Zhanna Tsitkov [Thu, 15 Dec 2011 22:55:41 +0000 (22:55 +0000)]
Formating
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25589
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 13 Dec 2011 00:53:56 +0000 (00:53 +0000)]
krb5_server_decrypt_ticket_keytab wrongly succeeds
If krb5_server_decrypt_ticket_keytab doesn't find a key of the
appropriate enctype in an iterable keytab, it returns 0 (without
decrypting the ticket) due to a misplaced initialization of retval.
This bug causes kinit -k to claim "keytab entry valid" when it
shouldn't. Reported by mark@mproehl.net.
ticket: 7051
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25584
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:47:14 +0000 (20:47 +0000)]
kfw leash: fix bad data in get tickets dialog when -autoinit specified
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25583
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:47:11 +0000 (20:47 +0000)]
kfw leash help: fix/add aliases for command help
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25582
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:47:05 +0000 (20:47 +0000)]
kfw: remove line breaks from html to fix table of contents generation
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25581
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:47:02 +0000 (20:47 +0000)]
kfw installer: install leash help file (leash.chm)
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25580
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:59 +0000 (20:46 +0000)]
kfw: "make install" installs htmlhelp (leash.chm)
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25579
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:56 +0000 (20:46 +0000)]
kfw: use html help in leash
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25578
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:48 +0000 (20:46 +0000)]
kfw: leash htmlhelp file source
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25577
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:44 +0000 (20:46 +0000)]
kfw installer: add site-local.wxi
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25576
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:41 +0000 (20:46 +0000)]
kfw installer: leash32.pdb->leash.pdb
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25575
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:37 +0000 (20:46 +0000)]
kfw: "make install" also installs pdbs
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25574
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:33 +0000 (20:46 +0000)]
kfw installer: install krb5.ini to CommonAppDataFolder, not WindowsFolder
...but only if there isn't already a krb5.ini in the WindowsFolder.
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25573
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:30 +0000 (20:46 +0000)]
kfw leash: bracket krb.con code with #ifndef NO_KRB4
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25572
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:27 +0000 (20:46 +0000)]
kfw: use _WIN64 names where appropriate
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25571
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:24 +0000 (20:46 +0000)]
kfw leash: add -console option to create console for debug output
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25570
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:20 +0000 (20:46 +0000)]
Split cci_thread_init into per-process and per-thread portions
Call the per-thread code on thread attach and per-process once per
process. Previously, while the function was named 'thread', it was
only actually called once per process. Currently, the per-thread
code does nothing on non-windows platforms and is not even actually
invoked.
Fixes a windows bug when multiple non-main threads try to use ccapi
at the same time.
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25569
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:16 +0000 (20:46 +0000)]
kfw: rename leash32/64.exe to simply leash.exe
Also install leash.exe in 64 bit installer.
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25568
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:13 +0000 (20:46 +0000)]
kfw installer: purge bufferoverflowu from custom.dll
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25567
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:10 +0000 (20:46 +0000)]
kfw: fix 'K5_ORIGINAL_NAME' for 64 bit dlls
...still need to actually to define _WIN64 for rc.exe though
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25566
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:07 +0000 (20:46 +0000)]
kfw installer: generate leash shortcuts (desktop and start menu)
...also install xpprof64
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25565
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:04 +0000 (20:46 +0000)]
kfw: generate manifests
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25564
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:46:00 +0000 (20:46 +0000)]
kfw fixes: ccapiserver only quits after all clients detach
Not sure if this is really a good idea or not...
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25563
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:58 +0000 (20:45 +0000)]
kfw fixes: fix _snprintf usage; use full error code in leash_error_message
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25562
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:55 +0000 (20:45 +0000)]
kfw fix: restructure low ticket warning popup code to workaround mfc bug
mfc bug causes assertions when dialog is generated from
within PreTranslateMessages() (MSG input param points to a global
variable which is corrupted in the dialog message loop). So we need
to instead PostMessage() to cause the popup later.
Also fixed logic to cause warning dialog to actually be modal as intended
when the leash window is not minimized.
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25561
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:52 +0000 (20:45 +0000)]
kfw fix: int -> size_t to fix warning in krb5routines.c
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25560
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:49 +0000 (20:45 +0000)]
kfw fixes: krb5_get_init_creds_opt_init->krb5_get_init_creds_opt_alloc
Should enable leash to generate config credentials (needs verification!)
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25559
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:46 +0000 (20:45 +0000)]
kfw fixes: define USE_MESSAGE_BOX in leashdll code for user feedback
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25558
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:42 +0000 (20:45 +0000)]
kfw fix: Add custom "Password incorrect" message to Leash_int_kinit_ex()
Overrides obscure KRB5KRB_AP_ERR_BAD_INTEGRITY message.
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25557
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:38 +0000 (20:45 +0000)]
kfw fix: make Leash_kdestroy() actually destroy k5 tickets
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25556
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:33 +0000 (20:45 +0000)]
kfw fixes: make leash ignore credentials that store config principals
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25555
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:29 +0000 (20:45 +0000)]
kfw installer: don't build installer into installer
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25554
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:26 +0000 (20:45 +0000)]
kfw installer: purge support for old compilers
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25553
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:23 +0000 (20:45 +0000)]
kfw fixes: install xpprof32
TODO: xpprof64!
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25552
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:16 +0000 (20:45 +0000)]
kfw: update copyright notice in license.rtf
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25551
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:13 +0000 (20:45 +0000)]
kfw: use correct message id to obtain tgt from leash
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25550
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:08 +0000 (20:45 +0000)]
kfw: clean out unused #defines from Lglobals.h
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25549
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:45:03 +0000 (20:45 +0000)]
kfw installer: install leash32.exe
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25548
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:44:59 +0000 (20:44 +0000)]
kfw installer: use MSVC 2010 merge modules
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25547
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:44:56 +0000 (20:44 +0000)]
Windows leash fixes: 'make install' installs leash exes
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25546
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:44:52 +0000 (20:44 +0000)]
Windows leash64 fixes: use proper names for leash and krb5 dlls
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25545
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:44:48 +0000 (20:44 +0000)]
kfw installer: add runtime.wxi WIXINCLUDES in Makefile to fix dependencies
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25544
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:44:44 +0000 (20:44 +0000)]
LeashView.cpp: only specify TVIF_TEXT if there is actually text
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25543
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:44:40 +0000 (20:44 +0000)]
windows ccapi: use a random challenge to authenticate ccapiserver
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25542
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:44:36 +0000 (20:44 +0000)]
windows ccapi: launch server without console by default
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25541
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:44:30 +0000 (20:44 +0000)]
Make ccapiserver exit if its receiveloop thread terminates for any reason
This happens, for example, when the rpc endpoint is already registered
by another ccapiserver process. There's no reason to leave a zombie
process running that can't receive messages.
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25540
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:44:21 +0000 (20:44 +0000)]
fix warning in test_cc_credentials_iterator_next.c
include test_ccapi_iterators.h for check_cc_credentials_iterator_next
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25539
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 12 Dec 2011 20:44:14 +0000 (20:44 +0000)]
windows ccapiserver: replace Sleep with event wait
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7050
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25538
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Mon, 12 Dec 2011 18:33:35 +0000 (18:33 +0000)]
Corrected the name of KRB5_NT_SRV_HST macro. Added some doxygen comments
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25537
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 9 Dec 2011 17:57:52 +0000 (17:57 +0000)]
Fix subkey memory leak in krb5_get_credentials
If a get_credentials operation requires multiple TGS requests, we need
to free the subkey from previous requests before saving a new one.
ticket: 7049
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25536
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 9 Dec 2011 17:57:47 +0000 (17:57 +0000)]
Fix memory leaks in FAST TGS support
krb5int_fast_prep_req remove tgs from request->padata and needs to
free it. get_creds.c needs to use a fresh FAST state for each TGS
request to avoid leaking armor keys.
ticket: 7026
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25535
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Thu, 8 Dec 2011 04:21:23 +0000 (04:21 +0000)]
Actually allow null server key in krb5_pac_verify
ticket: 7048
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25534
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Wed, 7 Dec 2011 20:54:41 +0000 (20:54 +0000)]
Remove reference to krb5_anadd. Correct the name of HAVE_GETUSERSHELL flag
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25533
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 7 Dec 2011 19:38:32 +0000 (19:38 +0000)]
Allow null server key to krb5_pac_verify
When the KDC verifies a PAC, it doesn't really need to check the
server signature, since it can't trust that anyway. Allow the caller
to pass only a TGT key.
ticket: 7048
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25532
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 7 Dec 2011 19:38:29 +0000 (19:38 +0000)]
Add automated tests for S4U2Self and S4U2Proxy
These tests mainly exercise the client-side GSSAPI code for S4U2Self
and S4U2Proxy. They also exercise the KDC code for S4U2Self, but only
the denial logic for S4U2Proxy since the DB2 back end doesn't support
constrained delegation currently.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25531
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 7 Dec 2011 19:38:22 +0000 (19:38 +0000)]
Allow S4U2Proxy service tickets to be cached
Previous to this change, the GSS code avoids caching S4U2Proxy results
for fear of the memory cache growing without bound, but that seems
unlikely to be a serious problem. Allow these to be cached.
ticket: 7047
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25530
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 7 Dec 2011 19:38:13 +0000 (19:38 +0000)]
Allow S4U2Proxy delegated credentials to be saved
The initial implementation of client-side S4U2Proxy support did not
allow delegated proxy credentials to be stored (gss_store_cred would
error out, and gss_krb5_copy_ccache would generate a non-working
cache). To make this work, we save the impersonator name in a cache
config variable and in a cred structure field (replacing the
proxy_cred flag), and make the default principal of the proxy cache
the subject principal as the caller would expect for a regular
delegated cred.
ticket: 7046
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25529
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Tue, 6 Dec 2011 20:42:46 +0000 (20:42 +0000)]
SA-2011-007 KDC null pointer deref in TGS handling [CVE-2011-1530]
Fix a null pointer dereference condition that could cause a denial of
service.
ticket: 7042
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25525
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 5 Dec 2011 00:38:19 +0000 (00:38 +0000)]
make depend
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25505
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Sun, 4 Dec 2011 22:38:36 +0000 (22:38 +0000)]
Set a default enctype for optimistic preauth
When the client application requests optimistic preauth for a preauth
type which uses the password, we don't have an etype-info2 to
interpret since we haven't talked to the KDC. So we need to guess an
enctype, salt, and s2k parameters. In 1.9 and prior, encrypted
timestamp contained code to use the first requested enctype in this
case, but encrypted challenge did not. In 1.10 prior to this change,
neither mechanism uses a reasonable default.
Set a default enctype in krb5_init_creds_init so that all
password-based preauth mechanisms will use a reasonable default in the
optimistic preauth case. The default salt and s2k parameters for this
case will be the principal-based default salt and the enctype-based
default parameters.
ticket: 7033
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25504
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Fri, 2 Dec 2011 19:42:12 +0000 (19:42 +0000)]
Added support for loading of Krb5.ini from Windows APPDATA
Signed-off-by: Alexey Melnikov <aamelnikov@gmail.com>
ticket: 7038
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25500
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Fri, 2 Dec 2011 19:20:54 +0000 (19:20 +0000)]
Use LsaDeregisterLogonProcess(), not CloseHandle()
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7037
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25499
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Fri, 2 Dec 2011 18:52:22 +0000 (18:52 +0000)]
Fix free ofuninitialized memory in sname_to_princ
Fix free of uninitialized memory in error case introduced in 1.10
development cycle.
ticket: 7036
tags: pullup
Target_Version: 1.10
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25498
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Fri, 2 Dec 2011 18:52:19 +0000 (18:52 +0000)]
krb5_lcc_store() now ignores config credentials
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7035
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25497
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Fri, 2 Dec 2011 18:52:12 +0000 (18:52 +0000)]
mk_cred: memory management
Fix for mk_cred.c: calloc() not malloc()
Avoid calling free() in cleanup on uninitialized sub-ptrs if error occurs.
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7034
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25496
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Wed, 30 Nov 2011 22:28:43 +0000 (22:28 +0000)]
Added Test Coverage topic
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25495
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Tue, 29 Nov 2011 23:11:13 +0000 (23:11 +0000)]
Ldap dependency for parallel builds
The ldap plugin needs to declare a dependency on the ldap library
ticket: 7030
tags: pullup
target_version: 1.10
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25494
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 29 Nov 2011 22:49:56 +0000 (22:49 +0000)]
Fix --with-system-verto without pkg-config
If we're using the system verto and pkg-config isn't found but
libverto is, set VERTO_LIBS to just -lverto as there won't be a k5ev
module.
ticket: 7029
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25493
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Tue, 29 Nov 2011 21:22:26 +0000 (21:22 +0000)]
Use INSTALL_DATA to avoid marking .mo files executable
ticket: new target_version: 1.10 tags: pullup subject: Use INSTALL_DATA to install message catalogues
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25492
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Tue, 29 Nov 2011 21:22:21 +0000 (21:22 +0000)]
AC_CHECK_LIB should put -lcrypto in PKINIT_CRYPTO_IMPL_LIBS not LIBS
for pkinit. A similar problem exists for crypto_impl and is not
addressed by this patch.
ticket: new Subject: LIBS should not include PKINIT_CRYPTO_IMPL_LIBS tags: pullup target_version: 1.10
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25491
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 23 Nov 2011 16:17:25 +0000 (16:17 +0000)]
Adjust krb5int_decode_tgs_rep, closing a leak
Use current practices for parameter naming and resource cleanup.
Avoid a leak of local_dec_rep (now named dec_rep) if we take a "goto
cleanup" path.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25490
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 23 Nov 2011 06:10:07 +0000 (06:10 +0000)]
Whitespace, style changes to past two commits
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25489
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 23 Nov 2011 01:04:38 +0000 (01:04 +0000)]
FAST TGS
Implement RFC 6113 FAST TGS support.
Includes library support for a varient of explicit TGS armor that has not yet been proposed within the IETF.
ticket: 7026
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25488
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 23 Nov 2011 01:00:36 +0000 (01:00 +0000)]
FAST: error handling and const keyblock
krb5int_fast_process_error: Allow out_padata and retry to be null for
TGS case. Refactor function to do more frees in the exit handling and
to declare variables at the top.
krb5int_fast_reply_key: input keyblock arguments should be const
ticket: 7025
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25487
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 23 Nov 2011 01:00:27 +0000 (01:00 +0000)]
ticket: new
subject: FAST PKINIT
target_version: 1.10
tags: pullup
Per RFC 6113 fast should use the inner request body for the pkinit
checksum. We did that on the KDC; now do so on the client. Remove
code that explicitly blocked pkinit under FAST.
Also, use the reply key *before* the strengthen key is applied when
verifying the PADATA_PKINIT_KX.
Add FAST pkinit test.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25486
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 22 Nov 2011 17:52:55 +0000 (17:52 +0000)]
Use POSIX constants instead of S_IREAD/S_IWRITE
S_IREAD and S_IWRITE are ancient names for S_IRUSR and S_IWUSR, and
are not defined on some modern platforms (such as Android). Use the
POSIX names instead.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25485
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 22 Nov 2011 17:48:29 +0000 (17:48 +0000)]
Fix compile error in previous change
A last-minute code editing mistake crept into the previous commit; fix
it.
ticket: 7023
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25484
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Mon, 21 Nov 2011 21:14:39 +0000 (21:14 +0000)]
Clean up client-side preauth error data handling
Change the clpreauth tryagain method to accept a list of pa-data,
taken either from the FAST response or from decoding the e_data as
either pa-data or typed-data. Also change the in_padata argument to
contain just the type of the request padata rather than the whole
element, since modules generally shouldn't care about the contents of
their request padata (or they can remember it).
In krb5int_fast_process_error, no longer re-encode FAST pa-data as
typed-data for the inner error e_data, but decode traditional error
e_data for all error types, and try both pa-data and typed-data
encoding.
In PKINIT, try all elements of the new pa-data list, since it may
contain FAST elements as well as the actual PKINIT array. (Fixes an
outstanding bug in FAST PKINIT.)
ticket: 7023
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25483
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Mon, 21 Nov 2011 17:30:41 +0000 (17:30 +0000)]
Recognize IAKERB mech in krb5_gss_display_status
Minor status codes were not displaying properly when originated from
the IAKERB mech, because of a safety check on mech_type. From Ralf
Haferkamp <rhafer@suse.de>.
ticket: 7020
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25482
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Mon, 21 Nov 2011 17:11:58 +0000 (17:11 +0000)]
Formating fixes and update per rev#25480
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25481
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Sun, 20 Nov 2011 05:19:45 +0000 (05:19 +0000)]
Fix failure interval of 0 in LDAP lockout code
A failure count interval of 0 caused krb5_ldap_lockout_check_policy to
pass the lockout check (but didn't cause a reset of the failure count
in krb5_ldap_lockout_audit). It should be treated as forever, as in
the DB2 back end.
This bug is the previously unknown cause of the assertion failure
fixed in CVE-2011-1528.
ticket: 7021
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25480
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Sat, 19 Nov 2011 22:06:15 +0000 (22:06 +0000)]
Improve documentation in preauth_plugin.h
Also declare the verto_context structure to ensure that it is has the
proper scope when used as the return type of the event_context
callback.
ticket: 7019
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25479
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 18 Nov 2011 18:58:59 +0000 (18:58 +0000)]
Document --with-system-verto in rst docs
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25478
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 15 Nov 2011 17:58:22 +0000 (17:58 +0000)]
Fix k5test error message for missing runenv.py
"make fake-install" no longer exists, so tell the developer to run
"make runenv.py" instead.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25477
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 15 Nov 2011 17:31:09 +0000 (17:31 +0000)]
Adjust "make check" constraints in rst docs
Recopy the text from the texinfo build docs into the rst version,
describing --disable-rpath and avoiding an erroneous reference to make
fake-install.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25476
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 15 Nov 2011 02:42:58 +0000 (02:42 +0000)]
Make verto context available to kdcpreauth modules
Add an event_context callback to kdcpreauth. Adjust the internal KDC
and main loop interfaces to pass around the event context, and expose
it to kdcpreauth modules via the rock.
ticket: 7019
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25475
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 15 Nov 2011 01:59:01 +0000 (01:59 +0000)]
Update verto to 0.2.2 release
Update verto sources to 0.2.2 release versions. verto_reinitialize()
now has a return value; check it in kdc/main.c. Store verto-libev.c
alongside verto-k5ev.c to make it easy to diff corresponding versions
when updating.
ticket: 7018
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25474
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Mon, 14 Nov 2011 21:45:33 +0000 (21:45 +0000)]
Simplify and fix kdcpreauth request_body callback
Alter the contract for the kdcpreauth request_body callback so that it
returns an alias to the encoded body instead of a fresh copy. At the
beginning of AS request processing, save a copy of the encoded request
body, or the encoded inner request body for FAST requests. Previously
the request_body callback would re-encode the request structure, which
in some cases has been modified by the AS request code.
No kdcpreauth modules currently use the request_body callback, but
PKINIT will need to start using it in order to handle FAST requests
correctly.
ticket: 7017
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25473
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Mon, 14 Nov 2011 18:02:52 +0000 (18:02 +0000)]
Handle TGS referrals to the same realm
krb5 1.6 through 1.8 contained a workaround for the Active Directory
behavior of returning a TGS referral to the same realm as the request.
1.9 responds to this behavior by caching the returned TGT, trying
again, and detecting a referral loop. This is a partial regression of
ticket #4955. Detect this case and fall back to a non-referreal
request.
ticket: 7016
target_version: 1.9.3
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25472
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Sun, 13 Nov 2011 00:38:23 +0000 (00:38 +0000)]
Add consistency check for plugin interface names
Add an assertion to ensure that the interface_names table in plugin.c
is updated when a new pluggable interface is added.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25471
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Sat, 12 Nov 2011 22:03:54 +0000 (22:03 +0000)]
Add plugin interface_names entry for ccselect
When the ccselect pluggable interface was added, the interface_names
table wasn't updated, so configuring modules for it wouldn't work.
Add it now.
ticket: 7015
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25470
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 11 Nov 2011 17:01:12 +0000 (17:01 +0000)]
Avoid looping when preauth can't be generated
If we receive a PREAUTH_REQUIRED error and fail to generate any real
preauthentication, error out immediately instead of continuing to
generate non-preauthenticated requests until we hit the loop count.
There is a lot of room to generate a more meaningful error about why
we failed to generate preauth (although in many cases the answer may
be too complicated to explain in an error message), but that requires
more radical restructuring of the preauth framework.
ticket: 6430
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25469
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 11 Nov 2011 04:04:58 +0000 (04:04 +0000)]
Fix com_err.h dependencies in gss-kernel-lib
make check was failing in util/gss-kernel-lib due to dependencies
when the build is configured with --with-system-et, because depfix.pl
wasn't smart enough to substitute the dependency on com_err.h in the
current directory. Make depfix.pl smarter, and adjust COM_ERR_DEPS
to be com_err.h in gss-kernel-lib when building with the bundled
com_err.
ticket: 7014
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25468
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 11 Nov 2011 02:14:56 +0000 (02:14 +0000)]
Remove -v from the preset valgrind flags
Verbose output from valgrind is rarely needed and makes it harder to
find errors and leaks in the output. When it is needed, it's easier
to add it in than to take it out.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25467
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Wed, 9 Nov 2011 19:57:25 +0000 (19:57 +0000)]
Added the note to the trace API functions that they have higher priority than the KRB5_TRACE env variable
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25466
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Wed, 9 Nov 2011 19:46:43 +0000 (19:46 +0000)]
Updated text for the KRB5_TRACE env variable.
Updated Sphinx index with the new API functions and changed macros names.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25465
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Tue, 8 Nov 2011 15:16:29 +0000 (15:16 +0000)]
Added Environment Variables document.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25457
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Mon, 7 Nov 2011 17:51:57 +0000 (17:51 +0000)]
Fix documentation typos
Fix the typos from r25290 which were also present in the RST
documentation.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25446
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Mon, 7 Nov 2011 00:47:20 +0000 (00:47 +0000)]
Fix warnings and version check for NSS pkinit
From nalin@redhat.com.
ticket: 6999
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25445
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Sun, 6 Nov 2011 04:32:34 +0000 (04:32 +0000)]
Fix month/year units in getdate
getdate strings like "1 month" or "next year" would fail some of the
time, depending on the value of stack garbage, because DSTcorrect()
doesn't set *error on success and RelativeMonth() doesn't initialize
error. Make DSTcorrect() responsible for setting *error in all cases.
ticket: 7003
target_version: 1.10
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25444
dc483132-0cff-0310-8789-
dd5450dbe970
projects / krb5.git / log