krb5.git
13 years agoAdded Environment Variables document.
Zhanna Tsitkov [Tue, 8 Nov 2011 15:16:29 +0000 (15:16 +0000)]
Added Environment Variables document.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25457 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoFix documentation typos
Greg Hudson [Mon, 7 Nov 2011 17:51:57 +0000 (17:51 +0000)]
Fix documentation typos

Fix the typos from r25290 which were also present in the RST
documentation.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25446 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoFix warnings and version check for NSS pkinit
Greg Hudson [Mon, 7 Nov 2011 00:47:20 +0000 (00:47 +0000)]
Fix warnings and version check for NSS pkinit

From nalin@redhat.com.

ticket: 6999
target_version: 1.10
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25445 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoFix month/year units in getdate
Greg Hudson [Sun, 6 Nov 2011 04:32:34 +0000 (04:32 +0000)]
Fix month/year units in getdate

getdate strings like "1 month" or "next year" would fail some of the
time, depending on the value of stack garbage, because DSTcorrect()
doesn't set *error on success and RelativeMonth() doesn't initialize
error.  Make DSTcorrect() responsible for setting *error in all cases.

ticket: 7003
target_version: 1.10
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25444 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoImprove verto and libev documentation
Greg Hudson [Sat, 5 Nov 2011 19:55:34 +0000 (19:55 +0000)]
Improve verto and libev documentation

NOTICE was missing the copyright statement for verto (it's not quite
the same as other Red Hat licenses).  util/verto had no README file,
and neither the verto nor k5ev README contained pointers to the
upstream project pages.

ticket: 7002
target_version: 1.10
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25443 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoClean up more stuff in make clean
Greg Hudson [Fri, 4 Nov 2011 18:39:48 +0000 (18:39 +0000)]
Clean up more stuff in make clean

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25437 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoGet rid of fake-install
Greg Hudson [Fri, 4 Nov 2011 18:39:35 +0000 (18:39 +0000)]
Get rid of fake-install

Instead, use $(BUILDTOP)/plugins as the plugin base for tests.  For
each real plugin module, create a link in the parent directory if
we're doing a shared-library build--so built KDB modules can be found
in plugins/kdb, preauth modules in plugins/preauth, etc..

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25436 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoAdd cross-realm support to "make testrealm"
Greg Hudson [Fri, 4 Nov 2011 17:15:37 +0000 (17:15 +0000)]
Add cross-realm support to "make testrealm"

Allow "make testrealm CROSSNUM=N" to make N fully-connected realms for
cross-realm testing convenience.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25435 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoUpdated the documentation for the propagation
Zhanna Tsitkov [Fri, 4 Nov 2011 17:13:39 +0000 (17:13 +0000)]
Updated the documentation for the propagation

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25434 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoExit on error in kadmind kprop child
Greg Hudson [Fri, 4 Nov 2011 05:53:23 +0000 (05:53 +0000)]
Exit on error in kadmind kprop child

When we fork from kadmind to dump the database and kprop to an iprop
slave, if we encounter an error in the child process we should exit
rather than returning to the main loop.

ticket: 7000
target_version: 1.10
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25433 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoGet rid of periods in Python test success messages
Greg Hudson [Thu, 3 Nov 2011 17:42:46 +0000 (17:42 +0000)]
Get rid of periods in Python test success messages

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25432 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoClean up realms as we go in t_crossrealm.py
Greg Hudson [Thu, 3 Nov 2011 17:42:43 +0000 (17:42 +0000)]
Clean up realms as we go in t_crossrealm.py

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25431 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoFix typos in k5test.py
Greg Hudson [Thu, 3 Nov 2011 17:42:41 +0000 (17:42 +0000)]
Fix typos in k5test.py

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25430 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoAdd cross-realm tests to python test framework
Greg Hudson [Thu, 3 Nov 2011 17:27:59 +0000 (17:27 +0000)]
Add cross-realm tests to python test framework

Add a cross_realms function to k5test.py to generate several linked
realms.  Add a test script t_crossrealm.py to exercise six different
cross-realm scenarios.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25429 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoConditionalize po subdir on msgfmt, not dgetext
Greg Hudson [Tue, 1 Nov 2011 03:49:16 +0000 (03:49 +0000)]
Conditionalize po subdir on msgfmt, not dgetext

The presence of dgettext in libc or libintl doesn't imply that msgfmt
is installed, so conditionalize building the po subdir on whether
msgfmt is installed.

ticket: 6997
target_version: 1.10
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25425 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoMake krb5_check_clockskew public
Greg Hudson [Mon, 31 Oct 2011 16:43:40 +0000 (16:43 +0000)]
Make krb5_check_clockskew public

Rename krb5int_check_clockskew to krb5_check_clockskew and make it
public, in order to give kdcpreauth plugins a way to check timestamps
against the configured clock skew.

ticket: 6996
target_version: 1.10
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25424 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoAdded instruction on how to build this Sphinx documentation
Zhanna Tsitkov [Sun, 30 Oct 2011 21:52:18 +0000 (21:52 +0000)]
Added instruction on how to build this Sphinx documentation

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25423 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoUse zero-filled states for all async ops in KDC
Greg Hudson [Fri, 28 Oct 2011 16:18:45 +0000 (16:18 +0000)]
Use zero-filled states for all async ops in KDC

There have been a couple of uninitialized field bugs in the
restructured KDC code, partly because compilers can't find these bugs
as easily as they can find uninitialized local variable bugs.  Use
zero-filled state structures to make this type of bug less likely.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25422 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoExpanded documentation on configure/build options
Zhanna Tsitkov [Fri, 28 Oct 2011 15:59:54 +0000 (15:59 +0000)]
Expanded documentation on configure/build options

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25421 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoAdded "Unable to find requested database type" to the troubleshooting doc
Zhanna Tsitkov [Fri, 28 Oct 2011 15:55:11 +0000 (15:55 +0000)]
Added "Unable to find requested database type" to the troubleshooting doc

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25420 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoInitialize typed_e_data in as_req_state
Greg Hudson [Fri, 28 Oct 2011 15:53:50 +0000 (15:53 +0000)]
Initialize typed_e_data in as_req_state

The typed_e_data field in struct as_req_state was not properly
initialized, causing the KDC to sometimes respond with typed-data
e_data for a preauth-required error when the client sends no padata.
This bug was masked with recent clients, which send a
KRB5_ENCPADATA_REQ_ENC_PA_REP padata.

ticket: 6995
target_version: 1.10
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25419 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoFix intermediate key length in hmac-md5 checksum
Greg Hudson [Fri, 28 Oct 2011 15:45:03 +0000 (15:45 +0000)]
Fix intermediate key length in hmac-md5 checksum

When using hmac-md5, the intermediate key length is the output of the
hash function (128 bits), not the input key length.  Relevant if the
input key is not an RC4 key.

ticket: 6994
target_version: 1.10
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25418 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoFix format string for TRACE_INIT_CREDS_SERVICE
Greg Hudson [Wed, 26 Oct 2011 22:34:21 +0000 (22:34 +0000)]
Fix format string for TRACE_INIT_CREDS_SERVICE

This should also be pulled up to 1.10.

ticket: 6993
tags: pullup
target_version: 1.9.2

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25417 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoMake krb5_find_authdata public
Greg Hudson [Tue, 25 Oct 2011 18:30:14 +0000 (18:30 +0000)]
Make krb5_find_authdata public

Rename krb5int_find_authdata to krb5_find_authdata and make it public.

ticket: 6992
target_version: 1.10
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25414 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoRefactor salt computation into libkdb5
Greg Hudson [Mon, 24 Oct 2011 15:09:32 +0000 (15:09 +0000)]
Refactor salt computation into libkdb5

Add a new API krb5_dbe_compute_salt() to determine the salt for a key
data entry, and use it in the three places we currently compute salts.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25410 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoRevised KDC propagation section.
Zhanna Tsitkov [Fri, 21 Oct 2011 23:15:27 +0000 (23:15 +0000)]
Revised KDC propagation section.
Removed rst files that are not used any more.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25406 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoAdd MIT Kerberos License notice file
Zhanna Tsitkov [Fri, 21 Oct 2011 21:14:13 +0000 (21:14 +0000)]
Add MIT Kerberos License notice file

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25405 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoUpdated "MIT Kerberos defaults" with references to the internet drafts/standards...
Zhanna Tsitkov [Fri, 21 Oct 2011 19:31:41 +0000 (19:31 +0000)]
Updated "MIT Kerberos defaults" with references to the internet drafts/standards and projects

On the unrelated note, commiting the reference to the new API krb5_pac_sign in  krb_appldev/refs/api/index.rst

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25404 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoUpdated some of the topics related to "how to build Kerberos"
Zhanna Tsitkov [Fri, 21 Oct 2011 19:10:57 +0000 (19:10 +0000)]
Updated some of the topics related to "how to build Kerberos"

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25403 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoRemove unneeded stuff from util directory
Zhanna Tsitkov [Fri, 21 Oct 2011 17:52:14 +0000 (17:52 +0000)]
Remove unneeded stuff from util directory

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25398 dc483132-0cff-0310-8789-dd5450dbe970

13 years agofix tar invocation in mkrel
Tom Yu [Fri, 21 Oct 2011 17:35:49 +0000 (17:35 +0000)]
fix tar invocation in mkrel

Fix the tar invocation in mkrel so that it defaults to using "tar" as
the tar program rather than "gtar".

This should probably be pulled up to at least 1.9 and 1.8 as well.

ticket: 6989
target_version: 1.10
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25395 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoAdded documentation on how to build Kerberos. Mainly from the Installation Guide...
Zhanna Tsitkov [Thu, 20 Oct 2011 22:50:22 +0000 (22:50 +0000)]
Added documentation on how to build Kerberos. Mainly from the Installation Guide with some corrections

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25393 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoFix handling of null edata method in KDC preauth
Greg Hudson [Thu, 20 Oct 2011 15:16:03 +0000 (15:16 +0000)]
Fix handling of null edata method in KDC preauth

Correctly include an empty padata value if a KDC preauth system has no
get_edata method.  This bug prevented the KDC from indicating FAST
support in preauth-required errors.

ticket: 6988
target_version: 1.10
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25385 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoFix krb5_cc_set_config
Greg Hudson [Thu, 20 Oct 2011 03:45:12 +0000 (03:45 +0000)]
Fix krb5_cc_set_config

krb5_cc_set_config has been non-functional since r24753 on cache types
which don't support removal of credential entries.  Fix it by only
calling krb5_cc_remove_cred if data is NULL, since krb5_cc_store_cred
will do it anyway in the positive case.

Also fix an old memory leak in an uncommon error case.

ticket: 6987
target_version: 1.10
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25384 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoUpdated kpropd option list
Zhanna Tsitkov [Tue, 18 Oct 2011 19:35:06 +0000 (19:35 +0000)]
Updated kpropd option list

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25371 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoSA-2011-006 KDC denial of service [CVE-2011-1527 CVE-2011-1528 CVE-2011-1529]
Tom Yu [Tue, 18 Oct 2011 18:51:35 +0000 (18:51 +0000)]
SA-2011-006 KDC denial of service [CVE-2011-1527 CVE-2011-1528 CVE-2011-1529]

Fix null pointer dereference and assertion failure conditions that
could cause a denial of service.

ticket: 6981
target_version: 1.10
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25368 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoEnsure termination in Windows vsnprintf wrapper
Greg Hudson [Tue, 18 Oct 2011 16:32:28 +0000 (16:32 +0000)]
Ensure termination in Windows vsnprintf wrapper

The Windows _vsnprintf does not terminate its output buffer in the
overflow case.  Make sure we do that in the wrapper.  Reported by
Chris Hecker.

(Not an issue for KfW 3.2 since we weren't using snprintf in 1.6.x
except in Unix-specific code.)

ticket: 6980
target_version: 1.10
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25367 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoBump release numbers in definitions.texinfo
Tom Yu [Mon, 17 Oct 2011 22:54:12 +0000 (22:54 +0000)]
Bump release numbers in definitions.texinfo

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25365 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoNoted that kadmind should be restarted if its acl file has been changed
Zhanna Tsitkov [Mon, 17 Oct 2011 20:17:08 +0000 (20:17 +0000)]
Noted that kadmind should be restarted if its acl file has been changed

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25364 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoDelete Network Identity Manager
Tom Yu [Mon, 17 Oct 2011 19:34:08 +0000 (19:34 +0000)]
Delete Network Identity Manager

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25363 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoMake reindent
Tom Yu [Mon, 17 Oct 2011 19:11:01 +0000 (19:11 +0000)]
Make reindent

Also fix pkinit_crypto_nss.c struct initializers and add parens to a
ternary operator in do_as_req.c for better indentation.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25362 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoExclude util/wshelper from reindent
Tom Yu [Mon, 17 Oct 2011 19:10:52 +0000 (19:10 +0000)]
Exclude util/wshelper from reindent

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25361 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoAdd AC_LANG_SOURCE to PKINIT NSS version check
Greg Hudson [Mon, 17 Oct 2011 17:15:31 +0000 (17:15 +0000)]
Add AC_LANG_SOURCE to PKINIT NSS version check

The configure.in code for the PKINIT NSS back end version check was
copied from the k5crypto NSS back end version check, but from before
r25181 which added AC_LANG_SOURCE wrappers.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25360 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoStyle police
Greg Hudson [Mon, 17 Oct 2011 04:05:56 +0000 (04:05 +0000)]
Style police

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25359 dc483132-0cff-0310-8789-dd5450dbe970

13 years agogssalloc-related fixes to naming_exts.c
Sam Hartman [Mon, 17 Oct 2011 00:45:30 +0000 (00:45 +0000)]
gssalloc-related fixes to naming_exts.c

renamed kg_data_list_to_buffer_set_nocopy to data_list_buffer_set
(since nocopy is no longer guaranteed).
removed extra indirection to input krb5_data list.
ensured input krb5_data list is always completely freed.
no longer returns EINVAL when output buffer set is NULL.
fixed krb5_gss_get_name_attribute to use data_to_gss.

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25358 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoRFC 4120 says that we should not canonicalize using DNS. We cannot get
Sam Hartman [Mon, 17 Oct 2011 00:45:23 +0000 (00:45 +0000)]
RFC 4120 says that we should not canonicalize using DNS. We cannot get
that far today, but there's no reason we should fail to use a
perfectly good principal name just because DNS is failing. For some
services there isn't even a requirement they be in DNS. With
AI_ADDRCONFIG there's no reason that Kerberos canonicalization should
fail simply because a v6 address is not present, for example.  So, if
getaddrinfo fails in krb5_sname_to_principal simply use the input
hostname uncanonicalized.

sn2princ: On getaddrinfo failure use the input

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25357 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoAllow password changes over NATs
Greg Hudson [Sat, 15 Oct 2011 16:56:30 +0000 (16:56 +0000)]
Allow password changes over NATs

In the kpasswd server code, don't set a remote address in the auth
context before calling krb5_rd_priv, since the kpasswd protocol is
well-protected against reflection attacks.  This allows password
changes to work in cases where a NAT has changed the client IP address
as it is seen by the server.

ticket: 6979

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25356 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoAllow rd_priv/rd_safe without remote address
Greg Hudson [Sat, 15 Oct 2011 16:56:26 +0000 (16:56 +0000)]
Allow rd_priv/rd_safe without remote address

Allow krb5_rd_priv and krb5_rd_safe to work when there is no remote
address set in the auth context, unless the KRB5_AUTH_CONTEXT_DO_TIMES
flag is set (in which case we need the remote address for the replay
cache name).  Note that failing to set the remote address can create a
vulnerability to reflection attacks in some protocols, although it is
fairly easy to defend against--either use sequence numbers, or make
sure that requests don't look like replies, or both.

ticket: 6978

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25355 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoUpdate mit-krb5.pot
Greg Hudson [Sat, 15 Oct 2011 16:31:00 +0000 (16:31 +0000)]
Update mit-krb5.pot

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25354 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoInstall krb5/preauth_plugin.h
Greg Hudson [Sat, 15 Oct 2011 16:29:28 +0000 (16:29 +0000)]
Install krb5/preauth_plugin.h

The clpreauth and kdcpreauth pluggable interfaces are public as of
krb5 1.10.  Install the header so that preauth modules can be built
outside of the krb5 source tree.

ticket: 6977

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25353 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoRename PAC type constants to avoid conflicts
Greg Hudson [Sat, 15 Oct 2011 16:26:27 +0000 (16:26 +0000)]
Rename PAC type constants to avoid conflicts

Since the PAC type constants are now exposed in krb5.h, give them a
KRB5_ prefix so they don't conflict with similar PAC type constants
in other packages, like Samba.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25352 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoHide gak_fct interface and arguments in clpreauth
Greg Hudson [Sat, 15 Oct 2011 16:06:03 +0000 (16:06 +0000)]
Hide gak_fct interface and arguments in clpreauth

Remove the gak_fct, gak_data, salt, s2kparams, and as_key arguments
of krb5_clpreauth_process_fn and krb5_clpreauth_tryagain_fn.  To
replace them, add two callbacks: one which gets the AS key using the
previously selected etype-info2 information, and a second which lets
the module replace the AS key with one it has computed.

This changes limits module flexibility in a few ways.  Modules cannot
check whether the AS key was already obtained before asking for it,
and they cannot use the etype-info2 salt and s2kparams for purposes
other than getting the password-based AS key.  It is believed that
of existing preauth mechanisms, only SAM-2 preauth needs more
flexibility than the new interfaces provide, and as an internal legacy
mechanism it can cheat.  Future mechanisms should be okay since the
current IETF philosophy is that etype-info2 information should not be
used for other purposes.

ticket: 6976

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25351 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoDrop retransmits while processing requests
Greg Hudson [Sat, 15 Oct 2011 15:35:46 +0000 (15:35 +0000)]
Drop retransmits while processing requests

Supporting asynchronous preauth modules means that the KDC can receive
a retransmitted request before it finishes processing the initial
request.  Ignore those retransmits instead of processing them.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25350 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoUntabify kdc_preauth_encts.c
Greg Hudson [Sat, 15 Oct 2011 15:08:02 +0000 (15:08 +0000)]
Untabify kdc_preauth_encts.c

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25349 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoMake kdcpreauth edata method respond via callback
Greg Hudson [Sat, 15 Oct 2011 15:06:37 +0000 (15:06 +0000)]
Make kdcpreauth edata method respond via callback

From npmccallum@redhat.com with changes.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25348 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoMake get_preauth_hint_list respond via callback
Greg Hudson [Sat, 15 Oct 2011 15:03:17 +0000 (15:03 +0000)]
Make get_preauth_hint_list respond via callback

From npmccallum@redhat.com with changes.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25347 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoRemove enc-timestamp code from kdc_preauth.c
Greg Hudson [Sat, 15 Oct 2011 15:03:10 +0000 (15:03 +0000)]
Remove enc-timestamp code from kdc_preauth.c

This code should have been removed in r25319 but was not.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25346 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoExclude more stuff from make reindent
Tom Yu [Fri, 14 Oct 2011 23:14:53 +0000 (23:14 +0000)]
Exclude more stuff from make reindent

Apply exclusions to "make reindent" as well, to fully exclude some
files from whitespace cleanups.  Add fnmatch.c to exclusions.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25345 dc483132-0cff-0310-8789-dd5450dbe970

13 years agomake depend
Tom Yu [Fri, 14 Oct 2011 18:19:36 +0000 (18:19 +0000)]
make depend

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25344 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoUntabify a recent gssapi_alloc.h change
Greg Hudson [Fri, 14 Oct 2011 15:14:57 +0000 (15:14 +0000)]
Untabify a recent gssapi_alloc.h change

Also mark the file as using the krb5 C style.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25343 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoFix gssapi_strdup
Sam Hartman [Fri, 14 Oct 2011 15:07:01 +0000 (15:07 +0000)]
Fix gssapi_strdup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25342 dc483132-0cff-0310-8789-dd5450dbe970

13 years agogssalloc memory management for gss_buffer_set
Sam Hartman [Fri, 14 Oct 2011 14:46:57 +0000 (14:46 +0000)]
gssalloc memory management for gss_buffer_set

compiles, but untested

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25341 dc483132-0cff-0310-8789-dd5450dbe970

13 years agobuild profile dll (xpprof32/64.dll) on windows
Sam Hartman [Fri, 14 Oct 2011 14:44:35 +0000 (14:44 +0000)]
build profile dll (xpprof32/64.dll) on windows

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25340 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoFurther attempt at removing K4 specific code from the leash executable
Sam Hartman [Fri, 14 Oct 2011 14:42:37 +0000 (14:42 +0000)]
Further attempt at removing K4 specific code from the leash executable
Updates to leash Makefile.in to make it link on Windows 64

Signed-off-by: Alexey Melnikov <aamelnikov@gmail.com>
leash link fixes: fix mfc library and fix path to wshelper

MFC100D.lib for mscv2010; util\wshelper instead of windows\wshelper

Add ver.rc for leash

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25339 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoFixed some warnings and Windows 64 portability issues in the leash executable
Sam Hartman [Fri, 14 Oct 2011 14:40:36 +0000 (14:40 +0000)]
Fixed some warnings and Windows 64 portability issues in the leash executable

Signed-off-by: Alexey Melnikov <aamelnikov@gmail.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25338 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoFixed some warnings in libwin
Sam Hartman [Fri, 14 Oct 2011 14:40:32 +0000 (14:40 +0000)]
Fixed some warnings in libwin

Signed-off-by: Alexey Melnikov <aamelnikov@gmail.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25337 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoUpdated resource file dependencies for leashdll
Sam Hartman [Fri, 14 Oct 2011 14:40:28 +0000 (14:40 +0000)]
Updated resource file dependencies for leashdll

Signed-off-by: Alexey Melnikov <aamelnikov@gmail.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25336 dc483132-0cff-0310-8789-dd5450dbe970

13 years agore-remove windows/gss from windows build
Sam Hartman [Fri, 14 Oct 2011 14:40:24 +0000 (14:40 +0000)]
re-remove windows/gss from windows build

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25335 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoFix windows fork detection
Sam Hartman [Fri, 14 Oct 2011 14:40:20 +0000 (14:40 +0000)]
Fix windows fork detection

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25334 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoAdd "-dce" commandline option to gss-client.c to set GSS_C_DCE_STYLE flag
Sam Hartman [Fri, 14 Oct 2011 14:40:17 +0000 (14:40 +0000)]
Add "-dce" commandline option to gss-client.c to set GSS_C_DCE_STYLE flag

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25333 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoUse gssalloc memory management where appropriate
Sam Hartman [Fri, 14 Oct 2011 14:40:10 +0000 (14:40 +0000)]
Use gssalloc memory management where appropriate

gss_buffer_t may be freed in a different module from where they
are allocated so it is not safe to use strdup/malloc/calloc/free.
similarly, gss_OID_set need to use gssalloc functions.

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25332 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoUtility functions to move allocations from k5buf/krb5_data to gss_buffer_t
Sam Hartman [Fri, 14 Oct 2011 14:40:05 +0000 (14:40 +0000)]
Utility functions to move allocations from k5buf/krb5_data to gss_buffer_t

On Unix, these simply move the buffer pointer, but on windows they need to
reallocated with gssalloc_malloc and coied since the gss_buffer_t may need
to be freed in a separate module with potentially mismatched c runtime.

Also fix a mismatched parameter warning in generic_gss_copy_oid_set().

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25331 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoAdd new header gssapi_alloc.h
Sam Hartman [Fri, 14 Oct 2011 14:39:01 +0000 (14:39 +0000)]
Add new header gssapi_alloc.h

Contains allocator methods for use with mechanisms and mechglues for
allocations that must be made in one module but freed in another.  On
windows, an allocation made in one module cannot safely be freed in
another using the usual c runtime malloc/free; runtime dll mismatch
will cause heap corruption in that case.  But it is safe to instead
directly use HeapAlloc()/HeapFree() specifying the default process
heap.  For now, this header is not public. If it becomes public
strncpy will need to be used instead of strlcpy.

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25330 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoSimplify gss_indicate_mechs() by using generic_gss_copy_oid_set
Sam Hartman [Fri, 14 Oct 2011 14:37:14 +0000 (14:37 +0000)]
Simplify gss_indicate_mechs() by using generic_gss_copy_oid_set

...instead of hand-duplicating all the logic therein.  Also makes
the switch to using gssalloc functions with oid_sets easier.

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25329 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoRemoved unused macros
Zhanna Tsitkov [Fri, 14 Oct 2011 14:25:23 +0000 (14:25 +0000)]
Removed unused macros

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25328 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoAdd PKINIT NSS support
Greg Hudson [Thu, 13 Oct 2011 16:07:23 +0000 (16:07 +0000)]
Add PKINIT NSS support

Add an implementation of PKINIT using NSS instead of OpenSSL, from
nalin@redhat.com.

ticket: 6975

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25327 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoFix the doxygen comments for krb5_pac_sign
Zhanna Tsitkov [Wed, 12 Oct 2011 17:57:33 +0000 (17:57 +0000)]
Fix the doxygen comments for krb5_pac_sign

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25326 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoMake krb5_pac_sign public
Greg Hudson [Wed, 12 Oct 2011 16:34:07 +0000 (16:34 +0000)]
Make krb5_pac_sign public

krb5int_pac_sign was created as a private API because it is only
needed by the KDC.  But it is actually used by DAL or authdata plugin
modules, not the core KDC code.  Since plugin modules should not need
to consume internal libkrb5 functions, rename krb5int_pac_sign to
krb5_pac_sign and make it public.

ticket: 6974

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25325 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoDocumentation pass over preauth_plugin.h
Greg Hudson [Wed, 12 Oct 2011 15:05:39 +0000 (15:05 +0000)]
Documentation pass over preauth_plugin.h

No functional changes.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25324 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoFix a memory leak in make_gss_checksum
Greg Hudson [Fri, 7 Oct 2011 22:17:06 +0000 (22:17 +0000)]
Fix a memory leak in make_gss_checksum

From greg.mcclement@sap.com.

ticket: 6972
target_version: 1.9.2
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25323 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoRemoved references to non-existing krb5_default_local_realm(3) and some source-code...
Zhanna Tsitkov [Fri, 7 Oct 2011 21:19:41 +0000 (21:19 +0000)]
Removed references to non-existing krb5_default_local_realm(3) and some source-code-defined macros from the administration programs documentation.
Also, minor cleanup & corrections.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25322 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoMinor updates and correction of the RST documents
Zhanna Tsitkov [Fri, 7 Oct 2011 16:33:25 +0000 (16:33 +0000)]
Minor updates and correction of the RST documents

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25321 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoMinor cleanups to encrypted challenge
Greg Hudson [Fri, 7 Oct 2011 14:44:15 +0000 (14:44 +0000)]
Minor cleanups to encrypted challenge

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25320 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoUse built-in modules for encrypted timestamp
Greg Hudson [Fri, 7 Oct 2011 14:26:25 +0000 (14:26 +0000)]
Use built-in modules for encrypted timestamp

Break out the encrypted timestamp code from kdc_preauth.c and
preauth2.c into built-in modules, allowing admins to disable it and
reducing the size of the framework code.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25319 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoAdd get_string, free_string kdcpreauth callbacks
Greg Hudson [Thu, 6 Oct 2011 20:08:29 +0000 (20:08 +0000)]
Add get_string, free_string kdcpreauth callbacks

String attributes should be useful to preauth modules without having
to link against libkdb5.  Add a callback to make client string
attributes accessible to modules.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25318 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoDitch fast_factor.h since it contains only stubs
Greg Hudson [Thu, 6 Oct 2011 19:24:56 +0000 (19:24 +0000)]
Ditch fast_factor.h since it contains only stubs

Leave a comment behind where we called fast_set_kdc_verified().
Remove the call to fast_kdc_replace_reply_key() since it's wrong
(encrypted challenge doesn't replace the reply key in that sense).

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25317 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoInitialize localname on error in gss_localname
Greg Hudson [Thu, 6 Oct 2011 16:38:35 +0000 (16:38 +0000)]
Initialize localname on error in gss_localname

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25316 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoUse type-safe callbacks in preauth interface
Greg Hudson [Thu, 6 Oct 2011 16:18:56 +0000 (16:18 +0000)]
Use type-safe callbacks in preauth interface

Replace the generic get_data functions in clpreauth and kdcpreauth
with structures containing callback functions.  Each structure has a
minor version number to allow adding new callbacks.

For simplicity, the new fast armor key callbacks return aliases, which
is how we would supply the armor key as a function parameter.  The new
client keys callback is paired with a free_keys callback to reduce the
amount of cleanup code needed in modules.

ticket: 6971

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25315 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoRemove edata code in sample preauth plugins
Greg Hudson [Wed, 5 Oct 2011 22:11:19 +0000 (22:11 +0000)]
Remove edata code in sample preauth plugins

The code assumes unstructured edata and would be somewhat annoying to
reframe in terms of pa-data.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25314 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoReplace gss_pname_to_uid with gss_localname in gss-server.c
Sam Hartman [Wed, 5 Oct 2011 21:31:08 +0000 (21:31 +0000)]
Replace gss_pname_to_uid with gss_localname in gss-server.c

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25313 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoReplace gss_pname_to_uid with gss_localname in gssapi32.def
Sam Hartman [Wed, 5 Oct 2011 21:30:59 +0000 (21:30 +0000)]
Replace gss_pname_to_uid with gss_localname in gssapi32.def

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25312 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoDon't need to check for fork on windows
Sam Hartman [Wed, 5 Oct 2011 21:30:55 +0000 (21:30 +0000)]
Don't need to check for fork on windows

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25311 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoAdd krb5int_gettimeofday to k5sprt for platforms w/o native gettimeofday
Sam Hartman [Wed, 5 Oct 2011 21:30:50 +0000 (21:30 +0000)]
Add krb5int_gettimeofday to k5sprt for platforms w/o native gettimeofday

Microsecond accuracy on _WIN32, but only one second accuracy on other,
AFAIK purely hypothetical, platforms that lack native gettimeofday.
Shamelessly cribbed from Heimdal.

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25310 dc483132-0cff-0310-8789-dd5450dbe970

13 years agogss_unwrap_iov crashes with stream buffers for 3des, des, rc4
Sam Hartman [Wed, 5 Oct 2011 21:30:42 +0000 (21:30 +0000)]
gss_unwrap_iov crashes with stream buffers for 3des, des, rc4

Use correct key to determine enctype for KG2 tokens in
kg_unseal_stream_iov

Tested with AES for a new enctype and 3DES for an old enctype.

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 6970
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25309 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoFrom: Sam Hartman <hartmans@debian.org>
Sam Hartman [Wed, 5 Oct 2011 21:30:31 +0000 (21:30 +0000)]
From: Sam Hartman <hartmans@debian.org>

Pkinit: offer supported KDFs in client

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25308 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoAdd tests to pkinit_kdf_test to test SHA-256/AES and SHA-512/DES3
Sam Hartman [Wed, 5 Oct 2011 21:30:28 +0000 (21:30 +0000)]
Add tests to pkinit_kdf_test to test SHA-256/AES and SHA-512/DES3

Signed-off-by: Margaret Wasserman <mrw@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25307 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoMake alg agility KDF work properly when the hash length differs from the key length
Sam Hartman [Wed, 5 Oct 2011 21:30:24 +0000 (21:30 +0000)]
Make alg agility KDF work properly when the hash length differs from the key length

Signed-off-by: Margaret Wasserman <mrw@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25306 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoClean up unused constants
Sam Hartman [Wed, 5 Oct 2011 21:30:20 +0000 (21:30 +0000)]
Clean up unused constants

From: Margaret Wasserman <mrw@painless-security.com>

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25305 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoMake pkinit fall back to octetstring2key() if there are not matching KDFs
Sam Hartman [Wed, 5 Oct 2011 21:30:16 +0000 (21:30 +0000)]
Make pkinit fall back to octetstring2key() if there are not matching KDFs

From: Margaret Wasserman <mrw@painless-security.com>

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25304 dc483132-0cff-0310-8789-dd5450dbe970

13 years agoTreat the client's list of supported KDFs as an unordered list
Sam Hartman [Wed, 5 Oct 2011 21:30:12 +0000 (21:30 +0000)]
Treat the client's list of supported KDFs as an unordered list

Signed-off-by: Margaret Wasserman <mrw@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25303 dc483132-0cff-0310-8789-dd5450dbe970