summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Don't use void * arithmetic in interposed_oidGreg Hudson2012-10-131-1/+2
|
* Make t_iprop.py faster and more robustGreg Hudson2012-10-123-32/+80
| | | | | | | | | | | | | | | Catch SIGUSR1 in iprop-mode kpropd so that we can use it to interrupt sleeps and make kpropd do an iprop request immediately. In k5test.py, add prod_kpropd and read_from_kpropd methods to allow test scripts to send a SIGUSR1 to kpropd and to read its stdout/stderr output; also allow the test script to specify additional arguments when starting kpropd. In t_iprop.py, start kpropd with -d and, instead of sleeping, read kpropd output until we see an indication that kpropd is in sync with the master. To avoid delays, prod kpropd before waiting for sync and after a completed full prop.
* Fix a couple of typosNalin Dahyabhai2012-10-121-2/+2
|
* Add responder support to preauth_encts/preauth_ecNathaniel McCallum2012-10-122-0/+26
|
* Add responder support to get_as_key()Nathaniel McCallum2012-10-129-9/+70
| | | | | This follows the design laid out on the project page: http://k5wiki.kerberos.org/wiki/Projects/Password_response_item
* Allow null inputs to response item functionsNathaniel McCallum2012-10-121-2/+14
|
* Remove unused texinfo sourcesBen Kaduk2012-10-1210-6233/+0
| | | | | | | | Now that the admin guide make rules are removed, quite a few of the texinfo sources are not referenced from anywhere and can be safely removed. ticket: 7408
* Remove make glue for texinfo admin guideBen Kaduk2012-10-121-30/+1
| | | | | | Towards removing the texinfo docs entirely. ticket: 7408
* Disconnect the texinfo admin guide from the buildBen Kaduk2012-10-121-1/+1
| | | | | | | | | | | | | | | | | Its content has been migrated to or superseded by the reST documentation, essentially entirely in krb_admins. A few portions of the texinfo document are simply no longer relevant and do not need to be migrated. In particular: Information about reporting bugs lives on k5wiki.kerberos.org. General Kerberos concepts/introduction will be elsewhere in the tree. We do not need to document the time zones accepted by kadmin. We do not need a table of the various error codes and strings in our formal documentation. A complete description of the layout of our source tree is not useful or relevant to most Kerberos administrators. ticket: 7408
* Fix cast regexp in C style checkerGreg Hudson2012-10-111-1/+1
| | | | | | | In check_cast, we want to match cast operators with or without spaces after the closing paren, and then check for spaces after we match. Also, per the comment, we want to match potential cast operators followed by an open paren.
* Improve the ktadd and ktremove synopsesBen Kaduk2012-10-111-3/+4
| | | | | | | Mention the options on the synopsis line, and do not imply that the principal argument(s) for ktadd are optional. reST line blocks are needed to keep the two forms of ktadd on separate lines.
* Fix ordered list styleBen Kaduk2012-10-111-0/+22
| | | | | | | Sphynx outputs class information that corresponds to its generated basic.css, which we do not include. This results in all lists, even nested lists, using arabic numerals. Import the class properties into kerb.css for now.
* Fix copy/paste errors in dbadminBen Kaduk2012-10-111-4/+4
| | | | | | We should include the stashsrvpw content in that section, not the list content. Likewise, the list_policy content instead of the destroy_policy content.
* Update kdb5_util example outputBen Kaduk2012-10-111-2/+4
| | | | | | This text has not caught up with changes to the utility itself. As a side effect, our output text box is narrower and does not have to scroll on as many browser windows.
* Wordsmith kdb5_util stash -fBen Kaduk2012-10-111-1/+2
| | | | | | | The keyfile worth overriding is the one in kdc.conf. Though using stash -f would override kdb5_util's -sf argument, there is no reason to pass both flags to the same invocation. In any case, the "at startup" language is not really correct.
* Remove pronoun referent ambiguityBen Kaduk2012-10-111-2/+2
| | | | The policy must be unused, not the delete_policy command.
* Move cross-realm info to the cross-realm sectionBen Kaduk2012-10-111-16/+10
| | | | | | | | It's really not appropriate for the "examples" subsection of "Adding, modifying and deleting principals". While here, update the enctype recommendation for cross-realm principals to something that does not include weak crypto.
* Normalize format of kadmin option descriptionsBen Kaduk2012-10-101-27/+28
| | | | | Start with a capital letter and end with a full stop, making the description a sentence (or at least close to one).
* Correct kadm5.acl synopsisBen Kaduk2012-10-101-1/+1
| | | | | | The target principal and restrictions arguments are not orthogonal; a target principal argument must be given in order for a restriction list to be supplied.
* Make the kadm5.acl example saneBen Kaduk2012-10-101-9/+10
| | | | | | | | | It is an eggregious security violation to give all admin principals admin rights and then give all null instances permission to change the password of the associated admin instance. While here, don't assume that admin and root are the only non-null instances, and correct the formatting of an entry with restrictions.
* kadm5.acl line order is importantBen Kaduk2012-10-101-2/+2
| | | | Make it a special note in the documentation to help it stand out.
* Wordsmith in kadm5_acl.rstBen Kaduk2012-10-101-2/+2
| | | | Grammar fixup and avoid jargon.
* Fix slow kprop dejagnu testGreg Hudson2012-10-103-6/+4
| | | | | | | | | Fix kpropd -S -t to actually exit after processing one connection (it was breaking out of the switch statement, not the while loop). Use the -t when invoking kpropd from the dejagnu test framework; previously it was unnecessary because kpropd -S -d exited after one connection. Clear up some confusion in the kprop.exp comments about whether kpropd is expected to exit.
* Wordsmith SRV records for KDCsBen Kaduk2012-10-101-5/+6
| | | | | Tweak the wording a bit to be more clear and avoid using multiple words deriving from the stem "use" in close succession.
* Document TXT records for realm lookupBen Kaduk2012-10-101-1/+22
| | | | | | | | | Even though they are subject to vulnerabilities via DNS spoofing and we accordingly don't recommend their use, we do have the code to use them. Just as we document dns_lookup_realm in krb5.conf(5), document them here. ticket: 7407
* Fix argument order when calling the responderNathaniel McCallum2012-10-101-2/+2
|
* Remove unused texinfo sourcesBen Kaduk2012-10-103-2461/+1
| | | | | | | | Now that the install guide make rules are removed, nothing references build.texinfo or install.texinfo any more (other than the tgz target, which is updated accordingly). ticket: 7408
* Remove make glue for texinfo install guideBen Kaduk2012-10-101-30/+1
| | | | | | Towards removing the texinfo docs entirely. ticket: 7408
* Disconnect texinfo install guide from the buildBen Kaduk2012-10-101-1/+1
| | | | | | | | | | | | | | | | | Its content has been migrated to or superseded by the RST documentation, split amongst krb_build and various sections of krb_admins. A few portions of the texinfo document are simply no longer relevant and do not need to be migrated. In particular: It's 2012; we don't need to specify that we require a C89 compiler. It's 2012; it will be easy to get enough disk to build krb5. The KADM5 tests are part of 'make check' and don't need separate documentation. Shared library support is not limited to "a few operating systems". We do not need to document incompatibilities with ancient/dead OSes. kadmind4 and v5passwdd are no longer relevant. ticket: 7408
* Add section on updating from single-DESBen Kaduk2012-10-093-1/+132
| | | | | | | | | | | | | There are, unfortunately, still some single-DES deployments out there. Try to help them along by documenting a procedure for migrating to stronger crypto. The texinfo install guide had a section on "upgrading", but it was not really suitable for direct import into a RST document. For one, it gave a high profile to the on-disk incompatibilities in upgrades to 1.1 and 1.2. It also was driven at upgrading *to* triple-des (or RC4), which are something of a dead-end. This new text attempts to be more general and applicable to today's environment.
* Add a kdb5_util examples for old KDC upgradesBen Kaduk2012-10-091-0/+20
| | | | | | | | | | | | It's a slightly less-contrived use case of the utility than the other example, which reads more like a usage statement. Give a motivating sentence before each example, and note that this new example is not needed in the general upgrade case. The need to dump/load for upgrades prior to 1.2 was documented in the texinfo install guide, but not in any RST sources until now. ticket: 7407
* De-conditionalize Camellia codeGreg Hudson2012-10-0930-221/+42
| | | | | | | | | | The Camellia enctypes and cksumtypes have received IANA assignments. Add #defines using those assignments to krb5.h, remove the CAMELLIA conditional, and enable testing code as appropriate. The Camellia draft has not received an RFC number yet, so there is no Doxygen markup for the enctype and cksumtype #defines. That can be added once the RFC number is known.
* Document DejaGnu dependency and manual testsBen Kaduk2012-10-081-0/+11
| | | | | | | | | The Texinfo install guide had a separate subsection about the DejaGnu tests which did not get converted to the RST source. In the testing section, also link to the wiki page on manual testing. ticket: 7407
* Remove bug-report.texinfoBen Kaduk2012-10-082-11/+1
| | | | | | It is unused; send-pr.texinfo supercedes it at the moment anyway. ticket: 7408
* Untabify preauth_sam2.cGreg Hudson2012-10-081-17/+17
|
* Remove iprop dejagnu testGreg Hudson2012-10-081-236/+0
| | | | | | | Both the Python and dejagnu iprop tests are slow since they use sleeps to give kpropd time to do its work (although we can fix this with some work). Since the Python tests cover the same ground as the dejagnu tests, we don't need both.
* Import and complete Greg Hudson's iprop testNicolas Williams2012-10-082-0/+140
| | | | ticket: 7374
* Prep k5test.py for iprop (add start_kpropd(), ...)Nicolas Williams2012-10-081-6/+42
| | | | | | | Add a start_kpropd() method to K5Realm and make start_kadmind() use the kadmind -p, -K, and -F options. ticket: 7378
* krb5_db_delete_principal() can fail to unlock ulogNicolas Williams2012-10-081-1/+3
| | | | | | Not really: only when the KDB backend lacks a delete method. Still. ticket: 7403
* Remove an old, incorrect comment in kpropd.cNicolas Williams2012-10-081-9/+0
| | | | | | | We absolutely do not want a parking brake on the kprop protocol as described in the comment being removed. Instead the kprop command should be fixed so it doesn't die on error (assuming it even still does or ever did, neither of which I've checked).
* Send kpropd debug msgs to stderrNicolas Williams2012-10-081-4/+5
|
* Fix a minor race in kdb5_util loadNicolas Williams2012-10-053-37/+65
| | | | | | | | | | | | | | | | | | | If a kdb5_util load gets killed between rename()ing the new KDB file into place and resetting the iprop ulog then the ulog can reflect the pre-load state, which will almost certainly be incorrect. This matters because we want to impose a timeout on full resyncs in kpropd when iprop dictates that a full resync is needed, and the simplest timeout scheme involves signaling the kdb5_util load process. But also, we want no such races in general. The fix is simple: re-initialize the ulog before renaming the new KDB file into place, then proceed as usual. If the ulog is not properly updated at the end of the load it will at least always result in subsequent iprop get updates operations always indicating that a full resync is required. ticket: 7399
* Make kadmind iprop never return UPDATE_BUSYNicolas Williams2012-10-051-11/+1
| | | | | | | | | | | | | | | Currently kadmind allows slaves to poll for updates as often as they like, but not within 10s of the last update. This means that iprop will appear to fail to synchronize the KDC at any site whose master KDC processes at least one write transaction every 10 seconds consistently. The original intention must have been to throttle iprop clients (slave KDCs) that poll too often. But UPDATE_BUSY as implemented is not that, and implementing a throttle would be difficult (requires keeping state in a table) and mostly useless (admins can manage their poll timers just fine without a throttle in kadmind). ticket: 7369
* Remove MAX_ULOGENTRIESNicolas Williams2012-10-052-4/+1
| | | | | | | | | | | If a master KDC uses only a 64-bit libkadm5srv then there is no reason to impose any limit on ulog size: the practical maximum will be given by the filesystem and available storage space. Even when using a 32-bit libkadm5srv the maximum practical ulog size will be found easily enough when mmap() fails. ticket: 7368
* Add -R option to kproplog to force full resyncsNicolas Williams2012-10-053-4/+34
| | | | ticket: 7375
* Fix policy refcount corruption race in dumpNicolas Williams2012-10-051-10/+10
| | | | ticket: 7384
* Sync iprop header in kdb5_util dumpNicolas Williams2012-10-051-0/+10
| | | | [ghudson@mit.edu: split out from previous commit]
* kdb5_util load needs iprop safety netNicolas Williams2012-10-051-15/+36
| | | | ticket: 7370
* Deprecate kpropd -S optionNicolas Williams2012-10-052-6/+17
| | | | ticket: 7376
* Correct docs re: kpropd usage w/ ipropNicolas Williams2012-10-052-7/+8
| | | | ticket: 7379
generated by cgit (git 2.34.1) at 2024-09-22 09:38:54 +0000