Greg Hudson [Fri, 13 Jan 2012 17:35:30 +0000 (17:35 +0000)]
Simplify integer loading in ASN.1 encoding
Instead of defining an auxiliary load function for each integer
type, just use its size and signedness to decide how to load it.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25651
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 13 Jan 2012 15:04:35 +0000 (15:04 +0000)]
Add PKINIT decoder tests
Add tests to krb5_decode_test.c for PKINIT types. Where the decoders
do not match the encoders, include comments and hand-generated
encodings which work with the decoder.
Add a comment to asn1_k_encode.c documenting inconsistencies between
the draft 9 PA-PK-AS-REQ spec and our encoder results.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25650
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Thu, 12 Jan 2012 18:48:57 +0000 (18:48 +0000)]
Updated domain_realm section of krb5.conf. Reformated files
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25649
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Thu, 12 Jan 2012 16:55:37 +0000 (16:55 +0000)]
Added k5identity doc in RST format.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25648
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 11 Jan 2012 21:20:08 +0000 (21:20 +0000)]
Fix spurious clock skew caused by gak_fct delay
In get_in_tkt.c, a time offset is computed between the KDC's auth_time
and the current system time after the reply is decrypted. Time may
have elapsed between these events because of a gak_fct invocation
which blocks on user input. The resulting spurious time offset can
cause subsequent TGS-REQs to fail and can also cause the end time of
the next AS request to be in the past (issue #889) in cases where the
old ccache is opened to find the default principal.
Use the system time, without offset, for the request time of an AS
request, for more predictable kinit behavior. Use this request time,
rather than the current time, when computing the clock skew after the
reply is decrypted.
ticket: 7063
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25644
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 10 Jan 2012 18:01:15 +0000 (18:01 +0000)]
Fix an allocation size bug in ASN.1 tests
ktest_make_sample_pa_pk_as_req_draft9 was allocating the wrong
size of objects for the trustedCertifiers array. Fix it.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25638
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 10 Jan 2012 17:27:38 +0000 (17:27 +0000)]
Use DEFTAGGEDTYPE for FAST choice types
pa_fx_fast_request and pa_fx_fast_reply are defined in RFC 6113 as
extensible choice types with only one choice, which means they encode
as another type with a [0] tag wrapper. Use DEFTAGGEDTYPE to add
this wrapper instead of DEFFIELDTYPE/FIELDOF_ENCODEAS, and add a
comment describing why.
After this change, all uses of DEFFIELDYPE are for dataptr/lenptr
types or just simple offset transformations on the base pointer.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25635
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 10 Jan 2012 07:33:41 +0000 (07:33 +0000)]
Simplify asn1_decode_kdc_dh_key_info
Due to some lingering confusion, the last commit changing
asn1_decode_kdc_dh_key_info was correct but overly complicated (and
contained an incorrect comment). Change it to just use get_lenfield
for subjectPublicKey.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25634
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Tue, 10 Jan 2012 04:23:56 +0000 (04:23 +0000)]
documentation license to CC-BY-SA 3.0 Unported
Update documentation license to Creative Commons
Attribution-ShareAlike 3.0 Unported.
ticket: 7067
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25633
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Mon, 9 Jan 2012 21:45:52 +0000 (21:45 +0000)]
Added documentation for sserver, sclient and krb5-send-pr in RST format
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25632
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 9 Jan 2012 21:35:30 +0000 (21:35 +0000)]
delete duplicate NOTICE file
Delete the duplicate NOTICE file, as it is checked into the tree and
relative include paths work for sphinx.
ticket: 7065
status: open
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25631
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Mon, 9 Jan 2012 21:03:58 +0000 (21:03 +0000)]
Make dh_key_info encoder and decoder symmetric
The dh_key_info encoder expects subjectPublicKey to contain the
contents of a bit string, but the decoder outputs the DER encoding of
the bit string including tag. The PKINIT client code expects this, so
everything works, but the encoder and decoder should be symmetric.
Change the decoder to process the bit string (adding a bit string
decoding primitive) and modify the PKINIT client code to expect only
the bit string contents.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25626
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 9 Jan 2012 20:13:10 +0000 (20:13 +0000)]
install sphinx-generated manpages
Install sphinx-generated manpages. Original nroff manpages remain for
reference until proofreading is complete. Modify
doc/rst_source/conf.py to better deal with shadow manpages -- sphinx
will now build k5login.5 instead of .k5login.5, and kadmin.1 instead
of both kadmin.1 and kadmin.local.8.
Proofreaders should ensure that the original nroff manpages (and
associated Makefile rules) are deleted once their reST format
equivalents have been proofread.
ticket: 7064
status: open
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25625
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Sun, 8 Jan 2012 21:54:29 +0000 (21:54 +0000)]
Remove unneeded kdcRealm field in PKINIT structure
krb5_pk_authenticator_draft9 had a kdcRealm field which was set by the
client code but never encoded or decoded. Remove it. Eliminating this
field exposed a bug in auth_pack_draft9_optional; fix that.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25624
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Sun, 8 Jan 2012 21:27:59 +0000 (21:27 +0000)]
Fix PKINIT serverDHNonce encoding
Use an explicit tag for serverDHNonce, as specified in RFC 4556,
rather than the implicit tag we historically used. This bug had no
practical effect (and creates no interoperability issues) because we
never generate a serverDHNonce.
ticket: 7061
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25623
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Sun, 8 Jan 2012 02:10:47 +0000 (02:10 +0000)]
Clean up the asn1 encoder design
Now that the PKINIT types have been converted and atype_fn has only
one use, we can more easily modify the encoder so that any object can
be encoded without its tag, which makes for a cleaner design. The
basic building block is now krb5int_asn1_encode_type, which encodes
the contents of a function and returns its tag information to the
caller.
atype_fn now has its own structure, and the encoder function it
references follows the semantics of krb5int_asn1_encode_type.
atype_opaque is now atype_der and goes with a new corresponding field
type (field_der); stored DER encodings are parsed to separate the tag
from the content.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25622
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Sat, 7 Jan 2012 20:57:36 +0000 (20:57 +0000)]
Convert securid module edata method
r25348 made modified the edata method of the kdcpreauth interface to
be async-capable, but neglected to convert the securid_sam2 module's
edata function. Do that now.
ticket: 7060
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25621
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Sat, 7 Jan 2012 17:26:13 +0000 (17:26 +0000)]
Remove some unneeded accessor fields
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25620
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Sat, 7 Jan 2012 16:50:06 +0000 (16:50 +0000)]
Remove some unused structures and encoders
krb5_alt_method was added in r6604 but never supported. krb5_pwd_data
became unused when the Sandia kadmin system was replaced.
krb5_pa_server_referral_data and krb5_pa_svr_referral_data were added
in r21690 with internally-visible encoders which nothing uses.
Leave behind structure declarations in krb5.hin for API compatibility.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25619
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Sat, 7 Jan 2012 15:50:14 +0000 (15:50 +0000)]
Remove SAM encoders and structures
r24403 removed the old SAM support, but left behind the structures,
free functions, and ASN.1 encoders/decoders. Remove those now.
(SAM-2 support is still present.)
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25618
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 6 Jan 2012 21:17:14 +0000 (21:17 +0000)]
Convert all remaining macro-coded ASN.1 encoders
Use data-driven encoders for all of the remaining types which still
used macros (primarily PKINIT types), and get rid of the macros. Do
not change any encoding behavior, but add some comments where behavior
differs from the spec.
DEFFNTYPE is now unused except for the kdc_req_body hack.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25617
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 6 Jan 2012 21:13:59 +0000 (21:13 +0000)]
Add support for CHOICE in ASN.1 encoder
Add a new field type where the length offset indicates a distinguisher
and the data offset indicates a union address. The field's type is an
atype_choice containing a seq_info indexed by the distinguisher.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25616
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 6 Jan 2012 21:10:42 +0000 (21:10 +0000)]
Factor out length retrieval in ASN.1 encoder
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25615
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 6 Jan 2012 21:08:54 +0000 (21:08 +0000)]
Support implicit context tags in ASN.1 fields
Add a field_info bit (the 32nd bit of the bitfields) indicating whether
the context tag is implicit, and support it in encode_a_field. Adjust
all field-generating macros and invocations to include the new bit
(always 0 for the moment).
For atype_tagged_thing, narrow the construction field to six bits and
add an implicit bit. We could remove the construction field if it
weren't for DEFOCTETWRAPPEDTYPE abusing atype_tagged_thing a little
bit, since (normal) explicit tags are always constructed and implicit
tag construction is computed from the base type.
Given how rarely implicit tagging is used, it might be nice to have
separate _IMPLICIT macros rather than an extra argument to every
field. But we already have separate _OPT macros for optional fields
and FIELDOF_STRING vs. FIELDOF_STRINGL, so we start to get a
combinatoric explosion in the number of macros.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25614
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 6 Jan 2012 21:06:10 +0000 (21:06 +0000)]
Support ASN.1 encoding without the outer tag
In order to support implicit tagging, make it possible to ASN.1-encode
a value without its outer tag, instead remembering the construction
bit of the omitted tag.
A cleaner design would be to have separate functions for encoding a
value's contents and its tag. However, we can't do that for atype_fn
or atype_opaque, and the possible indirections between types and
fields mean we want to stay at the "encode everything" level for as
long as possible to allow implicit tagging of the largest possible
subset of types. If we can get rid of atype_fn, we may be able to
switch to the cleaner design with some adjustments to atype_opaque.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25613
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 6 Jan 2012 20:52:12 +0000 (20:52 +0000)]
Use content-only ASN.1 primitives
As part of implicit tag support, rework ASN.1 encoding primitives so
that they encode only content, not tags. Combine primitives which
become identical with this change. The new atype_primitive type
invokes a primitive encoder and adds a tag. atype_fn_len is split
into atype_string and atype_opaque, both of which are hardcoded to
use asn1_encode_bytestring.
For the encoders still using macros, create asn1_addprimitive,
asn1_addinteger, and asn1_addstring macros which call the primitive
encoder function and add a tag.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25612
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 6 Jan 2012 20:52:09 +0000 (20:52 +0000)]
Make ASN.1 struct atype_info more extensible
Instead of including all of the possible type fields in struct
atype_info, use a pointer to a type-specific structure. This might
save a little space, but more importantly, if we get to the point of
exposing this stuff across plugin APIs, it allows ASN.1 type
information to be extensible via defining new atype_type values.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25611
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 6 Jan 2012 20:52:05 +0000 (20:52 +0000)]
Add missing test cases for ASN.1 types
Add test cases for ASN.1 types which didn't previously have them.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25610
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 6 Jan 2012 20:52:02 +0000 (20:52 +0000)]
Add test cases for PKINIT ASN.1 encoders
Do not add decode tests, because those would trip some bugs in the
decoders, and we can't safely fix some of those bugs without interop
testing. Encode tests are sufficient to detect when we
unintentionally change the output of the encoders.
Fix trval2() not to use the context shortcut on primitive context
tags.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25609
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 6 Jan 2012 20:51:57 +0000 (20:51 +0000)]
Simplify and reformat ASN.1 test code
Use abort-on-error memory allocation to reduce failure handling.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25608
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 6 Jan 2012 20:46:17 +0000 (20:46 +0000)]
Fix asn1_encode_subject_pk_info without params
r20923 inadvertently broke asn1_encode_subject_pk_info in the case
where algorithm.parameters.length == 0. Fortunately this case never
happens, but fix it anyway.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25607
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Wed, 4 Jan 2012 15:47:52 +0000 (15:47 +0000)]
Remove unused functions (older API residue) krb5_realm_iterator* and krb5_free_realm_string
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25606
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 28 Dec 2011 01:31:59 +0000 (01:31 +0000)]
Fix implicit declaration in ksu for some builds
ksu's setenv implementation needs to include <string.h> for memcpy.
Patch from basch@alum.mit.edu.
ticket: 7057
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25605
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 27 Dec 2011 06:39:07 +0000 (06:39 +0000)]
Fix an unlikely memory leak in r25591
ticket: 6936
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25604
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Thu, 22 Dec 2011 16:25:43 +0000 (16:25 +0000)]
Updated env variable sections, formating and other corrections
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25602
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 21 Dec 2011 22:52:52 +0000 (22:52 +0000)]
Stop using krb5_typed_data structure type
Use the krb5_pa_data structure type when encoding or decoding
TYPED-DATA. Leave the krb5_typed_data structure definition in krb5.h
with a comment saying not to use it. Remove krb5_free_typed_data
(which was never declared in krb5.h). Remove some vestigial accessor
stuff related to PKINIT encoding and decoding TYPED-DATA, which was
unneeded since r25483. Bump the accessor structure version to 19
accordingly.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25601
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 21 Dec 2011 22:52:43 +0000 (22:52 +0000)]
Stop using krb5_octet_data
For consistency with the rest of the code base, make PKINIT use
krb5_data as a pointer/length container. Leave krb5_octet_data and
krb5_free_octet_data behind for API compatibility.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25600
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Tue, 20 Dec 2011 19:39:55 +0000 (19:39 +0000)]
Remove MITKC logo from the tree
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25599
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 20 Dec 2011 18:08:07 +0000 (18:08 +0000)]
Table of Contents.hhc -> Table_of_Contents.hhc
Avoid using spaces in filenames as it makes searching the source
tree less convenient on Unix.
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25598
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Mon, 19 Dec 2011 19:08:49 +0000 (19:08 +0000)]
Correct typos and formating
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25594
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Sat, 17 Dec 2011 18:22:47 +0000 (18:22 +0000)]
Fix make depend in unbuilt build tree
Add dependency rules so that "make depend" succeeds from a fresh build
tree.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25593
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Sat, 17 Dec 2011 05:01:32 +0000 (05:01 +0000)]
Avoid using itertools.permutations in k5test
k5test is only supposed to require Python 2.4, but cross_realms uses
itertools.permutations which is new in 2.6. Use a list display
instead.
ticket: 7054
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25592
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 16 Dec 2011 23:19:01 +0000 (23:19 +0000)]
Do mech fallback for first SPNEGO context token
When producing the first SPNEGO security context token, if the first
mechanism's init_sec_context fails, fall back to a later mechanism.
This fixes a regression in 1.10 for SPNEGO initiators using non-krb5
credentials. The identity selection work causes errors to be deferred
from krb5's acquire_cred in some cases, which means SPNEGO doesn't see
an error until it tries the krb5 init_sec_context.
ticket: 6936
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25591
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 16 Dec 2011 23:18:54 +0000 (23:18 +0000)]
Verify acceptor's mech in SPNEGO initiator
In spnego_gss_ctx_id_rec, store the set of negotiable mechanisms as
well as the currently selected internal_mech, which becomes an alias
into mech_set. In init_ctx_reselect, locate the acceptor's counter-
proposal in sc->mech_set and consider the token defective if it is not
found.
ticket: 7053
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25590
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Thu, 15 Dec 2011 22:55:41 +0000 (22:55 +0000)]
Formating
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25589
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 13 Dec 2011 00:53:56 +0000 (00:53 +0000)]
krb5_server_decrypt_ticket_keytab wrongly succeeds
If krb5_server_decrypt_ticket_keytab doesn't find a key of the
appropriate enctype in an iterable keytab, it returns 0 (without
decrypting the ticket) due to a misplaced initialization of retval.
This bug causes kinit -k to claim "keytab entry valid" when it
shouldn't. Reported by mark@mproehl.net.
ticket: 7051
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25584
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:47:14 +0000 (20:47 +0000)]
kfw leash: fix bad data in get tickets dialog when -autoinit specified
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25583
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:47:11 +0000 (20:47 +0000)]
kfw leash help: fix/add aliases for command help
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25582
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:47:05 +0000 (20:47 +0000)]
kfw: remove line breaks from html to fix table of contents generation
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25581
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:47:02 +0000 (20:47 +0000)]
kfw installer: install leash help file (leash.chm)
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25580
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:59 +0000 (20:46 +0000)]
kfw: "make install" installs htmlhelp (leash.chm)
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25579
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:56 +0000 (20:46 +0000)]
kfw: use html help in leash
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25578
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:48 +0000 (20:46 +0000)]
kfw: leash htmlhelp file source
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25577
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:44 +0000 (20:46 +0000)]
kfw installer: add site-local.wxi
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25576
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:41 +0000 (20:46 +0000)]
kfw installer: leash32.pdb->leash.pdb
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25575
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:37 +0000 (20:46 +0000)]
kfw: "make install" also installs pdbs
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25574
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:33 +0000 (20:46 +0000)]
kfw installer: install krb5.ini to CommonAppDataFolder, not WindowsFolder
...but only if there isn't already a krb5.ini in the WindowsFolder.
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25573
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:30 +0000 (20:46 +0000)]
kfw leash: bracket krb.con code with #ifndef NO_KRB4
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25572
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:27 +0000 (20:46 +0000)]
kfw: use _WIN64 names where appropriate
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25571
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:24 +0000 (20:46 +0000)]
kfw leash: add -console option to create console for debug output
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25570
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:20 +0000 (20:46 +0000)]
Split cci_thread_init into per-process and per-thread portions
Call the per-thread code on thread attach and per-process once per
process. Previously, while the function was named 'thread', it was
only actually called once per process. Currently, the per-thread
code does nothing on non-windows platforms and is not even actually
invoked.
Fixes a windows bug when multiple non-main threads try to use ccapi
at the same time.
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25569
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:16 +0000 (20:46 +0000)]
kfw: rename leash32/64.exe to simply leash.exe
Also install leash.exe in 64 bit installer.
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25568
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:13 +0000 (20:46 +0000)]
kfw installer: purge bufferoverflowu from custom.dll
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25567
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:10 +0000 (20:46 +0000)]
kfw: fix 'K5_ORIGINAL_NAME' for 64 bit dlls
...still need to actually to define _WIN64 for rc.exe though
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25566
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:07 +0000 (20:46 +0000)]
kfw installer: generate leash shortcuts (desktop and start menu)
...also install xpprof64
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25565
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:04 +0000 (20:46 +0000)]
kfw: generate manifests
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25564
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:00 +0000 (20:46 +0000)]
kfw fixes: ccapiserver only quits after all clients detach
Not sure if this is really a good idea or not...
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25563
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:58 +0000 (20:45 +0000)]
kfw fixes: fix _snprintf usage; use full error code in leash_error_message
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25562
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:55 +0000 (20:45 +0000)]
kfw fix: restructure low ticket warning popup code to workaround mfc bug
mfc bug causes assertions when dialog is generated from
within PreTranslateMessages() (MSG input param points to a global
variable which is corrupted in the dialog message loop). So we need
to instead PostMessage() to cause the popup later.
Also fixed logic to cause warning dialog to actually be modal as intended
when the leash window is not minimized.
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25561
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:52 +0000 (20:45 +0000)]
kfw fix: int -> size_t to fix warning in krb5routines.c
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25560
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:49 +0000 (20:45 +0000)]
kfw fixes: krb5_get_init_creds_opt_init->krb5_get_init_creds_opt_alloc
Should enable leash to generate config credentials (needs verification!)
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25559
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:46 +0000 (20:45 +0000)]
kfw fixes: define USE_MESSAGE_BOX in leashdll code for user feedback
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25558
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:42 +0000 (20:45 +0000)]
kfw fix: Add custom "Password incorrect" message to Leash_int_kinit_ex()
Overrides obscure KRB5KRB_AP_ERR_BAD_INTEGRITY message.
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25557
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:38 +0000 (20:45 +0000)]
kfw fix: make Leash_kdestroy() actually destroy k5 tickets
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25556
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:33 +0000 (20:45 +0000)]
kfw fixes: make leash ignore credentials that store config principals
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25555
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:29 +0000 (20:45 +0000)]
kfw installer: don't build installer into installer
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25554
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:26 +0000 (20:45 +0000)]
kfw installer: purge support for old compilers
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25553
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:23 +0000 (20:45 +0000)]
kfw fixes: install xpprof32
TODO: xpprof64!
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25552
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:16 +0000 (20:45 +0000)]
kfw: update copyright notice in license.rtf
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25551
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:13 +0000 (20:45 +0000)]
kfw: use correct message id to obtain tgt from leash
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25550
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:08 +0000 (20:45 +0000)]
kfw: clean out unused #defines from Lglobals.h
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25549
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:03 +0000 (20:45 +0000)]
kfw installer: install leash32.exe
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25548
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:44:59 +0000 (20:44 +0000)]
kfw installer: use MSVC 2010 merge modules
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25547
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:44:56 +0000 (20:44 +0000)]
Windows leash fixes: 'make install' installs leash exes
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25546
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:44:52 +0000 (20:44 +0000)]
Windows leash64 fixes: use proper names for leash and krb5 dlls
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25545
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:44:48 +0000 (20:44 +0000)]
kfw installer: add runtime.wxi WIXINCLUDES in Makefile to fix dependencies
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25544
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:44:44 +0000 (20:44 +0000)]
LeashView.cpp: only specify TVIF_TEXT if there is actually text
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25543
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:44:40 +0000 (20:44 +0000)]
windows ccapi: use a random challenge to authenticate ccapiserver
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25542
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:44:36 +0000 (20:44 +0000)]
windows ccapi: launch server without console by default
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25541
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:44:30 +0000 (20:44 +0000)]
Make ccapiserver exit if its receiveloop thread terminates for any reason
This happens, for example, when the rpc endpoint is already registered
by another ccapiserver process. There's no reason to leave a zombie
process running that can't receive messages.
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25540
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:44:21 +0000 (20:44 +0000)]
fix warning in test_cc_credentials_iterator_next.c
include test_ccapi_iterators.h for check_cc_credentials_iterator_next
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25539
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:44:14 +0000 (20:44 +0000)]
windows ccapiserver: replace Sleep with event wait
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25538
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Mon, 12 Dec 2011 18:33:35 +0000 (18:33 +0000)]
Corrected the name of KRB5_NT_SRV_HST macro. Added some doxygen comments
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25537
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 9 Dec 2011 17:57:52 +0000 (17:57 +0000)]
Fix subkey memory leak in krb5_get_credentials
If a get_credentials operation requires multiple TGS requests, we need
to free the subkey from previous requests before saving a new one.
ticket: 7049
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25536
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 9 Dec 2011 17:57:47 +0000 (17:57 +0000)]
Fix memory leaks in FAST TGS support
krb5int_fast_prep_req remove tgs from request->padata and needs to
free it. get_creds.c needs to use a fresh FAST state for each TGS
request to avoid leaking armor keys.
ticket: 7026
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25535
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Thu, 8 Dec 2011 04:21:23 +0000 (04:21 +0000)]
Actually allow null server key in krb5_pac_verify
ticket: 7048
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25534
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Wed, 7 Dec 2011 20:54:41 +0000 (20:54 +0000)]
Remove reference to krb5_anadd. Correct the name of HAVE_GETUSERSHELL flag
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25533
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 7 Dec 2011 19:38:32 +0000 (19:38 +0000)]
Allow null server key to krb5_pac_verify
When the KDC verifies a PAC, it doesn't really need to check the
server signature, since it can't trust that anyway. Allow the caller
to pass only a TGT key.
ticket: 7048
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25532
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 7 Dec 2011 19:38:29 +0000 (19:38 +0000)]
Add automated tests for S4U2Self and S4U2Proxy
These tests mainly exercise the client-side GSSAPI code for S4U2Self
and S4U2Proxy. They also exercise the KDC code for S4U2Self, but only
the denial logic for S4U2Proxy since the DB2 back end doesn't support
constrained delegation currently.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25531
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 7 Dec 2011 19:38:22 +0000 (19:38 +0000)]
Allow S4U2Proxy service tickets to be cached
Previous to this change, the GSS code avoids caching S4U2Proxy results
for fear of the memory cache growing without bound, but that seems
unlikely to be a serious problem. Allow these to be cached.
ticket: 7047
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25530
dc483132-0cff-0310-8789-
dd5450dbe970