summaryrefslogtreecommitdiffstats
path: root/src/lib/krb5/krb
Commit message (Collapse)AuthorAgeFilesLines
...
* Use correct salt for canonicalized principalsGreg Hudson2009-03-131-1/+23
| | | | | | | | | | | | In cases where the salt is derived from the client principal, use the canonicalized principal received from the KDC to determine the salt. Further changes are probably required for some preauth cases. ticket: 6415 target_version: 1.7 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@22083 dc483132-0cff-0310-8789-dd5450dbe970
* Make a working krb5_copy_error_messageGreg Hudson2009-03-111-0/+14
| | | | | | | | | | | | The krb5_copy_error_state macro wasn't used, didn't work, and didn't need to be a macro. Replace it with an exported API function named krb5_copy_error_message. ticket: 6407 target_version: 1.7 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@22078 dc483132-0cff-0310-8789-dd5450dbe970
* send_as_req re-encodes the requestSam Hartman2009-03-061-19/+12
| | | | | | | | | | | | | | | | krb5_get_init_creds calls encode_krb5_as_req to produce an encoding for the preauth plugins, then passes the unencoded request structure into the static function send_as_req. That function re-encodes the request. This is an unnecessary call to the encoder. In addition, for the FAST project, it is desirable to encapsulate the unencoded outer request so that krb5_get_init_creds does not need it. * send_as_req is modified to take an encoded request and realm * Remove unused logic to fill in request nonce from send_as_req ticket: 6401 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@22067 dc483132-0cff-0310-8789-dd5450dbe970
* krb5_merge_authdata should initialize output on failureSam Hartman2009-02-261-0/+1
| | | | | | ticket: 6400 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@22057 dc483132-0cff-0310-8789-dd5450dbe970
* Include authenticator and ticket authdata in gss-apiSam Hartman2009-02-261-11/+35
| | | | | | | | | | | | | | | Currently, the GSS-API routines for handling authdata only extract the authorization data from the ticket, not that from the authenticator. This is incorrect. Introduce a new function krb5_merge_authadata to merge two authdata arrays into a newly allocated result array. Use this function in accept_sec_context.c to include both sets of authdata. ticket: 6400 Target_version: 1.7 Tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@22056 dc483132-0cff-0310-8789-dd5450dbe970
* Check return code of encode_krb5_ap_req. Also, tabs vs whitespaceZhanna Tsitkov2009-02-231-134/+135
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@22050 dc483132-0cff-0310-8789-dd5450dbe970
* In krb5int_generate_and_save_subkey, check the return value ofGreg Hudson2009-02-231-4/+5
| | | | | | | | krb5_crypto_us_timeofday. It can't really fail in practice, but if it did we'd be passing stack garbage to krb5_c_random_add_entropy. That's harmless, but poor form. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@22049 dc483132-0cff-0310-8789-dd5450dbe970
* Kill an odd (but harmless) use of strncpy inGreg Hudson2009-02-231-7/+4
| | | | | | | krb5_get_in_tkt_with_password, by using the construction from krb5_get_init_creds_password. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@22045 dc483132-0cff-0310-8789-dd5450dbe970
* send_tgs.c:Sam Hartman2009-02-231-30/+33
| | | | | | | | | | | | | | * Move generation of subkey into krb5int_send_tgs from construct_authenticator so that it is available for encrypting authorization data. * Initialize rep->message_type and note that rep is touched on unsuccessful calls (this has always been true). * Do not set *subkey until successful return. Thanks to Greg Hudson for pointing out these problems. Ticket: 6393 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@22044 dc483132-0cff-0310-8789-dd5450dbe970
* In tgs_construct_tgsreq, free scratch even if scratch->data is NULL.Greg Hudson2009-02-131-2/+2
| | | | | | | (Which probably can't happen, but static analyzers don't know that.) Also protect scratch from being freed before initialization. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@22002 dc483132-0cff-0310-8789-dd5450dbe970
* Implement TGS authenticator subkey usageSam Hartman2009-02-133-34/+52
| | | | | | | | | | | | | | | | | Implement support for use of a subkey in the TGS req. This is needed by FAST TGS support. The interface to krb5_send_tgs changed in order to gain a subkey output parameter. Since this is a private interface it was renamed to krb5int_send_tgs and removed from the export list. * send_tgs.c: generate a subkey and return to caller * decode_kdc_rep.c: Use subkey keyusage * gc_via_tkt.c: pass in subkey to decode_kdc_rep * send_tgs.c: use subkey for encrypting authorization data ticket: 6393 tags: enhancement git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21993 dc483132-0cff-0310-8789-dd5450dbe970
* In krb5_get_in_tkt_with_password, free opte before returning the errorGreg Hudson2009-02-121-1/+1
| | | | | | from krb5_unparse_name, not after. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21985 dc483132-0cff-0310-8789-dd5450dbe970
* Make output parameter of krb5_generate_subkey_extended well-defined onGreg Hudson2009-02-121-7/+15
| | | | | | error, and reformat function to fit coding standards. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21984 dc483132-0cff-0310-8789-dd5450dbe970
* Fix allocation failure check in walk_rtreeGreg Hudson2009-02-121-1/+1
| | | | | | | | | | | Check the correct variable for null after allocating the server string in rtree_capath_vals. ticket: 6392 tags: pullup target_version: 1.7 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21980 dc483132-0cff-0310-8789-dd5450dbe970
* Ensure we have a free function for every data type we have an ASN.1Greg Hudson2009-02-111-7/+36
| | | | | | | | | decoder for. Export the new free functions, but only declare them in k5-int.h since they shouldn't be needed by applications. Also export a couple of encoder and decoder functions not previously exported. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21969 dc483132-0cff-0310-8789-dd5450dbe970
* Fix one more case of an explicit null check before calling a freeKen Raeburn2009-02-091-7/+2
| | | | | | | | | | | function that does the null check. Also, use krb5_free_keyblock_contents instead of open-coding all the work (and not trying hard enough to clear the memory). ticket: 6377 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21926 dc483132-0cff-0310-8789-dd5450dbe970
* Fix possible free of uninitialized value in walk_rtreeGreg Hudson2009-02-091-1/+1
| | | | | | | | | | | | | In rtree_hier_realms, if the first rtree_hier_tweens call failed, the cleanup handler would free stweens which had not been initialized. Initialize ctweens and stweens to NULL in the variable declarations to make the cleanup handler safe. ticket: 6379 tags: pullup target_version: 1.7 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21924 dc483132-0cff-0310-8789-dd5450dbe970
* make krb5_free_* functions ignore NULLKen Raeburn2009-02-094-230/+187
| | | | | | | | | | | | This makes them safer to call in various contexts where NULL may leak through, and makes analysis easier. Also, remove some checks for NULL before calling a free routine that will also check for NULL. ticket: 6377 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21920 dc483132-0cff-0310-8789-dd5450dbe970
* Memory handling fixes in walk_rtreeGreg Hudson2009-02-061-13/+35
| | | | | | | | | | | | | In walk_rtree's rtree_hier_tree, don't leak the result of rtree_hier_realms. In rtree_hier_realms, avoid freeing one too many krb5_data contents on allocation failure, and use the recommend pattern to ensure well-defined output parameter values. ticket: 6376 tags: pullup target_version: 1.7 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21912 dc483132-0cff-0310-8789-dd5450dbe970
* Fix error handling in krb5_walk_realm_treeGreg Hudson2009-02-061-1/+1
| | | | | | | | | | | | rtree_hier_realms was forgetting to assign the return value of krb5int_copy_data_contents to retval, which would cause a failure to notice out-of-memory conditions. ticket: 6375 tags: pullup target_version: 1.7 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21909 dc483132-0cff-0310-8789-dd5450dbe970
* Change variable accepting return from strftime to time_t. ThisEzra Peisach2009-02-061-1/+1
| | | | | | matches prototype for function and removes a signed/unsigned warning. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21907 dc483132-0cff-0310-8789-dd5450dbe970
* Fix memory handling bug in mk_req_extGreg Hudson2009-02-051-2/+1
| | | | | | | | | | | In make_etype_list, assign *authdata before we have a chance to fail, since we may have invalidated the previous value with realloc. ticket: 6372 tags: pullup target_version: 1.7 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21901 dc483132-0cff-0310-8789-dd5450dbe970
* In gc_frm_kdc.c's do_traversal(), fix an assert which was doing anGreg Hudson2009-02-051-1/+1
| | | | | | assignment instead of a compare. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21899 dc483132-0cff-0310-8789-dd5450dbe970
* In recvauth_common, initialize ap_option. It can't be usedGreg Hudson2009-02-051-1/+1
| | | | | | | uninitialized, but you can only deduce that by examining the relationships between ap_option, problem, and outbuf. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21897 dc483132-0cff-0310-8789-dd5450dbe970
* Add a missing break in the switch statement ofGreg Hudson2009-02-051-0/+1
| | | | | | | | | | krb5int_setpw_result_code_string. ticket: 6368 tags: pullup target_version: 1.7 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21894 dc483132-0cff-0310-8789-dd5450dbe970
* Create and use (in several places) a variant ofKen Raeburn2009-02-053-42/+43
| | | | | | | krb5int_copy_data_contents that adds a trailing '\0' so the result can be used as a C string. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21893 dc483132-0cff-0310-8789-dd5450dbe970
* Use macros for config parametersZhanna Tsitkov2009-02-044-39/+39
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21879 dc483132-0cff-0310-8789-dd5450dbe970
* prefer structure assignment to memcpyKen Raeburn2009-02-031-1/+1
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21876 dc483132-0cff-0310-8789-dd5450dbe970
* Remove unnecessary pointer casts in args to free,memcpy,memset,memchr except ↵Ken Raeburn2009-02-0220-28/+25
| | | | | | unicode, windows code git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21875 dc483132-0cff-0310-8789-dd5450dbe970
* Get rid of casts of free() argument to char*, except where it'sKen Raeburn2009-02-022-3/+3
| | | | | | | | casting away const (so as to make this change warning-neutral), and in unicode source (which we may want to keep in sync with another source), and krb5_xfree macro (to be handled separately). git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21870 dc483132-0cff-0310-8789-dd5450dbe970
* Default allow_weak_crypto=true for now. Default supported_enctypes toTom Yu2009-01-311-1/+1
| | | | | | | | | exclude single-DES enctypes. ticket: 6353 status: open git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21851 dc483132-0cff-0310-8789-dd5450dbe970
* krb5_get_server_rcache had some dead (and incorrect) code for cleaningGreg Hudson2009-01-301-13/+5
| | | | | | up the rcache on failure. Fix the cleanup code and make use of it. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21842 dc483132-0cff-0310-8789-dd5450dbe970
* In krb5_kdcrep2creds, call the correct free function when cleaning upGreg Hudson2009-01-301-2/+2
| | | | | | the keyblock, and clean up the keyblock if krb5_copy_data fails. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21840 dc483132-0cff-0310-8789-dd5450dbe970
* whitespaceKen Raeburn2009-01-291-186/+185
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21826 dc483132-0cff-0310-8789-dd5450dbe970
* clear outbuf[0].data to unconfuse coverityKen Raeburn2009-01-291-0/+1
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21825 dc483132-0cff-0310-8789-dd5450dbe970
* disable single-DES by defaultTom Yu2009-01-281-2/+15
| | | | | | | | | | Mark all single-DES enctypes as "weak", and create a new libdefaults variable "allow_weak_crypto", which defaults to "false". ticket: 6353 status: open git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21823 dc483132-0cff-0310-8789-dd5450dbe970
* Start to phase out krb5_xfree macro, which just casts its argument toKen Raeburn2009-01-2844-242/+242
| | | | | | | | | | | char* and calls free. Replace most uses, outside of the LDAP KDB plugin, which doesn't build on my test system of the moment because of version dependencies. Add one explicit cast to make the change warning-neutral (under gcc 4.0.1 on Mac OS X 10.5.6). git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21812 dc483132-0cff-0310-8789-dd5450dbe970
* Use 16/32-bit big/little-endian store functions in more placesKen Raeburn2009-01-261-8/+8
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21796 dc483132-0cff-0310-8789-dd5450dbe970
* Change 16/32/64-bit big-/little-endian/native unaligned load/storeKen Raeburn2009-01-241-1/+1
| | | | | | | | routines to take void pointers, so they can operate on both plain and unsigned char buffers, or other types. Remove some now-unneeded casts. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21793 dc483132-0cff-0310-8789-dd5450dbe970
* In krb5_pac_get_buffer, check the correct value for null after callingGreg Hudson2009-01-231-1/+1
| | | | | | malloc. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21789 dc483132-0cff-0310-8789-dd5450dbe970
* In krb5_pac_parse, change the code around a bit to avoid harmlesslyGreg Hudson2009-01-231-7/+8
| | | | | | copying an uninitialized Buffers field of a PACTYPE structure. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21788 dc483132-0cff-0310-8789-dd5450dbe970
* In krb5_get_init_creds, null out err_reply in a case where we free itGreg Hudson2009-01-231-0/+1
| | | | | | and do not necessarily exit the loop. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21785 dc483132-0cff-0310-8789-dd5450dbe970
* Always initialize the output parameter in krb5_parse_name and friendsGreg Hudson2009-01-231-0/+2
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21784 dc483132-0cff-0310-8789-dd5450dbe970
* In krb5_rd_rep_dce, initialize repl to NULL to avoid using itsGreg Hudson2009-01-201-1/+1
| | | | | | initialized value when we take the first goto to clean_scratch. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21763 dc483132-0cff-0310-8789-dd5450dbe970
* patch from Luke - fix enctype-nego enctype list setupKen Raeburn2009-01-171-16/+8
| | | | | | ticket: 6336 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21760 dc483132-0cff-0310-8789-dd5450dbe970
* patch from Luke - fix sign problemKen Raeburn2009-01-171-2/+2
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21759 dc483132-0cff-0310-8789-dd5450dbe970
* Fix an additional multiple-write case noted by John, where sendauthKen Raeburn2009-01-151-13/+16
| | | | | | | | | | | | calls write_message twice in a row. Add new function krb5int_write_messages, calls krb5_net_writev with multiple messages (currently only two at a time). Use it from krb5_write_message and krb5_sendauth. ticket: 6339 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21752 dc483132-0cff-0310-8789-dd5450dbe970
* Patch from Luke Howard to:Sam Hartman2009-01-132-1/+10
| | | | | | | | | | * Accept both CFX and non-CFX tokens all the time on acceptor * Only produce an acceptor subkey if you are using cfx or dce or negotiating up to cfx Additional changes from Sam Hartman: * do not assume that the ticket key type (server key) is a valid target for negotiation: the client may not support it. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21742 dc483132-0cff-0310-8789-dd5450dbe970
* Add message hash support to the replay interface, using extensionGreg Hudson2009-01-127-1/+13
| | | | | | | | | | | | | | records (with an empty client string) to retain compatibility with old code. For rd_req, the ciphertext of the authenticator (with no ASN.1 wrapping) is hashed; for other uses of the replay cache, no message hash is used at this time. This commit adds a command-line tool for testing the replay cache but does not add any automated tests. ticket: 1201 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21723 dc483132-0cff-0310-8789-dd5450dbe970
* Follow "off-path" TGT referralsTom Yu2009-01-091-21/+189
| | | | | | | ticket: 5627 status: open git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21720 dc483132-0cff-0310-8789-dd5450dbe970
generated by cgit (git 2.34.1) at 2025-09-28 12:07:50 +0000