Greg Hudson [Fri, 30 Jan 2009 21:22:31 +0000 (21:22 +0000)]
Make output parameter value of krb5_rc_resolve_full well-defined on
error return.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21841
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 30 Jan 2009 21:21:10 +0000 (21:21 +0000)]
In krb5_kdcrep2creds, call the correct free function when cleaning up
the keyblock, and clean up the keyblock if krb5_copy_data fails.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21840
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Fri, 30 Jan 2009 20:40:46 +0000 (20:40 +0000)]
Changed the name match_config_pattern to krb5_match_config_pattern. Check strdup return code.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21838
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Thu, 29 Jan 2009 19:23:22 +0000 (19:23 +0000)]
Introduced match_config_pattern function to find a pattern in the config value strings
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21828
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Thu, 29 Jan 2009 01:19:01 +0000 (01:19 +0000)]
whitespace
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21826
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Thu, 29 Jan 2009 01:12:17 +0000 (01:12 +0000)]
clear outbuf[0].data to unconfuse coverity
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21825
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Wed, 28 Jan 2009 23:22:27 +0000 (23:22 +0000)]
disable single-DES by default
Mark all single-DES enctypes as "weak", and create a new libdefaults
variable "allow_weak_crypto", which defaults to "false".
ticket: 6353
status: open
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21823
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Wed, 28 Jan 2009 17:01:36 +0000 (17:01 +0000)]
include netinet/in.h to make sure we know what struct in_addr looks like
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21820
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Wed, 28 Jan 2009 05:42:11 +0000 (05:42 +0000)]
no more -r option for setting krb.conf path
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21819
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Wed, 28 Jan 2009 05:37:10 +0000 (05:37 +0000)]
remove some remnants of krb4-related config file options
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21818
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 28 Jan 2009 01:28:25 +0000 (01:28 +0000)]
return correct kvno in TGS case
krb5_c_encrypt sets the kvno of ciphertext to 0.
So fill it in after the call to encrypt_tkt_part.
ticket: 6352
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21815
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Wed, 28 Jan 2009 00:32:29 +0000 (00:32 +0000)]
Run a single expect statement to read from both client and server, to
avoid an apparent race condition on Darwin.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21814
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Wed, 28 Jan 2009 00:30:06 +0000 (00:30 +0000)]
whitespace
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21813
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Wed, 28 Jan 2009 00:04:15 +0000 (00:04 +0000)]
Start to phase out krb5_xfree macro, which just casts its argument to
char* and calls free.
Replace most uses, outside of the LDAP KDB plugin, which doesn't build
on my test system of the moment because of version dependencies. Add
one explicit cast to make the change warning-neutral (under gcc 4.0.1
on Mac OS X 10.5.6).
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21812
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Tue, 27 Jan 2009 23:14:35 +0000 (23:14 +0000)]
Helper script for processing valgrind logs that don't indicate any errors, or are for system programs
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21810
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Tue, 27 Jan 2009 22:00:15 +0000 (22:00 +0000)]
use memchr
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21809
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Tue, 27 Jan 2009 21:09:35 +0000 (21:09 +0000)]
"Coding practices" related fixes
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21808
dc483132-0cff-0310-8789-
dd5450dbe970
Luke Howard [Mon, 26 Jan 2009 22:50:02 +0000 (22:50 +0000)]
In asn1_decode_pa_for_user(), ensure that user member is allocated
before assigning a value to it.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21805
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Mon, 26 Jan 2009 21:26:33 +0000 (21:26 +0000)]
Introduced new static function prep_reprocess_req to make code more readable
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21801
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 26 Jan 2009 20:02:54 +0000 (20:02 +0000)]
gss_header|trailerlen should be unsigned int
The krb5_c_crypto_length API returns unsigned int per its design.
so, use unsigned int not size_t for its output.
ticket: 6351
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21799
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Mon, 26 Jan 2009 19:47:57 +0000 (19:47 +0000)]
Preliminary update of README for krb5-1.7 release
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21798
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 26 Jan 2009 19:06:21 +0000 (19:06 +0000)]
Use 16/32-bit big/little-endian store functions in more places
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21796
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Mon, 26 Jan 2009 16:20:41 +0000 (16:20 +0000)]
Check asprintf return codes. Styling
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21795
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Sun, 25 Jan 2009 16:44:02 +0000 (16:44 +0000)]
Use a struct in_addr to insure alignment of address - instead of
random alignment on the stack. Solaris 2.10 has issues if the address
is not aligned. The rest of the code in the tree uses a struct
in_addr or mallocs the address - which will be sufficiently aligned.
ticket: 6308
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21794
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Sat, 24 Jan 2009 01:27:16 +0000 (01:27 +0000)]
Change 16/32/64-bit big-/little-endian/native unaligned load/store
routines to take void pointers, so they can operate on both plain and
unsigned char buffers, or other types.
Remove some now-unneeded casts.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21793
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Fri, 23 Jan 2009 19:59:50 +0000 (19:59 +0000)]
Eliminate the need for the domain_realm mapping table on the client side by implementing minimal referral support in the KDC
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21792
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 23 Jan 2009 19:04:57 +0000 (19:04 +0000)]
Remove some null checks in cases where pointers can't be null
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21790
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 23 Jan 2009 19:01:56 +0000 (19:01 +0000)]
In krb5_pac_get_buffer, check the correct value for null after calling
malloc.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21789
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 23 Jan 2009 18:41:39 +0000 (18:41 +0000)]
In krb5_pac_parse, change the code around a bit to avoid harmlessly
copying an uninitialized Buffers field of a PACTYPE structure.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21788
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 23 Jan 2009 18:19:19 +0000 (18:19 +0000)]
Initialize ds.magic in k5_md5_hmac_hash, to avoid harmlessly copying
around its uninitialized value in krb5_hmac.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21787
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Fri, 23 Jan 2009 18:04:08 +0000 (18:04 +0000)]
hash db2 code breaks if st_blksize > 64k
The hash db code assumes in places that the block size is no larger
than 64K. There's a range check in the case where you don't have a
file but provide initialization info. The btree code will cap the
block size used at 64K.
Apparently Sun's ZFS can report back a block size of 128K, causing the
db2 tests to fail.
Add such a cap to the hash db creation code.
Note that our default configuration is to use the btree code when
creating a new database, so it's unlikely that this will cause
real-world problems unless someone went out of their way to specify
use of the hash format.
ticket: 6342
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21786
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 23 Jan 2009 17:53:52 +0000 (17:53 +0000)]
In krb5_get_init_creds, null out err_reply in a case where we free it
and do not necessarily exit the loop.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21785
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 23 Jan 2009 17:45:58 +0000 (17:45 +0000)]
Always initialize the output parameter in krb5_parse_name and friends
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21784
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 23 Jan 2009 17:24:50 +0000 (17:24 +0000)]
In kadmin, free the correct item in an error case (fixes a double-free
and a memory leak).
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21783
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 23 Jan 2009 06:51:03 +0000 (06:51 +0000)]
Add some output parameter initializations n order to eliminate some
spurious Coverity defects. (Far from a comprehensive pass.)
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21782
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Fri, 23 Jan 2009 05:02:07 +0000 (05:02 +0000)]
Per coding standards, don't declare variables in inner scopes in new
rcache code except when it really makes sense (option processing for
t_replay).
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21781
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Fri, 23 Jan 2009 00:46:46 +0000 (00:46 +0000)]
Include cksumtypes.h from aead.h to get struct krb5_cksumtypes (moved
in rev 21753).
Protect cksumtypes.h from multiple inclusions.
Update dependencies.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21780
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Thu, 22 Jan 2009 23:37:35 +0000 (23:37 +0000)]
fix trailing whitespace
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21779
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Thu, 22 Jan 2009 23:21:11 +0000 (23:21 +0000)]
whitespace
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21778
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Thu, 22 Jan 2009 19:19:34 +0000 (19:19 +0000)]
Adapted patch from Apple: in kadmind's process_chpw_request, make sure
to free error message strings.
ticket: 6284
status: open
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21776
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Thu, 22 Jan 2009 06:34:14 +0000 (06:34 +0000)]
If USE_VALGRIND, check that source principal is defined before copying.
Initialize magic number fields of allocated name components.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21775
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Thu, 22 Jan 2009 06:30:08 +0000 (06:30 +0000)]
If USE_VALGRIND, check readability of byte string before copying
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21774
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Thu, 22 Jan 2009 06:04:10 +0000 (06:04 +0000)]
Define valgrind macros as no-ops if not USE_VALGRIND, and use unconditionally, per Danilo's suggestion
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21773
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 21 Jan 2009 19:38:12 +0000 (19:38 +0000)]
Patch from Love: when opening an existing replay cache, check more
thoroughly to prevent symlink attacks.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21770
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 21 Jan 2009 18:23:58 +0000 (18:23 +0000)]
Patch from Luke: fix error return of krb5_gss_use_kdc_context
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21768
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Tue, 20 Jan 2009 23:49:08 +0000 (23:49 +0000)]
When encoding, and compiling with -DUSE_VALGRIND, explicitly get valgrind to check the inputs
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21766
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Tue, 20 Jan 2009 22:52:15 +0000 (22:52 +0000)]
delete trailing whitespace, including insanely long 'blank' lines
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21764
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 20 Jan 2009 18:50:51 +0000 (18:50 +0000)]
In krb5_rd_rep_dce, initialize repl to NULL to avoid using its
initialized value when we take the first goto to clean_scratch.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21763
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Sat, 17 Jan 2009 01:00:22 +0000 (01:00 +0000)]
If buffer length is 0, force pointer to NULL, to keep valgrind happier when callers don't bother
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21762
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Sat, 17 Jan 2009 00:06:06 +0000 (00:06 +0000)]
patch from Luke - minor cleanup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21761
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Sat, 17 Jan 2009 00:04:49 +0000 (00:04 +0000)]
patch from Luke - fix enctype-nego enctype list setup
ticket: 6336
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21760
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Sat, 17 Jan 2009 00:02:05 +0000 (00:02 +0000)]
patch from Luke - fix sign problem
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21759
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Fri, 16 Jan 2009 23:55:01 +0000 (23:55 +0000)]
include dependencies for decoder test
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21758
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Fri, 16 Jan 2009 00:33:00 +0000 (00:33 +0000)]
Use valgrind in more cases if VALGRIND is set
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21754
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Thu, 15 Jan 2009 23:22:53 +0000 (23:22 +0000)]
Make enctype and checksumtype name mapping table types private to the
crypto library. Add a field for aliases to the record type so that
aliases don't have to be implemented by duplicating all the other
information.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21753
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Thu, 15 Jan 2009 19:15:22 +0000 (19:15 +0000)]
Fix an additional multiple-write case noted by John, where sendauth
calls write_message twice in a row.
Add new function krb5int_write_messages, calls krb5_net_writev with
multiple messages (currently only two at a time). Use it from
krb5_write_message and krb5_sendauth.
ticket: 6339
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21752
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Thu, 15 Jan 2009 19:11:45 +0000 (19:11 +0000)]
Rework the replay cache extensions to make the hash extension records
stand alone. Otherwise, reordering of records during an expunge could
cause the hash to be applied to the wrong record.
Also add an "expunge" option to the t_replay program, and clean up some
memory-handling inconsistencies.
ticket: 1201
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21751
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Thu, 15 Jan 2009 01:13:04 +0000 (01:13 +0000)]
update
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21750
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Thu, 15 Jan 2009 00:59:27 +0000 (00:59 +0000)]
Add new routine krb5int_net_writev using scatter-gather source.
Use it from krb5_net_write to ensure testing and reduce duplication.
Use it from krb5_write_message to avoid Nagle+DelayedAck problem.
ticket: 6339
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21749
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Wed, 14 Jan 2009 23:36:04 +0000 (23:36 +0000)]
If we have a local UDP socket without the PKTINFO option set, it's
bound to a local address, so use getsockname to extract the local
(destination) address.
ticket: 6335
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21748
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Wed, 14 Jan 2009 21:29:10 +0000 (21:29 +0000)]
If recv_from_to is passed a buffer for the local endpoint address,
clobber it before doing anything else, just in case we can't retrieve
the address and the caller blindly uses the buffer anyways.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21747
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Wed, 14 Jan 2009 20:05:09 +0000 (20:05 +0000)]
Merge some very simple points of divergence in the two copies of network.c -- enum ordering, whitespace,
duplicate macro definitions, unused code, 0 vs NULL...
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21746
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Wed, 14 Jan 2009 19:50:34 +0000 (19:50 +0000)]
Pass s4u name and c_flags to log_tgs_req. If values are supplied, log
an additional message to record the name and s4u mode.
Untested for lack of code to invoke these code paths.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21745
dc483132-0cff-0310-8789-
dd5450dbe970
Russ Allbery [Wed, 14 Jan 2009 00:29:04 +0000 (00:29 +0000)]
Force tickets acquired by the kadm5 client library via password
authentication to be non-forwardable and non-proxiable, overridding
any [libdefaults] configuration. This may be necessary at sites that
set forwardable to true by default in their krb5.conf files but
disable forwardable tickets for privileged principals. Since the
ticket cache acquired by the kadm5 client library is used only for
kadmin operations, where forwardable is not useful or necessary, there
is no reason to ever attempt to obtain forwardable or proxiable tickets
here.
Ticket: 6337
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21744
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Tue, 13 Jan 2009 22:57:42 +0000 (22:57 +0000)]
Patch from Luke Howard to:
* Accept both CFX and non-CFX tokens all the time on acceptor
* Only produce an acceptor subkey if you are using cfx or dce or negotiating up to cfx
Additional changes from Sam Hartman:
* do not assume that the ticket key type (server key) is a valid target for negotiation: the client may not support it.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21742
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Tue, 13 Jan 2009 21:54:45 +0000 (21:54 +0000)]
/tmp/3
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21741
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Tue, 13 Jan 2009 19:43:18 +0000 (19:43 +0000)]
FreeBSD compiler errors out on an error "zero or negative size array"
after setting up an array with no elements.
ifdef out array declarations and code that uses it until there are entries.
Affects: krb5_gss_inquire_cred_by_oid_ops and
krb5_gss_set_sec_context_option_ops which would return an error in any
case as here are no entries in the arrays.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21740
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 12 Jan 2009 21:18:45 +0000 (21:18 +0000)]
Add a call to limit_string that appears to have been accidentally removed
somewhere along the mskrb-integ branch
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21729
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 12 Jan 2009 21:03:02 +0000 (21:03 +0000)]
Remove gss_export_name_object and gss_import_name_object.
These are not standard interfaces, are not used by our tree
and were added because they might be useful but ended up not being used.
The stubs in gssapi.hin remain as they were shipped with previous releases.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21728
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 12 Jan 2009 19:59:16 +0000 (19:59 +0000)]
Patch from Luke Howard:
Previously when using the kdb keytab, there was a check to confirm that the server
was supported as a server and that attackers
could not force an enctype downgrade.
Add these to kdc_get_server_key
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21727
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 12 Jan 2009 19:43:13 +0000 (19:43 +0000)]
Patch from Luke Howard
There's a superfluous check in kdc_util.c; ad_entry is always non NULL
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21726
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 12 Jan 2009 19:43:07 +0000 (19:43 +0000)]
Restore behavior of returning KRB5APP_ERR_BAD_INTEGRITY from
preauth methods.
This creates a problem for Windows clients, but not doing it creates a problem for MIT clients.
Today our KDC is more likely to be used with MIT clients, but we need to examine this issues in more detail.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21725
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Mon, 12 Jan 2009 19:40:37 +0000 (19:40 +0000)]
Check the return code from krb5int_clean_hostname as the sanity verification of the hostname might fail
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21724
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Mon, 12 Jan 2009 18:29:42 +0000 (18:29 +0000)]
Add message hash support to the replay interface, using extension
records (with an empty client string) to retain compatibility with old
code. For rd_req, the ciphertext of the authenticator (with no ASN.1
wrapping) is hashed; for other uses of the replay cache, no message
hash is used at this time.
This commit adds a command-line tool for testing the replay cache but
does not add any automated tests.
ticket: 1201
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21723
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Fri, 9 Jan 2009 01:42:37 +0000 (01:42 +0000)]
Follow "off-path" TGT referrals
ticket: 5627
status: open
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21720
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Fri, 9 Jan 2009 00:07:50 +0000 (00:07 +0000)]
Remove conflict marker; restore broken copyright line
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21719
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 7 Jan 2009 18:13:30 +0000 (18:13 +0000)]
kdb/keytab.c: map KRB5_KDB_NO_MATCHING_KEY to KRB5_KT_KVNONOTFOUND.
At least in cases other than tgts, this code handles its own enctype matching, so kvno not found is the only
thing that produces the no matching key error.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21718
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Wed, 7 Jan 2009 00:11:40 +0000 (00:11 +0000)]
Don't create include/kerberosIV on installation
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21717
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Tue, 6 Jan 2009 23:45:23 +0000 (23:45 +0000)]
Add support for referral null realms and use the default realm as krb5_rd_req_extended does
ticket: 5954
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21716
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Tue, 6 Jan 2009 23:45:17 +0000 (23:45 +0000)]
Remove ksu's own implementation of krb5_verify_init_creds now that it is not used
ticket: 5954
status: open
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21715
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Tue, 6 Jan 2009 23:44:56 +0000 (23:44 +0000)]
Ksu should call krb5_verify_init_creds instead of using its own function.
This was prompted by a desire for ksu to work without a domain_realm mapping for the local server, but the duplication of code is bad anyway.
ticket: 5954
Status: open
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21714
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Tue, 6 Jan 2009 22:52:50 +0000 (22:52 +0000)]
Set RELTAIL back to "trunk"
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21713
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Tue, 6 Jan 2009 22:32:30 +0000 (22:32 +0000)]
Patch from Luke Howard
to make an explicit call to check the ACL for s4u delegations rather than relying on tl-data.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21712
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Tue, 6 Jan 2009 21:48:24 +0000 (21:48 +0000)]
be a little looser in checking for tail output
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21711
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Tue, 6 Jan 2009 21:47:05 +0000 (21:47 +0000)]
remove unused file
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21710
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 6 Jan 2009 20:44:01 +0000 (20:44 +0000)]
Clean up many error-condition leaks of the server handle in the
kadmind server stubs.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21709
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 6 Jan 2009 20:24:09 +0000 (20:24 +0000)]
In kadmin, remove a bunch of checks for handle being NULL (some old,
some introduced by the last rev) when it is known from context that
handle is not NULL.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21708
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Tue, 6 Jan 2009 16:01:56 +0000 (16:01 +0000)]
Fix capitalization
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21707
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 5 Jan 2009 23:29:37 +0000 (23:29 +0000)]
Oops. Don't include openssl install paths from my local machine.
Thanks to Ezra for noticing so quickly.
ticket: 6315
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21706
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 5 Jan 2009 22:56:37 +0000 (22:56 +0000)]
include string.h
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21705
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 5 Jan 2009 22:56:00 +0000 (22:56 +0000)]
fix missed var rename
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21704
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 5 Jan 2009 22:45:10 +0000 (22:45 +0000)]
Define SWAP16 if not already defined
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21703
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 5 Jan 2009 22:44:41 +0000 (22:44 +0000)]
No C++ style comments in C code please
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21702
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 5 Jan 2009 20:27:53 +0000 (20:27 +0000)]
move generated dependencies out of Makefile.in
Move automatically-generated dependencies into separate files in the
source tree, and take the data out of Makefile.in.
Keep the "make depend" rules for stripping out the dependencies from
Makefile.in, in case some optional directories were missed, but
everything that builds on my UNIX build has been converted.
(Converting a directory just requires creating an empty "deps" file so
that config.status can build the makefile, and then later running
"make depend" in that directory to get the correct content for it.)
Change configure scripts to incorporate the "deps" file when building
each Makefile. This change requires the existence of a file "deps" in
each source directory where we build a makefile, even if there are no
sources for which to compute dependencies; a switch to GNU make would
let us conditionalize that, but we can assess that later.
Update dependencies for the generate Makefile itself to list the deps
file.
This will also require some minor tweaking of the Windows build, to
make it incorporate the new deps file.
ticket: new
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21701
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 5 Jan 2009 18:19:32 +0000 (18:19 +0000)]
Build against Python 2.5 as well as 2.3. Long term, should use python-config
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21700
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 5 Jan 2009 17:59:59 +0000 (17:59 +0000)]
fix minor comment typos
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21699
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 5 Jan 2009 17:49:00 +0000 (17:49 +0000)]
fix merge of new openldap notice
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21698
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Mon, 5 Jan 2009 05:01:04 +0000 (05:01 +0000)]
ifdef out unused functions that are also missing prototypes.
krb5int_utf8_islower and krb5int_utf8_isupper.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21697
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Mon, 5 Jan 2009 04:59:30 +0000 (04:59 +0000)]
Include ucdata/ucdata.h for missing prototypes
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21696
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Mon, 5 Jan 2009 04:57:56 +0000 (04:57 +0000)]
Include strings.h for memset prototype
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21695
dc483132-0cff-0310-8789-
dd5450dbe970