summaryrefslogtreecommitdiffstats
path: root/src/lib
Commit message (Collapse)AuthorAgeFilesLines
...
* Move CCAPI sources to krb5 repositoryAlexandra Ellwood2007-05-312-3/+3
| | | | | | | ticket: new status: open git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19564 dc483132-0cff-0310-8789-dd5450dbe970
* don't check for readability resolving SRVTAB: keytabKen Raeburn2007-05-311-7/+0
| | | | | | | | | | | Greg Hudson has pointed out that the FILE: and SRVTAB: keytab types differ in when they report errors for files not existing. The implementations of ANY: floating around cope better if they consistently accept names of files that aren't present, and report the error later when fetching information. ticket: new git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19563 dc483132-0cff-0310-8789-dd5450dbe970
* Remove unused macroKen Raeburn2007-05-231-3/+1
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19558 dc483132-0cff-0310-8789-dd5450dbe970
* Change struct _krb5_context.os_context into a single element instead of array[1]Ken Raeburn2007-05-2110-43/+40
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19554 dc483132-0cff-0310-8789-dd5450dbe970
* Fix various gcc warnings about pointer target signedness and qualifiersKen Raeburn2007-05-1011-36/+54
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19548 dc483132-0cff-0310-8789-dd5450dbe970
* Rewrite weak key check to use a small custom struct instead of wedgingKen Raeburn2007-05-101-10/+12
| | | | | | | data into krb5_data, and use the array size rather than a sentinel for loop control. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19547 dc483132-0cff-0310-8789-dd5450dbe970
* We're requiring that 'inline' work nowadays, so don't conditionalize its useKen Raeburn2007-05-101-7/+1
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19546 dc483132-0cff-0310-8789-dd5450dbe970
* Use new comparison inline fnKen Raeburn2007-05-101-3/+2
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19545 dc483132-0cff-0310-8789-dd5450dbe970
* Define and use some inline helper functions for comparing data and authdata ↵Ken Raeburn2007-05-107-65/+27
| | | | | | | | structures, instead of open-coding checks of multiple fields everywhere. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19544 dc483132-0cff-0310-8789-dd5450dbe970
* k5-int.h, gic_opt.cJeffrey Altman2007-05-021-2/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The krb5_get_init_creds_password() and krb5_get_init_creds_keytab() functions permit the gic_opts parameter to be NULL. This is not taken into account when testing the value with the macros krb5_gic_opt_is_extended() and krb5_gic_opt_is_shadowed(). Nor is it taken into account within krb5int_gic_opte_copy() which is called by krb5int_gic_opt_to_opte() when the input parameter is not a krb5_gic_opt_ext structure. This commit makes two changes: (1) it modifies the macros to ensure that the value is non-NULL before evaluation. (2) it modifies krb5int_gic_opte_copy() to avoid copying the original values with memcpy() when the input is NULL. In addition, the code was audited to ensure that the flag KRB5_GET_INIT_CREDS_OPT_SHADOWED is properly set and that when it is set, that the allocated krb5_gic_opt_ext structure is freed by krb5_get_init_creds_password() and krb5_get_init_creds_keytab(). ticket: 5552 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19537 dc483132-0cff-0310-8789-dd5450dbe970
* rd_req_decoded needs to deal with referral realmsSam Hartman2007-04-291-5/+21
| | | | | | | | | | | * Fix handling of null realm in krb5_rd_req_decoded; now we treat a null realm as a default realm there, as we do in the keytab code. ticket: new Target_Version: 1.6.2 Tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19536 dc483132-0cff-0310-8789-dd5450dbe970
* race condition in referrals fallbackTom Yu2007-04-251-0/+1
| | | | | | | | | | | | | | | | | * src/lib/krb5/krb/gc_frm_kdc.c (krb5_get_cred_from_kdc_opt): During referrals fallback, set *tgts to NULL after freeing. This avoids returning a pointer to freed memory when the first call to do_traversal() obtains some TGTs and the subsequent krb5_cc_retrieve_cred() of the final-hop TGT succeeds (due to some other thread or process storing that TGT into the ccache), causing second do_traversal() call (which would re-initialize *tgts) to not execute. Race condition found during KfW-3.2 testing. ticket: new target_version: 1.6.2 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19526 dc483132-0cff-0310-8789-dd5450dbe970
* Add the new kadm5srv function krb5_get_principal_keys to the export listRuss Allbery2007-04-161-0/+1
| | | | | | | | | | Build a separate copy of kadmin/cli/keytab.c for kadmin.local that exposes the -norandkey flag in a way that doesn't require the compiler support -c and -o at the same time. Ticket: 914 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19475 dc483132-0cff-0310-8789-dd5450dbe970
* Add support for extracting existing keys from the KDC with kadmin.local.Russ Allbery2007-04-162-0/+65
| | | | | | | | | | Adds a -norandkey option to the ktadd command only in kadmin.local, and adds a new function to the libkadm5srv library that kadmin.local can call. There is no protocol or network access to this function. Ticket: 914 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19474 dc483132-0cff-0310-8789-dd5450dbe970
* Revert previous change; krb5int_cm_call_select is used by the KDC, and shouldKen Raeburn2007-04-131-7/+8
| | | | | | | | | return when interrupted by a signal. Instead, check for EINTR in service_fds and call krb5int_cm_call_select again. ticket: 5440 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19457 dc483132-0cff-0310-8789-dd5450dbe970
* Produce a more informative error message for KDC_UNREACH with KDC not respondingKen Raeburn2007-04-131-2/+11
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19456 dc483132-0cff-0310-8789-dd5450dbe970
* Provide more detailed error message for 'client not found in kdb'Ken Raeburn2007-04-131-0/+17
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19455 dc483132-0cff-0310-8789-dd5450dbe970
* If select returns EINTR, recompute the expiration time and call it againKen Raeburn2007-04-131-1/+5
| | | | | | | ticket: 5440 status: open git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19452 dc483132-0cff-0310-8789-dd5450dbe970
* EAI_NODATA deprecated, not always definedKen Raeburn2007-04-092-2/+11
| | | | | | | | | | | | | | | | Brian Kantor reports (on the kerberos@mit list today) that krb5-1.6 doesn't build on FreeBSD 6.1 because they've done away with EAI_NODATA, which was removed from the getaddrinfo API in RFC 3943. This patch conditionalizes two tests for EAI_NODATA on the macro being defined, and also adds handling for EAI_OVERFLOW, a new error code added in RFC 3943. ticket: new tags: pullup target_version: 1.6.1 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19410 dc483132-0cff-0310-8789-dd5450dbe970
* service location plugin returning no addresses handled incorrectlyKen Raeburn2007-04-051-18/+18
| | | | | | | | | | | | | | If a locate plugin (e.g., the Python sample plugin and script, when given realm BOBO.MIT.EDU) returns no error but no addresses, the library won't report an error, but will try to make contact, and eventually crash with a null pointer dereference. Fix: If a plugin returns a value other than PLUGIN_NO_HANDLE, including success, continue into the code that checks for an empty address list. ticket: new git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19399 dc483132-0cff-0310-8789-dd5450dbe970
* MITKRB5-SA-2007-002: buffer overflow in krb5_klog_syslogTom Yu2007-04-031-3/+7
| | | | | | | | | | | | | | | | Fix MITKRB5-SA-2007-002: buffer overflow in krb5_klog_syslog. * src/lib/krb5/krb/get_in_tkt.c (krb5_klog_syslog): Use vsnprintf if available. Everything else: use precision fields on "%s" specifiers to truncate logged strings, in case someone doesn't have vsnprintf. ticket: new target_version: 1.6.1 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19395 dc483132-0cff-0310-8789-dd5450dbe970
* Remove unused scc_default_format field from krb5_contextKen Raeburn2007-03-262-13/+0
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19287 dc483132-0cff-0310-8789-dd5450dbe970
* Initialize 'now' to avoid compiler warningKen Raeburn2007-03-251-0/+1
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19285 dc483132-0cff-0310-8789-dd5450dbe970
* MAX_FORMAT_BUFFER should be type size_t to reduce warningsKen Raeburn2007-03-251-1/+1
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19284 dc483132-0cff-0310-8789-dd5450dbe970
* Adjust type of 'stable' in krb5_register_serializer to reduce warningsKen Raeburn2007-03-251-4/+4
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19283 dc483132-0cff-0310-8789-dd5450dbe970
* Change strnchr sought value to int to match passed valueKen Raeburn2007-03-251-1/+1
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19282 dc483132-0cff-0310-8789-dd5450dbe970
* Initialize values to avoid 'possibly uninitialized' compiler warningsKen Raeburn2007-03-251-2/+2
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19281 dc483132-0cff-0310-8789-dd5450dbe970
* Convert keyblock or padata types to krb5_data without compiler warnings.Ken Raeburn2007-03-253-7/+33
| | | | | | (Added inline functions, with appropriate casts, for data conversion.) git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19280 dc483132-0cff-0310-8789-dd5450dbe970
* Use memset to silence some 'may be used uninitialized' warningsKen Raeburn2007-03-252-0/+2
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19279 dc483132-0cff-0310-8789-dd5450dbe970
* whitespace (mostly wrapping long lines produced by protoize)Ken Raeburn2007-03-2513-36/+74
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19278 dc483132-0cff-0310-8789-dd5450dbe970
* Generate makefiles for two static libs plus the python plugin from the ↵Ken Raeburn2007-03-252-8/+2
| | | | | | top-level configure script git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19270 dc483132-0cff-0310-8789-dd5450dbe970
* Remove KRB5_BUILD_LIBRARY_STATIC; always use KRB5_BUILD_LIBRARYKen Raeburn2007-03-251-1/+1
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19266 dc483132-0cff-0310-8789-dd5450dbe970
* Never set krb5_force_static. Instead, set the defaults for buildingKen Raeburn2007-03-251-0/+1
| | | | | | | | | | | | | | | | shared libraries, and allow a Makefile.in to include a new makefile fragment for building private (static, not installed) libraries. Created another makefile fragment to be included to indicate the shared library has no dependencies. (Currently this is the case only for the libdb2 library, which we don't install, but do build for testing.) The way we construct the library dependency search path arguments doesn't work for an empty list on some platforms. Updated Makefile.in to use @libpriv_frag@ and @libnodeps_frag@ as necessary. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19265 dc483132-0cff-0310-8789-dd5450dbe970
* Store a little more detail for unknown enctype errorKen Raeburn2007-03-251-1/+5
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19264 dc483132-0cff-0310-8789-dd5450dbe970
* krb5 library uses kdc.conf when it shouldn'tKen Raeburn2007-03-211-1/+1
| | | | | | | | | Don't add kdc.conf to the list of config files to use unless it's actually requested. Reported by Will Fiveash. ticket: new git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19239 dc483132-0cff-0310-8789-dd5450dbe970
* Enable Vista support for MSLSAJeffrey Altman2007-03-201-9/+99
| | | | | | | | | | | | | | | | | The MSLSA: ccache type when used on Windows Vista can take advantage of an ability to write tickets to the LSA credential cache for the current logon session. This is possible due to the addition of the KERB_SUBMIT_TICKET interface. Also new to Vista is the CACHE_INFO_EX2 interface which permits a much more efficient method of enumerating the contents of the LSA credential cache. The code to take advantage of these features has been present for more than a year. However, due to the lack of a public SDK that included the necessary data structures the functionality has been disabled. As of this commit, the functionality will be enabled if the version of NTSecAPI.h includes TRUST_ATTRIBUTE_TRUST_USES_AES_KEYS. This is a preprocessor symbol that is new to the Vista SDK. In order to build with the new Vista functionality when using the XP SP2 SDK, the NTSecAPI.h file from the Vista SDK must be used in place of the version from the XP SP2 SDK. This commit also addresses the issues associated with the inability to read session keys from a UAC limited process. When UAC limitation is detected by examining the process token elevation level all access to the MSLSA contents is disabled. At some point in the future we can implement an elevated COM service in order to obtain access to the session keys. ticket: new tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19237 dc483132-0cff-0310-8789-dd5450dbe970
* * include/k5-platform.h: Add load_{16,32,64}_n for loading values fromKen Raeburn2007-03-141-2/+15
| | | | | | | | | | | (possibly unaligned) memory in native order. * lib/krb5/krb/get_in_tkt.c (krb5_get_init_creds): Fetch four random bytes from the crypto library and generate a 31-bit (non-negative) nonce, instead of using the timestamp. ticket: 5425 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19223 dc483132-0cff-0310-8789-dd5450dbe970
* * sendto_kdc.c (default_debug_handler): If writing to a log file, keepKen Raeburn2007-03-141-8/+22
| | | | | | | | it open and unbuffered instead of always opening and closing. When the format string has characters to be copied literally to the output, write them all at once instead of individually. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19222 dc483132-0cff-0310-8789-dd5450dbe970
* On unload, free up g_mechSet and g_mechListKen Raeburn2007-03-021-7/+33
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19201 dc483132-0cff-0310-8789-dd5450dbe970
* update dependenciesKen Raeburn2007-03-022-3/+8
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19199 dc483132-0cff-0310-8789-dd5450dbe970
* Delete more stuff for 'clean' and 'distclean' targetsKen Raeburn2007-03-021-1/+2
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19198 dc483132-0cff-0310-8789-dd5450dbe970
* valgrind detects uninitialized (but really unused) bytes in 'queue'Ken Raeburn2007-03-011-0/+6
| | | | | | | | | | | | | | | | | | | | | The gsstest program exports a GSSAPI security context to a blob in memory, writes that memory to a file, and reads it back to use it. Under valgrind, the writing phase triggers a warning about uninitialized storage. The "queue" structure as implemented in generic/util_ordering.c holds an array of values, some of which may never be initialized. As far as I can tell, those uninitialized values are never used before being initialized, either, but valgrind doesn't know that. This patch zaps the structure contents (including the array) before using the queue object. ticket: new target_version: 1.6.1 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19196 dc483132-0cff-0310-8789-dd5450dbe970
* krb5_get_cred_from_kdc fails to null terminate the tgt listJeffrey Altman2007-03-011-0/+1
| | | | | | | | | | | | | | | | | | | | | | if the next tgt in a cross-realm traversal cannot be obtained find_nxt_kdc() was calling krb5_free_creds() on the last tgt in the list but was failing to nullify the pointer to the cred that was just freed. if there were no additional tgts obtained, krb5_get_cred_from_kdc() would return a non-NULL terminated cred list to the caller. This would result in a crash when attempting to manipulate the non-existent cred past the end of the list. This commit nullifies the credential pointer in find_nxt_kdc() after the call to krb5_free_creds() ticket: new tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19195 dc483132-0cff-0310-8789-dd5450dbe970
* When importing a name with a valid (non-null) handle but a zeroKen Raeburn2007-02-241-1/+4
| | | | | | | | | length, set GSS_S_BAD_NAME but not GSS_S_CALL_INACCESSIBLE_READ. ticket: 5445 status: open git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19172 dc483132-0cff-0310-8789-dd5450dbe970
* If a reflection is detected, zap the message buffer pointer outputKen Raeburn2007-02-241-1/+4
| | | | | | | | | | argument as well as actually freeing the buffer. (Found while using the gsstest option to exercise error conditions.) ticket: 5445 status: open git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19171 dc483132-0cff-0310-8789-dd5450dbe970
* Initialize "loopback" field in newly allocated name structureKen Raeburn2007-02-221-0/+1
| | | | | | | ticket: 5445 status: open git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19170 dc483132-0cff-0310-8789-dd5450dbe970
* Ensure consistancy between prototypes and functionsEzra Peisach2007-02-198-29/+22
| | | | | | | | | | | | I am using an older compiler that is complaining that prototypes do not match the functions they reference. The issue is that a number of prototypes are using "const int foo" while the function is "int foo". From a caller sense it makes no difference - but the compiler is correct they are different. All is now consistant. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19169 dc483132-0cff-0310-8789-dd5450dbe970
* Conditionalize some ipv6 bitsKen Raeburn2007-02-161-1/+9
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19168 dc483132-0cff-0310-8789-dd5450dbe970
* rename krb5_server_decrypt_ticket_keyblock() toTom Yu2007-02-131-4/+5
| | | | | | | | krb5int_server_decrypt_ticket_keyblock() ticket: 5349 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19159 dc483132-0cff-0310-8789-dd5450dbe970
* hack to permit GetEnvironmentVariable usage without requiring getenv() ↵Jeffrey Altman2007-02-121-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | conversion Windows has a major flaw when it comes to the use of getenv/putenv. getenv/putenv do not modify the actual environment of the process. Instead, they modify a copy of the environment block at the time the C Runtime Library was initialized for the current module. In other words, the C Runtime Library environment block for the executable is not the same as the C Runtime Library environment block for the krb5_32.dll library, etc. This results in problems when a process wants to set the default ccache name outside the krb5_context. The krb5_context default ccname disappears when the context is destroyed. gss_acquire_cred() suffers from the creation and destruction of krb5_contexts and therefore the krb5_context default ccname cannot be used to set a default ccname. Instead, the process environment must be used. In order to modify the process environment, SetEnvironmentVariable() must be used. However, this does not result in the C Runtime Library environment blocks being updated. putenv() does not see the definition of "KRB5CCNAME". This patch modifies get_os_ccname() for Windows to check GetEnvironmentVariable() before checking the registry. This hack will work as long as there is no "KRB5CCNAME" variable in the C Runtime Library environment block. The long term solution is to replace all calls to getenv and putenv with GetEnvironmentVariable/SetEnvironmentVariable for Windows. ticket: new tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19154 dc483132-0cff-0310-8789-dd5450dbe970
generated by cgit (git 2.34.1) at 2026-02-16 22:09:15 +0000