summaryrefslogtreecommitdiffstats
path: root/src/lib/krb5/os
Commit message (Collapse)AuthorAgeFilesLines
* Eliminate internal fixed-width type wrappersGreg Hudson2014-02-261-1/+1
| | | | | Directly use stdint.h names for integer types in preference to the various internal names we have made up for them.
* Remove unused krb5_context fieldsGreg Hudson2013-12-181-1/+0
| | | | | The vtbl and locate_fptrs fields were ostensibly related to the locate pluggable interface, but weren't actually used.
* Don't require krb5.conf without KRB5_DNS_LOOKUPGreg Hudson2013-12-161-11/+2
| | | | | | | | | | | | For a long time we have allowed krb5 contexts to be initialized in the absence of krb5.conf--but only if KRB5_DNS_LOOKUP is defined, presumably on the theory that no KDCs could be contacted without either DNS support or profile configuration. But locate plugins could provide the ability to find KDCs, and some libkrb5 operations (such as IAKERB initiation) could succeed without needing to locate KDCs. Also get rid of the profile_in_memory context flag, since we don't use it any more.
* Allow ":port" suffixes in sn2princ hostnamesGreg Hudson2013-12-111-2/+37
| | | | | | | | | MSSQLSvc principal names can contain a ":port" or ":instance" trailer on the hostname part. If we see that in the hostname argument of krb5_sname_to_principal(), remove it before canonicalizing the hostname and put it back on afterwards. ticket: 7795 (new)
* Modernize sn2princ.cGreg Hudson2013-12-111-133/+115
| | | | | Refactor and edit sn2princ.c to match current coding style. No behavior changes, except to be less chatty in trace logs.
* Add a flag to prevent all host canonicalizationGreg Hudson2013-09-061-1/+1
| | | | | | | | If dns_canonicalize_hostname is set to false in [libdefaults], krb5_sname_to_principal will not canonicalize the hostname using either forward or reverse lookups. ticket: 7703 (new)
* Move utility functions to hostrealm.cGreg Hudson2013-08-154-184/+134
| | | | | | | Move the remaining internal functions from hst_realm.c to hostrealm.c, and get rid of hst_realm.c. ticket: 7687
* Use hostrealm interface for realm mappingGreg Hudson2013-08-159-467/+873
| | | | | | | | | Reimplement krb5_get_host_realm, krb5_get_fallback_host_realm, and krb5_get_default_realm in terms of the hostrealm interface. Three built-in modules (dns, domain, and profile) implement the current behavior. ticket: 7687
* Remove KRB5_DNS_LOOKUP_KDCBen Kaduk2013-08-141-4/+0
| | | | | | | | | | | | | It has been unconditionally activated by all supported build systems for almost two years, and no complaints or issues have been reported. In particular, aclocal.m4 has had an unconditional AC_DEFINE() since 3d708e55 in 2003, and win-pre.in has unconditionally set KRB5_USE_DNS_KDC since 17ffebf7 in 2011. While here, simplify some other DNS conditionals in win-pre.in where only one branch was ever taken. ticket: 7691 (new)
* Fix localauth memory leakGreg Hudson2013-08-122-0/+8
| | | | | localauth modules were not freed by krb5_free_context(), causing a memory leak.
* Add trace logging for TXT lookupsGreg Hudson2013-08-124-11/+15
| | | | | | Rename krb5_try_realm_txt_rr (an internal function despite the name) and add a context parameter. Generate trace logs when we successfully look up a record and when a record is not found.
* Report KDC response sizes in trace logsGreg Hudson2013-08-071-1/+1
|
* Remove old comments in sendto_kdc.cRobbie Harwood (frozencemetery)2013-07-301-12/+0
| | | | | | | The commented code in question is present in set_conn_state_msg_length which is called immediately after the comments. [ghudson@mit.edu: clarified commit message]
* Remove is_udp field in sendto_kdc.c conn_stateRobbie Harwood (frozencemetery)2013-07-301-5/+1
| | | | | | | This field is redundant with addr.type. [ghudson@mit.edu: removed extraneous changes; clarified commit message]
* Use k5calloc instead of k5alloc where appropriateGreg Hudson2013-07-112-2/+2
| | | | | Wherever we use k5alloc with a multiplication in the size parameter,, use the new k5calloc helper function instead.
* Rely on module ordering for localauthGreg Hudson2013-06-271-25/+6
| | | | | | | Register built-in localauth modules in the order we want them used by default, and document accordingly. ticket: 7665
* Fix spin loop reading from KDC TCP socketViktor Dukhovni2013-06-261-2/+2
| | | | | | | | | | | | In the k5_sendto code for reading from a TCP socket, detect end-of-stream when reading the length. Otherwise we can get stuck in an infinite loop of poll() and read(). [ghudson@mit.edu: commit message] ticket: 7508 target_version: 1.11.4 tags: pullup
* Fix various warningsGreg Hudson2013-06-071-5/+3
|
* Try to use best DNS search functions in dnsglue.cGreg Hudson2013-05-191-23/+45
| | | | | | | | | | Create macros to declare a DNS search handle, initialize a handle, perform a search, and destroy a handle. On OS X, use the native dns_open, dns_search, and dns_free functions, since using the res_* interfaces may not contact the correct servers. On systems with res_ninit, use res_nclose if we don't have res_ndestroy. Based on a patch by Nate Rosenblum.
* Reduce boilerplate in makefilesGreg Hudson2013-05-161-10/+6
| | | | | | | | | Provide default values in pre.in for PROG_LIBPATH, PROG_RPATH, SHLIB_DIRS, SHLIB_RDIRS, and STOBJLISTS so that they don't have to be specified in the common case. Rename KRB5_RUN_ENV and KRB5_RUN_VARS to RUN_SETUP (already the most commonly used name) and RUN_VARS. Make sure to use DEFINES for local defines (not DEFS). Remove some other unnecessary makefile content.
* Fix windows buildBen Kaduk2013-05-161-0/+1
| | | | | Catch a few stragglers that missed the memo that k5_mutex_lock cannot fail, and sprinkle some cc-int.h as needed.
* Assume mutex locking cannot failGreg Hudson2013-05-141-3/+1
| | | | | | | | | | | | Locking and unlocking a non-recursive mutex is a simple memory operation and should not fail on any reasonable platform with correct usage. A pthread mutex can return EDEADLK on lock or EPERM on unlock, or EINVAL if the mutex is uninitialized, but all of these conditions would reflect serious bugs in the calling code. Change the k5_mutex_lock and k5_mutex_unlock wrappers to return void and adjust all call sites. Propagate this change through k5_cc_mutex_lock and k5_cc_mutex_unlock as well.
* Simplify sendto_kdc exception handlingGreg Hudson2013-04-121-83/+25
|
* Remove sendto_kdc debugging codeGreg Hudson2013-04-123-251/+2
| | | | | It's a lot of code, and trace logging should cover most of the cases where it's useful.
* Dynamically expand timeout when TCP connectsNathaniel McCallum2013-04-121-1/+27
| | | | | | | | | | | Wait ten seconds for a TCP connection to succeed or fail before moving on. During this wait time, other TCP connections will be serviced if we already initiated them, but no new TCP connections will be created and no UDP packets will be retransmitted. [ghudson@mit.edu: minor adjustments; commit message] ticket: 7604 (new)
* Use millisecond timeouts in sendto_kdc.cNathaniel McCallum2013-04-121-68/+51
| | | | | | | | | | Replace the end_time field of struct select_state with an endtime argument to cm_select_or_poll, expressed in milliseconds since the epoch. Add a helper function to get the current time in that format. Use a millisecond interval argument to service_fds for consistency. [ghudson@mit.edu: fix overflow issue in get_curtime_ms; service_fds interval argument change; log message]
* Get rid of cm.c and cm.hGreg Hudson2013-04-128-170/+137
| | | | | | | | | | | Since net-server.c now uses libverto, only sendto_kdc.c consumes cm.c. Move stuff out of cm.c and cm.h into sendto_kdc.c and get rid of them. Change the sendto_kdc callback (used by chpw.c) to receive the socket descriptor instead of the entire conn_state structure, and move the declarations into os-proto.h. struct remote_address also needs to be in os-proto.h so that trace.c and t_trace.c can use it. k5_curtime isn't needed since k5-platform.h now guarantees the presence of gettimeofday().
* Trace log with a subset of struct conn_stateGreg Hudson2013-04-124-56/+59
| | | | | | | In struct conn_state, collect together the fields for the remote address and put them in a substructure. Pass this substructure to trace logging macros instead of the entire conn_state structure, so that trace.c doesn't have to know about the whole structure.
* Tighten up fixed buffer usage in hst_realm.cGreg Hudson2013-04-101-9/+10
| | | | Avoid or notice truncations, rather than letting them happen silently.
* Allow numeric addresses as service hostnamesGreg Hudson2013-04-091-47/+66
| | | | | | | | | | | | | | | | Since krb5 1.3, krb5_get_host_realm (and therefore krb5_sname_to_principal) has refused hostnames which appear to be numeric addresses--with the exception of 1.6, which was ignoring errors from clean_hostname. In specialized environments, it may be desirable to use IP addresses in service principal names, and there's no compelling reason for us to get in the way of that. Move the numeric address check out of k5_clean_hostname into a new helper function, and simply skip the domain-based mechanisms if it returns true. Factor out the [domain_realm] search into a second new helper function to make it easier to skip. ticket: 7603 (new)
* Update hst_realm.c coding styleGreg Hudson2013-04-091-337/+236
| | | | | Bring this file up to date with current coding style. No functional changes, except some trace logs were removed.
* Simplify principal access within libkrb5Greg Hudson2013-04-083-11/+7
| | | | | For conciseness, directly use fields of krb5_principal objects instead of using the accessor macros.
* Using k5-int.h data helpers for some functionsGreg Hudson2013-03-291-5/+4
| | | | | | Use empty_data(), alloc_data(), and make_data() in some appropriate places. This has the side effect of initializing the krb5_data magic field, which can placate debugging tools.
* make dependGreg Hudson2013-03-241-200/+143
|
* Move a bunch of stuff out of k5-int.hGreg Hudson2013-03-2414-36/+66
| | | | | | | | | Move internal declarations from k5-int.h to more localized headers (like int-proto.h) where appropriate. Rename many symbols whose prototypes were moved to use the k5_ prefix instead of krb5int_. Remove some unused declarations or move them to the single source file they were needed in. Remove krb5_creds_compare since it isn't used any more.
* Get rid of krb5_{get,free}_krbhstGreg Hudson2013-03-226-208/+9
| | | | | These functions were always internal. They haven't been used since v5passwdd was eliminated in krb5 1.4.
* Get rid of osconfig.cGreg Hudson2013-03-224-47/+2
| | | | | These variables were marked as internal in 1996. Two are unused and the other is easily replaced with the macro it is initialized from.
* Remove stray include in localauth_plugin.hGreg Hudson2013-03-111-75/+35
| | | | | This unnecessary include was causing build failures on some systems by making libkrb5 sources depend on gssapi.h.
* Add localauth pluggable interfaceGreg Hudson2013-03-0910-1067/+1271
| | | | | | | | Add a new pluggable interface for local authorization, and replace the existing krb5_aname_to_localname and krb5_kuserok implementations with implementations based on the pluggable interface. ticket: 7583 (new)
* Add missing .gitignore entries and clean rulesGreg Hudson2013-02-271-1/+1
| | | | ticket: 7585
* Modernize k5bufGreg Hudson2013-02-146-73/+72
| | | | | | Rename the krb5int_buf_ family of functions to use the k5_ prefix for brevity. Reformat some k5buf implementation code to match current practices.
* Add and use k5memdup, k5memdup0 helpersGreg Hudson2013-02-095-41/+15
| | | | | | Add k5-int.h static functions to duplicate byte ranges, optionally with a trailing zero byte, and set an error code like k5alloc does. Use them where they would shorten existing code.
* Check for negative poll timeout in k5_sendto_kdcGreg Hudson2013-01-251-0/+4
| | | | | | ticket: 7553 target_version: 1.11.1 tags: pullup
* Clean up k5_locate_server error handlingGreg Hudson2013-01-111-25/+10
| | | | | | | | | | | profile_get_values() cannot return success with an empty list of values, so don't bother counting them. Return 0 from locate_srv_conf_1 if no profile values exist and from dns_locate_server if we decide not to make a SRV query. Adjust k5_locate_server to match the new helper behavior, and return KRB5_REALM_UNKNOWN if neither profile nor DNS come up with any answers (not KRB5_REALM_CANT_RESOLVE, which doesn't make sense now that we're deferring KDC hostname resolution).
* make dependGreg Hudson2013-01-101-11/+11
| | | | | Mostly this gets rid of the trailing space on line 2 after bb76891f5386526bdf91bc790c614fc9296cb5fa.
* Rename internal preauth functionsGreg Hudson2012-12-191-1/+2
| | | | | | | | | | | | The preauth functions are internal to libkrb5, so use the k5_ prefix, don't use KRB5_CALLCONV, and prototype them in int-proto.h. Also remove krb5_do_preauth from the Unix libkrb5 export list. Reorder the k5_preauth() and k5_preauth_tryagain() arguments for more consistency with the clpreauth interface, and put the output padata arguments at the end. Rename any remaining uses of "kcontext" to "context" in preauth2.c.
* Separate clpreauth and kdcpreauth interfacesGreg Hudson2012-12-191-91/+91
| | | | | | | Since there is no overlap between the clpreauth and kdcpreauth interface declarations, there's no particular reason to combine them into one header. For backward compatibility and convenience, leave behind a preauth_plugin.h which includes both.
* Avoid redundant socket cleanup in sendto_kdc.cGreg Hudson2012-11-291-4/+0
| | | | | | | | Since r25120, kill_conn() has been responsible for closing and invalidating conn->fd. In the unlikely event that the KDC sends a TCP response to us before we send a TCP request, we were cleaning up the socket again, which is useless (though also harmless). Get rid of that code.
* Fix spin-loop bug in k5_sendto_kdcGreg Hudson2012-11-291-1/+1
| | | | | | | | | | | | In the second part of the first pass over the server list, we passed the wrong list pointer to service_fds, causing it to see only a subset of the server entries corresponding to sel_state. This could cause service_fds to spin if an event is reported on an fd not in the subset. ticket: 7454 target_version: 1.10.4 tags: pullup
* Make krb5_trace_info a typedefBen Kaduk2012-11-271-2/+2
| | | | | | | | | | | | | Our doxygen-to-sphinx documentation bridge only processes typedefs and not structure definitions, since we almost universally use typedefs for our data structures. krb5_trace_info is the sole exception, so bring it into the fold. While here, flesh out the comment a bit more. ticket: 7447 tags: pullup target_version: 1.11
generated by cgit (git 2.34.1) at 2025-09-18 05:47:10 +0000