[krbdev.mit.edu #9142] git commit
"Greg Hudson via RT" <[email protected]> Wed, 16 Oct 2024 16:03:34 -0400
| Newsgroups | gmane.comp.encryption.kerberos.bugs |
|---|---|
| Message-ID | <[email protected]> |
Wed Oct 16 16:03:34 2024: Request 9142 was acted upon. Transaction: Ticket created by [email protected] Queue: krb5 Subject: git commit Owner: [email protected] Requestors: Status: new Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9142 > Generate and verify message MACs in libkrad Implement some of the measures specified in draft-ietf-radext-deprecating-radius-03 for mitigating the BlastRADIUS attack (CVE-2024-3596): * Include a Message-Authenticator MAC as the first attribute when generating a packet of type Access-Request, Access-Reject, Access-Accept, or Access-Challenge (sections 5.2.1 and 5.2.4), if the secret is non-empty. (An empty secret indicates the use of Unix domain socket transport.) * Validate the Message-Authenticator MAC in received packets, if present. FreeRADIUS enforces Message-Authenticator as of versions 3.2.5 and 3.0.27. libkrad must generate Message-Authenticator attributes in order to remain compatible with these implementations. [[email protected]: adjusted style and naming; simplified some functions; edited commit message] https://github.com/krb5/krb5/commit/871125fea8ce0370a972bf65f7d1de63f619b06c Author: Julien Rische <[email protected]> Committer: Greg Hudson <[email protected]> Commit: 871125fea8ce0370a972bf65f7d1de63f619b06c Branch: master src/include/k5-int.h | 5 + src/lib/crypto/krb/checksum_hmac_md5.c | 28 +++++ src/lib/crypto/libk5crypto.exports | 1 + src/lib/krad/attr.c | 17 +++ src/lib/krad/attrset.c | 58 +++++++--- src/lib/krad/internal.h | 7 +- src/lib/krad/packet.c | 205 ++++++++++++++++++++++++++++++--- src/lib/krad/t_attrset.c | 2 +- src/lib/krad/t_daemon.py | 3 +- src/lib/krad/t_packet.c | 11 ++ src/tests/t_otp.py | 3 + 11 files changed, 309 insertions(+), 31 deletions(-)