summaryrefslogtreecommitdiffstats
path: root/src/include
Commit message (Collapse)AuthorAgeFilesLines
...
* Alter responder function signature for consistencyGreg Hudson2012-10-231-3/+3
| | | | | | | | | | For the responder callback signature, put the closure argument just after the context, and use KRB5_CALLCONV. These changes make the signature consistent with most other libkrb5 callbacks. ticket: 7419 (new) target_version: 1.11 tags: pullup
* Don't expose binary format in preauth otpNathaniel McCallum2012-10-191-1/+0
| | | | | | ticket: 7417 (new) target_version: 1.11 tags: pullup
* Add "pa_config_data" configuration to ccachesNalin Dahyabhai2012-10-172-47/+17
| | | | | | | | | | | * Read a "pa_config_data" item from an in_ccache, if provided, and add a callback which client preauth plugins can use to retrieve a string value from it that's keyed by a string. * Add a callback which client preauth plugins can use to provide string key/value pairs to be stored in the ccache. * Moves the definition of (struct krb5_clpreauth_rock_st) from k5-int.h to init_creds_ctx.h to try to reduce the number of files that will need to include k5-json.h to understand k5_json_value.
* Remove KRB5_DB_LOCKMODE_DONTBLOCK from kdb.hGreg Hudson2012-10-161-2/+0
| | | | It's wasn't used and wasn't implemented.
* Test in_ccache and pa_types functionalityNalin Dahyabhai2012-10-161-0/+5
| | | | | | | | | * Add a krb5int_build_conf_principals() function to allow our get/set code to directly prune out duplicate config entries. * Verify that when we specify a pa_type, it affects whether or not we will use a particular preauth plugin. * Verify that we correctly save the KDC's preauth type number, that we tried to answer, to the out_ccache.
* Add "pa_type" configuration to ccachesNalin Dahyabhai2012-10-161-0/+12
| | | | | | | | | | | | | | * When producing preauth data, keep track of the type of padata in the KDC's list of acceptable types which prompted the module to produce padata. * After obtaining credentials, store that value as a "pa_type" configuration item in the out_ccache. * Read that allowed preauth type from an in_ccache, if possible. * If we have an allowed preauth type, only call "real" modules that handle that value when filling in responder items and producing a client request. ticket: 7414 (new)
* Add an input ccache get_init_creds optionNalin Dahyabhai2012-10-162-0/+20
| | | | | | | | Add a krb5_get_init_creds_opt_set_in_ccache() function. An input ccache may hold configuration data which the client libraries can use to influence their decisions. ticket: 7413 (new)
* Avoid bit shifting in krb5.h constantsGreg Hudson2012-10-161-5/+5
| | | | | | Our traditional practice is to use hex integer literals for flag bits. Bit shifting can be dangerous because shifting into the sign bit is undefined. Convert existing bit shift expressions to hex literals.
* Handle concat OTP responder caseNathaniel McCallum2012-10-161-0/+9
|
* Bump libkdb5 API and DAL versionsGreg Hudson2012-10-151-2/+2
| | | | | | We made two sets of incompatible changes to the DAL and libkdb5 API during development for 1.11 (master key list simplification and policy extensions), so increment the appropriate version numbers.
* Add responder support to preauth_otpNathaniel McCallum2012-10-151-0/+126
|
* Add responder support to get_as_key()Nathaniel McCallum2012-10-123-1/+15
| | | | | This follows the design laid out on the project page: http://k5wiki.kerberos.org/wiki/Projects/Password_response_item
* De-conditionalize Camellia codeGreg Hudson2012-10-092-22/+4
| | | | | | | | | | The Camellia enctypes and cksumtypes have received IANA assignments. Add #defines using those assignments to krb5.h, remove the CAMELLIA conditional, and enable testing code as appropriate. The Camellia draft has not received an RFC number yet, so there is no Doxygen markup for the enctype and cksumtype #defines. That can be added once the RFC number is known.
* Fix a minor race in kdb5_util loadNicolas Williams2012-10-051-0/+1
| | | | | | | | | | | | | | | | | | | If a kdb5_util load gets killed between rename()ing the new KDB file into place and resetting the iprop ulog then the ulog can reflect the pre-load state, which will almost certainly be incorrect. This matters because we want to impose a timeout on full resyncs in kpropd when iprop dictates that a full resync is needed, and the simplest timeout scheme involves signaling the kdb5_util load process. But also, we want no such races in general. The fix is simple: re-initialize the ulog before renaming the new KDB file into place, then proceed as usual. If the ulog is not properly updated at the end of the load it will at least always result in subsequent iprop get updates operations always indicating that a full resync is required. ticket: 7399
* Remove MAX_ULOGENTRIESNicolas Williams2012-10-051-1/+0
| | | | | | | | | | | If a master KDC uses only a 64-bit libkadm5srv then there is no reason to impose any limit on ulog size: the practical maximum will be given by the filesystem and available storage space. Even when using a 32-bit libkadm5srv the maximum practical ulog size will be found easily enough when mmap() fails. ticket: 7368
* Use a single global dump for iprop full syncsNicolas Williams2012-10-051-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Use a global dump (the default dump file) for full syncs for iprop. When a slave asks for a fullsync we kprop the existing global dump to it if that is good enough, else we dump the DB and send the new global dump. Before this change kadmind would run kdb5_util dump -i... each time a slave asked for a full dump. This was done in a sub-process, thankfully, but it was still a waste of time and storage (e.g., if one has a huge KDB). Also, long dump times might cause a slave to give up (the timeout for this is now configurable). But since iprop dumps bear a serial number and timestamp and since slaves will resync from that point forward, it doesn't matter if the dump we send a slave is fresh as long as it is fresh enough (i.e., that its sno and timestamp are in the ulog). Also: - Rename dumps into place instead of unlink, create, write (but we still keep the dump ok files as lock files and as a method of signaling to kprop that the dump is complete). ticket: 7371
* Improve kpropd behavior in iprop modeNicolas Williams2012-10-051-0/+1
| | | | | | | | | | | | | | | | | | | | | | - Make kpropd in iprop mode fork a child to listen for kprops from the master. The child writes progress and outcome reports to the parent for each kprop. This fixes a race between asking for a full resync and setting up a listener socket for it. - Add runonce (-t) for kpropd do_standalone() too. - Add a new iprop parameter: iprop_resync_timeout. kpropd will keep asking for incremental updates while waiting for a full resync to finish, and will re-request a full resync if kadmind continues to indicate that one is needed after this timeout passes since the previous full resync was requested. - Allow polling intervals less than 10 seconds. [ghudson@mit.edu: split out debug output changes; note polling interval change in commit message] ticket: 7373
* Add new api to Sphinx doc; doc introduced versionZhanna Tsitkov2012-09-111-1/+9
|
* Add internal JSON encoding and decoding supportGreg Hudson2012-09-112-0/+198
| | | | Add JSON support based loosely on Heimdal's heimbase code.
* Add internal base64 encoding and decoding supportGreg Hudson2012-09-111-0/+52
| | | | Add base64 support based on Heimdal's libroken base64 code.
* Add responder feature for initial cred exchangesNathaniel McCallum2012-09-113-1/+115
| | | | | | | | | | | | | | | | | | | | | | | Add new APIs: * krb5_get_init_creds_opt_set_responder * krb5_responder_get_challenge * krb5_responder_list_questions * krb5_responder_set_answer If a caller sets a responder, it will be invoked after preauth modules have had a chance to review their incoming padata but before they produce outgoing padata. The responder will be presented a set of questions with optional challenges. The responder should then answer all questions it knows how to handle. Both the answers and the challenges are printable UTF-8 and may contain encoded, structured data specific to the question asked. Add two new callbacks and one optional method to the clpreauth interface. The new method (prep_questions) allows modules to ask questions by setting them in the responder context using one of the new callbacks (ask_responder_question). The other new callback (get_responder_answer) is used by the process method to read the answers to the questions asked. ticket: 7355 (new)
* Add zapfreestr() helper to k5-int.hGreg Hudson2012-09-101-0/+10
| | | | | | Since zapfree(str, strlen(str)) won't work for possibly-null values of str, add a helper zapfreestr() which only calls strlen() if the string value is non-null.
* Doc newly introduced padata types for OTP supportZhanna Tsitkov2012-08-231-7/+6
| | | | | Remove KRB5_PADATA_OTP_CONFIRM pre-authentication data (padata) type as it is marked as OBSOLETE in RFC 6560.
* Add otp client preauth pluginNathaniel McCallum2012-08-232-0/+11
| | | | | | | Implements the client side of RFC 6560. Not all features are implemented, but it should work for the most common cases. ticket: 7242 (new)
* Add ASN.1 support for OTPGreg Hudson2012-08-231-0/+75
| | | | | | | Add encoders and decoders for the OTP-TOKENINFO, PA-OTP-CHALLENGE, PA-OTP-REQUEST, and PA-OTP-ENC-REQUEST types from RFC 6560. For more thorough testing, add support for generating test encodings using asn1c for sample objects (currently only for the OTP types).
* Further fixes for WSA/Posix error translationKevin Wasserman2012-08-031-2/+42
| | | | | | | | | | | | | | Don't translate '0' (no error). Handle WSAEAFNOSUPPORT and WSAEINVAL. Add Posix->WSA translation. Add default translation for unrecognized errors. [ghudson@mit.edu: Merged with master and adjusted comments.] Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> ticket: 7228 (new) tags: pullup
* Constify krb5_string_to_keysalts()'s string argNicolas Williams2012-07-301-3/+3
|
* Policy extensions + new policy: allowed ks typesNicolas Williams2012-07-301-0/+15
| | | | | | | | | | | | | | | | | This simply adds KADM5_API_VERSION_4 and various fields to the policy structures: - attributes (policy-ish principal attributes) - max_life (max ticket life) - max_renewable_life (max ticket renewable life) - allowed_keysalts (allowed key/salt types) - TL data (future policy extensions) Of these only allowed_keysalts is currently implemented. Some refactoring of TL data handling is also done. ticket: 7223 (new)
* Support changing the built-in ccache/keytab namesGreg Hudson2012-07-242-4/+3
| | | | | | | | | | | | | | * Add DEFCCNAME, DEFKTNAME, and DEFCKTNAME configure variables to change the built-in ccache and keytab names. * Add krb5-config options to display the built-in ccache and keytab names. * In the default build, use krb5-config to discover the system's built-in ccache and keytab names and use them (if not overridden). This can be controlled with the --with-krb5-config=PATH or --without-krb5-config configure options. * Make the built-in ccache name subject to parameter expansion. ticket: 7221 (new)
* Add default_ccache_name profile variableGreg Hudson2012-07-241-0/+1
| | | | | | | Like default_keytab_name and default_client_keytab_name, default_ccache_name is subject to parameter expansion. ticket: 7220 (new)
* Add token expansion for keytab namesGreg Hudson2012-07-241-2/+2
| | | | | | | Make the default_keytab_name and default_client_keytab_name variables subject to parameter expansion. ticket: 7219 (new)
* Doc introduced version for krb5_kt_client_defaultZhanna Tsitkov2012-07-161-0/+2
|
* Remove DISABLE_TRACING from windows buildKevin Wasserman2012-07-161-1/+0
| | | | | | | Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> ticket: 7215 (new) tags: pullup
* KFW win-mac.h fixesKevin Wasserman2012-07-161-0/+6
| | | | | | | | | | | | | | | | kfw: add int16_t, uint16_t typedefs to win-mac.h uint16_t is used in chpw.c include stdlib.h, crtdbg.h in win-mac.h Allows leak-tracking using built-in msvc tools on windows. crtdbg.h needs to come _after_ stdlib.h, but _before_ checking for strdup. Define DEBUG and CRTDBG_MAP_ALLOC for full tracking. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> ticket: 7204 (new) tags: pullup
* Correct comments in port-sockets.hGreg Hudson2012-07-121-23/+20
|
* Add krb5int_cc_user_set_default_nameKevin Wasserman2012-07-111-0/+3
| | | | | | | | | | | | | Set the default credential cache name for all processes for the current user. Currently implemented, for windows only, by setting HKEY_CURRENT_USER\Software\MIT\Kerberos5:ccname to the specified ccache name. This will not override the environment variable 'KRB5CCNAME'. It will override HKEY_LOCAL_MACHINE and 'indirect' registry values. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> ticket: 7199 (new) tags: pullup
* Translate WinSock errors to Posix counterpartsKevin Wasserman2012-07-111-1/+35
| | | | | | | | | | | | | | | | | | | | | MSVC 2010 defines both Posix and WinSock error values so we can no longer simply #define the Posix error values to be their WinSock counterpart. This patch explicitly #includes <errno.h> in port-sockets.h and still conditionally defines the Posix error values for compatibility with older MSVC but also translates WinSock errors to Posix for MSVC 2010 compatibility. The downside to this approach is that there are some Posix errors we do not currently detect (e.g. EADDRINUSE) that are neither #defined nor translated. If we use one of those in the future but fail to update TranslateWSAGetLastError() we'll once again be in the situation that the windows build will compile but fail to work, possibly only when some rare error condition occurs. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> ticket: 7197 (new) tags: pullup
* Allow using locales when gettext is absentBen Kaduk2012-07-061-5/+3
| | | | | | | | | | | Previously, if configure did not detect dgettext(), we disabled anything that smelled like localization, inadvertently including setlocale(). Now that we use setlocale(LC_ALL, ""), we have localized dates available as well as messages, so we should not disable calls to setlocale() any more. Since the routines from locale.h are only used in a relatively small number of places, just include the header directly in those files and remove it from k5-platform.h.
* Increase MAX_DGRAM_SIZEGreg Hudson2012-07-021-1/+1
| | | | | | | | | Accept UDP datagrams up to 64K in size. We should still detect when an oversized datagram comes in by comparing against the maximum size, but this is trivial and covers 90% of the practical issues. ticket: 6566 status: open
* Add client keytab initiation supportGreg Hudson2012-07-021-0/+1
| | | | | | | | | Support acquiring GSSAPI krb5 credentials by fetching initial credentials using the client keytab. Credentials obtained this way will be stored in the default ccache or collection, and will be refreshed when they are halfway to expiring. ticket: 7189 (new)
* Add krb5_kt_client_default APIGreg Hudson2012-07-023-0/+22
| | | | | | | | | | | | | | | | The default client keytab is intended to be used to automatically acquire initial credentials for client applications. The current hardcoded default is a placeholder, and will likely change before 1.11. Add test framework settings to ensure that a system default client keytab doesn't interfere with tests, and to allow tests to be written to deliberately use the default client keytab. Add documentation about keytabs to the concepts section of the RST docs, and describe the default client keytab there. ticket: 7188 (new)
* Correct and clarify keytab API documentationGreg Hudson2012-06-291-12/+12
|
* Simplify bld_princ.cGreg Hudson2012-06-211-9/+0
|
* Remove orphaned KfM codeGreg Hudson2012-06-2112-3495/+0
|
* Document how to free krb5_cc_get_full_name resultGreg Hudson2012-06-201-0/+2
| | | | | | | | Also, in klist, use the appropriate libkrb5 free functions for krb5_cc_get_full_name and krb5_unparse_name_results. Reported by Kevin Wasserman. ticket: 7179
* Document version for new API functionsZhanna Tsitkov2012-06-151-0/+4
|
* Add krb5_cccol_have_content APIGreg Hudson2012-06-151-0/+11
| | | | | | | Add a new API to determine whether any krb5 credentials are available in the ccache collection. Add tests to t_cccol.py. ticket: 7173 (new)
* Remove krb5int_cc_os_default_nameGreg Hudson2012-06-111-3/+0
| | | | | krb5int_cc_os_default_name has been unused since #6955 removed the call to it in cccursor.c. Get rid of it.
* Rename and add to etype utility functionsGreg Hudson2012-06-071-0/+6
| | | | | | | Rename krb5int_count_etypes and krb5int_copy_etypes to have k5_ prefixes, and make them available outside of libkrb5 (but not part of the public API). Add k5_etypes_contains to search an etype list, and use it in krb5_is_permitted_enctype.
* Remove krb5_is_permitted_enctype_extGreg Hudson2012-06-071-10/+0
| | | | | It's an internal function (not in krb5.h or the libkrb5 export list) and nothing uses it.
generated by cgit (git 2.34.1) at 2025-09-25 19:51:37 +0000