summaryrefslogtreecommitdiffstats
path: root/src/include
Commit message (Collapse)AuthorAgeFilesLines
...
* Get rid of cm.c and cm.hGreg Hudson2013-04-122-104/+0
| | | | | | | | | | | Since net-server.c now uses libverto, only sendto_kdc.c consumes cm.c. Move stuff out of cm.c and cm.h into sendto_kdc.c and get rid of them. Change the sendto_kdc callback (used by chpw.c) to receive the socket descriptor instead of the entire conn_state structure, and move the declarations into os-proto.h. struct remote_address also needs to be in os-proto.h so that trace.c and t_trace.c can use it. k5_curtime isn't needed since k5-platform.h now guarantees the presence of gettimeofday().
* Trace log with a subset of struct conn_stateGreg Hudson2013-04-122-31/+34
| | | | | | | In struct conn_state, collect together the fields for the remote address and put them in a substructure. Pass this substructure to trace logging macros instead of the entire conn_state structure, so that trace.c doesn't have to know about the whole structure.
* Update hst_realm.c coding styleGreg Hudson2013-04-091-10/+0
| | | | | Bring this file up to date with current coding style. No functional changes, except some trace logs were removed.
* Avoid passing null pointers to memcpy/memcmpGreg Hudson2013-04-081-7/+8
| | | | | | | | | | | | | | | By a strict reading of the C standard, memcpy and memcmp have undefined behavior if their pointer arguments aren't valid object pointers, even if the length argument is 0. Compilers are becoming more aggressive about breaking code with undefined behavior, so we should try to avoid it when possible. In a krb5_data object, we frequently use NULL as the data value when the length is 0. Accordingly, we should avoid copying from or comparing the data field of a length-0 krb5_data object. Add checks to our wrapper functions (like data_eq and k5_memdup) and to code which works with possibly-empty krb5_data objects. In a few places, use wrapper functions to simplify the code rather than adding checks.
* Add krb5_kt_dup API and use it in two placesGreg Hudson2013-04-011-0/+15
| | | | | | | Add an API to duplicate keytab handles, mirroring krb5_cc_dup. Use it to simplify the krb5 GSS acquire_cred code. ticket: 7599 (new)
* Get rid of krb5_xfreeGreg Hudson2013-03-281-3/+0
|
* Replace "First introduced" with concise "New"Zhanna Tsitkov2013-03-251-37/+37
|
* Move a bunch of stuff out of k5-int.hGreg Hudson2013-03-241-371/+0
| | | | | | | | | Move internal declarations from k5-int.h to more localized headers (like int-proto.h) where appropriate. Rename many symbols whose prototypes were moved to use the k5_ prefix instead of krb5int_. Remove some unused declarations or move them to the single source file they were needed in. Remove krb5_creds_compare since it isn't used any more.
* Get rid of krb5_{get,free}_krbhstGreg Hudson2013-03-221-2/+0
| | | | | These functions were always internal. They haven't been used since v5passwdd was eliminated in krb5 1.4.
* Get rid of osconfig.cGreg Hudson2013-03-221-3/+0
| | | | | These variables were marked as internal in 1996. Two are unused and the other is easily replaced with the macro it is initialized from.
* Remove stray include in localauth_plugin.hGreg Hudson2013-03-111-1/+0
| | | | | This unnecessary include was causing build failures on some systems by making libkrb5 sources depend on gssapi.h.
* Add localauth pluggable interfaceGreg Hudson2013-03-093-1/+153
| | | | | | | | Add a new pluggable interface for local authorization, and replace the existing krb5_aname_to_localname and krb5_kuserok implementations with implementations based on the pluggable interface. ticket: 7583 (new)
* Add krb5_free_enctypes APIGreg Hudson2013-02-272-2/+13
| | | | | | | Rename krb5_free_ktypes to krb5_free_enctypes and add it to the public API. ticket: 7584
* Fix windows buildBen Kaduk2013-02-252-2/+2
| | | | | | | | | | Catch up to the split of preauth_plugin.h into client and kdc specific portions. While here, use copy's /y flag to suppress an override-confirmation prompt (though we do not list any dependencies for this target at the moment, so no such prompt will be generated). Do not disable library finalizers for windows, erroneously disabled in 4538146e1452e0966164119cefb0804993ce6bbb.
* Modernize k5bufGreg Hudson2013-02-141-39/+36
| | | | | | Rename the krb5int_buf_ family of functions to use the k5_ prefix for brevity. Reformat some k5buf implementation code to match current practices.
* Add k5_json_array_fmt and use it in export_cred.cGreg Hudson2013-02-131-0/+18
| | | | | | Add a template-based array constructor for convenient marshalling of structured values as JSON array values. Use it to simplify export_cred.c.
* Make internal JSON functions return error codesGreg Hudson2013-02-131-17/+19
| | | | | | | | | Return error codes (0, ENOMEM, or EINVAL) from JSON support functions instead of returning results directly. This makes error handling simpler for functions which assemble JSON objects and then return a krb5_error_code values. Adjust all callers. Use shims in export_cred.c to minimize changes there; it will be redesigned internally in a subsequent commit.
* Add and use k5memdup, k5memdup0 helpersGreg Hudson2013-02-091-0/+22
| | | | | | Add k5-int.h static functions to duplicate byte ranges, optionally with a trailing zero byte, and set an error code like k5alloc does. Use them where they would shorten existing code.
* Fix iprop log reinitializationGreg Hudson2013-01-221-0/+1
| | | | | | | | | | | | | | | | If the master iprop log is reinitialized to serial number 0, slaves will need to take a full dump--but after that happens, we need to know whether the slave has taken that full dump, we we don't offering full dumps indefinitely. So, record a timestamp in kdb_last_time when we reinitialize the log header, and compare the slave timestamp to kdb_last_time whenever it has the current serial number, even if it's 0. Test this by performing a propagation with sno 0 in t_iprop.py and detecting whether kpropd gets a second UPDATE_FULL_RESYNC_NEEDED response from kadmind. ticket: 7550 (new)
* Get rid of krb5_read_realm_paramsGreg Hudson2013-01-161-9/+0
| | | | | | | Read realm parameters directly from the profile in the KDC's init_realm(), getting rid of the intermediate krb5_realm_params structure. Then get rid of krb5_realm_params and krb5_read_realm_params, since nothing else uses it.
* Correct typo in krb5_responder_context_st descrZhanna Tsitkov2013-01-141-3/+4
| | | | responder_get_challenge() meant to be krb5_responder_get_challenge()
* Flesh out responder context doxygen markupGreg Hudson2013-01-111-0/+30
|
* Use [out] more sparingly in doxygen markupGreg Hudson2013-01-111-107/+107
| | | | | | | | | In krb5.hin doxygen markup, only use [out] or [in,out] when a function changes the entire value of what the parameter points to, not when the function mutates a larger object (especially an abstract object). Also remove a couple of incorrect [in] annotations, change a few parameter descriptions to be more consistent, and fix one typo.
* Better doxygen markup for RESPONDER_QUESTION_OTPZhanna Tsitkov2013-01-111-21/+23
| | | | | | Doxygen and, consequently, Sphinx gets confused with the KRB5_RESPONDER_QUESTION_OTP comment layout. Also, mark the output parameter of krb5_responder_set_answer().
* Simplify KDC host referral codeGreg Hudson2013-01-112-2/+0
| | | | | | | | | | | Remove some unnecessary optimizations to reduce code complexity. Get rid of krb5_match_config_pattern in favor of a simpler helper function in do_tgs_req_c. Get rid of KRB5_CONF_ASTERISK and just use "*" instead. Use a helper function to combine [kdcdefaults] and realm subsection values of variables, and don't bother adding leading and trailing spaces. Consistently use the names "hostbased" and "no_referral" to refer to variable values (with a "realm_" prefix for structures which currently use it).
* Get rid of adm.hGreg Hudson2013-01-102-231/+2
| | | | | | adm.h predates the ovsec kadm5 integration. It contains a bunch of obsolete defines and a redundant definition of krb5_realm_params. Get rid of it, and include <kadm5/admin.h> where we currently include it.
* Allow principals to refer to nonexistent policiesGreg Hudson2013-01-091-1/+1
| | | | | | | | | | | | | | Stop using and maintaining the policy_refcnt field, and do not try to prevent deletion of a policy which is still referenced by principals. Instead, allow principals to refer to policy names which do not exist as policy objects; treat those principals as having no associated policy. In the kadmin client, warn if addprinc or modprinc tries to reference a policy which doesn't exist, since the server will no longer error out in this case. ticket: 7385
* Rename ccache configuration macrosZhanna Tsitkov2013-01-091-5/+5
| | | | | KRB5_CONF_ prefix should be used for the krb5/kdc.conf parameters. Use KRB5_CC_CONF_ prefix for cache configuration variables.
* Get rid of KRB5_KDB_SRV_TYPE_PASSWDGreg Hudson2012-12-202-4/+1
| | | | | | Nothing was using KRB5_KDB_SRV_TYPE_PASSWD, so get rid of it. (kpasswdd is part of kadmind and interacts with the KDB using KRB5_KDB_SRV_TYPE_ADMIN.)
* Rename internal preauth functionsGreg Hudson2012-12-191-27/+0
| | | | | | | | | | | | The preauth functions are internal to libkrb5, so use the k5_ prefix, don't use KRB5_CALLCONV, and prototype them in int-proto.h. Also remove krb5_do_preauth from the Unix libkrb5 export list. Reorder the k5_preauth() and k5_preauth_tryagain() arguments for more consistency with the clpreauth interface, and put the output padata arguments at the end. Rename any remaining uses of "kcontext" to "context" in preauth2.c.
* Make clpreauth flags function optionalGreg Hudson2012-12-191-3/+5
| | | | | | | | With one exception (KRB5_PADATA_PKINIT_KX), every padata type processed by a clpreauth module is now a real preauthentication type. Reduce the amount of boilerplate required for a clpreauth module by making the flags method optional if all of the preauth types advertised by the module are real.
* Use a proper consumer interface for clpreauthGreg Hudson2012-12-191-3/+6
| | | | | | | | In preauth2.c, use wrapper functions for calls to clpreauth functions. Get rid of the expanded-out module table, instead using a helper function to find the handle for a preauth type. Replace use counts with a list of previously processed pa types. Check for pa type conflicts when loading clpreauth modules.
* Separate clpreauth and kdcpreauth interfacesGreg Hudson2012-12-195-599/+682
| | | | | | | Since there is no overlap between the clpreauth and kdcpreauth interface declarations, there's no particular reason to combine them into one header. For backward compatibility and convenience, leave behind a preauth_plugin.h which includes both.
* Add functions to save and restore error stateGreg Hudson2012-12-191-0/+1
|
* Simplify error message retrievalGreg Hudson2012-12-191-1/+0
| | | | | | Eliminate the scratch_buf field of struct error_info and just return a non-localized constant error message if we can't allocate a copy of the real one. Also rely on a conformant strerror().
* Style cleanup for internal error handlingGreg Hudson2012-12-191-25/+17
| | | | | | | Fix style issues in kerrs.c and errors.c. Rename error handling functions to use shorter k5_ prefix. Eliminate an inoperable krb5int_set_error() call in gic_opte_alloc and convert the other call to use krb5_set_error_message().
* Don't finalize libraries in static buildGreg Hudson2012-12-121-11/+13
| | | | | | | | | | | | In a build with static libraries, functions tagged with __attribute__((destructor)) may be executed in any order, not in a topologically sorted order as they are in shared libraries. This could result in libcom_err functions being invoked (from another library's finalizer) after libcom_err has been finalized, which would (at minimum) result in using a mutex after it is destroyed. To prevent this kind of problem, disable finalizers in the static build regardless of whether we have compiler or linker support for them. Reported by Mihai Serban <mihai.serban@gmail.com>.
* Update comments for RFC 3244 kpasswd extensionsBen Kaduk2012-12-111-3/+4
| | | | | | | | | Remove the inaccurate comments "unused" and replace them with more useful representations of what they mean. ticket: 7490 (new) tags: pullup target_version: 1.11
* Document key usage assigned number conflictZhanna Tsitkov2012-11-301-11/+10
| | | | | | | | | | | | | | | | Document the fact that the key usage type 26 is used by both KBKRB5_KEYUSAGE_PA_S4U_X509_USER_REQUEST and KRB5_KEYUSAGE_PA_S4U_X509_USER_REQUEST, while 27 - by KRB5_KEYUSAGE_PA_S4U_X509_USER_REPLY and KRB5_KEYUSAGE_PA_SAM_RESPONSE. Also, since KRB5_KEYUSAGE_PA_REFERRAL is not actually used in MIT Kerberos code and is not defined in the latest referrals draft (http://tools.ietf.org/html/draft-ietf-krb-wg-kerberos-referrals-15) mark it as "unused". ticket: 7474 tags: pullup target_version: 1.11
* Update doxygen markup in krb5.hinBen Kaduk2012-11-271-20/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A few places were using the standard C /* comment */ form, but this is rendered poorly by doxygen through to our Sphinx bridge. Use the special /**< comment */ form to get doxygen-specific behavior. If the standard C comment form is used, the full comment (including start and end markers) is included in the value of the macro, and Sphinx then tries to treat the end of the comment as the start of inline markup with no corresponding end-string, which is a warning. Using the doxygen form of the comment, the contents of the comment are put in a separate paragraph block, which is inserted in the body of the generated RST document. The markup for krb5_rd_priv() had a line that ended with an @c markup statement without a symbol following it. This confused doxygen into not parsing any more of the comment. The beginning of the next line is a macro identifier with markup to auto-linkify it. In RST, it is not possible to have a link and a terminal font on the same text, so removing the @c is the appropriate fix. There are also eleven deprecated functions which are replaced by the krb5_c_* family of functions. However, referring to this class of functions as the "krb5_c_" class of functions results in Sphinx attempting to interpret this statement as a link to a label elsewhere in the document, and no such label exists. To avoid this warning, use "krb5_c_*" to refer to the class of functions, which is arguably more correct anyways. ticket: 7447 tags: pullup target_version: 1.11
* Make krb5_trace_info a typedefBen Kaduk2012-11-271-5/+11
| | | | | | | | | | | | | Our doxygen-to-sphinx documentation bridge only processes typedefs and not structure definitions, since we almost universally use typedefs for our data structures. krb5_trace_info is the sole exception, so bring it into the fold. While here, flesh out the comment a bit more. ticket: 7447 tags: pullup target_version: 1.11
* Document krb5_get_init_creds_opt_set_in_ccacheZhanna Tsitkov2012-11-261-0/+2
| | | | | | | More specifically, document that this new API was first introduced in 1.11 ticket: 7460
* Remove broken clean_hostname trace messagesGreg Hudson2012-11-251-7/+0
| | | | | | | | | | | | The trace messages in krb5int_clean_hostname were outputting the entire contents of the output buffer (mostly uninitialized garbage) into the trace log. Since these messages were essentially redundant with messages in the callers, and were arguably at too low of a level to begin with, simply remove them. ticket: 7459 (new) target_version: 1.11 tags: pullup
* Reword krb5_unparse_name_ext doxygen markupGreg Hudson2012-11-201-5/+6
| | | | | | | | | | Avoid using asterix characters in the documentation for krb5_unparse_ext_name, since they get intepreted as markdown punctuation when translated to RST. ticket: 7452 (new) target_version: 1.11 tags: pullup
* Add Doxygen markup for Camellia enctype constantsGreg Hudson2012-11-161-4/+4
| | | | | | An RFC number has been assigned for the Camellia draft. Add Doxygen markup to the enctype and cksumtype constants pointing to the informational RFC.
* Correctly document krb5_unparse_name_extGreg Hudson2012-10-251-7/+13
| | | | | | ticket: 7431 target_version: 1.11 tags: pullup
* Don't save empty cc_config_out in ccacheGreg Hudson2012-10-241-0/+2
| | | | | | | | | | Add an internal json function to make it easier to detect if an object is empty, and use it to avoid creating a ccache config entry for preauth module config data if there isn't any to save. ticket: 7427 (new) target_version: 1.11 tags: pullup
* Add loop() kdcpreauth methodNathaniel McCallum2012-10-231-1/+12
| | | | | | | | [ghudson@mit.edu: avoid verto.h header dependency; minor fixes] ticket: 7426 (new) target_version: 1.11 tags: pullup
* Fix verto_ctx declaration in preauth_plugin.hGreg Hudson2012-10-231-1/+1
| | | | | | ticket: 7425 (new) target_version: 1.11 tags: pullup
* Correct typo in krb5_rd_req documentationGreg Hudson2012-10-231-1/+1
| | | | ticket: 7421
generated by cgit (git 2.34.1) at 2025-09-25 07:31:19 +0000