Ticket History #8011: PKINIT PKCS12 prompt length constraint limits certificate path length

# Thu Sep 11 17:58:52 2014 Neng Xue <neng.xue@oracle.com> - Ticket created

Date:	Thu, 11 Sep 2014 14:22:37 -0700
From:	Neng Xue <neng.xue@oracle.com>
To:	krb5-bugs@mit.edu
Subject:	Problem regarding 'Pass phrase' prompt length limit in pkinit plugins

Download (untitled) / with headers
text/plain 958B

Download (untitled) / with headers
text/html 1.2KiB

Hi,

I am Neng Xue currently working in MIT dropin project in Oracle Solaris group as a software developer. Recently we noticed an occasionally happened test failure of python test t_pkinit.py[54] in our build environment. Then I tried to debug into the issue. I noticed that after reading the certs file for test case 54, the pass phrase prompt did not even appear before reporting the test case failure. So I turned on the -DDEBUG option for debug mode. I saw the following error message:

Prompt string, 'Pass phrase for /*****/*******/*****/*****/user-enc.p12', is too long!

The prompt_string length limit is set to 128 characters, in our build environment, the file path length around 100 which makes the total length of prompt_string exceeding the 128 limit. I was wondering is there a particular reason for this limit? Or is there a workaround for this issue? Thanks!

-- 
Neng Xue
Oracle Solaris Software Engineer
Santa Clara, CA, USA

# Thu Sep 11 18:21:29 2014 ghudson@mit.edu (Greg Hudson) - Correspondence added

Download (untitled) / with headers
text/plain 304B

prompt_string is currently a stack-allocated array, so it has to be a fixed
length. The length can't be all that big, since threads can have
constrained stack sizes in some circumstances.

We should remove this limitation by changing prompt_string to a pointer and
using asprintf instead of snprintf.

# Thu Sep 11 18:22:19 2014 ghudson@mit.edu (Greg Hudson) - Subject changed from 'Problem regarding 'Pass phrase' prompt length limit in pkinit plugins' to 'PKINIT PKCS12 prompt length constraint limits certificate path length'

# Thu Sep 11 18:22:19 2014 ghudson@mit.edu (Greg Hudson) - Status changed from 'new' to 'open'

# Wed Oct 29 22:08:06 2014 ghudson@mit.edu (Greg Hudson) - Given to ghudson@mit.edu (Greg Hudson)

# Wed Oct 29 22:08:06 2014 ghudson@mit.edu (Greg Hudson) - Target_Version 1.13.1 added

# Wed Oct 29 22:08:06 2014 ghudson@mit.edu (Greg Hudson) - Status changed from 'open' to 'review'

# Wed Oct 29 22:08:06 2014 ghudson@mit.edu (Greg Hudson) - Tags pullup added

# Wed Oct 29 22:08:06 2014 ghudson@mit.edu (Greg Hudson) - Correspondence added

From:	ghudson@mit.edu
Subject:	git commit

Download (untitled) / with headers
text/plain 529B

Remove length limit on PKINIT PKCS#12 prompt

Long pathnames can trigger the 128-byte prompt length limit in
pkinit_get_certs_pkcs12. Use asprintf instead of snprintf. Also
check the result of the prompter invocation.

https://github.com/krb5/krb5/commit/3c330ea5846ca02da36a0cb5a5c879364d28a267
Author: Greg Hudson <ghudson@mit.edu>
Commit: 3c330ea5846ca02da36a0cb5a5c879364d28a267
Branch: master
src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 17 ++++++++++-------
1 files changed, 10 insertions(+), 7 deletions(-)

# Tue Dec 16 14:25:51 2014 tlyu (Taylor Yu) - Status changed from 'review' to 'resolved'

# Tue Dec 16 14:25:51 2014 tlyu (Taylor Yu) - Version_Fixed 1.13.1 added

# Tue Dec 16 14:25:51 2014 tlyu (Taylor Yu) - Correspondence added

From:	tlyu@mit.edu
Subject:	git commit

Download (untitled) / with headers
text/plain 635B

Remove length limit on PKINIT PKCS#12 prompt

Long pathnames can trigger the 128-byte prompt length limit in
pkinit_get_certs_pkcs12. Use asprintf instead of snprintf. Also
check the result of the prompter invocation.

(cherry picked from commit 3c330ea5846ca02da36a0cb5a5c879364d28a267)

https://github.com/krb5/krb5/commit/bbff4de352a5c36c78e5d58ac2f1a81265094bcc
Author: Greg Hudson <ghudson@mit.edu>
Committer: Tom Yu <tlyu@mit.edu>
Commit: bbff4de352a5c36c78e5d58ac2f1a81265094bcc
Branch: krb5-1.13
src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 17 ++++++++++-------
1 files changed, 10 insertions(+), 7 deletions(-)

# Wed Dec 16 18:03:03 2015 tlyu (Taylor Yu) - CustomField pullup deleted