6538001 KDC, kadmind stack overflow in krb5_klog_syslog (CVE-2007-0957)

9 files changed, 205 insertions, 149 deletions

diff --git a/usr/src/cmd/krb5/kadmin/server/server_stubs.c b/usr/src/cmd/krb5/kadmin/server/server_stubs.c
index b76a002ab2..56fed7f5f1 100644
--- a/usr/src/cmd/krb5/kadmin/server/server_stubs.c
+++ b/usr/src/cmd/krb5/kadmin/server/server_stubs.c
@@ -444,6 +444,61 @@ gss_name_to_string(gss_name_t gss_name, gss_buffer_desc *str)
      return 0;
 }
 
+static int
+log_unauth(
+    char *op,
+    char *target,
+    char *client,
+    char *server,
+    char *addr)
+{
+    size_t tlen, clen, slen;
+    char *tdots, *cdots, *sdots;
+
+    tlen = strlen(target);
+    trunc_name(&tlen, &tdots);
+    clen = strlen(client);
+    trunc_name(&clen, &cdots);
+    slen = strlen(server);
+    trunc_name(&slen, &sdots);
+
+    return krb5_klog_syslog(LOG_NOTICE,
+			"Unauthorized request: %s, %.*s%s, "
+			"client=%.*s%s, service=%.*s%s, addr=%s",
+			op, tlen, target, tdots,
+			clen, client, cdots,
+			slen, server, sdots,
+			addr);
+}
+
+static int
+log_done(
+    char *op,
+    char *target,
+    const char *errmsg,
+    char *client,
+    char *server,
+    char *addr)
+{
+    size_t tlen, clen, slen;
+    char *tdots, *cdots, *sdots;
+
+    tlen = strlen(target);
+    trunc_name(&tlen, &tdots);
+    clen = strlen(client);
+    trunc_name(&clen, &cdots);
+    slen = strlen(server);
+    trunc_name(&slen, &sdots);
+
+    return krb5_klog_syslog(LOG_NOTICE,
+			"Request: %s, %.*s%s, %s, "
+			"client=%.*s%s, service=%.*s%s, addr=%s",
+			op, tlen, target, tdots, errmsg,
+			clen, client, cdots,
+			slen, server, sdots,
+			addr);
+}
+
 generic_ret *
 create_principal_1_svc(cprinc_arg *arg, struct svc_req *rqstp)
 {
@@ -497,9 +552,8 @@ create_principal_1_svc(cprinc_arg *arg, struct svc_req *rqstp)
 		audit_kadmind_unauth(rqstp->rq_xprt, l_port,
 				    "kadm5_create_principal",
 				    prime_arg, client_name);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_create_principal",
-		prime_arg, client_name,
-			service_name, client_addr(rqstp, buf));
+	 log_unauth("kadm5_create_principal", prime_arg,
+		client_name, service_name, client_addr(rqstp, buf));
     } else {
 	 ret.code = kadm5_create_principal((void *)handle,
 						&arg->rec, arg->mask,
@@ -508,10 +562,9 @@ create_principal_1_svc(cprinc_arg *arg, struct svc_req *rqstp)
 		audit_kadmind_auth(rqstp->rq_xprt, l_port,
 				"kadm5_create_principal",
 				prime_arg, client_name, ret.code);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_create_principal",
-		prime_arg,((ret.code == 0) ? "success" :
-			   error_message(ret.code)), 
-		client_name, service_name, client_addr(rqstp, buf));
+	 log_done("kadm5_create_principal", prime_arg,
+	    ((ret.code == 0) ? "success" : error_message(ret.code)), 
+	    client_name, service_name, client_addr(rqstp, buf));
 
 		if (policy_migrate && (ret.code == 0)) {
 			arg->rec.policy = strdup("default");
@@ -526,8 +579,7 @@ create_principal_1_svc(cprinc_arg *arg, struct svc_req *rqstp)
 
 			retval = kadm5_modify_principal((void *)handle,
 					&arg->rec, arg->mask);
-			krb5_klog_syslog(LOG_NOTICE, LOG_DONE,
-				"kadm5_modify_principal",
+			log_done("kadm5_modify_principal",
 				prime_arg, ((retval == 0) ? "success" :
 				error_message(retval)), client_name,
 				service_name, client_addr(rqstp, buf));
@@ -596,20 +648,17 @@ create_principal3_1_svc(cprinc3_arg *arg, struct svc_req *rqstp)
 	|| kadm5int_acl_impose_restrictions(handle->context,
 				   &arg->rec, &arg->mask, rp)) {
 	 ret.code = KADM5_AUTH_ADD;
-	 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_create_principal",
-		prime_arg, client_name, service_name,
-		client_addr(rqstp, buf));
+	 log_unauth("kadm5_create_principal", prime_arg,
+		client_name, service_name, client_addr(rqstp, buf));
     } else {
 	 ret.code = kadm5_create_principal_3((void *)handle,
 					     &arg->rec, arg->mask,
 					     arg->n_ks_tuple,
 					     arg->ks_tuple,
 					     arg->passwd);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_create_principal",
-		prime_arg,((ret.code == 0) ? "success" :
-			   error_message(ret.code)), 
-			  client_name, service_name,
-			  client_addr(rqstp, buf));
+	 log_done("kadm5_create_principal", prime_arg,
+		((ret.code == 0) ? "success" : error_message(ret.code)), 
+		client_name, service_name, client_addr(rqstp, buf));
 
 	 if (policy_migrate && (ret.code == 0)) {
 	 	arg->rec.policy = strdup("default");
@@ -624,11 +673,9 @@ create_principal3_1_svc(cprinc3_arg *arg, struct svc_req *rqstp)
 
 		retval = kadm5_modify_principal((void *)handle,
 					   &arg->rec, arg->mask);
-		krb5_klog_syslog(LOG_NOTICE, LOG_DONE,
-			    "kadm5_modify_principal",
-			    prime_arg, ((retval == 0) ? "success" :
-					error_message(retval)), client_name,
-			    service_name, client_addr(rqstp, buf));
+		log_done("kadm5_modify_principal", prime_arg,
+			((retval == 0) ? "success" : error_message(retval)),
+			client_name, service_name, client_addr(rqstp, buf));
 	 }
     }
 
@@ -685,8 +732,7 @@ delete_principal_1_svc(dprinc_arg *arg, struct svc_req *rqstp)
 		audit_kadmind_unauth(rqstp->rq_xprt, l_port,
 				    "kadm5_delete_principal",
 				    prime_arg, client_name);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_delete_principal",
-		prime_arg, client_name,
+	 log_unauth("kadm5_delete_principal", prime_arg, client_name,
 			service_name, client_addr(rqstp, buf));
     } else {
 	 ret.code = kadm5_delete_principal((void *)handle, arg->princ);
@@ -694,7 +740,7 @@ delete_principal_1_svc(dprinc_arg *arg, struct svc_req *rqstp)
 		audit_kadmind_auth(rqstp->rq_xprt, l_port,
 				"kadm5_delete_principal",
 				prime_arg, client_name, ret.code);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_delete_principal", prime_arg, 
+	 log_done("kadm5_delete_principal", prime_arg, 
 		((ret.code == 0) ? "success" : error_message(ret.code)), 
 		client_name, service_name, client_addr(rqstp, buf));
     }
@@ -753,8 +799,7 @@ modify_principal_1_svc(mprinc_arg *arg, struct svc_req *rqstp)
 		audit_kadmind_unauth(rqstp->rq_xprt, l_port,
 				    "kadm5_modify_principal",
 				    prime_arg, client_name);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_modify_principal",
-		prime_arg, client_name,
+	 log_unauth("kadm5_modify_principal", prime_arg, client_name,
 		    service_name, client_addr(rqstp, buf));
     } else {
 	 ret.code = kadm5_modify_principal((void *)handle, &arg->rec,
@@ -763,9 +808,8 @@ modify_principal_1_svc(mprinc_arg *arg, struct svc_req *rqstp)
 		audit_kadmind_auth(rqstp->rq_xprt, l_port,
 				"kadm5_modify_principal",
 				prime_arg, client_name, ret.code);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_modify_principal",
-		prime_arg, ((ret.code == 0) ? "success" :
-			    error_message(ret.code)), 
+	 log_done("kadm5_modify_principal", prime_arg,
+		((ret.code == 0) ? "success" : error_message(ret.code)), 
 		client_name, service_name, client_addr(rqstp, buf));
     }
 
@@ -838,8 +882,7 @@ rename_principal_1_svc(rprinc_arg *arg, struct svc_req *rqstp)
 		audit_kadmind_unauth(rqstp->rq_xprt, l_port,
 				    "kadm5_rename_principal",
 				    prime_arg, client_name);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_rename_principal",
-		prime_arg, client_name,
+	 log_unauth("kadm5_rename_principal", prime_arg, client_name,
 		    service_name, client_addr(rqstp, buf));
     } else {
 	 ret.code = kadm5_rename_principal((void *)handle, arg->src,
@@ -848,9 +891,8 @@ rename_principal_1_svc(rprinc_arg *arg, struct svc_req *rqstp)
 		audit_kadmind_auth(rqstp->rq_xprt, l_port,
 				"kadm5_rename_principal",
 				prime_arg, client_name, ret.code);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_rename_principal",
-		prime_arg, ((ret.code == 0) ? "success" :
-			    error_message(ret.code)), 
+	 log_done("kadm5_rename_principal", prime_arg,
+		((ret.code == 0) ? "success" : error_message(ret.code)), 
 		client_name, service_name, client_addr(rqstp, buf));
     }
 
@@ -916,8 +958,7 @@ get_principal_1_svc(gprinc_arg *arg, struct svc_req *rqstp)
 		audit_kadmind_unauth(rqstp->rq_xprt, l_port,
 				    funcname,
 				    prime_arg, client_name);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, funcname,
-		prime_arg, client_name, service_name,
+	 log_unauth(funcname, prime_arg, client_name, service_name,
 		    client_addr(rqstp, buf));
     } else {
 	 if (handle->api_version == KADM5_API_VERSION_1) {
@@ -936,8 +977,7 @@ get_principal_1_svc(gprinc_arg *arg, struct svc_req *rqstp)
 		audit_kadmind_auth(rqstp->rq_xprt, l_port,
 				funcname,
 				prime_arg, client_name, ret.code);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname,
-		prime_arg,  
+	 log_done(funcname, prime_arg,  
 		((ret.code == 0) ? "success" : error_message(ret.code)), 
 		client_name, service_name, client_addr(rqstp, buf));
     }
@@ -997,8 +1037,7 @@ get_princs_1_svc(gprincs_arg *arg, struct svc_req *rqstp)
 		audit_kadmind_unauth(rqstp->rq_xprt, l_port,
 				    "kadm5_get_principals",
 				    prime_arg, client_name);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_get_principals",
-		prime_arg, client_name,
+	 log_unauth("kadm5_get_principals", prime_arg, client_name,
 		    service_name, client_addr(rqstp, buf));
     } else {
 	 ret.code  = kadm5_get_principals((void *)handle,
@@ -1008,8 +1047,7 @@ get_princs_1_svc(gprincs_arg *arg, struct svc_req *rqstp)
 		audit_kadmind_auth(rqstp->rq_xprt, l_port,
 				"kadm5_get_principals",
 				prime_arg, client_name, ret.code);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_get_principals",
-		prime_arg,  
+	 log_done("kadm5_get_principals", prime_arg,  
 		((ret.code == 0) ? "success" : error_message(ret.code)), 
 		client_name, service_name, client_addr(rqstp, buf));
 	}
@@ -1069,8 +1107,7 @@ chpass_principal_1_svc(chpass_arg *arg, struct svc_req *rqstp)
 		audit_kadmind_unauth(rqstp->rq_xprt, l_port,
 				    "kadm5_chpass_principal",
 				    prime_arg, client_name);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_chpass_principal",
-		prime_arg, client_name,
+	 log_unauth("kadm5_chpass_principal", prime_arg, client_name,
 		    service_name, client_addr(rqstp, buf));
 	 ret.code = KADM5_AUTH_CHANGEPW;
     }
@@ -1079,10 +1116,9 @@ chpass_principal_1_svc(chpass_arg *arg, struct svc_req *rqstp)
 		audit_kadmind_auth(rqstp->rq_xprt, l_port,
 				"kadm5_chpass_principal",
 				prime_arg, client_name, ret.code);
-	krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_chpass_principal", 
-	       prime_arg, ((ret.code == 0) ? "success" :
-			   error_message(ret.code)), 
-	       client_name, service_name, client_addr(rqstp, buf));
+	log_done("kadm5_chpass_principal", prime_arg,
+		((ret.code == 0) ? "success" : error_message(ret.code)), 
+		client_name, service_name, client_addr(rqstp, buf));
     }
 
 error:
@@ -1146,18 +1182,15 @@ chpass_principal3_1_svc(chpass3_arg *arg, struct svc_req *rqstp)
 					     arg->ks_tuple,
 					     arg->pass);
     } else {
-	 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_chpass_principal",
-		prime_arg, client_name, service_name,
-		client_addr(rqstp, buf));
+	 log_unauth("kadm5_chpass_principal", prime_arg,
+		client_name, service_name, client_addr(rqstp, buf));
 	 ret.code = KADM5_AUTH_CHANGEPW;
     }
 
     if(ret.code != KADM5_AUTH_CHANGEPW) {
-	krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_chpass_principal", 
-	       prime_arg, ((ret.code == 0) ? "success" :
-				    error_message(ret.code)), 
-			client_name, service_name,
-			client_addr(rqstp, buf));
+	log_done("kadm5_chpass_principal", prime_arg,
+		((ret.code == 0) ? "success" : error_message(ret.code)), 
+		client_name, service_name, client_addr(rqstp, buf));
     }
 
 error:
@@ -1213,18 +1246,15 @@ setv4key_principal_1_svc(setv4key_arg *arg, struct svc_req *rqstp)
 	 ret.code = kadm5_setv4key_principal((void *)handle, arg->princ,
 					     arg->keyblock);
     } else {
-	 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_setv4key_principal",
-		prime_arg, client_name, service_name,
-		client_addr(rqstp, buf));
+	 log_unauth("kadm5_setv4key_principal", prime_arg,
+		client_name, service_name, client_addr(rqstp, buf));
 	 ret.code = KADM5_AUTH_SETKEY;
     }
 
     if(ret.code != KADM5_AUTH_SETKEY) {
-	krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_setv4key_principal", 
-	       prime_arg, ((ret.code == 0) ? "success" :
-			   error_message(ret.code)), 
-	       client_name, service_name,
-		    client_addr(rqstp, buf));
+	log_done("kadm5_setv4key_principal", prime_arg,
+		((ret.code == 0) ? "success" : error_message(ret.code)), 
+		client_name, service_name, client_addr(rqstp, buf));
     }
 
 error:
@@ -1279,18 +1309,15 @@ setkey_principal_1_svc(setkey_arg *arg, struct svc_req *rqstp)
 	 ret.code = kadm5_setkey_principal((void *)handle, arg->princ,
 					   arg->keyblocks, arg->n_keys);
     } else {
-	 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_setkey_principal",
-		prime_arg, client_name, service_name,
-		    client_addr(rqstp, buf));
+	 log_unauth("kadm5_setkey_principal", prime_arg,
+		client_name, service_name, client_addr(rqstp, buf));
 	 ret.code = KADM5_AUTH_SETKEY;
     }
 
     if(ret.code != KADM5_AUTH_SETKEY) {
-	krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_setkey_principal", 
-	       prime_arg, ((ret.code == 0) ? "success" :
-			   error_message(ret.code)), 
-	       client_name, service_name,
-		    client_addr(rqstp, buf));
+	log_done("kadm5_setkey_principal", prime_arg,
+		((ret.code == 0) ? "success" : error_message(ret.code)), 
+		client_name, service_name, client_addr(rqstp, buf));
     }
 
 error:
@@ -1348,18 +1375,15 @@ setkey_principal3_1_svc(setkey3_arg *arg, struct svc_req *rqstp)
 					     arg->ks_tuple,
 					     arg->keyblocks, arg->n_keys);
     } else {
-	 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_setkey_principal",
-		prime_arg, client_name, service_name,
-		    client_addr(rqstp, buf));
+	 log_unauth("kadm5_setkey_principal", prime_arg,
+		client_name, service_name, client_addr(rqstp, buf));
 	 ret.code = KADM5_AUTH_SETKEY;
     }
 
     if(ret.code != KADM5_AUTH_SETKEY) {
-	krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_setkey_principal", 
-	       prime_arg, ((ret.code == 0) ? "success" :
-			   error_message(ret.code)), 
-	       client_name, service_name,
-	       client_addr(rqstp, buf));
+	log_done("kadm5_setkey_principal", prime_arg,
+		((ret.code == 0) ? "success" : error_message(ret.code)), 
+		client_name, service_name, client_addr(rqstp, buf));
     }
 
 error:
@@ -1424,9 +1448,8 @@ chrand_principal_1_svc(chrand_arg *arg, struct svc_req *rqstp)
     } else {
 		audit_kadmind_unauth(rqstp->rq_xprt, l_port,
 				    funcname, prime_arg, client_name);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, funcname,
-		prime_arg, client_name, service_name,
-		client_addr(rqstp, buf));
+	 log_unauth(funcname, prime_arg,
+		client_name, service_name, client_addr(rqstp, buf));
 	 ret.code = KADM5_AUTH_CHANGEPW;
     }
 
@@ -1443,10 +1466,9 @@ chrand_principal_1_svc(chrand_arg *arg, struct svc_req *rqstp)
     if(ret.code != KADM5_AUTH_CHANGEPW) {
 		audit_kadmind_auth(rqstp->rq_xprt, l_port,
 				funcname, prime_arg, client_name, ret.code);
-	krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname,
-	       prime_arg, ((ret.code == 0) ? "success" :
-			   error_message(ret.code)), 
-	       client_name, service_name, client_addr(rqstp, buf));
+	log_done(funcname, prime_arg,
+		((ret.code == 0) ? "success" : error_message(ret.code)), 
+		client_name, service_name, client_addr(rqstp, buf));
      }
 
 error:
@@ -1515,9 +1537,8 @@ chrand_principal3_1_svc(chrand3_arg *arg, struct svc_req *rqstp)
 					      arg->ks_tuple,
 					      &k, &nkeys);
     } else {
-	 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, funcname,
-		prime_arg, client_name, service_name,
-		client_addr(rqstp, buf));
+	 log_unauth(funcname, prime_arg,
+		client_name, service_name, client_addr(rqstp, buf));
 	 ret.code = KADM5_AUTH_CHANGEPW;
     }
 
@@ -1532,11 +1553,9 @@ chrand_principal3_1_svc(chrand3_arg *arg, struct svc_req *rqstp)
     }
 
     if(ret.code != KADM5_AUTH_CHANGEPW) {
-	krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname,
-	       prime_arg, ((ret.code == 0) ? "success" :
-			   error_message(ret.code)), 
-	       client_name, service_name,
-	       client_addr(rqstp, buf));
+	log_done(funcname, prime_arg,
+		((ret.code == 0) ? "success" : error_message(ret.code)), 
+		client_name, service_name, client_addr(rqstp, buf));
     }
 
 error:
@@ -1591,9 +1610,8 @@ create_policy_1_svc(cpol_arg *arg, struct svc_req *rqstp)
 		audit_kadmind_unauth(rqstp->rq_xprt, l_port,
 				    "kadm5_create_policy",
 				    prime_arg, client_name);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_create_policy",
-		prime_arg, client_name,
-		service_name, client_addr(rqstp, buf));
+	 log_unauth("kadm5_create_policy", prime_arg,
+		client_name, service_name, client_addr(rqstp, buf));
 	 
     } else {
 	 ret.code = kadm5_create_policy((void *)handle, &arg->rec,
@@ -1602,7 +1620,7 @@ create_policy_1_svc(cpol_arg *arg, struct svc_req *rqstp)
 		audit_kadmind_auth(rqstp->rq_xprt, l_port,
 				"kadm5_create_policy",
 				prime_arg, client_name, ret.code);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_create_policy",
+	 log_done("kadm5_create_policy",
 		((prime_arg == NULL) ? "(null)" : prime_arg),
 		((ret.code == 0) ? "success" : error_message(ret.code)), 
 		client_name, service_name, client_addr(rqstp, buf));
@@ -1656,9 +1674,8 @@ delete_policy_1_svc(dpol_arg *arg, struct svc_req *rqstp)
 		audit_kadmind_unauth(rqstp->rq_xprt, l_port,
 				    "kadm5_delete_policy",
 				    prime_arg, client_name);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_delete_policy",
-		prime_arg, client_name, service_name,
-		client_addr(rqstp, buf));
+	 log_unauth("kadm5_delete_policy", prime_arg,
+		client_name, service_name, client_addr(rqstp, buf));
 	 ret.code = KADM5_AUTH_DELETE;
     } else {
 	 ret.code = kadm5_delete_policy((void *)handle, arg->name);
@@ -1666,7 +1683,7 @@ delete_policy_1_svc(dpol_arg *arg, struct svc_req *rqstp)
 		audit_kadmind_auth(rqstp->rq_xprt, l_port,
 				"kadm5_delete_policy",
 				prime_arg, client_name, ret.code);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_delete_policy",
+	 log_done("kadm5_delete_policy",
 		((prime_arg == NULL) ? "(null)" : prime_arg),
 		((ret.code == 0) ? "success" : error_message(ret.code)), 
 		client_name, service_name, client_addr(rqstp, buf));
@@ -1720,9 +1737,8 @@ modify_policy_1_svc(mpol_arg *arg, struct svc_req *rqstp)
 		audit_kadmind_unauth(rqstp->rq_xprt, l_port,
 				    "kadm5_modify_policy",
 				    prime_arg, client_name);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_modify_policy",
-		prime_arg, client_name,
-		service_name, client_addr(rqstp, buf));
+	 log_unauth("kadm5_modify_policy", prime_arg,
+		client_name, service_name, client_addr(rqstp, buf));
 	 ret.code = KADM5_AUTH_MODIFY;
     } else {
 	 ret.code = kadm5_modify_policy((void *)handle, &arg->rec,
@@ -1731,7 +1747,7 @@ modify_policy_1_svc(mpol_arg *arg, struct svc_req *rqstp)
 		audit_kadmind_auth(rqstp->rq_xprt, l_port,
 				"kadm5_modify_policy",
 				prime_arg, client_name, ret.code);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_modify_policy",
+	 log_done("kadm5_modify_policy",
 		((prime_arg == NULL) ? "(null)" : prime_arg),	    
 		((ret.code == 0) ? "success" : error_message(ret.code)), 
 		client_name, service_name, client_addr(rqstp, buf));
@@ -1821,15 +1837,13 @@ get_policy_1_svc(gpol_arg *arg, struct svc_req *rqstp)
 	 
 		audit_kadmind_auth(rqstp->rq_xprt, l_port,
 				funcname, prime_arg, client_name, ret.code);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname,
-		((prime_arg == NULL) ? "(null)" : prime_arg),
+	 log_done(funcname, ((prime_arg == NULL) ? "(null)" : prime_arg),
 		((ret.code == 0) ? "success" : error_message(ret.code)), 
 		client_name, service_name, client_addr(rqstp, buf));
 	} else {
 		audit_kadmind_unauth(rqstp->rq_xprt, l_port,
 				    funcname, prime_arg, client_name);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, funcname,
-		prime_arg, client_name,
+	 log_unauth(funcname, prime_arg, client_name,
 		service_name, client_addr(rqstp, buf));
     }
 
@@ -1886,9 +1900,8 @@ get_pols_1_svc(gpols_arg *arg, struct svc_req *rqstp)
 		audit_kadmind_unauth(rqstp->rq_xprt, l_port,
 				    "kadm5_get_policies",
 				    prime_arg, client_name);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_get_policies",
-		prime_arg, client_name, service_name,
-		client_addr(rqstp, buf));
+	 log_unauth("kadm5_get_policies", prime_arg,
+		client_name, service_name, client_addr(rqstp, buf));
     } else {
 	 ret.code  = kadm5_get_policies((void *)handle,
 		    arg->exp, &ret.pols,
@@ -1897,8 +1910,7 @@ get_pols_1_svc(gpols_arg *arg, struct svc_req *rqstp)
 		audit_kadmind_auth(rqstp->rq_xprt, l_port,
 				"kadm5_get_policies",
 				prime_arg, client_name, ret.code);
-	 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_get_policies",
-		prime_arg,  
+	 log_done("kadm5_get_policies", prime_arg,  
 		((ret.code == 0) ? "success" : error_message(ret.code)), 
 		client_name, service_name, client_addr(rqstp, buf));
     }
@@ -1946,8 +1958,7 @@ getprivs_ret * get_privs_1_svc(krb5_ui_4 *arg, struct svc_req *rqstp)
 	audit_kadmind_auth(rqstp->rq_xprt, l_port,
 			"kadm5_get_privs", NULL, client_name,
 			ret.code);
-	krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_get_privs",
-	    client_name,
+	log_done("kadm5_get_privs", client_name,
 	    ((ret.code == 0) ? "success" : error_message(ret.code)),
 	    client_name, service_name, client_addr(rqstp, buf));
 
@@ -1965,8 +1976,10 @@ error:
 generic_ret *init_1_svc(krb5_ui_4 *arg, struct svc_req *rqstp)
 {
      static generic_ret		ret;
-	char *client_name, *service_name;
-	kadm5_server_handle_t handle;
+     char *client_name, *service_name;
+     kadm5_server_handle_t handle;
+     size_t clen, slen;
+     char *cdots, *sdots;
 
      xdr_free(xdr_generic_ret, (char *) &ret);
 
@@ -1987,12 +2000,21 @@ generic_ret *init_1_svc(krb5_ui_4 *arg, struct svc_req *rqstp)
 			(ret.api_version == KADM5_API_VERSION_1 ?
 			"kadm5_init (V1)" : "kadm5_init"),
 			NULL, client_name, ret.code);
-	krb5_klog_syslog(LOG_NOTICE, LOG_DONE,
+
+	clen = strlen(client_name);
+	trunc_name(&clen, &cdots);
+	slen = strlen(service_name);
+	trunc_name(&slen, &sdots);
+	krb5_klog_syslog(LOG_NOTICE, "Request %s, %.*s%s, %s, "
+	    "client=%.*s%s, service=%.*s%s, addr=%s, flavor=%d",
 	    (ret.api_version == KADM5_API_VERSION_1 ?
-	     "kadm5_init (V1)" : "kadm5_init"),
-	    client_name,
+	    "kadm5_init (V1)" : "kadm5_init"),
+	    clen, client_name, cdots,
 	    (ret.code == 0) ? "success" : error_message(ret.code),
-	    client_name, service_name, client_addr(rqstp, buf));
+	    clen, client_name, cdots,
+	    slen, service_name, sdots,
+	    client_addr(rqstp, buf),
+	    rqstp->rq_cred.oa_flavor);
 	free(client_name);
 	free(service_name);
 
diff --git a/usr/src/cmd/krb5/krb5kdc/do_tgs_req.c b/usr/src/cmd/krb5/krb5kdc/do_tgs_req.c
index 9f0f5fc79a..d0c5ebba00 100644
--- a/usr/src/cmd/krb5/krb5kdc/do_tgs_req.c
+++ b/usr/src/cmd/krb5/krb5kdc/do_tgs_req.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -519,27 +519,37 @@ tgt_again:
 	newtransited = 1;
     }
     if (!isflagset (request->kdc_options, KDC_OPT_DISABLE_TRANSITED_CHECK)) {
+	unsigned int tlen;
+	char *tdots;
+
 	errcode = krb5_check_transited_list (kdc_context,
 					     &enc_tkt_reply.transited.tr_contents,
 					     krb5_princ_realm (kdc_context, header_ticket->enc_part2->client),
 					     krb5_princ_realm (kdc_context, request->server));
+	tlen = enc_tkt_reply.transited.tr_contents.length;
+	tdots = tlen > 125 ? "..." : "";
+	tlen = tlen > 125 ? 125 : tlen;
+
 	if (errcode == 0) {
 	    setflag (enc_tkt_reply.flags, TKT_FLG_TRANSIT_POLICY_CHECKED);
 	} else if (errcode == KRB5KRB_AP_ERR_ILL_CR_TKT)
 	    krb5_klog_syslog (LOG_INFO,
-			      "bad realm transit path from '%s' to '%s' via '%.*s'",
+			      "bad realm transit path from '%s' to '%s' "
+			      "via '%.*s%s'",
 			      cname ? cname : "<unknown client>",
 			      sname ? sname : "<unknown server>",
-			      enc_tkt_reply.transited.tr_contents.length,
-			      enc_tkt_reply.transited.tr_contents.data);
+			      tlen,
+			      enc_tkt_reply.transited.tr_contents.data,
+			      tdots);
 	else
 	    krb5_klog_syslog (LOG_ERR,
-			      "unexpected error checking transit from '%s' to '%s' via '%.*s': %s",
+			      "unexpected error checking transit from "
+			      "'%s' to '%s' via '%.*s%s': %s",
 			      cname ? cname : "<unknown client>",
 			      sname ? sname : "<unknown server>",
-			      enc_tkt_reply.transited.tr_contents.length,
+			      tlen,
 			      enc_tkt_reply.transited.tr_contents.data,
-			      error_message (errcode));
+			      tdots, error_message (errcode));
     } else
 	krb5_klog_syslog (LOG_INFO, "not checking transit path");
     if (reject_bad_transit
@@ -567,6 +577,8 @@ tgt_again:
 	if (!krb5_principal_compare(kdc_context, request->server, client2)) {
 		if ((errcode = krb5_unparse_name(kdc_context, client2, &tmp)))
 			tmp = 0;
+		if (tmp != NULL)
+			limit_string(tmp);
 		audit_krb5kdc_tgs_req_2ndtktmm(
 			(struct in_addr *)from->address->contents,
 			(in_port_t)from->port,
@@ -850,6 +862,7 @@ find_alternate_tgs(krb5_kdc_req *request, krb5_db_entry *server,
 		krb5_klog_syslog(LOG_INFO,
 		       "TGS_REQ: issuing alternate <un-unparseable> TGT");
 	    } else {
+		limit_string(sname);
 		audit_krb5kdc_tgs_req_alt_tgt(
 			(struct in_addr *)from->address->contents,
 			(in_port_t)from->port,
diff --git a/usr/src/cmd/krb5/krb5kdc/kdc_util.c b/usr/src/cmd/krb5/krb5kdc/kdc_util.c
index 6158ca00f1..468533a96e 100644
--- a/usr/src/cmd/krb5/krb5kdc/kdc_util.c
+++ b/usr/src/cmd/krb5/krb5kdc/kdc_util.c
@@ -407,6 +407,7 @@ kdc_get_server_key(krb5_ticket *ticket, krb5_keyblock **key, krb5_kvno *kvno)
 
 	krb5_db_free_principal(kdc_context, &server, nprincs);
 	if (!krb5_unparse_name(kdc_context, ticket->server, &sname)) {
+	    limit_string(sname);
 	    krb5_klog_syslog(LOG_ERR,"TGS_REQ: UNKNOWN SERVER: server='%s'",
 			     sname);
 	    free(sname);
diff --git a/usr/src/lib/krb5/kadm5/admin.h b/usr/src/lib/krb5/kadm5/admin.h
index d4d98c66f9..2671e8c15d 100644
--- a/usr/src/lib/krb5/kadm5/admin.h
+++ b/usr/src/lib/krb5/kadm5/admin.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -817,6 +817,10 @@ ovsec_kadm_ret_t    ovsec_kadm_get_policies(void *server_handle,
 
 #endif /* USE_KADM5_API_VERSION == 1 */
 
+#define MAXPRINCLEN 125
+
+void trunc_name(size_t *len, char **dots);
+
 krb5_chgpwd_prot _kadm5_get_kpasswd_protocol(void *server_handle);
 kadm5_ret_t	kadm5_chpass_principal_v2(void *server_handle,
 					krb5_principal princ,
diff --git a/usr/src/lib/krb5/kadm5/clnt/logger.c b/usr/src/lib/krb5/kadm5/clnt/logger.c
index 790b6f6a8f..8dcc0326bd 100644
--- a/usr/src/lib/krb5/kadm5/clnt/logger.c
+++ b/usr/src/lib/krb5/kadm5/clnt/logger.c
@@ -23,7 +23,7 @@
  */
 
 /*
- * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -45,7 +45,7 @@
 #include <stdarg.h>
 #include <libintl.h>
 
-#define	KRB5_KLOG_MAX_ERRMSG_SIZE	1024
+#define	KRB5_KLOG_MAX_ERRMSG_SIZE	2048
 #ifndef	MAXHOSTNAMELEN
 #define	MAXHOSTNAMELEN	256
 #endif	/* MAXHOSTNAMELEN */
@@ -371,8 +371,11 @@ klog_com_err_proc(whoami, code, format, ap)
 
     /* If reporting an error message, separate it. */
     if (code) {
-	strcat(outbuf, error_message(code));
-	strcat(outbuf, " - ");
+	outbuf[sizeof(outbuf) - 1] = '\0';
+
+	strncat(outbuf, error_message(code),
+		sizeof(outbuf) - 1 - strlen(outbuf));
+	strncat(outbuf, " - ", sizeof(outbuf) - 1 - strlen(outbuf));
     }
     cp = &outbuf[strlen(outbuf)];
     
@@ -417,7 +420,7 @@ klog_com_err_proc(whoami, code, format, ap)
     } 
 
     /* Now format the actual message */
-    vsprintf(cp, actual_format, ap);
+    vsnprintf(cp, sizeof (outbuf) - (cp - outbuf), actual_format, ap);
     
     /*
      * Now that we have the message formatted, perform the output to each
@@ -992,7 +995,7 @@ klog_vsyslog(priority, format, arglist)
     syslogp = &outbuf[strlen(outbuf)];
 
     /* Now format the actual message */
-    vsprintf(syslogp, format, arglist);
+    vsnprintf(syslogp, sizeof (outbuf) - (syslogp - outbuf), format, arglist);
 
     /*
      * Now that we have the message formatted, perform the output to each
diff --git a/usr/src/lib/krb5/kadm5/srv/chgpwd.c b/usr/src/lib/krb5/kadm5/srv/chgpwd.c
index 38ed07ebe5..020326fb25 100644
--- a/usr/src/lib/krb5/kadm5/srv/chgpwd.c
+++ b/usr/src/lib/krb5/kadm5/srv/chgpwd.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -67,6 +67,8 @@ process_chpw_request(krb5_context context, void *server_handle,
 	int numresult;
 	char strresult[1024];
 	char *clientstr;
+	size_t clen;
+	char *cdots;
 
 	ret = 0;
 	rep->length = 0;
@@ -379,9 +381,11 @@ process_chpw_request(krb5_context context, void *server_handle,
 	free(ptr);
 	clear.length = 0;
 
-	krb5_klog_syslog(LOG_NOTICE, "chpw request from %s for %s: %s",
+	clen = strlen(clientstr);
+	trunc_name(&clen, &cdots);
+	krb5_klog_syslog(LOG_NOTICE, "chpw request from %s for %.*s%s: %s",
 		inet_ntoa(((struct sockaddr_in *)&remote_addr)->sin_addr),
-		clientstr, ret ? error_message(ret) : "success");
+		clen, clientstr, cdots, ret ? error_message(ret) : "success");
 	krb5_free_unparsed_name(context, clientstr);
 
 	if (ret) {
diff --git a/usr/src/lib/krb5/kadm5/srv/logger.c b/usr/src/lib/krb5/kadm5/srv/logger.c
index d94083500d..55b4875b75 100644
--- a/usr/src/lib/krb5/kadm5/srv/logger.c
+++ b/usr/src/lib/krb5/kadm5/srv/logger.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -50,7 +50,7 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 
-#define	KRB5_KLOG_MAX_ERRMSG_SIZE	1024
+#define	KRB5_KLOG_MAX_ERRMSG_SIZE	2048
 #ifndef	MAXHOSTNAMELEN
 #define	MAXHOSTNAMELEN	256
 #endif	/* MAXHOSTNAMELEN */
@@ -380,7 +380,9 @@ klog_com_err_proc(whoami, code, format, ap)
     /* If reporting an error message, separate it. */
     if (code) {
         outbuf[sizeof(outbuf) - 1] = '\0';
-	strncat(outbuf, error_message(code), sizeof(outbuf) - 1 - strlen(outbuf));
+
+	strncat(outbuf, error_message(code),
+		sizeof(outbuf) - 1 - strlen(outbuf));
 	strncat(outbuf, " - ", sizeof(outbuf) - 1 - strlen(outbuf));
     }
     cp = &outbuf[strlen(outbuf)];
@@ -426,7 +428,7 @@ klog_com_err_proc(whoami, code, format, ap)
     } 
 
     /* Now format the actual message */
-    vsprintf(cp, actual_format, ap);
+    vsnprintf(cp, sizeof (outbuf) - (cp - outbuf), actual_format, ap);
     
     /*
      * Now that we have the message formatted, perform the output to each
@@ -995,7 +997,7 @@ klog_vsyslog(priority, format, arglist)
     syslogp = &outbuf[strlen(outbuf)];
 
     /* Now format the actual message */
-    vsprintf(syslogp, format, arglist);
+    vsnprintf(syslogp, sizeof (outbuf) - (syslogp - outbuf), format, arglist);
 
     /*
      * Now that we have the message formatted, perform the output to each
diff --git a/usr/src/lib/krb5/kadm5/srv/mapfile-vers b/usr/src/lib/krb5/kadm5/srv/mapfile-vers
index 4a92d4a409..6f697a1d59 100644
--- a/usr/src/lib/krb5/kadm5/srv/mapfile-vers
+++ b/usr/src/lib/krb5/kadm5/srv/mapfile-vers
@@ -18,8 +18,7 @@
 #
 # CDDL HEADER END
 #
-#
-# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
 # ident	"%Z%%M%	%I%	%E% SMI"
@@ -145,6 +144,7 @@ SUNWprivate_1.1 {
 	osa_free_policy_ent;
 	osa_free_princ_ent;
 	passwd_check;
+	trunc_name;
 	xdr_chpass3_arg;
 	xdr_chpass_arg;
 	xdr_chrand3_arg;
diff --git a/usr/src/lib/krb5/kadm5/srv/server_misc.c b/usr/src/lib/krb5/kadm5/srv/server_misc.c
index b2283e973b..facaf9dc82 100644
--- a/usr/src/lib/krb5/kadm5/srv/server_misc.c
+++ b/usr/src/lib/krb5/kadm5/srv/server_misc.c
@@ -205,3 +205,10 @@ passwd_check(kadm5_server_handle_t handle,
     }
     return KADM5_OK;    
 }
+
+void
+trunc_name(size_t *len, char **dots)
+{
+    *dots = *len > MAXPRINCLEN ? "..." : "";
+    *len = *len > MAXPRINCLEN ? MAXPRINCLEN : *len;
+}