summaryrefslogtreecommitdiffstats
path: root/src/lib
Commit message (Collapse)AuthorAgeFilesLines
...
* Defer KEYRING key creation until initializeGreg Hudson2013-09-281-22/+58
| | | | | | | | | | If we resolve a KEYRING cache and the key does not exist, wait until initialize time to create it, to avoid wasting precious kernel memory on a cache which might not ever be created. Properly error out if store_cred or start_seq_get is called on an uninitialized cache, as we would for a FILE cache. Adapted from a patch by simo@redhat.com.
* Add ccache collection tests using APIGreg Hudson2013-09-243-2/+366
| | | | | | Create a new test program in lib/krb5/ccache named t_cccol.c which verifies collection semantics using the API. Run it with an empty DIR collection in t_cccol.py.
* Factor out krb5int_random_string() routineZhanna Tsitkov2013-09-245-40/+72
| | | | | Make krb5int_random_string() function available outside ccache code. Move it into a separate file under lib/krb5/krb hierarchy.
* Err codes in KRB_ERROR protocol messages are < 128Zhanna Tsitkov2013-09-231-1/+1
| | | | | | If the error code is out of [0,127] range, assign it to KRB_ERR_GENERIC. This fix is to correct the previous behavior with [0,128] range. For more information see krb5_err.et
* Add GSSAPI IOV MIC functionsGreg Hudson2013-09-1815-50/+310
| | | | | | | | | | | | | Add gss_get_mic_iov, gss_get_mic_iov_length, and gss_verify_mic_iov functions, which work similarly to the corresponding IOV wrap functions. Add a new buffer type GSS_IOV_BUFFER_TYPE_MIC_TOKEN for the destination buffer. Most of the internal code for this was already present, and just needed to be fixed up and adjusted to use the new buffer type for the MIC token. ticket: 7705 (new)
* Get rid of G_VFY_TOKEN_HDR_IGNORE_SEQ_SIZEGreg Hudson2013-09-083-7/+1
| | | | | | | | | | This flag was introduced in the mskrb-integ merge but is not actually used after r21742--while kg_unseal_iov_token sets it in vfyflags for DCE-style contexts, it doesn't actually pass vfyflags to g_verify_token_header or otherwise use it. Moreover, the flag is not necessary there; we correctly set input_length to the header length (without data, padding, or trailer) for v1 tokens in a DCE-style context.
* Add a flag to prevent all host canonicalizationGreg Hudson2013-09-062-1/+6
| | | | | | | | If dns_canonicalize_hostname is set to false in [libdefaults], krb5_sname_to_principal will not canonicalize the hostname using either forward or reverse lookups. ticket: 7703 (new)
* Simplify krb5_krcc_start_seq_getSimo Sorce2013-08-191-41/+20
| | | | | | | | | | This code can be simplified (and a potential race avoided) by using keyctl_read_alloc() and letting it allocate the necessary memory. This also allows to remove a helper function that is not used anymore as well as make the code more readable. The only penalty is that we have two allocations instad of one. [ghudson@mit.edu: trivial simplifications]
* Remove unused counter in keyring ccacheSimo Sorce2013-08-161-23/+10
| | | | | | | | | numkeys is never really used in the single cache data structure. Every time a new iteration is started, numkeys is recalculated anyway, and then only the copy held in the cursor is used. Remove it from the cache data and keep it only in the cursor. [ghudson@mit.edu: clarified commit message]
* Remove unused _gssd_keyring_ids_ featureSimo Sorce2013-08-161-85/+3
| | | | | | | This feature was intended to be used by gssd to access users' keyring credentials, but it was never used. [ghudson@mit.edu: clarified commit message]
* Save the full residual for keyring cachesSimo Sorce2013-08-151-1/+1
| | | | | | | | | | | krb5_cc_get_name() should allow the caller to reconstruct the full cache name. That is not possible if thread: and process: are omitted here. (The saved name is not used by anything except krb5_krcc_get_name, so this change is safe.) [ghudson@mit.edu: proofread and clarified commit message] ticket: 7692 (new)
* Use dry-run unparses in keyring ccacheSimo Sorce2013-08-151-40/+78
| | | | | | | | | | Support credentials larger than 4K in cc_keyring.c by calculating the payload size in one pass, allocating a buffer of precisely the right size, and then unparsing into that buffer. [ghudson@mit.edu: squashed two commits; rewrote message; added length field instead of doing pointer arithmetic on null pointers; used proper English comments and clarified what code they apply to.]
* Move utility functions to hostrealm.cGreg Hudson2013-08-154-184/+134
| | | | | | | Move the remaining internal functions from hst_realm.c to hostrealm.c, and get rid of hst_realm.c. ticket: 7687
* Use hostrealm interface for realm mappingGreg Hudson2013-08-1511-467/+875
| | | | | | | | | Reimplement krb5_get_host_realm, krb5_get_fallback_host_realm, and krb5_get_default_realm in terms of the hostrealm interface. Three built-in modules (dns, domain, and profile) implement the current behavior. ticket: 7687
* Add hostrealm pluggable interface definitionGreg Hudson2013-08-151-1/+2
| | | | ticket: 7687 (new)
* Remove KRB5_DNS_LOOKUP_KDCBen Kaduk2013-08-141-4/+0
| | | | | | | | | | | | | It has been unconditionally activated by all supported build systems for almost two years, and no complaints or issues have been reported. In particular, aclocal.m4 has had an unconditional AC_DEFINE() since 3d708e55 in 2003, and win-pre.in has unconditionally set KRB5_USE_DNS_KDC since 17ffebf7 in 2011. While here, simplify some other DNS conditionals in win-pre.in where only one branch was ever taken. ticket: 7691 (new)
* Fix windows buildBen Kaduk2013-08-141-0/+1
| | | | | | | This routine is now used in the gssapi library and must be exported as such. ticket: 7688
* Fix localauth memory leakGreg Hudson2013-08-124-0/+10
| | | | | localauth modules were not freed by krb5_free_context(), causing a memory leak.
* Add trace logging for TXT lookupsGreg Hudson2013-08-125-12/+15
| | | | | | Rename krb5_try_realm_txt_rr (an internal function despite the name) and add a context parameter. Generate trace logs when we successfully look up a record and when a record is not found.
* Fix gss_krb5_set_allowable_enctypes for acceptorGreg Hudson2013-08-121-2/+2
| | | | | | | | | | | | | | | | | | | The acceptor implementation of gss_krb5_set_allowable_enctypes (added in 1.9.1) is intended to restrict the acceptor subkey negotiated by krb5_rd_req(). It uses the same approach as the initiator, calling krb5_set_default_tgs_enctypes on the context. This has the unwanted side effect of restricting the encryption key of the ticket, because krb5_decrypt_tkt_part has checked krb5_is_permitted_enctype on the ticket encryption key since 1.8. Instead, use krb5_auth_con_setpermetypes on the auth context. This list is only used for session key enctype negotiation. Also add automated tests to verify that gss_krb5_set_allowable_enctypes works as desired. ticket: 7688 (new) target_version: 1.11.4 tags: pullup
* Report KDC response sizes in trace logsGreg Hudson2013-08-071-1/+1
|
* Remove unused function arguments in cc_keyring.cSimo Sorce2013-08-021-172/+149
| | | | | | | The credential serialization functions do not operate on a ccache, so do not need it as an argument. [ghudson@mit.edu: clarified commit message, rewrapped shortened lines]
* Fix leak in krb5_krcc_unparse_cred on errorGreg Hudson2013-08-021-1/+3
| | | | Based on a patch from simo@redhat.com.
* Remove old comments in sendto_kdc.cRobbie Harwood (frozencemetery)2013-07-301-12/+0
| | | | | | | The commented code in question is present in set_conn_state_msg_length which is called immediately after the comments. [ghudson@mit.edu: clarified commit message]
* Remove is_udp field in sendto_kdc.c conn_stateRobbie Harwood (frozencemetery)2013-07-301-5/+1
| | | | | | | This field is redundant with addr.type. [ghudson@mit.edu: removed extraneous changes; clarified commit message]
* Load import/export cred functions from GSS modulesSimo Sorce2013-07-211-0/+4
| | | | | | | | | | | | When the import/export credential feature was implement the related functions were added to struct gss_config, but the initialization function that dynamically loads modules was not changed to see if the plugin being loaded provided such functions. This will allow non-builtin mechanism and interposer mechanism to implement custom import/export credential extensions if they wish. ticket: 7682
* Load cred store functions from GSS modulesSimo Sorce2013-07-211-0/+4
| | | | | | | | | | | | When the credential store feature was implement the related functions were added to struct gss_config, but the initialization function that dynamically loads modules was not changed to see if the plugin being loaded provided such functions. This will allow non-builtin mechanism and interposer mechanism to implement custom credential store extensions if they wish. ticket: 7682
* Add non-JSON APIs for PKINIT responder itemsNalin Dahyabhai2013-07-175-0/+225
| | | | | | | | | | | | | | | | | Add wrappers for the JSON-oriented APIs for PKINIT responder items, modeled after the API we provide for OTP items: * krb5_responder_pkinit_get_challenge() returns the list of identities for which we need PINs * krb5_responder_pkinit_challenge_free() frees the structure that was returned by krb5_responder_pkinit_get_challenge() * krb5_responder_pkinit_set_answer() sets the answer to the PIN for one of the identities [ghudson@mit.edu: style cleanup; added comment pointing to main body of PKINIT module] ticket: 7680
* Add kadmin support for principals without keysGreg Hudson2013-07-152-3/+9
| | | | | | | | | Add kadmin support for "addprinc -nokey", which creates a principal with no keys, and "purgekeys -all", which deletes all keys from a principal. The KDC was modified by #7630 to support principals without keys. ticket: 7679 (new)
* Avoid allocating zero key_data structuresGreg Hudson2013-07-152-21/+20
| | | | | | | | When we allocate space for an array of key_data structures, make sure we allocate at least one, so we don't spuriously fail on platforms where malloc(0) returns NULL. Where we use malloc, use k5calloc instead. Where we use krb5_db_alloc or realloc, just allocate an extra entry.
* Use pipe instead of sigwait for krad testsGreg Hudson2013-07-142-27/+17
| | | | | | | | We've never used sigwait() before, and it has some problems on Solaris 10 (a nonconformant prototype by default, and experimentally it didn't seem to work correctly with _POSIX_PTHREAD_SEMANTICS defined). Use a pipe instead. Make t_daemon.py less chatty on stdout to avoid filling the pipe buffer.
* Fix minor type issues in krad testsGreg Hudson2013-07-142-2/+2
| | | | | Use unsigned char for test encodings, since the initializers use values greater than 127.
* Use k5calloc instead of k5alloc where appropriateGreg Hudson2013-07-1114-18/+18
| | | | | Wherever we use k5alloc with a multiplication in the size parameter,, use the new k5calloc helper function instead.
* Add libkradNathaniel McCallum2013-07-1121-1/+3427
| | | | | | | | The new library libkrad provides code for the parsing of RADIUS packets as well as client implementation based around libverto. This library should be considered unstable. ticket: 7678 (new)
* Fix uninitialized variable bugsGreg Hudson2013-06-271-1/+1
| | | | | The previous few commits introduced a couple of bugs where variables could be used without being initialized. Fix them.
* Rely on module ordering for localauthGreg Hudson2013-06-271-25/+6
| | | | | | | Register built-in localauth modules in the order we want them used by default, and document accordingly. ticket: 7665
* Provide plugin module ordering guaranteesGreg Hudson2013-06-271-188/+265
| | | | | | | | Rewrite the plugin internals so that modules have a well-defined order--either the order of enable_only tags, or dynamic modules followed by the built-in modules in order of registration. ticket: 7665 (new)
* Fix spin loop reading from KDC TCP socketViktor Dukhovni2013-06-261-2/+2
| | | | | | | | | | | | In the k5_sendto code for reading from a TCP socket, detect end-of-stream when reading the length. Otherwise we can get stuck in an infinite loop of poll() and read(). [ghudson@mit.edu: commit message] ticket: 7508 target_version: 1.11.4 tags: pullup
* Fix various warningsGreg Hudson2013-06-0729-199/+89
|
* Use KDC clock skew for AS-REQ timestampsGreg Hudson2013-06-051-5/+12
| | | | | | | | | | | | | | | | Calculate request timestamps each time we encode a request, and use the adjusted current time when calculating them, including adjustments resulting from preauth-required errors early in the AS exchange. As a side effect, this reverts one of the changes in commit 37b0e55e21926c7875b7176e24e13005920915a6 (#7063); we will once again use the time adjustment from any ccache we read before the AS exchange, if we don't have a more specific adjustment from a preauth-required error. Based on a patch from Stef Walter. ticket: 7657 (new)
* Refactor AS-REQ nonce and timestamp handlingGreg Hudson2013-06-053-67/+78
| | | | | | | | | | | | Create helper functions to set the request nonce and to set the request timestamp. Don't bother picking a nonce in restart_init_creds_loop since we will just pick a new one in init_creds_step_request. Create a library-internal function to get the current time with possible adjustment from a preauth-required error. Only set ctx->request_time in one place (just before encoding each request). Remove unused parameters from stash_as_reply. Partially based on a patch from Stef Walter.
* Fix spurious clock skew caused by preauth delayGreg Hudson2013-06-021-0/+3
| | | | | | | | | | Commit 37b0e55e21926c7875b7176e24e13005920915a6 (#7063) prevented clock skew caused by preauth delay by recording the time of the initial request. However, it failed to take into account delay between requests due to prompting during preauthentication. Fix this by recording the request time for each request. ticket: 7656 (new)
* Properly handle use_master in k5_init_creds_getGreg Hudson2013-05-311-2/+4
| | | | | | | | | | | If we make multiple requests in an initial creds exchange, the krb5_sendto_kdc call in k5_init_creds_get may flip the use_master value from 0 to 1 if it detects that the response was from a master KDC. Don't turn this into a requirement for future requests during the same exchange, or we may have trouble following AS referrals. Reported by Sumit Bose. ticket: 7650
* Fix non-builtin crypto module buildsGreg Hudson2013-05-2911-24/+39
| | | | | | | Commit 4b0985f8573840838bcfa8ec1df3dcd39a3dbf15 went a bit too far in pruning the placeholder makefiles for the openssl and nss crypto modules. We need enough boilerplate to create OBJS.SH in each directory.
* Make empty passwords work via init_creds APIsGreg Hudson2013-05-274-86/+60
| | | | | | | | | | | | | | In the gak_data value used by krb5_get_as_key_password, separate the already-known password from the storage we might have allocated to put it in, so that we no longer use an empty data buffer to determine whether we know the password. This allows empty passwords to work via the API. Remove the kadm5 test which explicitly uses an empty password. Based on a patch from Stef Walter. ticket: 7642
* Add AES-NI support on LinuxGreg Hudson2013-05-242-5/+138
| | | | | | | If yasm and cpuid.h are present on a Linux i686 or x64 system, compile the modified Intel AES-NI assembly sources. In the builtin AES enc provider, check at runtime whether the CPU supports AES-NI instructions and use the assembly functions if so.
* Adjust AESNI sources for krb5 treeGreg Hudson2013-05-242-2588/+17
| | | | | Remove functions we don't need. Add macros to redefine functions with an appropriate namespace prefix.
* Add Intel AESNI assembly filesGreg Hudson2013-05-242-0/+4280
| | | | | | Add assembly files from the Intel AESNI Sample Library, version 1.2, which implement AES encryption using AES-NI instructions. Trailing whitespace was removed.
* Refactor AES, Camellia builtin enc providersGreg Hudson2013-05-242-302/+309
| | | | | | | In preparation for AES-NI support, adjust the block encryption helpers in the AES enc provider so that the cache is only touched by helpers, and reframe the CTS operations in terms of CBC operations. Change the Camellia enc provider as well for consistency.
* Simplify crypto IOV helpersGreg Hudson2013-05-2415-768/+375
| | | | | | | | Expand the concept of an IOV block state into a cursor which remembers the IOV set being iterated over, the block size, and both input and output positions. Eliminate the no-copy inline block getter for now, but provide helpers to grab contiguous chains of blocks from a cursor. Also provide an inline helper to sum the total length of an iov chain.
generated by cgit (git 2.34.1) at 2025-09-30 00:48:28 +0000