Tom Yu [Thu, 22 Jan 2009 23:21:11 +0000 (23:21 +0000)]
whitespace
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21778
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Thu, 22 Jan 2009 19:19:34 +0000 (19:19 +0000)]
Adapted patch from Apple: in kadmind's process_chpw_request, make sure
to free error message strings.
ticket: 6284
status: open
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21776
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Thu, 22 Jan 2009 06:34:14 +0000 (06:34 +0000)]
If USE_VALGRIND, check that source principal is defined before copying.
Initialize magic number fields of allocated name components.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21775
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Thu, 22 Jan 2009 06:30:08 +0000 (06:30 +0000)]
If USE_VALGRIND, check readability of byte string before copying
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21774
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Thu, 22 Jan 2009 06:04:10 +0000 (06:04 +0000)]
Define valgrind macros as no-ops if not USE_VALGRIND, and use unconditionally, per Danilo's suggestion
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21773
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 21 Jan 2009 19:38:12 +0000 (19:38 +0000)]
Patch from Love: when opening an existing replay cache, check more
thoroughly to prevent symlink attacks.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21770
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 21 Jan 2009 18:23:58 +0000 (18:23 +0000)]
Patch from Luke: fix error return of krb5_gss_use_kdc_context
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21768
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Tue, 20 Jan 2009 23:49:08 +0000 (23:49 +0000)]
When encoding, and compiling with -DUSE_VALGRIND, explicitly get valgrind to check the inputs
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21766
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Tue, 20 Jan 2009 22:52:15 +0000 (22:52 +0000)]
delete trailing whitespace, including insanely long 'blank' lines
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21764
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 20 Jan 2009 18:50:51 +0000 (18:50 +0000)]
In krb5_rd_rep_dce, initialize repl to NULL to avoid using its
initialized value when we take the first goto to clean_scratch.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21763
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Sat, 17 Jan 2009 01:00:22 +0000 (01:00 +0000)]
If buffer length is 0, force pointer to NULL, to keep valgrind happier when callers don't bother
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21762
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Sat, 17 Jan 2009 00:06:06 +0000 (00:06 +0000)]
patch from Luke - minor cleanup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21761
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Sat, 17 Jan 2009 00:04:49 +0000 (00:04 +0000)]
patch from Luke - fix enctype-nego enctype list setup
ticket: 6336
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21760
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Sat, 17 Jan 2009 00:02:05 +0000 (00:02 +0000)]
patch from Luke - fix sign problem
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21759
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Fri, 16 Jan 2009 23:55:01 +0000 (23:55 +0000)]
include dependencies for decoder test
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21758
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Fri, 16 Jan 2009 00:33:00 +0000 (00:33 +0000)]
Use valgrind in more cases if VALGRIND is set
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21754
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Thu, 15 Jan 2009 23:22:53 +0000 (23:22 +0000)]
Make enctype and checksumtype name mapping table types private to the
crypto library. Add a field for aliases to the record type so that
aliases don't have to be implemented by duplicating all the other
information.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21753
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Thu, 15 Jan 2009 19:15:22 +0000 (19:15 +0000)]
Fix an additional multiple-write case noted by John, where sendauth
calls write_message twice in a row.
Add new function krb5int_write_messages, calls krb5_net_writev with
multiple messages (currently only two at a time). Use it from
krb5_write_message and krb5_sendauth.
ticket: 6339
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21752
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Thu, 15 Jan 2009 19:11:45 +0000 (19:11 +0000)]
Rework the replay cache extensions to make the hash extension records
stand alone. Otherwise, reordering of records during an expunge could
cause the hash to be applied to the wrong record.
Also add an "expunge" option to the t_replay program, and clean up some
memory-handling inconsistencies.
ticket: 1201
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21751
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Thu, 15 Jan 2009 01:13:04 +0000 (01:13 +0000)]
update
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21750
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Thu, 15 Jan 2009 00:59:27 +0000 (00:59 +0000)]
Add new routine krb5int_net_writev using scatter-gather source.
Use it from krb5_net_write to ensure testing and reduce duplication.
Use it from krb5_write_message to avoid Nagle+DelayedAck problem.
ticket: 6339
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21749
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Wed, 14 Jan 2009 23:36:04 +0000 (23:36 +0000)]
If we have a local UDP socket without the PKTINFO option set, it's
bound to a local address, so use getsockname to extract the local
(destination) address.
ticket: 6335
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21748
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Wed, 14 Jan 2009 21:29:10 +0000 (21:29 +0000)]
If recv_from_to is passed a buffer for the local endpoint address,
clobber it before doing anything else, just in case we can't retrieve
the address and the caller blindly uses the buffer anyways.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21747
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Wed, 14 Jan 2009 20:05:09 +0000 (20:05 +0000)]
Merge some very simple points of divergence in the two copies of network.c -- enum ordering, whitespace,
duplicate macro definitions, unused code, 0 vs NULL...
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21746
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Wed, 14 Jan 2009 19:50:34 +0000 (19:50 +0000)]
Pass s4u name and c_flags to log_tgs_req. If values are supplied, log
an additional message to record the name and s4u mode.
Untested for lack of code to invoke these code paths.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21745
dc483132-0cff-0310-8789-
dd5450dbe970
Russ Allbery [Wed, 14 Jan 2009 00:29:04 +0000 (00:29 +0000)]
Force tickets acquired by the kadm5 client library via password
authentication to be non-forwardable and non-proxiable, overridding
any [libdefaults] configuration. This may be necessary at sites that
set forwardable to true by default in their krb5.conf files but
disable forwardable tickets for privileged principals. Since the
ticket cache acquired by the kadm5 client library is used only for
kadmin operations, where forwardable is not useful or necessary, there
is no reason to ever attempt to obtain forwardable or proxiable tickets
here.
Ticket: 6337
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21744
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Tue, 13 Jan 2009 22:57:42 +0000 (22:57 +0000)]
Patch from Luke Howard to:
* Accept both CFX and non-CFX tokens all the time on acceptor
* Only produce an acceptor subkey if you are using cfx or dce or negotiating up to cfx
Additional changes from Sam Hartman:
* do not assume that the ticket key type (server key) is a valid target for negotiation: the client may not support it.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21742
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Tue, 13 Jan 2009 21:54:45 +0000 (21:54 +0000)]
/tmp/3
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21741
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Tue, 13 Jan 2009 19:43:18 +0000 (19:43 +0000)]
FreeBSD compiler errors out on an error "zero or negative size array"
after setting up an array with no elements.
ifdef out array declarations and code that uses it until there are entries.
Affects: krb5_gss_inquire_cred_by_oid_ops and
krb5_gss_set_sec_context_option_ops which would return an error in any
case as here are no entries in the arrays.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21740
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 12 Jan 2009 21:18:45 +0000 (21:18 +0000)]
Add a call to limit_string that appears to have been accidentally removed
somewhere along the mskrb-integ branch
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21729
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 12 Jan 2009 21:03:02 +0000 (21:03 +0000)]
Remove gss_export_name_object and gss_import_name_object.
These are not standard interfaces, are not used by our tree
and were added because they might be useful but ended up not being used.
The stubs in gssapi.hin remain as they were shipped with previous releases.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21728
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 12 Jan 2009 19:59:16 +0000 (19:59 +0000)]
Patch from Luke Howard:
Previously when using the kdb keytab, there was a check to confirm that the server
was supported as a server and that attackers
could not force an enctype downgrade.
Add these to kdc_get_server_key
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21727
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 12 Jan 2009 19:43:13 +0000 (19:43 +0000)]
Patch from Luke Howard
There's a superfluous check in kdc_util.c; ad_entry is always non NULL
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21726
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Mon, 12 Jan 2009 19:43:07 +0000 (19:43 +0000)]
Restore behavior of returning KRB5APP_ERR_BAD_INTEGRITY from
preauth methods.
This creates a problem for Windows clients, but not doing it creates a problem for MIT clients.
Today our KDC is more likely to be used with MIT clients, but we need to examine this issues in more detail.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21725
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Mon, 12 Jan 2009 19:40:37 +0000 (19:40 +0000)]
Check the return code from krb5int_clean_hostname as the sanity verification of the hostname might fail
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21724
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Mon, 12 Jan 2009 18:29:42 +0000 (18:29 +0000)]
Add message hash support to the replay interface, using extension
records (with an empty client string) to retain compatibility with old
code. For rd_req, the ciphertext of the authenticator (with no ASN.1
wrapping) is hashed; for other uses of the replay cache, no message
hash is used at this time.
This commit adds a command-line tool for testing the replay cache but
does not add any automated tests.
ticket: 1201
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21723
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Fri, 9 Jan 2009 01:42:37 +0000 (01:42 +0000)]
Follow "off-path" TGT referrals
ticket: 5627
status: open
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21720
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Fri, 9 Jan 2009 00:07:50 +0000 (00:07 +0000)]
Remove conflict marker; restore broken copyright line
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21719
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Wed, 7 Jan 2009 18:13:30 +0000 (18:13 +0000)]
kdb/keytab.c: map KRB5_KDB_NO_MATCHING_KEY to KRB5_KT_KVNONOTFOUND.
At least in cases other than tgts, this code handles its own enctype matching, so kvno not found is the only
thing that produces the no matching key error.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21718
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Wed, 7 Jan 2009 00:11:40 +0000 (00:11 +0000)]
Don't create include/kerberosIV on installation
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21717
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Tue, 6 Jan 2009 23:45:23 +0000 (23:45 +0000)]
Add support for referral null realms and use the default realm as krb5_rd_req_extended does
ticket: 5954
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21716
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Tue, 6 Jan 2009 23:45:17 +0000 (23:45 +0000)]
Remove ksu's own implementation of krb5_verify_init_creds now that it is not used
ticket: 5954
status: open
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21715
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Tue, 6 Jan 2009 23:44:56 +0000 (23:44 +0000)]
Ksu should call krb5_verify_init_creds instead of using its own function.
This was prompted by a desire for ksu to work without a domain_realm mapping for the local server, but the duplication of code is bad anyway.
ticket: 5954
Status: open
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21714
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Tue, 6 Jan 2009 22:52:50 +0000 (22:52 +0000)]
Set RELTAIL back to "trunk"
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21713
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Tue, 6 Jan 2009 22:32:30 +0000 (22:32 +0000)]
Patch from Luke Howard
to make an explicit call to check the ACL for s4u delegations rather than relying on tl-data.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21712
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Tue, 6 Jan 2009 21:48:24 +0000 (21:48 +0000)]
be a little looser in checking for tail output
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21711
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Tue, 6 Jan 2009 21:47:05 +0000 (21:47 +0000)]
remove unused file
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21710
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 6 Jan 2009 20:44:01 +0000 (20:44 +0000)]
Clean up many error-condition leaks of the server handle in the
kadmind server stubs.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21709
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Tue, 6 Jan 2009 20:24:09 +0000 (20:24 +0000)]
In kadmin, remove a bunch of checks for handle being NULL (some old,
some introduced by the last rev) when it is known from context that
handle is not NULL.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21708
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Tue, 6 Jan 2009 16:01:56 +0000 (16:01 +0000)]
Fix capitalization
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21707
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 5 Jan 2009 23:29:37 +0000 (23:29 +0000)]
Oops. Don't include openssl install paths from my local machine.
Thanks to Ezra for noticing so quickly.
ticket: 6315
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21706
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 5 Jan 2009 22:56:37 +0000 (22:56 +0000)]
include string.h
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21705
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 5 Jan 2009 22:56:00 +0000 (22:56 +0000)]
fix missed var rename
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21704
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 5 Jan 2009 22:45:10 +0000 (22:45 +0000)]
Define SWAP16 if not already defined
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21703
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 5 Jan 2009 22:44:41 +0000 (22:44 +0000)]
No C++ style comments in C code please
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21702
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 5 Jan 2009 20:27:53 +0000 (20:27 +0000)]
move generated dependencies out of Makefile.in
Move automatically-generated dependencies into separate files in the
source tree, and take the data out of Makefile.in.
Keep the "make depend" rules for stripping out the dependencies from
Makefile.in, in case some optional directories were missed, but
everything that builds on my UNIX build has been converted.
(Converting a directory just requires creating an empty "deps" file so
that config.status can build the makefile, and then later running
"make depend" in that directory to get the correct content for it.)
Change configure scripts to incorporate the "deps" file when building
each Makefile. This change requires the existence of a file "deps" in
each source directory where we build a makefile, even if there are no
sources for which to compute dependencies; a switch to GNU make would
let us conditionalize that, but we can assess that later.
Update dependencies for the generate Makefile itself to list the deps
file.
This will also require some minor tweaking of the Windows build, to
make it incorporate the new deps file.
ticket: new
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21701
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 5 Jan 2009 18:19:32 +0000 (18:19 +0000)]
Build against Python 2.5 as well as 2.3. Long term, should use python-config
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21700
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 5 Jan 2009 17:59:59 +0000 (17:59 +0000)]
fix minor comment typos
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21699
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 5 Jan 2009 17:49:00 +0000 (17:49 +0000)]
fix merge of new openldap notice
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21698
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Mon, 5 Jan 2009 05:01:04 +0000 (05:01 +0000)]
ifdef out unused functions that are also missing prototypes.
krb5int_utf8_islower and krb5int_utf8_isupper.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21697
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Mon, 5 Jan 2009 04:59:30 +0000 (04:59 +0000)]
Include ucdata/ucdata.h for missing prototypes
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21696
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Mon, 5 Jan 2009 04:57:56 +0000 (04:57 +0000)]
Include strings.h for memset prototype
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21695
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Sat, 3 Jan 2009 23:20:35 +0000 (23:20 +0000)]
Remove support for setting a client flag indicating pkinit is used on the db entry.
I'm reasonably sure that this would belong in a pkinit plugin not in do_as_req.c.
Also, the flag should be documented to indicate what it means--client attempted pkinit? Client succeeded in using pkinit?
I also wonder whether you want a mechanism for a db plugin to figure out all the padata or fast factors that a request is using.
Note that this flag will need to be added back by at least one vendor.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21694
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Sat, 3 Jan 2009 23:20:31 +0000 (23:20 +0000)]
xrealm_non_transitive not trust_non_transitive
Kerberos does not imply trust in the existence of a cross-realm key.
Trust is implied when a foreign principal is placed on an ACL: the remote realm
is trusted to authenticate that principal and is trusted
not to confuse one principal with another.
Keep terminology consistent.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21693
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Sat, 3 Jan 2009 23:20:26 +0000 (23:20 +0000)]
Remove flags that do not correspond to behavior we support
non_ms_principal would need to be phrased in terms of what behavior is being changed, not client OS.
The pkinit flag would need to be better documented
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21692
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Sat, 3 Jan 2009 23:20:19 +0000 (23:20 +0000)]
KDB API should not be public
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21691
dc483132-0cff-0310-8789-
dd5450dbe970
Sam Hartman [Sat, 3 Jan 2009 23:19:42 +0000 (23:19 +0000)]
Merge mskrb-integ onto trunk
The mskrb-integ branch includes support for the following projects:
Projects/Aliases
* Projects/PAC and principal APIs
* Projects/AEAD encryption API
* Projects/GSSAPI DCE
* Projects/RFC 3244
In addition, it includes support for enctype negotiation, and a variety of GSS-API extensions.
In the KDC it includes support for protocol transition, constrained delegation
and a new authorization data interface.
The old authorization data interface is also supported.
This commit merges the mskrb-integ branch on to the trunk.
Additional review and testing is required.
Merge commit 'mskrb-integ' into trunk
ticket: new
status: open
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21690
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Sat, 3 Jan 2009 12:40:53 +0000 (12:40 +0000)]
With no more fakeka, we don't need the --enable-fakeka option
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21683
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Sat, 3 Jan 2009 12:05:58 +0000 (12:05 +0000)]
Remove some unused AC_SUBSTs
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21682
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Sat, 3 Jan 2009 11:39:17 +0000 (11:39 +0000)]
Remove some unused variables
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21681
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Fri, 2 Jan 2009 01:40:41 +0000 (01:40 +0000)]
Rewrite walk_rtree.c to handle hierarchical traversal better and to be
less convoluted. Update test cases.
ticket: 5947
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21659
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Wed, 31 Dec 2008 17:25:25 +0000 (17:25 +0000)]
Set auth_context's rcache to NULL after destroying and before calling
krb5_auth_con_free, to avoid crashing when krb5_rc_close tries to run
using a destroyed rcache handle.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21644
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Wed, 31 Dec 2008 01:58:49 +0000 (01:58 +0000)]
I don't know what it was that someone else didn't know, but it doesn't
belong in the copyright header.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21642
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Tue, 30 Dec 2008 14:04:51 +0000 (14:04 +0000)]
Signed/unsigned fixes
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21639
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Tue, 30 Dec 2008 05:45:06 +0000 (05:45 +0000)]
Change kpropd_com_err_proc to prototype style, add format attribute
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21637
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Tue, 30 Dec 2008 05:42:04 +0000 (05:42 +0000)]
If full resync fails, go into backoff mode
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21636
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Mon, 29 Dec 2008 23:01:15 +0000 (23:01 +0000)]
Signed/unsigned fixes and remove unused variable
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21635
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Mon, 29 Dec 2008 22:41:27 +0000 (22:41 +0000)]
Fix up warning of suggested parens in assignment in conditional
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21634
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Mon, 29 Dec 2008 17:39:29 +0000 (17:39 +0000)]
Add gssrpcint.h to contain prototype for gssrpcint_printf. Include
gcc printf attribute if supported. Include header file and fix up some
of the debugging printf arguments.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21632
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Mon, 29 Dec 2008 17:12:54 +0000 (17:12 +0000)]
Revert r21589, and export krb5_get_fallback_host_realm instead
Rationale: Zephyr and AFS both use the Kerberos realm name as the
name of the service realm (AFS realm or Zephyr galaxy). AFS can grab
the Kerberos realm from the ticket being aklogged, but Zephyr is not
necessarily getting credentials at all (you could be sending an
unauthenticated message), and currently finds its answer by looking
up the realm of the server host. Although we can't currently provide
an accurate result for this lookup in the presence of referrals, we do
need to provide enough tools to get as good of an answer as libzephyr
could have gotten before referrals went in.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21631
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Mon, 29 Dec 2008 13:37:20 +0000 (13:37 +0000)]
Create a private header file for local functions missing prototypes.
Fix a number of warnning suggesting parenthesis.
Fix a signed/unsigned warning.
Update dependencies.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21627
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Mon, 29 Dec 2008 12:36:31 +0000 (12:36 +0000)]
Add prototype for usage. Change invocation of usage to db_usage when using an argument. Include adm_proto.h for prototype for krb5_keysalt_iterate
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21625
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Mon, 29 Dec 2008 04:45:36 +0000 (04:45 +0000)]
krb4 removal missed ldap kdb plugin directory
The krb4 removal failed to change the makefile in ldap kdb plugin directory.
ticket: new
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21622
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Mon, 29 Dec 2008 03:36:57 +0000 (03:36 +0000)]
Handle a number of warnings - including missing prototype,
paraenthesis in conditionals, unused function removal, unused variable
removal.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21621
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Sun, 28 Dec 2008 19:55:52 +0000 (19:55 +0000)]
whitespace
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21619
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 24 Dec 2008 18:48:00 +0000 (18:48 +0000)]
Clean up krb5_get_fallback_host_realm in two respects:
1. It isn't exported from libkrb5 (and no one seems to complain about
that). So give it a krb5int_ name and move its declaration to
k5-int.h. Also stop exporting it from the collected client lib.
2. It returned a list of realms, but its only caller assumes that the
list contains exactly one realm. So just make it return a single
realm.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21589
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Wed, 24 Dec 2008 16:51:33 +0000 (16:51 +0000)]
Add a new fallback host-to-realm heuristic to try the components of the
hostname as domains. The heuristic is off by default and is controlled
by the realm_try_domains variable under libdefaults.
Based on a patch submitted by Mark Phalan from Sun.
ticket: 6031
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21588
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 22 Dec 2008 04:40:39 +0000 (04:40 +0000)]
Collect ticket-request logging calls together in one place for easier
customization.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21564
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 22 Dec 2008 03:49:30 +0000 (03:49 +0000)]
Some cleanup from Shawn Emery: Use INITIAL_TIMER macros instead of
hardcoding values; reset 'gfd' when turning off the alarm.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21563
dc483132-0cff-0310-8789-
dd5450dbe970
Ken Raeburn [Mon, 22 Dec 2008 03:12:19 +0000 (03:12 +0000)]
Improvements from Shawn Emery: an extra-verbose mode
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21562
dc483132-0cff-0310-8789-
dd5450dbe970
Ezra Peisach [Fri, 19 Dec 2008 17:14:16 +0000 (17:14 +0000)]
Signed/unsigned fix. The function is called with a sizeof - so unsigned is
fine.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21553
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Thu, 18 Dec 2008 19:28:23 +0000 (19:28 +0000)]
Remove documentation references to krb4 functionality we no longer
have. Remove the krb425 transition guide since we no longer have
compatibility code to assist with a transition.
ticket: 6303
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21545
dc483132-0cff-0310-8789-
dd5450dbe970
Greg Hudson [Thu, 18 Dec 2008 18:31:16 +0000 (18:31 +0000)]
Remove krb524, lib/des425, lib/krb4, and include/kerberosIV.
Remove krb4 build system references and conditionals.
Move des425 header stuff referenced by des_int.h into des_int.h.
Remove krb4 test cases.
ticket: 6303
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21544
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Thu, 18 Dec 2008 16:21:10 +0000 (16:21 +0000)]
KIM: window settings
Ticket: 6290
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21543
dc483132-0cff-0310-8789-
dd5450dbe970
Zhanna Tsitkov [Thu, 18 Dec 2008 16:09:10 +0000 (16:09 +0000)]
Mem leak fix
Ticket: 6285
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21542
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Wed, 17 Dec 2008 20:44:37 +0000 (20:44 +0000)]
another diff test 4
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21519
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Wed, 17 Dec 2008 20:39:59 +0000 (20:39 +0000)]
another diff test 3
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21518
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Wed, 17 Dec 2008 20:37:15 +0000 (20:37 +0000)]
another diff test 2
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21517
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Wed, 17 Dec 2008 20:37:07 +0000 (20:37 +0000)]
another diff test
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21516
dc483132-0cff-0310-8789-
dd5450dbe970
Tom Yu [Wed, 17 Dec 2008 18:46:59 +0000 (18:46 +0000)]
test mailing diffs 6
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21515
dc483132-0cff-0310-8789-
dd5450dbe970