summaryrefslogtreecommitdiffstats
path: root/src/lib/krb5/asn.1
Commit message (Collapse)AuthorAgeFilesLines
* Eliminate internal fixed-width type wrappersGreg Hudson2014-02-264-42/+39
| | | | | Directly use stdint.h names for integer types in preference to the various internal names we have made up for them.
* Edit README.asn1Greg Hudson2013-12-031-34/+51
| | | | | | Add another blank line before section headers. Avoid contractions. Change some whiches to thats where it seems appropriate. Fix some missing or extra words.
* Reduce boilerplate in makefilesGreg Hudson2013-05-161-1/+0
| | | | | | | | | Provide default values in pre.in for PROG_LIBPATH, PROG_RPATH, SHLIB_DIRS, SHLIB_RDIRS, and STOBJLISTS so that they don't have to be specified in the common case. Rename KRB5_RUN_ENV and KRB5_RUN_VARS to RUN_SETUP (already the most commonly used name) and RUN_VARS. Make sure to use DEFINES for local defines (not DEFS). Remove some other unnecessary makefile content.
* Don't use "bool" for ASN.1 boolean macrosNate Rosenblum2013-05-141-2/+2
| | | | | | | | | | | | When building for IOS targets with clang, the stdbool.h header is included by default. This header includes the following C99 definition: #define bool _Bool which wrecks havoc with the DEFBOOLTYPE macro. ticket: 7525
* make dependGreg Hudson2013-03-241-14/+12
|
* make dependGreg Hudson2013-01-101-1/+1
| | | | | Mostly this gets rid of the trailing space on line 2 after bb76891f5386526bdf91bc790c614fc9296cb5fa.
* Separate clpreauth and kdcpreauth interfacesGreg Hudson2012-12-191-6/+6
| | | | | | | Since there is no overlap between the clpreauth and kdcpreauth interface declarations, there's no particular reason to combine them into one header. For backward compatibility and convenience, leave behind a preauth_plugin.h which includes both.
* Add ASN.1 support for OTPGreg Hudson2012-08-232-17/+113
| | | | | | | Add encoders and decoders for the OTP-TOKENINFO, PA-OTP-CHALLENGE, PA-OTP-REQUEST, and PA-OTP-ENC-REQUEST types from RFC 6560. For more thorough testing, add support for generating test encodings using asn1c for sample objects (currently only for the OTP types).
* Rename 'free' -> 'free_func' in asn1_encode.c/.hKevin Wasserman2012-07-162-3/+3
| | | | | | | | | MSVC memory tracking tools do '#define free(p) _dbg_free(...)'. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> ticket: 7205 (new) tags: pullup
* Avoid extern inline in asn1buf.hGreg Hudson2012-05-131-2/+4
| | | | | | | | Avoid using extern inline in asn1buf.h, as there are two conflicting sets of semantics (gnu89's and C99's). gcc defaults to the gnu89 semantics, which we were using, while clang defines __GNUC__ but defaults to the C99 semantics. To simplify things, use static inline instead, like we do in k5-int.h.
* Fix app tag choices for decoding EncASRepPartGreg Hudson2012-04-051-1/+1
| | | | | | | | | | When decoding an AS-REP enc part, we should accept app tags 26 (the bogus one we generate) and 25 (the correct value). We were accepting 26 and 24. Bug report and fix by stefw@gnome.org. ticket: 7111 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25802 dc483132-0cff-0310-8789-dd5450dbe970
* Avoid malloc(0) in ASN.1 bytestring decodeGreg Hudson2012-03-311-0/+2
| | | | | | | In k5_asn1_decode_bytestring, just leave *str_out as NULL if len is 0, instead of calling malloc(0) and possibly returning a spurious ENOMEM. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25796 dc483132-0cff-0310-8789-dd5450dbe970
* Properly decode etype-info2 with no saltGreg Hudson2012-03-081-1/+2
| | | | | | | | | | | The data-driven decoder for etype-info2 was neglecting to call init_no_salt() when no salt is present in the encoding. Add in the missing call. Also add decode test cases for etype-info2, which would have caught this if they weren't missing. ticket: 7100 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25744 dc483132-0cff-0310-8789-dd5450dbe970
* Correct fix for #7092Greg Hudson2012-02-221-1/+13
| | | | | | ticket: 7092 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25706 dc483132-0cff-0310-8789-dd5450dbe970
* Revert broken #7092 fixGreg Hudson2012-02-221-9/+1
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25705 dc483132-0cff-0310-8789-dd5450dbe970
* kvno ASN.1 encoding interop with Windows RODCsGreg Hudson2012-02-211-1/+9
| | | | | | | | | | | | | | | | | | RFC 4120 defines the EncryptedData kvno field as an integer in the range of unsigned 32-bit numbers. Windows encodes and decodes the field as a signed 32-bit integer. Historically we do the same in our encoder in 1.6 and prior, and in our decoder through 1.10. (Actually, our decoder through 1.10 decoded the value as a long and then cast the result to unsigned int, so it would accept positive values >= 2^31 on 64-bit platforms but not on 32-bit platforms.) kvno values that large (or negative) are only likely to appear in the context of Windows read-only domain controllers. So do what Windows does instead of what RFC 4120 says. ticket: 7092 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25703 dc483132-0cff-0310-8789-dd5450dbe970
* Fix void pointer arithmetic in ASN.1 decoderGreg Hudson2012-02-141-4/+4
| | | | | | | | An expression in decode_sequence_of was incorrectly parenthesized, resulting in addition to a void pointer. Also avoid repeating the expression. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25701 dc483132-0cff-0310-8789-dd5450dbe970
* Add explanatory README for ASN.1 infrastructureGreg Hudson2012-02-131-0/+560
| | | | | | | | Since we're not yet at the point of having an ASN.1 compiler for our ASN.1 encoder, create a document explaining how to write macro invocations for type descriptors from an ASN.1 module. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25699 dc483132-0cff-0310-8789-dd5450dbe970
* Separate tag info and length in ASN.1 encoderGreg Hudson2012-02-123-52/+54
| | | | | | | Remove the length field of taginfo, and change the internal ASN.1 encoder interfaces to return length separately from tag info. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25698 dc483132-0cff-0310-8789-dd5450dbe970
* Fix ASN.1 buildGreg Hudson2012-02-121-4/+2
| | | | | | | r25695 left behind a dangling reference to the asn1_make object; get rid of it. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25697 dc483132-0cff-0310-8789-dd5450dbe970
* Update ASN.1 TODO fileGreg Hudson2012-02-121-22/+7
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25696 dc483132-0cff-0310-8789-dd5450dbe970
* Remove unneeded ASN.1 codeGreg Hudson2012-02-1223-5634/+24
| | | | | | | | | | Get rid of a whole bunch of ASN.1 decoder infrastructure now that we're using the data-driven decoder for everything. Define taginfo in asn1_encode.h since asn1_get.h is going away. Rewrite split_der() to use get_tag() since it still had an unintended dependency on the previous generation of decoder infrastructure. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25695 dc483132-0cff-0310-8789-dd5450dbe970
* Convert utility functions to new decoderGreg Hudson2012-02-122-5/+44
| | | | | | | | | Create a special type to plug authdata types from authdata and make krb5int_get_authdata_containee_types use it. Add a test case for it as well. Move krb5_decode_ticket (a trivial wrapper) into asn1_k_encode.c so that krb5_decode.c is empty. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25694 dc483132-0cff-0310-8789-dd5450dbe970
* Data-driven ASN.1 decoderGreg Hudson2012-02-117-212/+1631
| | | | | | | | | | | | | | | | | | Add a general ASN.1 decoder implementation in asn1_encode.c using the same data structures as the encoder (augmented where necessary), and use it to define decoder functions in asn1_k_encode.c. Add a boolean type to atype_info, as it is needed for the pa_pac_req decoder. For the moment, just #if out the old decoder functions; they and their support code can be cleaned up later after a a few remaining utility functions are addressed. Changes to encoder and decoder interfaces are minimized, but there are two small ones. ldap_seqof_key_data has a kvno field added, and some of the decoder logic is pushed up into the caller. The safe_with_body decoder now outputs an allocated krb5_data * instead of a krb5_data with aliases into the input buffer. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25693 dc483132-0cff-0310-8789-dd5450dbe970
* Change optional handling in ASN.1 encoderGreg Hudson2012-02-114-641/+342
| | | | | | | | | | | Create a new atype_optional with a function pointer to decide whether the type is present in the C object. For simple cases, sequences just reference the optional version of a type. For more complex cases (such as when the presence of the usec field of a sequence depends on whether the timestamp is set), we define a predicate on the structure object and nest the field type inside the optional type. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25692 dc483132-0cff-0310-8789-dd5450dbe970
* Style and naming changes to ASN.1 encoderGreg Hudson2012-02-114-523/+444
| | | | | | | Make style changes in preparation for the table-driven decoder. No functional changes. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25691 dc483132-0cff-0310-8789-dd5450dbe970
* Use size_t for lengths in ASN.1 encoderGreg Hudson2012-02-113-67/+54
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25690 dc483132-0cff-0310-8789-dd5450dbe970
* Minimize draft9 PKINIT code by removing dead codeGreg Hudson2012-02-115-241/+9
| | | | | | | | | | | | | | | | The PKINIT client code doesn't use decode_krb5_pa_pk_as_rep_draft9, which is fortunate because it doesn't work (see issue #7072). Instead, it passes both kinds of PKINIT replies through decode_krb5_pa_pk_as_rep, then decodes the un-enveloped CMS data in alternative 1 (encKeyPack) as either an RFC or draft9 ReplyKeyPack. So, remove the unused broken pa_pk_as_rep_draft9 decoder. For pa_pk_as_req_draft9, we only use two of the fields on encode and only one of those on decode. So, get rid of the unused fields and the krb5_trusted_ca structure, and reduce the encoder and decoder sequences to the minimum necessary fields. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25689 dc483132-0cff-0310-8789-dd5450dbe970
* Eliminate some unused ASN.1 encoding primitivesGreg Hudson2012-02-117-329/+71
| | | | | | | | asn1_make.c contained a variety of utility functions, most of which we no longer needed. Fold make_tag into asn1_encode.c and get rid of asn1_make.c and asn1_make.h. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25688 dc483132-0cff-0310-8789-dd5450dbe970
* Fold atype_primitive into atype_fnGreg Hudson2012-02-113-58/+16
| | | | | | | | atype_primitive is used for only two types (KerberosTime and KerberosFlags), which doesn't justify the machinery. Turn those types into atype_fn types and get rid of atype_primitive. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25687 dc483132-0cff-0310-8789-dd5450dbe970
* Simplify ASN.1 choice type definitionsGreg Hudson2012-02-111-16/+7
| | | | | | | Union fields always have an offset of 0 relative to the union base, so we just need tag types for them, not DEFFIELDs. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25686 dc483132-0cff-0310-8789-dd5450dbe970
* Correct a fencepost in ASN.1 encode_cntypeGreg Hudson2012-02-111-1/+1
| | | | | | For cntype_choice, count must be less than choice->n_options. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25684 dc483132-0cff-0310-8789-dd5450dbe970
* Avoid sizeof(void) in ASN.1 encoderGreg Hudson2012-01-241-1/+1
| | | | | | | | | | We were computing sizeof(void) when referencing atype_int_immediate types in other types (primarily atype_tagged_thing). gcc gives this a pass but the Solaris compiler does not. Use "int" as the dummy type instead. (The type is unimportant since int-immediates aren't used by offset or sequence-of types.) git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25658 dc483132-0cff-0310-8789-dd5450dbe970
* Redesign ASN.1 encoder engine, removing field_infoGreg Hudson2012-01-244-1718/+1373
| | | | | | | | | | | | | | | | | | | | | Replace the "field" half of the ASN.1 encoder machinery with several new struct atype_info types (offset, counted, and int_immediate) and a new counted_type machinery used exclusively for object/integer pairs. This change eliminates the two-way entanglement between atypes and fields, and makes the encoder more independent of RFC 4120 ASN.1 conventions. Defining sequences with the preprocessor macros is now slightly more cumbersome; we need to define a type for each field and then string them together with an array of struct atype_info *. But it's not so bad, and hopefully we can auto-generate some of this soon. *_optional functions now return a bitmask of sequence field offsets not present in the C type. This will need some more attention before we add decoding support to the engine, since it means sequence fields no longer know whether they are optional or not. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25657 dc483132-0cff-0310-8789-dd5450dbe970
* Simplify integer loading in ASN.1 encodingGreg Hudson2012-01-132-41/+34
| | | | | | | Instead of defining an auxiliary load function for each integer type, just use its size and signedness to decide how to load it. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25651 dc483132-0cff-0310-8789-dd5450dbe970
* Add PKINIT decoder testsGreg Hudson2012-01-131-0/+9
| | | | | | | | | | | Add tests to krb5_decode_test.c for PKINIT types. Where the decoders do not match the encoders, include comments and hand-generated encodings which work with the decoder. Add a comment to asn1_k_encode.c documenting inconsistencies between the draft 9 PA-PK-AS-REQ spec and our encoder results. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25650 dc483132-0cff-0310-8789-dd5450dbe970
* Use DEFTAGGEDTYPE for FAST choice typesGreg Hudson2012-01-101-5/+10
| | | | | | | | | | | | | pa_fx_fast_request and pa_fx_fast_reply are defined in RFC 6113 as extensible choice types with only one choice, which means they encode as another type with a [0] tag wrapper. Use DEFTAGGEDTYPE to add this wrapper instead of DEFFIELDTYPE/FIELDOF_ENCODEAS, and add a comment describing why. After this change, all uses of DEFFIELDYPE are for dataptr/lenptr types or just simple offset transformations on the base pointer. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25635 dc483132-0cff-0310-8789-dd5450dbe970
* Simplify asn1_decode_kdc_dh_key_infoGreg Hudson2012-01-101-6/+2
| | | | | | | | | Due to some lingering confusion, the last commit changing asn1_decode_kdc_dh_key_info was correct but overly complicated (and contained an incorrect comment). Change it to just use get_lenfield for subjectPublicKey. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25634 dc483132-0cff-0310-8789-dd5450dbe970
* Make dh_key_info encoder and decoder symmetricGreg Hudson2012-01-093-5/+35
| | | | | | | | | | | | The dh_key_info encoder expects subjectPublicKey to contain the contents of a bit string, but the decoder outputs the DER encoding of the bit string including tag. The PKINIT client code expects this, so everything works, but the encoder and decoder should be symmetric. Change the decoder to process the bit string (adding a bit string decoding primitive) and modify the PKINIT client code to expect only the bit string contents. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25626 dc483132-0cff-0310-8789-dd5450dbe970
* Remove unneeded kdcRealm field in PKINIT structureGreg Hudson2012-01-082-2/+1
| | | | | | | | krb5_pk_authenticator_draft9 had a kdcRealm field which was set by the client code but never encoded or decoded. Remove it. Eliminating this field exposed a bug in auth_pack_draft9_optional; fix that. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25624 dc483132-0cff-0310-8789-dd5450dbe970
* Fix PKINIT serverDHNonce encodingGreg Hudson2012-01-081-7/+1
| | | | | | | | | | | Use an explicit tag for serverDHNonce, as specified in RFC 4556, rather than the implicit tag we historically used. This bug had no practical effect (and creates no interoperability issues) because we never generate a serverDHNonce. ticket: 7061 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25623 dc483132-0cff-0310-8789-dd5450dbe970
* Clean up the asn1 encoder designGreg Hudson2012-01-083-226/+227
| | | | | | | | | | | | | | | | | Now that the PKINIT types have been converted and atype_fn has only one use, we can more easily modify the encoder so that any object can be encoded without its tag, which makes for a cleaner design. The basic building block is now krb5int_asn1_encode_type, which encodes the contents of a function and returns its tag information to the caller. atype_fn now has its own structure, and the encoder function it references follows the semantics of krb5int_asn1_encode_type. atype_opaque is now atype_der and goes with a new corresponding field type (field_der); stored DER encodings are parsed to separate the tag from the content. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25622 dc483132-0cff-0310-8789-dd5450dbe970
* Remove some unneeded accessor fieldsGreg Hudson2012-01-071-1/+0
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25620 dc483132-0cff-0310-8789-dd5450dbe970
* Remove some unused structures and encodersGreg Hudson2012-01-074-160/+0
| | | | | | | | | | | krb5_alt_method was added in r6604 but never supported. krb5_pwd_data became unused when the Sandia kadmin system was replaced. krb5_pa_server_referral_data and krb5_pa_svr_referral_data were added in r21690 with internally-visible encoders which nothing uses. Leave behind structure declarations in krb5.hin for API compatibility. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25619 dc483132-0cff-0310-8789-dd5450dbe970
* Remove SAM encoders and structuresGreg Hudson2012-01-074-311/+0
| | | | | | | | r24403 removed the old SAM support, but left behind the structures, free functions, and ASN.1 encoders/decoders. Remove those now. (SAM-2 support is still present.) git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25618 dc483132-0cff-0310-8789-dd5450dbe970
* Convert all remaining macro-coded ASN.1 encodersGreg Hudson2012-01-066-1017/+302
| | | | | | | | | | | Use data-driven encoders for all of the remaining types which still used macros (primarily PKINIT types), and get rid of the macros. Do not change any encoding behavior, but add some comments where behavior differs from the spec. DEFFNTYPE is now unused except for the kdc_req_body hack. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25617 dc483132-0cff-0310-8789-dd5450dbe970
* Add support for CHOICE in ASN.1 encoderGreg Hudson2012-01-062-0/+50
| | | | | | | | Add a new field type where the length offset indicates a distinguisher and the data offset indicates a union address. The field's type is an atype_choice containing a seq_info indexed by the distinguisher. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25616 dc483132-0cff-0310-8789-dd5450dbe970
* Factor out length retrieval in ASN.1 encoderGreg Hudson2012-01-061-71/+54
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25615 dc483132-0cff-0310-8789-dd5450dbe970
* Support implicit context tags in ASN.1 fieldsGreg Hudson2012-01-064-356/+418
| | | | | | | | | | | | | | | | | | | | | Add a field_info bit (the 32nd bit of the bitfields) indicating whether the context tag is implicit, and support it in encode_a_field. Adjust all field-generating macros and invocations to include the new bit (always 0 for the moment). For atype_tagged_thing, narrow the construction field to six bits and add an implicit bit. We could remove the construction field if it weren't for DEFOCTETWRAPPEDTYPE abusing atype_tagged_thing a little bit, since (normal) explicit tags are always constructed and implicit tag construction is computed from the base type. Given how rarely implicit tagging is used, it might be nice to have separate _IMPLICIT macros rather than an extra argument to every field. But we already have separate _OPT macros for optional fields and FIELDOF_STRING vs. FIELDOF_STRINGL, so we start to get a combinatoric explosion in the number of macros. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25614 dc483132-0cff-0310-8789-dd5450dbe970
* Support ASN.1 encoding without the outer tagGreg Hudson2012-01-061-113/+135
| | | | | | | | | | | | | | | | In order to support implicit tagging, make it possible to ASN.1-encode a value without its outer tag, instead remembering the construction bit of the omitted tag. A cleaner design would be to have separate functions for encoding a value's contents and its tag. However, we can't do that for atype_fn or atype_opaque, and the possible indirections between types and fields mean we want to stay at the "encode everything" level for as long as possible to allow implicit tagging of the largest possible subset of types. If we can get rid of atype_fn, we may be able to switch to the cleaner design with some adjustments to atype_opaque. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25613 dc483132-0cff-0310-8789-dd5450dbe970
generated by cgit (git 2.34.1) at 2025-09-26 15:04:22 +0000