krb5.git
14 years agoAdd a missing break in the parsing of krb5kdc's -P option. Reported
Greg Hudson [Wed, 7 Jul 2010 20:52:06 +0000 (20:52 +0000)]
Add a missing break in the parsing of krb5kdc's -P option.  Reported
by nalin@redhat.com.

ticket: 6750
target_version: 1.8.3
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24176 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRemove count parameters from get_principal, put_principal,
Greg Hudson [Tue, 6 Jul 2010 21:53:23 +0000 (21:53 +0000)]
Remove count parameters from get_principal, put_principal,
free_principal, delete_principal, and get_policy.  Make get_principal
allocate the DB entry container.  Fold krb5_db_get_principal_ext into
krb5_db_get_principal.

ticket: 6749
status: open

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24175 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoFollow-on to r24168: in kdb5_ldap_util, indirect through
Greg Hudson [Sun, 4 Jul 2010 18:34:04 +0000 (18:34 +0000)]
Follow-on to r24168: in kdb5_ldap_util, indirect through
krb5_db_store_master_key instead of using the (now removed) default
implementation directly.

ticket: 6749
status: open

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24174 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoIn kdb5.c, simplify the code for getting the profile config section
Greg Hudson [Sat, 3 Jul 2010 19:56:17 +0000 (19:56 +0000)]
In kdb5.c, simplify the code for getting the profile config section

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24173 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRemove assertions for non-nullity of init_module and fini_module in
Greg Hudson [Sat, 3 Jul 2010 19:25:00 +0000 (19:25 +0000)]
Remove assertions for non-nullity of init_module and fini_module in
kdb5.c for consistency with other uses of mandatory vtable functions.

ticket: 6749
status: open

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24172 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoMake the APIs for iterate, get_master_key_list, set_master_key_list,
Greg Hudson [Sat, 3 Jul 2010 19:22:08 +0000 (19:22 +0000)]
Make the APIs for iterate, get_master_key_list, set_master_key_list,
and promote_db return KRB5_PLUGIN_OP_NOTSUPP if the KDB module does
not implement them, avoiding the need for stub default
implementations.

ticket: 6749

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24171 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoUse KRB5_PLUGIN_OP_NOTSUPP uniformly as the error code for operations
Greg Hudson [Sat, 3 Jul 2010 19:02:41 +0000 (19:02 +0000)]
Use KRB5_PLUGIN_OP_NOTSUPP uniformly as the error code for operations
not supported by a KDB module.  (Previously KRB5_KDB_DBTYPE_NOSUP was
used in some cases and KRB5_PLUGIN_OP_NOTSUPP in others.)

ticket: 6749
status: open

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24170 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRemove return value from void function
Ken Raeburn [Sat, 3 Jul 2010 15:23:45 +0000 (15:23 +0000)]
Remove return value from void function

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24169 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRemove store_master_key from the DAL table, and implement
Greg Hudson [Fri, 2 Jul 2010 20:16:21 +0000 (20:16 +0000)]
Remove store_master_key from the DAL table, and implement
krb5_store_master_key in terms of krb5_store_master_key_list.

ticket: 6749
status: open

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24168 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoMake krb5_db_free_principal and krb5_db_free_mkey_list return void.
Greg Hudson [Fri, 2 Jul 2010 19:18:12 +0000 (19:18 +0000)]
Make krb5_db_free_principal and krb5_db_free_mkey_list return void.
Remove the stale prototype for krb5_db_free_master_key.

ticket: 6749
status: open

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24167 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRemove verify_master_key from the DAL table, as well as its associated
Greg Hudson [Fri, 2 Jul 2010 19:09:20 +0000 (19:09 +0000)]
Remove verify_master_key from the DAL table, as well as its associated
libkdb5 interface.  Callers can (and mostly already do) use
krb5_fetch_mkey_list to verify master keyblocks.  Adjust tests/create,
tests/verify, and kdb5_util dump to do so.

ticket: 6749
status: open

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24166 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRemove db_ and similar prefixes from DAL function names, for
Greg Hudson [Fri, 2 Jul 2010 17:58:41 +0000 (17:58 +0000)]
Remove db_ and similar prefixes from DAL function names, for
consistency.  Follow suit inside the DB2 and LDAP modules.  (No change
to the caller-facing libkdb5 APIs.)

ticket: 6749
status: open

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24165 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRename krb5_dbekd_encrypt_key_data and krb5_dbekd_decrypt_key_data to
Greg Hudson [Fri, 2 Jul 2010 17:33:44 +0000 (17:33 +0000)]
Rename krb5_dbekd_encrypt_key_data and krb5_dbekd_decrypt_key_data to
just use the krb5_dbe prefix.

ticket: 6749
status: open

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24164 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRemove setup_master_key_name from the DAL table as it was not used
Greg Hudson [Fri, 2 Jul 2010 17:18:46 +0000 (17:18 +0000)]
Remove setup_master_key_name from the DAL table as it was not used

ticket: 6749
status: open

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24163 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRemove the set_master_key and get_master_key DAL interfaces and their
Greg Hudson [Fri, 2 Jul 2010 17:13:40 +0000 (17:13 +0000)]
Remove the set_master_key and get_master_key DAL interfaces and their
corresponding libkdb5 APIs, as they were not productively used.  In
kdb5_ldap_util, stop using the realm data's mkey field as a container
to communicate the master key to static helper functions, since the
field no longer exists.

ticket: 6749
status: open

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24162 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoFollow-up to r24157: return correctly from krb5_ldap_lib_init() if
Greg Hudson [Fri, 2 Jul 2010 16:59:33 +0000 (16:59 +0000)]
Follow-up to r24157: return correctly from krb5_ldap_lib_init() if
there is no version mismatch.

ticket: 6749

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24161 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoFollow-on to r24157: pass KRB5_KDB_DAL_VERSION to krb5_ldap_lib_init()
Greg Hudson [Fri, 2 Jul 2010 14:41:26 +0000 (14:41 +0000)]
Follow-on to r24157: pass KRB5_KDB_DAL_VERSION to krb5_ldap_lib_init()
in kdb5_ldap_util.c.

ticket: 6749

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24160 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRemove errcode_2_string and release_errcode_string from the DAL table,
Greg Hudson [Fri, 2 Jul 2010 14:19:39 +0000 (14:19 +0000)]
Remove errcode_2_string and release_errcode_string from the DAL table,
and stop using them in kdb5.c.  Modules can simply set error messages
in the krb5 context on error.

ticket: 6749
status: open

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24159 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRemove db_supported_realms and db_free_supported_realms from the DAL
Greg Hudson [Fri, 2 Jul 2010 14:08:20 +0000 (14:08 +0000)]
Remove db_supported_realms and db_free_supported_realms from the DAL
table, and remove the corresponding libkdb5 interfaces (which don't
seem to have been in the library export table).

ticket: 6749
status: open

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24158 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoDAL improvements
Greg Hudson [Fri, 2 Jul 2010 03:23:21 +0000 (03:23 +0000)]
DAL improvements

Add KRB5_KDB_API_VERSION to allow callers to adjust to incompatible
changes in libkdb; to be kept in sync with the libkdb major version,
which is bumped to 5 in anticipation of other changes.

Add KRB5_KDB_DAL_VERSION to allow database modules to detect when they
are mismatched with the KDB version.  Since KDB modules are often
developed concurrently with trunk code, this is defined to be the date
of the last incompatible DAL change.  The DAL version is passed to the
init_library DAL function; the module should check it against the value
of KRB5_KDB_DAL_VERSION it was compiled with and return
KRB5_KDB_DBTYPE_MISMATCH if it doesn't match.

ticket: 6749
status: open

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24157 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoIn kpropd, when getting a wildcard address to listen on, try IPv6
Greg Hudson [Thu, 1 Jul 2010 16:56:22 +0000 (16:56 +0000)]
In kpropd, when getting a wildcard address to listen on, try IPv6
explicitly (with AI_ADDRCONFIG specified where available, to avoid
IPv6 on hosts with no IPv6 interface) and then fall back to IPv4.
Only set IPV6_V6ONLY on the listener socket if the resulting address
is IPv6.

Note: we have mostly confirmed that OpenBSD does not have dual-stack
support, meaning that it would be better to open separate IPv4 and
IPv6 listener sockets, as we do in krb5kdc and kadmind.
Unfortunately, the complicated iprop retry-and-backoff logic makes
this less than straightforward.

ticket: 6686

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24156 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoFactor out a common socket creation sequence in net-server.c, which
Greg Hudson [Wed, 30 Jun 2010 16:45:47 +0000 (16:45 +0000)]
Factor out a common socket creation sequence in net-server.c, which
happens to coincide with what setup_a_rpc_listener does.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24153 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoEliminate warnings in net-server.c
Greg Hudson [Wed, 30 Jun 2010 16:11:33 +0000 (16:11 +0000)]
Eliminate warnings in net-server.c

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24152 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoImprove coding style conformance in net-server.c
Greg Hudson [Wed, 30 Jun 2010 16:03:22 +0000 (16:03 +0000)]
Improve coding style conformance in net-server.c

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24151 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoFix a bug in r24147 where svctcp_create() was passing the wrong length
Greg Hudson [Sat, 26 Jun 2010 17:37:20 +0000 (17:37 +0000)]
Fix a bug in r24147 where svctcp_create() was passing the wrong length
argument to bind(), causing it to fail on Solaris.

ticket: 6746

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24148 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoMake kadmin work over IPv6
Greg Hudson [Sat, 26 Jun 2010 03:32:55 +0000 (03:32 +0000)]
Make kadmin work over IPv6

Make gssrpc work over IPv6 TCP sockets provided that the client
creates and connects/binds the sockets and doesn't query their
addresses or use bindresvport().  Make kadmin work within those
constraints and handle IPv6.  Specific changes:

* Make svctcp_create() able to extract the port from an IPv6 socket,
  using a new helper function getport().
* Make clnttcp_create() handle a null raddr value if *sockp is set.
* Make kadm5_get_service_name() use getaddrinfo() to canonicalize the
  admin server name.
* Make libkadm5clnt's init_any() responsible for connecting its socket
  using a new helper function connect_to_server(), which uses
  getaddrinfo instead of gethostbyname.  Pass a null address to
  clnttcp_create().
* Make libapputil's net-server.c set up IPv6 as well as IPv4 listener
  ports for RPC connections.
* Adjust the error code expected in a libkadm5 unit test.

ticket: 6746

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24147 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoAdjust function names and declarations in libkadm5's client_init.c; in
Greg Hudson [Fri, 25 Jun 2010 22:26:04 +0000 (22:26 +0000)]
Adjust function names and declarations in libkadm5's client_init.c; in
particular, avoid the use of library namespace prefixes for static
helper functions.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24146 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoSimplify the iprop conditionalization of _kadm5_init_any()
Greg Hudson [Fri, 25 Jun 2010 22:14:53 +0000 (22:14 +0000)]
Simplify the iprop conditionalization of _kadm5_init_any()

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24145 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRemove some dead code in kdb5_stash() left behind by r24142
Greg Hudson [Tue, 22 Jun 2010 13:09:58 +0000 (13:09 +0000)]
Remove some dead code in kdb5_stash() left behind by r24142

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24144 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoIn kprop's sockaddr2krbaddr(), fill in addr.magic to avoid copying
Greg Hudson [Tue, 22 Jun 2010 12:52:03 +0000 (12:52 +0000)]
In kprop's sockaddr2krbaddr(), fill in addr.magic to avoid copying
around uninitialized values.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24143 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoEliminate a bunch of duplicated code in kdb5_stash() by using
Greg Hudson [Mon, 21 Jun 2010 20:29:12 +0000 (20:29 +0000)]
Eliminate a bunch of duplicated code in kdb5_stash() by using
util_context.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24142 dc483132-0cff-0310-8789-dd5450dbe970

14 years agokdb5_stash() contains its own kdb5_db_open() call (because it doesn't
Greg Hudson [Mon, 21 Jun 2010 19:56:29 +0000 (19:56 +0000)]
kdb5_stash() contains its own kdb5_db_open() call (because it doesn't
use util_context for some reason), which didn't work with the LDAP
back end because LDAP doesn't recognize KRB5_KDB_SRV_TYPE_OTHER.  As a
minimal fix, change that to KRB5_KDB_SRV_TYPE_ADMIN to be consistent
with open_db_and_mkey()--see also r18736.

ticket: 6345
target_version: 1.8.3
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24141 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoMake OFFLINE!=no work again
Tom Yu [Mon, 21 Jun 2010 15:25:38 +0000 (15:25 +0000)]
Make OFFLINE!=no work again

ticket: 6744

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24140 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoAdd correct error table when initializing gss-krb5
Greg Hudson [Mon, 21 Jun 2010 15:18:37 +0000 (15:18 +0000)]
Add correct error table when initializing gss-krb5

gss_krb5int_lib_init was adding the generic GSS error table (again)
instead of the krb5 error table, which could lead to crashes on
library unload.  This bug was introduced in krb5 1.7; the fix is also
applicable there.

Patch from Leonardo Chiquitto <leonardo.lists@gmail.com>.

ticket: 6745
target_version: 1.8.3
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24139 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoonly test t_locate_kdc if known-good DNS name is present
Tom Yu [Fri, 18 Jun 2010 19:41:48 +0000 (19:41 +0000)]
only test t_locate_kdc if known-good DNS name is present

Running "make check" while offline or on a firewalled network may
result in failure in lib/krb5/os because the invocation of
t_locate_kdc requires that the DNS servers for ATHENA.MIT.EDU be
reachable.  Autodetect DNS utilities "dig" and "nslookup", and use
them to check for existence of the known-good DNS name.  Also
parameterize the test so that the known-good DNS name can be
overridden on the make command line.

ticket: 6744
target_version: 1.8.3
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24138 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoIn PKINIT, notice if DH_compute_key() returns a value less than the
Greg Hudson [Mon, 14 Jun 2010 20:46:27 +0000 (20:46 +0000)]
In PKINIT, notice if DH_compute_key() returns a value less than the
buffer size, and pad it on the left if so.

ticket: 6738
target_version: 1.8.3
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24137 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoAdjust the PKINIT DH debugging code:
Greg Hudson [Mon, 14 Jun 2010 20:00:03 +0000 (20:00 +0000)]
Adjust the PKINIT DH debugging code:
  * Use %p and void * for pointers instead of %x and int
  * Don't call the computed symmetric key the "secret key" since
    that's easily confused with the private key g^x.
  * Print the private key when printing DH parameters, instead of the
    q value (not even sure what they is).

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24136 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoUse getaddrinfo() in kprop and kpropd, and recognize IPv6 addresses
Greg Hudson [Fri, 11 Jun 2010 21:03:03 +0000 (21:03 +0000)]
Use getaddrinfo() in kprop and kpropd, and recognize IPv6 addresses
when setting up krb5_address structures.  kpropd still only binds to
one socket to avoid the need for a select() loop, so we turn off
IPV6_V6ONLY on that socket to ensure that IPv4 connections will still
be accepted.

Based on a patch from Michael Stapelberg <michael@stapelberg.de>.

ticket: 6686

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24134 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRemove the code for krb5_append_addresses(), which was never used and
Greg Hudson [Fri, 11 Jun 2010 20:01:26 +0000 (20:01 +0000)]
Remove the code for krb5_append_addresses(), which was never used and
was ifdef'd out fifteen years ago in r5464.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24133 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoEliminate actx_copy_addr in auth_con.c; use krb5_copy_addr instead
Greg Hudson [Fri, 11 Jun 2010 19:58:55 +0000 (19:58 +0000)]
Eliminate actx_copy_addr in auth_con.c; use krb5_copy_addr instead
(it's exactly the same).

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24132 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoIn yarrow.c, undefine k5-trace.h's TRACE before defining it to avoid a
Greg Hudson [Thu, 10 Jun 2010 14:57:33 +0000 (14:57 +0000)]
In yarrow.c, undefine k5-trace.h's TRACE before defining it to avoid a
conflict.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24126 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRemove some unused (as of yet) trace macro definitions
Greg Hudson [Thu, 10 Jun 2010 14:54:28 +0000 (14:54 +0000)]
Remove some unused (as of yet) trace macro definitions

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24125 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoFix a couple of minor defects in trace.c
Greg Hudson [Thu, 10 Jun 2010 14:50:09 +0000 (14:50 +0000)]
Fix a couple of minor defects in trace.c

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24124 dc483132-0cff-0310-8789-dd5450dbe970

14 years agokadmin ktadd may display wrong name of default keytab
Greg Hudson [Tue, 8 Jun 2010 18:18:03 +0000 (18:18 +0000)]
kadmin ktadd may display wrong name of default keytab

kadmin's ktadd (and ktrem) displays WRFILE:/etc/krb5.keytab whenever
it uses the default keytab, even if the default has been overridden
(e.g. by KRB5_KTNAME).  Use krb5_kt_get_name to get the correct name
of the default cache instead of displaying the string we think was
used to open it.

ticket: 6740
target_version: 1.8.2
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24123 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoWhen we display enctypes, display the input name rather than the
Greg Hudson [Tue, 8 Jun 2010 17:53:19 +0000 (17:53 +0000)]
When we display enctypes, display the input name rather than the
description.  Affects klist -e, kdb5_util list_mkeys, kdb5_util stash
(error message), kadmin getprinc, kadmin ktadd, and ktutil list -e.

ticket: 5014

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24122 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoStop checking the current time against the context expiration time in
Greg Hudson [Tue, 8 Jun 2010 16:26:23 +0000 (16:26 +0000)]
Stop checking the current time against the context expiration time in
the message wrap/unwrap functions in the krb5 GSS mech.  Heimdal
doesn't do it, and it generally results in poor app behavior when a
ticket expires.  In exchange, it doesn't provide much security benefit
since it's not enforced across the board--for example, ssh sessions
can persist beyond ticket expiration time since they don't use GSS to
wrap payload data.

(This is a continuation of r24120, which should have contained the
changes to all four files.)

ticket: 6739

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24121 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoStop checking the current time against the context expiration time in
Greg Hudson [Tue, 8 Jun 2010 16:14:24 +0000 (16:14 +0000)]
Stop checking the current time against the context expiration time in
the message wrap/unwrap functions in the krb5 GSS mech.  Heimdal
doesn't do it, and it generally results in poor app behavior when a
ticket expires.  In exchange, it doesn't provide much security benefit
since it's not enforced across the board--for example, ssh sessions
can persist beyond ticket expiration time since they don't use GSS to
wrap payload data.

ticket: 6739
target_version: 1.8.2
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24120 dc483132-0cff-0310-8789-dd5450dbe970

14 years agomake depend
Greg Hudson [Mon, 7 Jun 2010 18:28:05 +0000 (18:28 +0000)]
make depend

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24119 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoTrace logging
Greg Hudson [Mon, 7 Jun 2010 18:26:17 +0000 (18:26 +0000)]
Trace logging

Add trace logging infrastructure code, enabled by the KRB5_TRACE
environment variable or the API functions krb5_set_trace_callback()
or krb5_set_trace_filename().  As a start, add tracing events for:
  * AS-REQ client code, including FAST and preauth
  * TGS-REQ client code
  * AP-REQ and AP-REP code (client and server)
  * sendto_kdc
  * Selected ccache operations
  * Selected keytab operations

ticket: 6737

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24118 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoAdd krb5_enctype_to_name() API
Greg Hudson [Fri, 4 Jun 2010 18:33:26 +0000 (18:33 +0000)]
Add krb5_enctype_to_name() API

Add an API to return the input name, or optionally the shortest alias,
of an enctype.  Similar to krb5_enctype_to_string() which returns a
description.

ticket: 6736

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24117 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoIn krb5_cc_set_config, don't call krb5_cc_remove_cred; it's redundant
Greg Hudson [Fri, 28 May 2010 18:26:43 +0000 (18:26 +0000)]
In krb5_cc_set_config, don't call krb5_cc_remove_cred; it's redundant
with the krb5_cc_remove_cred call in krb5_cc_store_cred.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24110 dc483132-0cff-0310-8789-dd5450dbe970

14 years agomake depend
Greg Hudson [Fri, 28 May 2010 15:56:05 +0000 (15:56 +0000)]
make depend

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24109 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoFrom Luke: make copies of S4U2Proxy authdata modules work when there
Greg Hudson [Fri, 28 May 2010 14:38:37 +0000 (14:38 +0000)]
From Luke: make copies of S4U2Proxy authdata modules work when there
is no S4U2Proxy authdata.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24107 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRemove the get_masters logic in locate_srv_conf_1 which was orphaned
Greg Hudson [Thu, 27 May 2010 22:25:51 +0000 (22:25 +0000)]
Remove the get_masters logic in locate_srv_conf_1 which was orphaned
by r15736 when we added the master_kdc profile variable.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24106 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoGet t_ser to build again after the S4U authdata branch merge
Greg Hudson [Thu, 27 May 2010 22:17:23 +0000 (22:17 +0000)]
Get t_ser to build again after the S4U authdata branch merge

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24105 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoIn testrealm.py, stash the passwords in testdir/passwords so that they
Greg Hudson [Tue, 25 May 2010 15:36:40 +0000 (15:36 +0000)]
In testrealm.py, stash the passwords in testdir/passwords so that they
can be retrieved after they've scrolled away.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24103 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoFAST negotiation could erroneously succeed
Greg Hudson [Tue, 25 May 2010 02:44:45 +0000 (02:44 +0000)]
FAST negotiation could erroneously succeed

When FAST negotiation is performed against an older KDC
(rep->enc_part2->flags & TKT_FLG_ENC_PA_REP not set),
krb5int_fast_verify_nego did not set the value of *fast_avail, causing
stack garbage to be used in init_creds_step_reply.  Initialize
*fast_avail at the beginning of the function per coding practices.

ticket: 6734
target_version: 1.8.2
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24102 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoFix long lines and other formatting issues in fast.h
Greg Hudson [Mon, 24 May 2010 19:22:02 +0000 (19:22 +0000)]
Fix long lines and other formatting issues in fast.h

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24101 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoFix long lines and other formatting issues in fast.c
Greg Hudson [Mon, 24 May 2010 19:17:36 +0000 (19:17 +0000)]
Fix long lines and other formatting issues in fast.c

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24100 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoDon't include nul characters in the text we send with krb-error
Greg Hudson [Mon, 24 May 2010 03:14:57 +0000 (03:14 +0000)]
Don't include nul characters in the text we send with krb-error
responses from the KDC.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24097 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoMake signedpath authdata visible via GSS naming exts
Greg Hudson [Sun, 23 May 2010 20:23:31 +0000 (20:23 +0000)]
Make signedpath authdata visible via GSS naming exts

Merge users/lhoward/signedpath-naming-exts to trunk.  Adds an authdata
provider which makes non-PAC S4U2Proxy signedpath authdata visible to
application servers via GSS naming extensions.

ticket: 6733

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24094 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRemove a non-functional and unnecessary check in kdb5_util's
Greg Hudson [Fri, 21 May 2010 19:29:04 +0000 (19:29 +0000)]
Remove a non-functional and unnecessary check in kdb5_util's
master_key_convert().  (key_data->key_data_length is an array, so its
address is never null.)

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24085 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoFix an error case in kdb_util's dump.c where the dump file handle was
Greg Hudson [Fri, 21 May 2010 19:23:21 +0000 (19:23 +0000)]
Fix an error case in kdb_util's dump.c where the dump file handle was
leaked.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24084 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRemove an unneeded conditional in the cleanup for kadmin's keytab
Greg Hudson [Fri, 21 May 2010 19:15:20 +0000 (19:15 +0000)]
Remove an unneeded conditional in the cleanup for kadmin's keytab
add_principal(), squashing a false-positive memory leak from Coverity.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24083 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoIn getdate.y, remove an error check from r19656 which couldn't ever
Greg Hudson [Fri, 21 May 2010 19:08:41 +0000 (19:08 +0000)]
In getdate.y, remove an error check from r19656 which couldn't ever
trigger (Convert() does not use an error parameter).

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24082 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoUse ANSI-style function definitions in our copy of getdate.y
Greg Hudson [Fri, 21 May 2010 19:03:45 +0000 (19:03 +0000)]
Use ANSI-style function definitions in our copy of getdate.y

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24081 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoDocument the disable_last_success and disable_lockout variables in
Greg Hudson [Fri, 21 May 2010 03:08:18 +0000 (03:08 +0000)]
Document the disable_last_success and disable_lockout variables in
krb5.conf.M.  Also document database_name in krb5.conf.M and slightly
adjust the wording in admin.texinfo.

ticket: 6719

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24078 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoApply patch from Arlene Berry to detect and ignore a duplicate
Tom Yu [Thu, 20 May 2010 21:32:47 +0000 (21:32 +0000)]
Apply patch from Arlene Berry to detect and ignore a duplicate
mechanism token sent in the mechListMIC field, such as sent by Windows
2000 Server.

ticket: 6726
target_version: 1.8.2
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24075 dc483132-0cff-0310-8789-dd5450dbe970

14 years agokdc_tcp_ports not documented in kdc.conf.M
Tom Yu [Thu, 20 May 2010 20:42:26 +0000 (20:42 +0000)]
kdc_tcp_ports not documented in kdc.conf.M

The kdc.conf setting kdc_tcp_ports was not documented in kdc.conf.M,
though it was documented in doc/admin.texinfo.  Copy text from there
for now.  The setting defaults to an empty string at the moment,
causing the KDC to not listen on TCP by default, confusing some users.
Changing this behavior is a separate issue.

ticket: 6730
target_version: 1.8.2
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24074 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoIn gss_acquire_cred_with_password() and gss_add_cred_with_password(),
Greg Hudson [Thu, 20 May 2010 15:13:06 +0000 (15:13 +0000)]
In gss_acquire_cred_with_password() and gss_add_cred_with_password(),
require desired_name to be set, and always honor it.  This is
consistent with the Sun implementation and simplifies the code.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24072 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoCVE-2010-1321 GSS-API lib null pointer deref (MITKRB5-SA-2010-005)
Tom Yu [Wed, 19 May 2010 18:09:37 +0000 (18:09 +0000)]
CVE-2010-1321 GSS-API lib null pointer deref (MITKRB5-SA-2010-005)

Make krb5_gss_accept_sec_context() check for a null authenticator
checksum pointer before attempting to dereference it.

ticket: 6725
tags: pullup
target_version: 1.8.2

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24056 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoWhen parsing a KDC or admin server string, allow the name or address
Greg Hudson [Tue, 18 May 2010 17:19:15 +0000 (17:19 +0000)]
When parsing a KDC or admin server string, allow the name or address
to be enclosed in brackets so that IPv6 addresses can be represented.
(IPv6 addresses contain colons, which look like port separators.)

ticket: 6562

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24055 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoImprove the error message from kadmin when hostname resolution fails
Greg Hudson [Tue, 18 May 2010 16:17:15 +0000 (16:17 +0000)]
Improve the error message from kadmin when hostname resolution fails
for the admin server.  (The extended message won't be displayed by
kadmin currently; that's a separate issue.)

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24054 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoIf gss_inquire_cred is called with a null credential, acquire a
Greg Hudson [Mon, 17 May 2010 20:38:24 +0000 (20:38 +0000)]
If gss_inquire_cred is called with a null credential, acquire a
default initiator credential and process it normally, instead of using
a completely different code path (the default mechanism's inquire_cred
handler).

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24052 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoThe mechglue always passes null for desired_mechs and actual_mechs
Greg Hudson [Mon, 17 May 2010 20:01:29 +0000 (20:01 +0000)]
The mechglue always passes null for desired_mechs and actual_mechs
when invoking gss_acquire_cred and friends.  Eliminate a lot of unused
and untestable logic in the krb5 mech which processed those arguments.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24051 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoThe mechglue never invokes a mech's gss_add_cred function. Remove the
Greg Hudson [Mon, 17 May 2010 17:11:28 +0000 (17:11 +0000)]
The mechglue never invokes a mech's gss_add_cred function.  Remove the
krb5 mech's add_cred implementation and null it out in the table.
(This has the effect of removing the IAKERB add_cred implementation.
SPNEGO already had it nulled out.)

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24050 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoReformat with shorter lines
Ken Raeburn [Sun, 16 May 2010 03:18:38 +0000 (03:18 +0000)]
Reformat with shorter lines

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24043 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoDelete an old pre-Yarrow item
Ken Raeburn [Sun, 16 May 2010 03:09:48 +0000 (03:09 +0000)]
Delete an old pre-Yarrow item

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24042 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoUpdate dependencies
Ken Raeburn [Sun, 16 May 2010 02:49:53 +0000 (02:49 +0000)]
Update dependencies

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24041 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoStop exporting some profile symbols that aren't either published in
Ken Raeburn [Sun, 16 May 2010 02:49:49 +0000 (02:49 +0000)]
Stop exporting some profile symbols that aren't either published in
the header or known serialization functions used by the krb5 library.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24040 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoForce hostname to lower-case for use in principal names
Ken Raeburn [Sun, 16 May 2010 02:49:45 +0000 (02:49 +0000)]
Force hostname to lower-case for use in principal names

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24039 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoNegative enctypes improperly read from ccaches
Greg Hudson [Thu, 13 May 2010 18:58:43 +0000 (18:58 +0000)]
Negative enctypes improperly read from ccaches

When reading enctypes from ccaches, we need to sign-extend the 16-bit
value we read in order to properly read negative enctypes.

ticket: 6723

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24021 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoError handling bug in krb5_init_creds_init()
Greg Hudson [Thu, 13 May 2010 18:49:20 +0000 (18:49 +0000)]
Error handling bug in krb5_init_creds_init()

Fix a bug in krb5_init_creds_init() where a freed context could be
returned to the caller in certain error cases.

ticket: 6722
tags: pullup
target_version: 1.8.2

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24020 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoNegative enctypes improperly read from keytabs
Greg Hudson [Thu, 13 May 2010 17:34:33 +0000 (17:34 +0000)]
Negative enctypes improperly read from keytabs

When reading enctypes from keytabs, we need to ntohs() the 16-bit
value we read in before sign-extending it to a 32-bit value in the
keyblock, or we run the risk of extending the wrong sign.

ticket: 6720

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24016 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoMake k5test.py work for builds in the source dir
Greg Hudson [Thu, 13 May 2010 16:46:50 +0000 (16:46 +0000)]
Make k5test.py work for builds in the source dir

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24015 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRemove krb5_get_in_tkt
Tom Yu [Wed, 12 May 2010 21:58:54 +0000 (21:58 +0000)]
Remove krb5_get_in_tkt

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24013 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoReimplement krb5_get_in_tkt_with_skey in terms of krb5_get_init_creds,
Greg Hudson [Wed, 12 May 2010 20:49:11 +0000 (20:49 +0000)]
Reimplement krb5_get_in_tkt_with_skey in terms of krb5_get_init_creds,
similar to how the password and keytab equivalents were done.

Eliminate krb5_get_in_tkt.  It's been very hard to use since we made
krb5_kdc_rep_decrypt_proc private (in krb5 1.7 the prototype was taken
out of krb5.h altogether), and it's unlikely that anything would have
used it directly in the first place.

Remove and/or simplify a lot of code depended on by krb_get_in_tkt,
including all of preauth.c.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24012 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoAdd lockout-related performance tuning variables
Greg Hudson [Mon, 10 May 2010 22:42:04 +0000 (22:42 +0000)]
Add lockout-related performance tuning variables

The account lockout feature of krb5 1.8 came at a cost in database
accesses for principals requiring preauth, even if lockout is not
used.  Add dbmodules variables disable_last_success and
disable_lockout for the DB2 and LDAP back ends, allowing the admin to
recover the lost performance at the cost of new functionality.

(Unrelated documentation fix: document database_name as a DB2-specific
dbmodules variable instead of the realm variable it used to be.)

ticket: 6719

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24003 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoMake KADM5_FAIL_AUTH_COUNT_INCREMENT more robust with LDAP
Greg Hudson [Mon, 10 May 2010 22:23:57 +0000 (22:23 +0000)]
Make KADM5_FAIL_AUTH_COUNT_INCREMENT more robust with LDAP

In krb5_ldap_put_principal, use krb5_get_attributes_mask to determine
whether krbLoginFailedCount existed on the entry when it was
retrieved.  If it didn't exist, don't try to use LDAP_MOD_INCREMENT,
and don't assert an old value when not using LDAP_MOD_INCREMENT.

Also, create the krbLoginFailedCount attribute when creating new
entries.  This allows us to use LDAP_MOD_INCREMENT during the first
failed login (if the server supports it), avoiding a race condition.

ticket: 6718
target_version: 1.8.2
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24002 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoGeneral code consistency pass in kdb_db2.c.
Greg Hudson [Wed, 5 May 2010 17:11:39 +0000 (17:11 +0000)]
General code consistency pass in kdb_db2.c.
Removes some pointless null checks.
Frees the DB context when a DB is finalized.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23973 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoAdjust for removal of krb5_ldap_set_option in r23965
Tom Yu [Tue, 4 May 2010 22:00:41 +0000 (22:00 +0000)]
Adjust for removal of krb5_ldap_set_option in r23965

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23972 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoGet rid of some kdb5_util load code which is no longer useful after
Greg Hudson [Tue, 4 May 2010 19:01:16 +0000 (19:01 +0000)]
Get rid of some kdb5_util load code which is no longer useful after
the introduction of the DAL.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23971 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRemove some unused format string definitions from kdb5_util's dump.c
Greg Hudson [Tue, 4 May 2010 17:08:39 +0000 (17:08 +0000)]
Remove some unused format string definitions from kdb5_util's dump.c

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23970 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRemove some unused fields from kadm5_config_params. Bump the client
Greg Hudson [Tue, 4 May 2010 16:54:00 +0000 (16:54 +0000)]
Remove some unused fields from kadm5_config_params.  Bump the client
and server sonames.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23969 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoEliminate the unused realm_dbname field from krb5_realm_params
Greg Hudson [Tue, 4 May 2010 15:58:59 +0000 (15:58 +0000)]
Eliminate the unused realm_dbname field from krb5_realm_params

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23968 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRemove a stray comment from r23966
Greg Hudson [Tue, 4 May 2010 05:49:39 +0000 (05:49 +0000)]
Remove a stray comment from r23966

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23967 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRefactor the kdb_db2.c code which processes db_args and profile
Greg Hudson [Tue, 4 May 2010 05:44:07 +0000 (05:44 +0000)]
Refactor the kdb_db2.c code which processes db_args and profile
variables to configure a DB context, to avoid repeating that code
three times in open/create/destroy.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23966 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoRemove krb5_db_set_option and the associated DAL entry. It was not
Greg Hudson [Tue, 4 May 2010 04:12:24 +0000 (04:12 +0000)]
Remove krb5_db_set_option and the associated DAL entry.  It was not
used.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23965 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoCorrect the DAL documentation for db_create
Greg Hudson [Mon, 3 May 2010 23:44:30 +0000 (23:44 +0000)]
Correct the DAL documentation for db_create

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23964 dc483132-0cff-0310-8789-dd5450dbe970

14 years agoEliminate some uses of variables as format strings. Based on a patch
Greg Hudson [Mon, 3 May 2010 19:42:29 +0000 (19:42 +0000)]
Eliminate some uses of variables as format strings.  Based on a patch
from Guillaume Rousse <Guillaume.Rousse@inria.fr>.

ticket: 6714

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23963 dc483132-0cff-0310-8789-dd5450dbe970