Sam Hartman [Wed, 28 Sep 2011 20:55:40 +0000 (20:55 +0000)]
Added CCLIB Makefile definition on Windows to hold import library for CCAPI
Signed-off-by: Alexey Melnikov <aamelnikov@gmail.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25262
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 28 Sep 2011 20:55:36 +0000 (20:55 +0000)]
Updated dependencies for the resource file
Signed-off-by: Alexey Melnikov <aamelnikov@gmail.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25261
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 28 Sep 2011 20:55:32 +0000 (20:55 +0000)]
Rationalized versioning resources and made KFW versions independent from non Windows releases
Signed-off-by: Alexey Melnikov <aamelnikov@gmail.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25260
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 28 Sep 2011 20:55:28 +0000 (20:55 +0000)]
Removed unused version.rc
Signed-off-by: Alexey Melnikov <aamelnikov@gmail.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25259
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 28 Sep 2011 20:55:23 +0000 (20:55 +0000)]
Enabled unconditional build of kfwlogon on Windows
Removed dependency on KFW, as it is now a part of the same build.
Signed-off-by: Alexey Melnikov <aamelnikov@gmail.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25258
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 28 Sep 2011 20:55:18 +0000 (20:55 +0000)]
Moved LoadFuncs/UnloadFuncs() to windows/lib
Signed-off-by: Alexey Melnikov <aamelnikov@gmail.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25257
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 28 Sep 2011 20:55:14 +0000 (20:55 +0000)]
Removed code protected by NO_KRB4, eliminated warnings about unused variables
Signed-off-by: Alexey Melnikov <aamelnikov@gmail.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25256
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 28 Sep 2011 20:55:10 +0000 (20:55 +0000)]
Eliminated lots of warnings about not typecasting char * to wchar_t *
Fixed various warnings in leashdll
Unused variables, dropping of const from "const char *", etc.
Signed-off-by: Alexey Melnikov <aamelnikov@gmail.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25255
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 28 Sep 2011 20:55:06 +0000 (20:55 +0000)]
Disable AFS related code for now
Building with AFS is to be fixed later.
Signed-off-by: Alexey Melnikov <aamelnikov@gmail.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25254
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 28 Sep 2011 20:55:02 +0000 (20:55 +0000)]
Updated a textual resource to match the .rc file include
Signed-off-by: Alexey Melnikov <aamelnikov@gmail.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25253
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 28 Sep 2011 20:54:58 +0000 (20:54 +0000)]
Fixed resource file compilation in leashdll
Signed-off-by: Alexey Melnikov <aamelnikov@gmail.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25252
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 28 Sep 2011 20:54:53 +0000 (20:54 +0000)]
Removed code protected by NO_KRB4
Also, Remove more Kerberos v4 related code which wasn't protected by NO_KRB4
From: Alexey Melnikov <alexey.melnikov@isode.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25251
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 28 Sep 2011 20:54:49 +0000 (20:54 +0000)]
if krb5_get_default_config_files() returns success and
an empty list, then get_profile_file() will attempt
to dereference a null pointer. check for the empty
list and treat it as failure.
Patch by Jeffrey Altman.
From: Alexey Melnikov <alexey.melnikov@isode.com>
leashw32: get_profile_file
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25250
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 28 Sep 2011 20:54:45 +0000 (20:54 +0000)]
If the KRB5CCNAME variable gets set to the empty string
there will be no credential cache and the automatic credential
cache detection will be skipped. Ensure that the KRB5CCNAME
variable is not set to an empty string by us. If it was set
to the empty string by someone else, unset it.
Patch by Jeffrey Altman.
From: Alexey Melnikov <alexey.melnikov@isode.com>
leashw32: do not set KRB5CCNAME to empty string
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25249
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 28 Sep 2011 20:54:41 +0000 (20:54 +0000)]
miscellaneous leash32.dll corrections
do not build leash32.dll with MessageBox() calls. Doing
so produces a library that on error must display a dialog
box to the end user. If this library is called from a
service (via gssapi32.dll) the service will block forever
while awaiting the dialog box to clear.
LeashKRB5GetTickets() treats krbv5Context as an in/out variable.
If the caller does not provide a krb5_context, one will be allocated.
It is up to the caller to ensure that the context is eventually freed.
A context can be returned even if the function returns an error.
Make sure that 'ctx' and 'cache' are properly initialized so that
it is possible to tell the difference. Do not free the context if
it was locally allocated.
In acquire_tkt_no_princ() do not set the KRB5CCNAME environment
variable if 'ccname' is an empty string.
Combination of 2 patches by Jeffrey Altman
From: Alexey Melnikov <alexey.melnikov@isode.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25248
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 28 Sep 2011 20:54:37 +0000 (20:54 +0000)]
increase stack buffer size for res_query result
from 0x2003 to 0x8000
Patch by Jeffrey Altman
From: Alexey Melnikov <alexey.melnikov@isode.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25247
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 28 Sep 2011 20:54:33 +0000 (20:54 +0000)]
Add missing prototypes; always use ANSI prototypes
Patch by Jeffrey Altman
From: Alexey Melnikov <alexey.melnikov@isode.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25246
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 28 Sep 2011 20:54:28 +0000 (20:54 +0000)]
Initial update to KFW related source to build with K5 1.9 on Windows
From: Alexey Melnikov <alexey.melnikov@isode.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25245
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 28 Sep 2011 20:54:23 +0000 (20:54 +0000)]
Add new krb5 exported functions to loadfuncs
Patch by Jeffrey Altman:
krb5_get_error_message
krb5_free_error_message
krb5_clear_error_message
From: Alexey Melnikov <alexey.melnikov@isode.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25244
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 28 Sep 2011 20:54:16 +0000 (20:54 +0000)]
Added leashdll/wshelper related files from KFW
From: Alexey Melnikov <alexey.melnikov@isode.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25243
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 28 Sep 2011 20:54:11 +0000 (20:54 +0000)]
win-mac.h additions for windows build
windows implementation of k5_get_os_entropy()
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
Signed-off-by: Sam Hartman <hartmans@debian.org>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25242
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 28 Sep 2011 17:03:15 +0000 (17:03 +0000)]
Eliminate domain-based client realm walk
For a very long time, KDCs have known how to perform a domain-based
realm walk when serving requests for TGTs. (So if a KDC for A.B.C
receives a request for krbtgt/X.B.C and doesn't have that principal,
it can return one for krbtgt/B.C instead.) Performing the same
heuristic on the client is unnecessary and inefficient in common
cases.
Add a new function k5_client_realm_path to walk_rtree.c which uses
capaths values only, and returns a list of realms (as desired by
get_creds.c) instead of TGT names.
ticket: 6966
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25241
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 28 Sep 2011 16:05:04 +0000 (16:05 +0000)]
Update verto.c to 2011-09-28 version
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25240
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 27 Sep 2011 15:05:44 +0000 (15:05 +0000)]
Fix an error case in encrypted timestamp preauth
If krb5_encrypt_helper returns an error, it's not the caller's
responsibility to free enc_data.ciphertext, and in one case (if
krb5_c_encrypt_length returns an error) it won't have been
initialized.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25239
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Mon, 26 Sep 2011 20:23:15 +0000 (20:23 +0000)]
Documentation - Updated the API list with the new interfaces.
Added reference to the examples subdirectory in Doxygen configuration file.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25238
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Mon, 26 Sep 2011 20:06:44 +0000 (20:06 +0000)]
Make the comments usable by Doxygen
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25237
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Mon, 26 Sep 2011 15:32:41 +0000 (15:32 +0000)]
Remove CFLAGS and external deps from krb5-config --libs
r15217 apparently intended to prune $(CFLAGS) from the --libs output,
but actually substituted in the value from the invoker's environment.
Actually prune it.
Don't output external dependencies like -lresolv or -ldl in
krb5-config --libs. We already don't generate output suitable for
static linking because we omit -lkrb5support, and there is no
expectation that bringing in the krb5 API also brings in the resolv or
dl APIs for the application.
We still output internal dependencies and a com_err dependency; for
instance, e.g. krb5-config --libs gssapi outputs a dependency on -lkrb5
and -lk5crypto, which is inappropriate for a program using only GSSAPI
interfaces. Removing internal dependencies would likely break callers
who have come to depend on them, especially as we've never correctly
supported things like "krb5-config --libs gssapi krb5" for a program
using multiple APIs.
From stephane@archlinux.org with changes.
ticket: 6965
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25236
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Mon, 26 Sep 2011 15:04:39 +0000 (15:04 +0000)]
Update dependencies
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25235
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Mon, 26 Sep 2011 01:33:07 +0000 (01:33 +0000)]
Move static function prototypes from header to individual file so header
can be used in other files without warning of function defined but never
declared.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25234
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Mon, 26 Sep 2011 00:37:20 +0000 (00:37 +0000)]
Remove variables set but not used
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25233
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Mon, 26 Sep 2011 00:36:11 +0000 (00:36 +0000)]
Remove the correct execuatble and object file on make clean
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25232
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Sat, 24 Sep 2011 15:01:02 +0000 (15:01 +0000)]
Eliminate union in net-server.c struct connection
Several of the u.tcp fields were also used for RPC connections. The
overlap between u.tcp.addr_s and u.rpc.closed could confuse
free_socket() into causing a null pointer dereference inside
svc_getreqset().
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25231
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Sat, 24 Sep 2011 12:19:21 +0000 (12:19 +0000)]
Fix krb5_dbe_get_strings error handling
The old error handling was incorrect in the case where a strdup() call
returns NULL but realloc() returns non-NULL.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25230
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Sat, 24 Sep 2011 12:19:14 +0000 (12:19 +0000)]
Don't use accessor in encrypted challenge
Now that the encrypted challenge code is linked into libkrb5 and the
KDC, it's unnecessary to use the accessor there.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25229
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 23 Sep 2011 14:49:13 +0000 (14:49 +0000)]
Remove empty src/preauth/encrypted_challenge dir
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25228
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 23 Sep 2011 14:35:34 +0000 (14:35 +0000)]
Recast encrypted challenge as linked built-ins
Since it has no external dependencies, split up encrypted preauth into
clpreauth and kdcpreauth chunks and link them directly into the
consumers.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25227
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Thu, 22 Sep 2011 18:09:45 +0000 (18:09 +0000)]
Support special salt type in default krb5_dbe_cpw
This change allows the "special" salt type to be used in
supported_enctypes or in the argument to kadmin's cpw -e. If used,
kadmind will pick a salt consisting of 64 random bits represented as
16 printable ASCII characters. The use of random explicit salts
creates some interoperability issues and is not generally recommended,
but can be useful for interop testing, as a workaround for obscure
bugs, or to increase the difficulty of brute-force password searches
in situations where none of the interoperability issues apply.
ticket: 6964
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25226
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Thu, 22 Sep 2011 16:20:13 +0000 (16:20 +0000)]
Improve mk_safe/mk_priv cleanup slightly
In both functions, initialize outbuf on error, and avoid putting
pointers into it before we reach the successful return stage.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25225
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 21 Sep 2011 22:29:25 +0000 (22:29 +0000)]
Whitespace
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25224
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 21 Sep 2011 21:18:35 +0000 (21:18 +0000)]
Fix string attribute unit tests
Wrap t_stringattr in a very minimal Python test script so that libkdb5
can find the DB2 module to allocate memory.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25223
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 21 Sep 2011 18:40:43 +0000 (18:40 +0000)]
* New implementation to map a gss name to localname
* Write gss_pname_to_uid in terms of gss_localname; suppress on win32
* Add test for gss_pname_to_uid indirectly testing gss_localname
* gss_localname is the SPI, not gss_pname_to_uid
* fix some const gss_OID->gss_const_oid
Signed-off-by: Sam Hartman <hartmans@painless-security.com>
gss_localname: map gss name to localname
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25222
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 21 Sep 2011 18:40:38 +0000 (18:40 +0000)]
fix pkinit warnings
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25221
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 21 Sep 2011 18:40:33 +0000 (18:40 +0000)]
Fix typo in pkinit_kdf_test error message
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25220
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 21 Sep 2011 18:40:23 +0000 (18:40 +0000)]
Add newlines to end of status messages
Signed-off-by: Margaret Wasserman <mrw@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25219
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 21 Sep 2011 18:40:16 +0000 (18:40 +0000)]
If the client offers the alg agility KDF, use it
Signed-off-by: Margaret Wasserman <mrw@painless-security.com>
pkinit: changes to call alg-agility KDF
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25218
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 21 Sep 2011 18:40:09 +0000 (18:40 +0000)]
Reordered pkinit_server_return_padata(), so that the alg-agility
KDF can be called after the reply is encoded, as it needs the
encoded reply as one of its arguments.
Signed-off-by: Margaret Wasserman <mrw@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25217
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 21 Sep 2011 17:46:27 +0000 (17:46 +0000)]
Add stubs for new pkinit encoders
The new pkinit encoders for hash agility are in the library export
list (whereas older encoders are invoked via the accessor), so we need
to provide stubs for them if we're building without pkinit support.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25216
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 21 Sep 2011 16:29:00 +0000 (16:29 +0000)]
Add kadmin functionality for string attributes
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25215
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 21 Sep 2011 16:28:54 +0000 (16:28 +0000)]
Add KRB5_TL_STRING_ATTRS and libkdb5 accessors
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25214
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 21 Sep 2011 04:40:49 +0000 (04:40 +0000)]
Fix asn.1 encoder build without PKINIT support
Move all of the added PKINIT hash agility stuff inside the #ifndef
DISABLE_PKINIT block.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25213
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Tue, 20 Sep 2011 12:39:02 +0000 (12:39 +0000)]
Fix Openssl 1.0 function capitalization in pkinit
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25212
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Mon, 19 Sep 2011 14:52:16 +0000 (14:52 +0000)]
Make ASN.1 code build without PKINIT support
Move asn1_decode_kdf_alg_id and asn1_decode_sequence_of_kdf_alg_id
inside the #ifndef DISABLE_PKINIT block; otherwise they reference a
nonexistent asn1_decode_kdf_alg_id_ptr when PKINIT is disabled.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25211
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Mon, 19 Sep 2011 05:34:22 +0000 (05:34 +0000)]
Make pkinit_kdf_test.c compile
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25210
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Mon, 19 Sep 2011 05:34:17 +0000 (05:34 +0000)]
Formatting fixes
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25209
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 01:00:56 +0000 (01:00 +0000)]
reindent
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25208
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:59:29 +0000 (00:59 +0000)]
Fix x64 compile issues: remove bufferoverflowu.lib; this is obsolete
as of VS2005SP1. Use undecorated _DllMainCRTStartup as entry point
instead of _DllMainCRTStartup@12
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
Signed-off-by: Sam Hartman <hartmans@debian.org>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25207
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:59:24 +0000 (00:59 +0000)]
Use closesocket() instead of close() for sockets on Windows
Signed-off-by: Alexey Melnikov <aamelnikov@gmail.com>
Signed-off-by: Sam Hartman <hartmans@debian.org>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25206
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:59:20 +0000 (00:59 +0000)]
Fixed some warnings on Windows
Windows VC compiler complains about comparison between signed and unsigned
int types, unused variables
Signed-off-by: Alexey Melnikov <aamelnikov@gmail.com>
Signed-off-by: Sam Hartman <hartmans@debian.org>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25205
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:59:14 +0000 (00:59 +0000)]
Added util\profile\testmod\Makefile to the list of Makefiles generated on Windows
Signed-off-by: Alexey Melnikov <aamelnikov@gmail.com>
Signed-off-by: Sam Hartman <hartmans@debian.org>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25204
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:59:08 +0000 (00:59 +0000)]
Add KRB5_CALLCONV to krb5_init_context_profile definition in init_ctx.c Remove extraneous 'p'
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
Signed-off-by: Sam Hartman <hartmans@debian.org>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25203
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:59:02 +0000 (00:59 +0000)]
Updated copyright year in a Windows version resource
Signed-off-by: Sam Hartman <hartmans@debian.org>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25202
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:58:58 +0000 (00:58 +0000)]
Updated command line utilities not to complain about missing getopt() definition
Signed-off-by: Sam Hartman <hartmans@debian.org>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25201
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:58:52 +0000 (00:58 +0000)]
__func__ -> __FUNCTION__ in #ifdef DEBUG blocks in util_errmap.c
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
Signed-off-by: Sam Hartman <hartmans@debian.org>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25200
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:58:48 +0000 (00:58 +0000)]
Protect autoconf #defines (HAVE_FOO, et al) in win-mac.h with #ifdef KRB5_PRIVATE add -DKRB5_PRIVATE to CPPFLAGS in win-pre.in and to ALL_CXXFLAGS and ALL_CFLAGS in pre.in
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
Signed-off-by: Sam Hartman <hartmans@debian.org>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25199
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:58:43 +0000 (00:58 +0000)]
On Windows, parse mechanism info from Registry instead of mech file
Currently the code parses @sysconfdir@/gss/mech as a set of GSS
mechanisms to dynamically load. On Windows this should come from the
registry.
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
Signed-off-by: Sam Hartman <hartmans@debian.org>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25198
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:58:38 +0000 (00:58 +0000)]
Remove the ticket from the pkinit-alg-agility KDF function, to match
agreed changes to the IETF specification. Includes removing a parameter from
the KDF function, removing the ticket from the ASN.1 encoder, and updating
the test code.
Signed-off-by: Margaret Wasserman <mrw@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25197
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:54:11 +0000 (00:54 +0000)]
Asn1_encode: indicate DER compressed form without tag or length as input
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25196
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:51:39 +0000 (00:51 +0000)]
Implement encoding and decoding for supportedKDFs and kdfID
pkinit: ASN.1 encoders and decoders for new KDF
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25195
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:35:10 +0000 (00:35 +0000)]
* Extend auth_pack
* extend dh_rep
* add krb5_free_octet_data
* extend pkinit free functions
pkinit: add supportedKDFs and kdfID to structures
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25194
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:35:06 +0000 (00:35 +0000)]
Refactor to use oid instead of algorithm_id in KDF interface
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25193
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:35:01 +0000 (00:35 +0000)]
pkinit_crypto_openssl: fix signed vs unsigned comparison
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25192
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:34:57 +0000 (00:34 +0000)]
implementation of new function and test program for pkinit agility.
Implementation of pkinit_alg_agility_kdf() function to implement the
key derivation function defined in draft-ietf-krb-wg-pkinit-alg-agility-04,
and implementation of pkinit_kdf_test program to test the new KDF
against the test vector in the draft.
Signed-off-by: Margaret Wasserman <mrw@painless-security.com>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25191
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:34:52 +0000 (00:34 +0000)]
Added underlying ASN.1 structures for pkinit algorithm agility
Signed-off-by: Margaret Wasserman <mrw@painless-security.com>
tested-by: Sam Hartman <hartmans@debian.org>
fixes-from: Sam Hartman <hartmans@debian.org>
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25190
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:34:48 +0000 (00:34 +0000)]
In pkinit_crypto_openssl.c, modified pkinit_octetstring2key() to
eliminate a possible memory leak in the error path, where the
key_block->length was set to zero but the key_block->contents were
not freed. Also, changed calloc() call to a malloc() call to avoid
allocating up to 8 times as much buffer space as needed.
In keyblocks.c, modified kr5_free_keyblock_contents() to set the
key->length to zero after the key->contents have been freed.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25189
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:34:44 +0000 (00:34 +0000)]
In order for asn1_encode_oid to be called from DEFLENFNTYPE it needs
to take void * like all the other string encoders.
asn1_encode_oid: take void not asn1_octet
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25188
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:34:40 +0000 (00:34 +0000)]
asn1_encode.{c,h}: support DEFOCTETWRAPTYPE
Support a way of defining a type that indicates that the DER encoding
of some other type is wrapped inside an octet string in a produced
encoding. To support this, support encoding of tagged things where
the class is not constructed; in this case it will be primitive.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25187
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:34:36 +0000 (00:34 +0000)]
pkinit: client: Use SignedData for anonymous
Per RFc 6112 use SignedData not ContentInfo for anonymous when the KDC
offers support for PKINIT_KX padata.
ticket: 6962
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25186
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:34:31 +0000 (00:34 +0000)]
Fix pkinit warnings
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25185
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 19 Sep 2011 00:34:25 +0000 (00:34 +0000)]
Support pkinit: SignedData with no signers (KDC)
For anonymous, MIT 1.9 sends
ContentInfo rather than SignedData. This violates RFc 6112. This patch accepts the RFC 6112 style encoding.
ticket: 6961
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25184
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Sun, 18 Sep 2011 09:43:33 +0000 (09:43 +0000)]
Drop code for finding top source directory among several
possibilities, since with only one configure script now, we know
exactly where it is.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25183
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Sun, 18 Sep 2011 09:43:30 +0000 (09:43 +0000)]
Don't check for memmove, inet_ntoa, inet_aton, pthread.h, or
semaphore.h, since the results of the tests are never used.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25182
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Sun, 18 Sep 2011 09:43:25 +0000 (09:43 +0000)]
Add invocations of AC_LANG_SOURCE to deal with autoconf 2.68 warning
messages. Verified to produce the same configure script (under
autoconf 2.68 on Mac OS X) as before.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25181
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Thu, 15 Sep 2011 20:00:15 +0000 (20:00 +0000)]
Fix a typo in r25026
A stray "p" was added to krb5_init_context_profile() inside a _WIN32
block.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25180
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 14 Sep 2011 19:00:39 +0000 (19:00 +0000)]
Fix terminate_workers() in the KDC
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25179
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 14 Sep 2011 16:12:39 +0000 (16:12 +0000)]
Simplify terminate_workers() in the KDC
Fixes a bug where we wait for one too many workers to terminate after
one of them crashes.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25178
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 14 Sep 2011 16:12:36 +0000 (16:12 +0000)]
Set up monitor signal handlers before forking
This avoids a race condition where a child reports "starting..." and
begins to service requests before the monitor is ready to handle
termination signals. Really only an issue for the test suite. From
npmccallum@redhat.com.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25177
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 14 Sep 2011 16:12:33 +0000 (16:12 +0000)]
Split signal setup into loop_setup_signals()
In the KDC, set up signals in the worker process child after forking
from the monitor process. From npmccallum@redhat.com.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25176
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 14 Sep 2011 16:12:29 +0000 (16:12 +0000)]
Reinitialize verto after creating worker child
Also mark fd events as reinitiable so they survive the fork. From
npmccallum@redhat.com.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25175
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 14 Sep 2011 16:12:25 +0000 (16:12 +0000)]
Update verto sources to 2011-09-14 versions
Also add verto_reinitialize to libverto exports (missed in the last
update).
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25174
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 14 Sep 2011 15:22:11 +0000 (15:22 +0000)]
Fix verto-k5ev.h dependencies for system libverto
When we build with the internal verto, we include verto-k5ev.h in
order to create loops. When we build with the system verto, we don't
include that header file. Add depfix logic and pre.in variables to
avoid depending on verto-k5ev.h for a system verto build.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25173
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Mon, 12 Sep 2011 16:08:04 +0000 (16:08 +0000)]
Update verto sources to 2011-09-10 versions
Also update verto-k5ev.c to match changes to verto-libev.c.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25172
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Sat, 10 Sep 2011 22:58:55 +0000 (22:58 +0000)]
Wait before killing daemons in interactive k5test
If k5test is invoked with any stop, wait, or debug options, wait for
input before killing daemons, in case a daemon is being debugged.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25171
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 9 Sep 2011 21:02:55 +0000 (21:02 +0000)]
Fix verto.h dependencies for system libverto
When we have conditionally built bundled source, we need logic in
depfix.pl and variables in pre.in to avoid depending on the bundled
verto.h in generated dependencies. Add that logic for verto.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25170
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Wed, 7 Sep 2011 21:31:48 +0000 (21:31 +0000)]
Fall back to EV_USE_SELECT
ev.c explicitly disables poll() on Mac and FreeBSD, which left our
standalone version without any working back ends on Mac OS X, for
example. Fall back to using select() on these platforms.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25169
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 7 Sep 2011 19:10:25 +0000 (19:10 +0000)]
Fix some error-handling bugs in cc_dir.c
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25168
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 6 Sep 2011 23:23:43 +0000 (23:23 +0000)]
Go back to symlinks for liblinks
Now that we're not using dynamic loading for libverto-k5ev, we don't
need to use hard links for liblinks, and using them would interfere
with an AFS build tree.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25167
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 6 Sep 2011 23:23:39 +0000 (23:23 +0000)]
Change how bundled libverto is linked
Give libverto-k5ev a header file. When using the internal verto
library, link against -lverto-k5ev and use verto_default_k5ev()
instead of verto_default(), bypassing the module loading logic and
making static builds possible.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25166
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 6 Sep 2011 16:03:37 +0000 (16:03 +0000)]
Fix t_ccselect bugs
initiator_cred wasn't initialized if no second arg was given.
t_ccselect wasn't removed on make clean.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25165
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 6 Sep 2011 15:14:10 +0000 (15:14 +0000)]
Fix several bugs in gss-krb5 inq_cred
cred could be used uninitialized if krb5_timeofday() failed. defcred
had the wrong type. kg_cred_resolve() should be used instead of
krb5_gss_validate_cred() to do delayed name/ccache resolution and get
a lock.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25164
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Tue, 6 Sep 2011 11:34:32 +0000 (11:34 +0000)]
Newer GCCs optimizer catches a variable used without initialization
in the bison library code. Use a GCC pragma to suppress.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25163
dc483132-0cff-0310-8789-
dd5450dbe970