8/sys/sys/ (props changed) Modified: stable/8/UPDATING ============================================================================== --- stable/8/UPDATING Mon Dec 16 02:25:28 2013 (r259448) +++ stable/8/UPDATING Mon Dec 16 02:30:56 2013 (r259449) @@ -15,6 +15,17 @@ NOTE TO PEOPLE WHO THINK THAT FreeBSD 8. debugging tools present in HEAD were left in place because sun4v support still needs work to become production ready. +20131216: + The behavior of gss_pseudo_random() for the krb5 mechanism + has changed, for applications requesting a longer random string + than produced by the underlying enctype's pseudo-random() function. + In particular, the random string produced from a session key of + enctype aes256-cts-hmac-sha1-96 or aes256-cts-hmac-sha1-96 will + be different at the 17th octet and later, after this change. + The counter used in the PRF+ construction is now encoded as a + big-endian integer in accordance with RFC 4402. + __FreeBSD_version is bumped to 804501. + 20130823: Behavior of devfs rules path matching has been changed. Pattern is now always matched against fully qualified devfs Modified: stable/8/crypto/heimdal/lib/gssapi/krb5/prf.c ============================================================================== --- stable/8/crypto/heimdal/lib/gssapi/krb5/prf.c Mon Dec 16 02:25:28 2013 (r259448) +++ stable/8/crypto/heimdal/lib/gssapi/krb5/prf.c Mon Dec 16 02:30:56 2013 (r259449) @@ -117,7 +117,7 @@ _gsskrb5_pseudo_random(OM_uint32 *minor_ num = 0; p = prf_out->value; while(desired_output_len > 0) { - _gsskrb5_encode_om_uint32(num, input.data); + _gsskrb5_encode_be_om_uint32(num, input.data); ret = krb5_crypto_prf(context, crypto, &input, &output); if (ret) { OM_uint32 junk; @@ -129,7 +129,7 @@ _gsskrb5_pseudo_random(OM_uint32 *minor_ return GSS_S_FAILURE; } memcpy(p, output.data, min(desired_output_len, output.length)); - p += output.length; + p += tsize; desired_output_len -= output.length; krb5_data_free(&output); num++; Modified: stable/8/sys/sys/param.h ============================================================================== --- stable/8/sys/sys/param.h Mon Dec 16 02:25:28 2013 (r259448) +++ stable/8/sys/sys/param.h Mon Dec 16 02:30:56 2013 (r259449) @@ -58,7 +58,7 @@ * in the range 5 to 9. */ #undef __FreeBSD_version -#define __FreeBSD_version 804500 /* Master, propagated to newvers */ +#define __FreeBSD_version 804501 /* Master, propagated to newvers */ /* * __FreeBSD_kernel__ indicates that this system uses the kernel of FreeBSD,