10 years agoConvert DEBUG_REFERRALS to TRACE_* framework master
W. Trevor King [Fri, 18 May 2012 01:26:36 +0000 (21:26 -0400)]
Convert DEBUG_REFERRALS to TRACE_* framework

The referrals debugging code under DEBUG_REFERRALS ceased building
correctly at some point.  Convert this debugging code to use the
tracing framework instead, including adding new trace macros to

ticket: 7151

10 years agoAdd tests for trace.c formatting
W. Trevor King [Fri, 18 May 2012 01:12:49 +0000 (21:12 -0400)]
Add tests for trace.c formatting

This improves the previously minimal test coverage of "trace.c".

ticket: 7151

10 years agoAdd support for "{ptype}" trace format specifier
W. Trevor King [Fri, 18 May 2012 01:10:20 +0000 (21:10 -0400)]
Add support for "{ptype}" trace format specifier

Add the "{ptype}" trace format specifier, for principal name types.
Also document the new option in the "k5-trace.h" comments.

ticket: 7151

10 years agoDocument "{keytab}" trace format specifier
W. Trevor King [Fri, 18 May 2012 01:07:07 +0000 (21:07 -0400)]
Document "{keytab}" trace format specifier

10 years agoModified the Sphinx HTML page layout
Zhanna Tsitkov [Wed, 23 May 2012 19:59:24 +0000 (15:59 -0400)]
Modified the Sphinx HTML page layout

1. The Feedback button is moved into the footer;
2. The default page/doc width are set to 960px;

10 years agoExport gss_mech_krb5_wrong from libgssapi_krb5
Greg Hudson [Tue, 22 May 2012 17:45:18 +0000 (13:45 -0400)]
Export gss_mech_krb5_wrong from libgssapi_krb5

Although there are few legitimate reasons to use gss_mech_krb5_wrong,
it's declared in the public header and exported in the Windows DLL.
So export it from the Unix library as well.

ticket: 7148 (new)
target_version: 1.10.2
tags: pullup

10 years agoMake doc/coding-style point to wiki page
Tom Yu [Tue, 22 May 2012 16:46:21 +0000 (12:46 -0400)]
Make doc/coding-style point to wiki page

The old doc/coding-style file was out of date; replace its content
with a pointer to the wiki page.

ticket: 7147 (new)

10 years agoExport krb5_set_trace_callback/filename
Greg Hudson [Mon, 21 May 2012 05:39:14 +0000 (01:39 -0400)]
Export krb5_set_trace_callback/filename

krb5_set_trace_callback and krb5_set_trace_filename were added to
krb5.h in krb5 1.9, but were mistakenly left out of the library export
lists.  Add them now.  Reported by Russ Allbery.

ticket: 7143
target_version: 1.10.2
tags: pullup

10 years agoFix "(empty" typo in "{etypes}" handler in trace.c
W. Trevor King [Wed, 16 May 2012 23:09:46 +0000 (19:09 -0400)]
Fix "(empty" typo in "{etypes}" handler in trace.c

ticket: 7137

10 years agoFix "(null" typo in "{key}" handler in trace.c
W. Trevor King [Wed, 16 May 2012 21:11:12 +0000 (17:11 -0400)]
Fix "(null" typo in "{key}" handler in trace.c

ticket: 7134

10 years agoCorrect the name of krb5int_trace in comments
Tom Yu [Fri, 18 May 2012 00:05:22 +0000 (20:05 -0400)]
Correct the name of krb5int_trace in comments

Patch from W. Trevor King.

ticket: 7133

10 years agoAdd missing $(LIBS) to some shared libraries
Tom Yu [Thu, 17 May 2012 23:32:41 +0000 (19:32 -0400)]
Add missing $(LIBS) to some shared libraries

Add $(LIBS) to the $(SHLIB_EXPLIBS) for some shared libraries which
did not previously include it, which prevented gcov from working
properly in some cases.

Patch from W. Trevor King.

ticket: 7138

10 years agoRemove mention of util/autoconf
Tom Yu [Thu, 17 May 2012 18:18:27 +0000 (14:18 -0400)]
Remove mention of util/autoconf

We no longer use our own customized version of autoconf, so remove
mentions of the src/util/autoconf directory where that used to be.

Reported by W. Trevor King.

ticket: 7139 (new)

10 years agoMake mkrel work on non-master branches
Tom Yu [Tue, 15 May 2012 19:15:07 +0000 (15:15 -0400)]
Make mkrel work on non-master branches

Appending "--" to the git checkout arguments appears to prevent it
from automatically creating a local branch from the remote.  Also
correct the default git URL and clean up a spurious find warning.

10 years agoUpdate CHANGES file generation for Git
Tom Yu [Mon, 14 May 2012 23:14:54 +0000 (19:14 -0400)]
Update CHANGES file generation for Git

Use the correct git log invocation for generating the CHANGES file.

10 years agoUpdate patchlevel.h for Git repository
Tom Yu [Mon, 14 May 2012 22:39:17 +0000 (18:39 -0400)]
Update patchlevel.h for Git repository

Use "master", not "trunk", as RELTAG now.

10 years agoAdd missing newline to sn2princ debug message
Greg Hudson [Mon, 14 May 2012 19:24:02 +0000 (15:24 -0400)]
Add missing newline to sn2princ debug message

Patch from

ticket: 7131

10 years agoConvert util/mkrel to use git instead of svn
Greg Hudson [Mon, 14 May 2012 19:06:51 +0000 (15:06 -0400)]
Convert util/mkrel to use git instead of svn

10 years agoCheck alloc_data result in krb5int_old_encrypt
Greg Hudson [Sun, 13 May 2012 19:42:50 +0000 (15:42 -0400)]
Check alloc_data result in krb5int_old_encrypt

10 years agoClean up a redundant assignment in libprofile
Greg Hudson [Sun, 13 May 2012 19:38:06 +0000 (15:38 -0400)]
Clean up a redundant assignment in libprofile

10 years agoAvoid extern inline in asn1buf.h
Greg Hudson [Sun, 13 May 2012 17:15:34 +0000 (13:15 -0400)]
Avoid extern inline in asn1buf.h

Avoid using extern inline in asn1buf.h, as there are two conflicting
sets of semantics (gnu89's and C99's).  gcc defaults to the gnu89
semantics, which we were using, while clang defines __GNUC__ but
defaults to the C99 semantics.  To simplify things, use static inline
instead, like we do in k5-int.h.

10 years agoDon't stomp minor code in spnego_gss_acquire_cred
Greg Hudson [Sun, 13 May 2012 17:12:06 +0000 (13:12 -0400)]
Don't stomp minor code in spnego_gss_acquire_cred

When spnego_gss_acquire_cred passes through a failure status from the
mechglue, it overwrites the minor code with a call to
gss_release_oid_set().  Use a temporary minor status for that and a
related call.

10 years agoRemove find-missing-eol-prop and fix-eol-prop
Greg Hudson [Sat, 12 May 2012 23:03:47 +0000 (19:03 -0400)]
Remove find-missing-eol-prop and fix-eol-prop

Remove two Subversion-specific scripts which are no longer necessary
now that the master repository is in git.

10 years agoAdd a .gitgnore file
Greg Hudson [Sat, 12 May 2012 22:56:59 +0000 (18:56 -0400)]
Add a .gitgnore file

10 years agoNull-terminate components of parsed principals
Greg Hudson [Sat, 12 May 2012 16:54:06 +0000 (12:54 -0400)]
Null-terminate components of parsed principals

The rewritten krb5_parse_name didn't null-terminate components or
realms of principals, while the old one did.  Fix the new one to do so
as well.

This means KRB5_PRINCIPAL_PARSE_IGNORE_REALM allocates one byte for
the realm instead of leaving it as empty_data(), so we need to free
the realm in build_in_tkt_name() before copying in the client realm.

10 years agoOmit start time in common AS requests
Greg Hudson [Fri, 11 May 2012 18:07:30 +0000 (18:07 +0000)]
Omit start time in common AS requests

MIT and Heimdal KDCs ignore the start time for non-postdated ticket
requests, but AD yields an error if the start time is in the KDC's
future, defeating the kdc_timesync option.  Omit the start time if the
caller did not specify a start time offset.

This change reenables the client check for too much clock skew in the
KDC reply in the non-timesync configuration.  That check had been
unintentionally suppressed since the introduction of the
get_init_creds interfaces.  Adjust the t_skew test script to expect
the new error behavior.

Code changes from with slight modifications.

ticket: 7130

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoAvoid requiring default realm for in_tkt_service
Greg Hudson [Thu, 10 May 2012 17:34:14 +0000 (17:34 +0000)]
Avoid requiring default realm for in_tkt_service

Use the new KRB5_PRINCIPAL_PARSE_IGNORE_REALM flag when parsing
in_tkt_service arguments in get_init_cred functions, since we're going
to overwrite the realm anyway.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoAdd krb5_parse_name flag to ignore realm
Greg Hudson [Thu, 10 May 2012 17:34:10 +0000 (17:34 +0000)]
Add krb5_parse_name flag to ignore realm

The flag KRB5_PRINCIPAL_PARSE_IGNORE_REALM causes krb5_parse_name to
return the principal with an empty realm whether or not a realm is
present in the name.

ticket: 7129

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoRewrite krb5_parse_name
Greg Hudson [Thu, 10 May 2012 17:34:07 +0000 (17:34 +0000)]
Rewrite krb5_parse_name

krb5_parse_name started out a bit unwieldy, and has become more so
with the introduction of flags.  Rewrite it using two passes (allocate
and fill), each broken out into its own helper, and a wrapper which
handles the realm flags.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoMake password change work without default realm
Greg Hudson [Thu, 10 May 2012 17:34:01 +0000 (17:34 +0000)]
Make password change work without default realm

This fix is not very general or clean, but is suitable for backporting
because it is minimally invasive.  A more comprehensive fix will

ticket: 7127
target_version: 1.10.2
tags: pullup

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoAdd no-op macro for ngettext for non-NLS builds
Greg Hudson [Wed, 9 May 2012 19:27:49 +0000 (19:27 +0000)]
Add no-op macro for ngettext for non-NLS builds

r25857 (#7128) uses ngettext, which means we need a no-op macro for it
when we're building without NLS support.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoConstify get_init_creds string input params
Greg Hudson [Wed, 9 May 2012 17:55:27 +0000 (17:55 +0000)]
Constify get_init_creds string input params

The get_init_creds functions take read-only string input parameters
for passwords and initial ticket services.  Make these const char *
parameters instead of just char * parameters, for caller convenience.

Reported by

ticket: 7121

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoAdd API to interpret changepw result strings
Greg Hudson [Wed, 9 May 2012 17:40:38 +0000 (17:40 +0000)]
Add API to interpret changepw result strings

Active Directory returns structured policy information in the
nominally UTF-8 result string field of a password change reply.  Add a
new API krb5_chpw_message() to convert a result string into a
displayable message, interpreting policy information if present.

Patch from with changes.

ticket: 7128

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoConstify krb5int_utf8_normalize input parameter
Greg Hudson [Wed, 9 May 2012 17:40:32 +0000 (17:40 +0000)]
Constify krb5int_utf8_normalize input parameter

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoFirst pass at PKINIT client trace logs
Greg Hudson [Tue, 8 May 2012 03:04:22 +0000 (03:04 +0000)]
First pass at PKINIT client trace logs

Trace basic decisions about PKINIT client protocol processing.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoImprove traced error messages from PKINIT client
Greg Hudson [Tue, 8 May 2012 03:04:15 +0000 (03:04 +0000)]
Improve traced error messages from PKINIT client

If we have no configured PKINIT client identity, or if we fail to
create a certificate chain, set a reasonable error code (not EINVAL or
ENOMEM) and a useful error message to appear in trace log output.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoImprove display of error code 0 in trace output
Greg Hudson [Tue, 8 May 2012 03:04:12 +0000 (03:04 +0000)]
Improve display of error code 0 in trace output

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoUse variadic macros to simplify k5-trace.h
Greg Hudson [Tue, 8 May 2012 03:04:07 +0000 (03:04 +0000)]
Use variadic macros to simplify k5-trace.h

Also fix the facility to make it possible to trace log without
including k5-int.h.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoProcess param/defname node for "#define".
Zhanna Tsitkov [Sat, 5 May 2012 17:03:50 +0000 (17:03 +0000)]
Process param/defname node for "#define".

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoFor typedef documents in Sphinx do not add short description to the titles
Zhanna Tsitkov [Sat, 5 May 2012 15:41:00 +0000 (15:41 +0000)]
For typedef documents in Sphinx do not add short description to the titles

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoAdd generalized definition of krb5_ui_4 and krb5_int32 to the documentation for bette...
Zhanna Tsitkov [Sat, 5 May 2012 15:35:51 +0000 (15:35 +0000)]
Add generalized definition of krb5_ui_4 and krb5_int32 to the documentation for better cross-referencing. Do not include internal structure krb5_cc_ops into Sphinx documentation

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoModernize style in vfy_increds.c
Greg Hudson [Thu, 3 May 2012 21:43:47 +0000 (21:43 +0000)]
Modernize style in vfy_increds.c

Make vfy_increds.c consistently use newer coding conventions.  Also
add a copyright statement.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoMake verify_init_creds work with existing ccache
Greg Hudson [Thu, 3 May 2012 21:43:42 +0000 (21:43 +0000)]
Make verify_init_creds work with existing ccache

As the file ccache implementation currently stands, we don't want to
turn off TC_OPENCLOSE on a file cache we're writing to, or it will be
opened read-only and stores to it will fail.  Reported by Russ

ticket: 5126

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoThe new version of Doxygen ( produces different xml output around the <initia...
Zhanna Tsitkov [Thu, 3 May 2012 20:28:02 +0000 (20:28 +0000)]
The new version of Doxygen ( produces different xml output around the <initializer> node. Adopt the script to the change.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoTry all host keys by default in vfy_increds
Greg Hudson [Thu, 3 May 2012 19:42:43 +0000 (19:42 +0000)]
Try all host keys by default in vfy_increds

Factor out the core code of krb5_verify_init_creds into a helper, add
new helper functions to retrieve the list of unique host principals
from a keytab, and make krb5_verify_init_creds drive the helper once
per host principal.

Augment the test harness and test cases to better test the new
behavior.  Add a k5test method to retrieve an NFS principal for the
test realm for the sake of the new test cases.

ticket: 7125

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoIn sn2princ, getaddrinfo without AI_ADDRCONFIG
Greg Hudson [Thu, 3 May 2012 15:15:51 +0000 (15:15 +0000)]
In sn2princ, getaddrinfo without AI_ADDRCONFIG

When canonicalizing a principal, use AI_CANONNAME alone in the hint
flags for getaddrinfo, for two reasons.  First, it works around a gnu
libc bug where getaddrinfo does a PTR lookup for the canonical name
(we tried to work around this in r24977 bug the addition of
AI_ADDRCONFIG caused the same problem as the use of AF_INET).  Second,
an IPv4-only host should be able create a principal for an IPv6-only
host even if it can't contact the host.

This does result in extra AAAA queries in the common case (IPv4-only
host contacting IPv4-only service), which is unfortunate.  But we need
to leave that optimization up to the platform at this point.

ticket: 7124

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoClarify profile pluggable interface documentation
Greg Hudson [Wed, 2 May 2012 18:38:33 +0000 (18:38 +0000)]
Clarify profile pluggable interface documentation

Explain how profile plugin modules integrate with libkrb5, since it's
a bit different than usual.  Also fix a broken note.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoSimplify krb5_do_preauth
Greg Hudson [Mon, 30 Apr 2012 23:33:45 +0000 (23:33 +0000)]
Simplify krb5_do_preauth

Now that krb5_do_preauth has many fewer moving parts, simplify its
flow control.  Also remove an unused output parameter from

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoGet rid of built-in preauth types table
Greg Hudson [Mon, 30 Apr 2012 23:33:43 +0000 (23:33 +0000)]
Get rid of built-in preauth types table

Turn the last two entries of the pa_types table into helper functions
which we invoke before the loop.  Then, get rid of the part of the
loop which consults the pa_types table.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoSimplify preauth2 helper functions using realloc
Greg Hudson [Mon, 30 Apr 2012 23:33:38 +0000 (23:33 +0000)]
Simplify preauth2 helper functions using realloc

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoUse correct name-type in TGS-REQs for 2008R2 RODCs
Tom Yu [Fri, 27 Apr 2012 22:40:21 +0000 (22:40 +0000)]
Use correct name-type in TGS-REQs for 2008R2 RODCs

Correctly set the name-type for the TGS principals to KRB5_NT_SRV_INST
in TGS-REQs.  (Previously, only AS-REQs had the name-type set in this
way.)  Windows Server 2008 R2 read-only domain controllers (RODCs)
insist on having the correct name-type for the TGS principal in
TGS-REQs as well as AS-REQs, at least for the TGT-forwarding case.

Thanks to Sebastian Galiano for reporting this bug and helping with

ticket: 7120
target_version: 1.10.2
tags: pullup

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoSplit up and fix get_etype_info
Greg Hudson [Fri, 27 Apr 2012 21:11:08 +0000 (21:11 +0000)]
Split up and fix get_etype_info

The addition of afs3-salt processing in get_etype_info made it overly
large, so split out the pw-salt/afs3-salt processing into a separate
function.  Also fix two dumb bugs.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoStop using SALT_TYPE_AFS_LENGTH
Greg Hudson [Fri, 27 Apr 2012 21:11:04 +0000 (21:11 +0000)]

In krb5_init_creds_ctx and krb5_clpreauth_rock_st, use a boolean to
track whether we're still using the default salt instead of
overloading salt.length.  In preauth2.c, process afs3 salt values like
we would in krb5int_des_string_to_key, and set an s2kparams indicator
instead of overloading salt.length.  Also use an s2kparams indicator
in kdb_cpw.c's add_key_pwd.  Remove the s2k code to handle overloaded
salt lengths, except for a sanity check.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoFix TRACE_PREAUTH_SALT format string
Greg Hudson [Fri, 27 Apr 2012 21:11:00 +0000 (21:11 +0000)]
Fix TRACE_PREAUTH_SALT format string

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoDraft initial credentials API documentation
Tom Yu [Fri, 27 Apr 2012 20:39:13 +0000 (20:39 +0000)]
Draft initial credentials API documentation

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoRefactor client etype-info handling in preauth2.c
Greg Hudson [Fri, 27 Apr 2012 17:13:23 +0000 (17:13 +0000)]
Refactor client etype-info handling in preauth2.c

Pull etype-info2, etype-info, pw-salt, and afs3-salt handling out of
the pa_types loop into a new helper function get_etype_info().

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoEnsure null termination of AFS salts
Greg Hudson [Fri, 27 Apr 2012 17:04:24 +0000 (17:04 +0000)]
Ensure null termination of AFS salts

Use krb5int_copy_data_contents_add0 when copying a pa-pw-salt or
pa-afs3-salt value in pa_salt().  If it's an afs3-salt, we're going to
throw away the length and use strcspn in krb5int_des_string_to_key,
which isn't safe if the value is unterminated.

ticket: 2545

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoMake it easier to test SAM-2 client code
Greg Hudson [Thu, 26 Apr 2012 21:47:05 +0000 (21:47 +0000)]
Make it easier to test SAM-2 client code

Add a method to the securid_sam2 plugin, built with alternate
compile-time flags, which supplies a plain-text challenge to the
client to be used as the OTP value.  This lets us manually exercise
the SAM-2 client code and a little bit of the KDC code.

securid_make_sam_challenge_2_and_cksum is moved into the method-
independent code and renamed.  get_securid_edata_2 has its sc2b
parameter removed as it was not used by the caller.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoConvert SAM-2 preauth mechanism to a module
Greg Hudson [Thu, 26 Apr 2012 21:47:02 +0000 (21:47 +0000)]
Convert SAM-2 preauth mechanism to a module

Move the last real preauth mechanism, SAM-2, from the pa_types table
to a built-in module.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoRemove orphaned Apple PKINIT support
Greg Hudson [Thu, 26 Apr 2012 21:46:57 +0000 (21:46 +0000)]
Remove orphaned Apple PKINIT support

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoRearrange navigation buttons in the HTML header
Zhanna Tsitkov [Thu, 26 Apr 2012 13:11:09 +0000 (13:11 +0000)]
Rearrange navigation buttons in the HTML header

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoAdd kadmin ACL enforcement tests
Greg Hudson [Thu, 26 Apr 2012 04:34:25 +0000 (04:34 +0000)]
Add kadmin ACL enforcement tests

Add a Python script to test the enforcement of kadm5.acl
specifications, including wildcards and restrictions.

ticket: 7097

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoAllow clearpolicy restriction for kadmin addprinc
Greg Hudson [Thu, 26 Apr 2012 04:34:20 +0000 (04:34 +0000)]
Allow clearpolicy restriction for kadmin addprinc

Although the kadmin client never generates a KADM5_POLICY_CLR mask bit
with addprinc, the bit will be set if a kadm5.acl line imposes the
-clearpolicy restriction.  Relax the sanity checking in
kadm5_create_principal_3 to allow KADM5_POLICY_CLR as long as
KADM5_POLICY is not also set.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoAdd helpers for running kadmin
Greg Hudson [Thu, 26 Apr 2012 04:34:15 +0000 (04:34 +0000)]
Add helpers for running kadmin

Add K5Realm.prep_kadmin() to create a ccache and K5Realm.run_kadmin()
to run a kadmin query using it.  Modify to use these
helpers instead of its own.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoFlip the default of start_kadmind in
Greg Hudson [Thu, 26 Apr 2012 04:33:48 +0000 (04:33 +0000)]
Flip the default of start_kadmind in

Very few Python tests need kadmind, so it makes more sense to have to
turn it on than to have to turn it off.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoMinor cleanup (mostly to remove the "Contents" section titles)
Zhanna Tsitkov [Wed, 25 Apr 2012 19:15:30 +0000 (19:15 +0000)]
Minor cleanup (mostly to remove the "Contents" section titles)

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoUse "agogo" HTML theme (with some modifications) for the Sphinx documentation. Do...
Zhanna Tsitkov [Wed, 25 Apr 2012 19:10:41 +0000 (19:10 +0000)]
Use "agogo" HTML theme (with some modifications) for the Sphinx documentation. Do not show the ReST source files

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoClear preauth use counts for each AS request
Greg Hudson [Wed, 25 Apr 2012 17:20:20 +0000 (17:20 +0000)]
Clear preauth use counts for each AS request

Initialize use_count fields in krb5_preauth_request_context_init,
which is invoked before each AS request.  Previously they were
initialized only in krb5_init_preauth_context, which is only invoked
once per krb5 library context.

ticket: 7119
target_version: 1.10.2
tags: pullup

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoAdd KRB5_TRACE test case
Greg Hudson [Tue, 24 Apr 2012 17:04:29 +0000 (17:04 +0000)]
Add KRB5_TRACE test case

In, run kinit with KRB5_TRACE enabled and make sure we
see some basic strings in the resulting file.

ticket: 7113

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoAdjust organization
Greg Hudson [Tue, 24 Apr 2012 17:04:21 +0000 (17:04 +0000)]
Adjust organization

Move some tests out of the multipass_realms loop since they aren't
enctype-dependent.  Fix the success message not to mention kvno
wrapping.  Don't start kadmind in the multipass_realms loop since we
don't use it.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoTry all history keys to decrypt password history
Greg Hudson [Tue, 24 Apr 2012 01:05:41 +0000 (01:05 +0000)]
Try all history keys to decrypt password history

A database created prior to 1.3 will have multiple password history
keys, and kadmin prior to 1.8 won't necessarily choose the first one.
So if there are multiple keys, we have to try them all.  If none of
the keys can decrypt a password history entry, don't fail the password
change operation; it's not worth it without positive evidence of
password reuse.

ticket: 7099

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoUse etypes from keytab in krb5_gic_keytab
Greg Hudson [Thu, 19 Apr 2012 17:55:14 +0000 (17:55 +0000)]
Use etypes from keytab in krb5_gic_keytab

When getting initial credentials with a keytab, filter the list of
request enctypes based on the keys in the keytab.

Based on a patch from Stef Walter.

ticket: 2131

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoUnify krb5_get_init_creds_keytab code paths
Greg Hudson [Thu, 19 Apr 2012 17:55:10 +0000 (17:55 +0000)]
Unify krb5_get_init_creds_keytab code paths

Use krb5_init_creds_set_keytab in krb5_get_init_creds_keytab, so that
processing added to the former will be used by the latter.  This is
slightly awkward because of the way we do the use_master fallback, in
that we have to duplicate some of krb5int_get_init_creds.

Based on a patch from Stef Walter.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoReturn kinit output in k5test's K5Realm.kinit
Greg Hudson [Thu, 19 Apr 2012 17:55:07 +0000 (17:55 +0000)]
Return kinit output in k5test's K5Realm.kinit

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoAdd keytab kinit test cases
Greg Hudson [Thu, 19 Apr 2012 17:55:03 +0000 (17:55 +0000)]
Add keytab kinit test cases

Create a test script for keytab-related tests.  Move the kvno wrapping
test there from, and augment it to better match what's in
standalone.exp.  Add tests for kinit with keytab, including kinit with
the most-preferred enctype missing from the keytab (which currently

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoAdd Doxygen markup to API functions that were introduced in 1.9 release
Zhanna Tsitkov [Thu, 19 Apr 2012 14:45:20 +0000 (14:45 +0000)]
Add Doxygen markup to API functions that were introduced in 1.9 release

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoEdit resources page
Greg Hudson [Tue, 17 Apr 2012 18:18:08 +0000 (18:18 +0000)]
Edit resources page

Improve description of kerberos and krbcore.  Remove trailing
whitespace throughout.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoRename mitresources.rst to resources.rst
Greg Hudson [Tue, 17 Apr 2012 18:08:13 +0000 (18:08 +0000)]
Rename mitresources.rst to resources.rst

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoTranslate @version Doxygen markup into rst format
Zhanna Tsitkov [Tue, 17 Apr 2012 18:07:07 +0000 (18:07 +0000)]
Translate @version Doxygen markup into rst format

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoAdd Doxygen markup to API functions that were introduced in 1.10 release
Zhanna Tsitkov [Tue, 17 Apr 2012 17:58:56 +0000 (17:58 +0000)]
Add Doxygen markup to API functions that were introduced in 1.10 release

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoAdded MIT resources document
Zhanna Tsitkov [Tue, 17 Apr 2012 17:49:10 +0000 (17:49 +0000)]
Added MIT resources document

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoAllow preauth mechs to work with clock skew
Greg Hudson [Tue, 17 Apr 2012 04:07:34 +0000 (04:07 +0000)]
Allow preauth mechs to work with clock skew

Add a clpreauth callback which gets the time of day using an offset
determined by the preauth-required error, and use it in encrypted
timestamp and encrypted challenge.  This timestamp is not necessarily
authenticated, but the security consequences for those preauth mechs
are minor (and can be mitigated by turning off kdc_timesync on

Based on a patch from Stef Walter.

ticket: 7114

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoAdd clock skew tests
Greg Hudson [Tue, 17 Apr 2012 03:19:12 +0000 (03:19 +0000)]
Add clock skew tests

Add a KDC option (-T) to run with a time offset, and use that to
test kdc_timesync behavior.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoCorrect kdc_timesync documentation
Greg Hudson [Tue, 17 Apr 2012 03:19:07 +0000 (03:19 +0000)]
Correct kdc_timesync documentation

kdc_timesync is read from the profile as an integer, not a boolean; go
back to documenting it that way.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoDocument kadm5_hook chpass randomize-key behavior
Greg Hudson [Mon, 16 Apr 2012 23:21:42 +0000 (23:21 +0000)]
Document kadm5_hook chpass randomize-key behavior

kadmind's randkey operation invokes the kadm5_hook chpass method with
a null newpass parameter, which wasn't documented.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoFix documention of unconfigured rsthml build
Tom Yu [Wed, 11 Apr 2012 22:45:56 +0000 (22:45 +0000)]
Fix documention of unconfigured rsthml build

It's necessary to specify srcdir=. on the command line when building
rsthtml in an unconfigured tree.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoFix trace logging initialization
Greg Hudson [Thu, 5 Apr 2012 14:07:05 +0000 (14:07 +0000)]
Fix trace logging initialization

Reported by

ticket: 7112

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoFix app tag choices for decoding EncASRepPart
Greg Hudson [Thu, 5 Apr 2012 13:57:37 +0000 (13:57 +0000)]
Fix app tag choices for decoding EncASRepPart

When decoding an AS-REP enc part, we should accept app tags 26 (the
bogus one we generate) and 25 (the correct value).  We were accepting
26 and 24.  Bug report and fix by

ticket: 7111

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoFix password reuse check with cpw -keepold
Greg Hudson [Wed, 4 Apr 2012 21:38:57 +0000 (21:38 +0000)]
Fix password reuse check with cpw -keepold

When we check for password reuse, only compare keys with the most
recent kvno against history entries, or else we will always fail with

This bug primarily affects rollover of cross-realm TGT principals,
which typically use password-derived keys and may have an associated
password policy such as "default".

Bug report and candidate fix (taken with a slight modification) by
Nicolas Williams.

ticket: 7110

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoIf trace logging facility is enabled, report misconfiguration errors encountered...
Zhanna Tsitkov [Mon, 2 Apr 2012 18:38:45 +0000 (18:38 +0000)]
If trace logging facility is enabled, report misconfiguration errors encountered while initializing krb5 library context

ticket: 7091

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoMake cross-TGT key rollover work from AD to MIT
Greg Hudson [Mon, 2 Apr 2012 17:49:56 +0000 (17:49 +0000)]
Make cross-TGT key rollover work from AD to MIT

Active Directory always issues cross-realm tickets without a kvno,
which we see as kvno 0.  When we see that, try the highest kvno (as we
already do) and then a few preceding kvnos so that key rollover of the
AD->MIT cross TGT can work.

Add new helpers kdc_rd_ap_req, which takes the place of a couple of
steps from kdc_process_tgs_req, and find_server_key, which takes the
place of some of the end steps of kdc_get_server_key.

Code changes by Nicolas Williams.  Test cases by me.

ticket: 7109

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoEdit RST docs on building RST docs
Greg Hudson [Sat, 31 Mar 2012 06:01:02 +0000 (06:01 +0000)]
Edit RST docs on building RST docs

Fix a couple of grammar errors noted by Ben Kaduk, and elaborate a
little bit on why generated man pages are checked into the repository.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoFix data handling in rd_req_decoded_opt
Greg Hudson [Sat, 31 Mar 2012 00:38:20 +0000 (00:38 +0000)]
Fix data handling in rd_req_decoded_opt

We shouldn't peer at trans->[0] if
trans->tr_contents.length is 0, even if the data field is non-null.
Harmless as long as the ASN.1 decoder uses null data fields for empty
krb5_data values, but still wrong.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoAvoid malloc(0) in ASN.1 bytestring decode
Greg Hudson [Sat, 31 Mar 2012 00:38:16 +0000 (00:38 +0000)]
Avoid malloc(0) in ASN.1 bytestring decode

In k5_asn1_decode_bytestring, just leave *str_out as NULL if len is 0,
instead of calling malloc(0) and possibly returning a spurious ENOMEM.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoAdd doc target with configured path substitutions
Greg Hudson [Wed, 28 Mar 2012 21:11:06 +0000 (21:11 +0000)]
Add doc target with configured path substitutions

Add a new target "substhtml" in src/doc to create HTML documentation
with configured paths, suitable for installation by an OS package.
The build target generates a file named containing the
directory substitutions, copies it into the rst_composite directory,
and instructs to use it with the "pathsubs" tag.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoUse reference substitutions for paths in docs
Greg Hudson [Wed, 28 Mar 2012 21:11:01 +0000 (21:11 +0000)]
Use reference substitutions for paths in docs

For the default doc build (used for the web site and release tarball),
substitute path variables with links to the paths table in
mitK5defaults.rst, using symbolic names for the link text.

The substitution of kdcdir for man pages is slightly altered as a
side-effect of this commit.  Regenerate the man pages to match.  The
rendered man pages are unchanged.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoEdit defaults page in documentation
Greg Hudson [Wed, 28 Mar 2012 21:10:49 +0000 (21:10 +0000)]
Edit defaults page in documentation

Eliminate unused values and OS-specific stuff.  Reformat tables.  Add
a path substitution for sysconfdir to be used in the default config
file path.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoMove rstman build target to man directory
Greg Hudson [Wed, 28 Mar 2012 02:03:45 +0000 (02:03 +0000)]
Move rstman build target to man directory

rstman makes more sense in man than in doc, so move it there.  Remove
the rstman target from the top-level doc Makefile to avoid confusion.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoAutomate RST HTML generation with doxygen info
Greg Hudson [Wed, 28 Mar 2012 02:03:33 +0000 (02:03 +0000)]
Automate RST HTML generation with doxygen info

In src/doc/, create an "rsthtml" target for generating
release tarball/web site HTML docs in doc/rst_html.  For now,
eliminate support for the bridge to the Doxygen HTML output; just
generate XML output with Doxygen and convert it to RST format.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970

10 years agoFix up gssapi_ext.h Doxygen markup somewhat
Greg Hudson [Tue, 27 Mar 2012 02:32:57 +0000 (02:32 +0000)]
Fix up gssapi_ext.h Doxygen markup somewhat

* Bring formatting for gss_userok and gss_authorize_localname into
* Bring parameter markup for gss_localname into conformance.

git-svn-id: svn:// dc483132-0cff-0310-8789-dd5450dbe970