| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| ... | |
| |
|
|
|
|
| |
Our traditional practice is to use hex integer literals for flag bits.
Bit shifting can be dangerous because shifting into the sign bit is
undefined. Convert existing bit shift expressions to hex literals.
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
| |
Refactor some of the second-ticket handling and session key
generation out of process_tgs_req().
|
| |
|
|
|
|
|
| |
Clean up domain->realm referrals by breaking prep_reprocess_tgs_req()
into smaller functions. Give the resulting functions more descriptive
names. Also delete an unnecessary and almost exact copy of
krb5_get_host_realm().
|
| |
|
|
|
|
| |
The service principal database entry search logic in process_tgs_req()
was excessively complex, containing questionable uses of "goto", along
with deeply nested control flow. Refactor it into smaller functions.
|
| | |
|
| |
|
|
|
|
|
| |
Break validate_tgs_request() into smaller functions. Collect related
checks into helper functions. As a result, some invalid requests with
multiple problems can produce different error messages. This is
probably not a problem for most situations.
|
| |
|
|
|
|
|
| |
add_to_transited() is fairly large, and also fairly independent of the
other contents of kdc_util.c. Move it into kdc_transit.c. Also
simplifies the building of rtest by removing dependencies that
kdc_util.c previously needed to satisfy undefined symbols.
|
| | |
|
| |
|
|
|
|
| |
Make kdc_active_realm a local variable in every function that needs
it. Pass it around in various state structures as needed. Keep the
macros that reference its members remain for now.
|
| |
|
|
|
|
|
| |
Too many parts of the KDC rely on the global variable
kdc_active_realm. rtest.c doesn't actually need any of the
KDC-specific information that's avaiable through kdc_active_realm, so
delete references to it.
|
| |
|
|
|
|
|
| |
RFC 4120 section 7.3 says that TGS principal names have two
components. Make krb5_is_tgs_principal() and is_cross_tgs_principal()
enforce this constraint. Code elsewhere in the KDC already checks for
two components anyway.
|
| |
|
|
|
|
|
|
| |
Change the make rules for the directory structure.
Update the RST sources which include other RST sources for the
loss of the krb_ prefix.
ticket: 7409
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Sphinx-build wants to scan over all the sources in the source dir,
and its text output engine does not handle the spanning row cells
used in some of our fancy tables, so it will crash if we attempt
to generate text output from our full suite of documents.
We could work around this by attempting to just compile the one
source file as an additional argument to sphinx-build, but this
seems to insist on producing an index.txt as well as a notice.txt.
Furthermore, we cannot use the same conf.py as in rst_composite because
the paths substitutions are not available with just the minimal
contents of rst_notice. Make a copy and remove the irrelevant parts,
for now, changing only the master_doc field as appropriate.
For the HTML build, we use the standard |copy| macro from isonum.txt
to get the unicode copyright symbol glyph, but for ASCII output we
prefer to just use the literal "(C)".
ticket: 7407
|
| | |
|
| |
|
|
|
|
| |
We made two sets of incompatible changes to the DAL and libkdb5 API
during development for 1.11 (master key list simplification and policy
extensions), so increment the appropriate version numbers.
|
| |
|
|
|
|
|
|
|
| |
The message "Got incremental updates from the master" precedes
actually replaying the updates on the slave. Instead look for
"Incremental updates:" (the statistics message), which happens just
after the updates are replayed.
Also, we don't need to import time now that we're not sleeping.
|
| | |
|
| |
|
|
|
|
| |
When adding {str}, {lenstr}, or {data} to trace output, scan for
bytes which might be non-printable, and add them as hex-escaped
versions of themselves if any are found.
|
| | |
|
| | |
|
| |
|
|
|
| |
Update to generate and consume signed-data with no signer-info, which we
need for anonymous PKINIT.
|
| |
|
|
|
| |
Create an NSS context for use when performing KDF, so that the tests,
which call into the function directly, will work.
|
| | |
|
| |
|
|
|
| |
Print a debug message if we're unable to locate the matching private key
for a certificate when we've just loaded both of them from PEM files.
|
| |
|
|
|
| |
Reset the prompt_types list immediately after the prompter callback
returns, as is done everywhere else.
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
After we start kpropd, read about the initial full dump before making
changes on the master. Avoid prodding kpropd for this read (by
shifting responsibility for the initial prod to the caller) since
kpropd doesn't sleep before its first request.
When waiting for sync, note whether we got a full propagation and
match that up with our expectations.
Use a long polling interval so kpropd doesn't wake up on its own and
confuse the test script with an extra incremental update.
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Catch SIGUSR1 in iprop-mode kpropd so that we can use it to interrupt
sleeps and make kpropd do an iprop request immediately.
In k5test.py, add prod_kpropd and read_from_kpropd methods to allow
test scripts to send a SIGUSR1 to kpropd and to read its stdout/stderr
output; also allow the test script to specify additional arguments
when starting kpropd.
In t_iprop.py, start kpropd with -d and, instead of sleeping, read
kpropd output until we see an indication that kpropd is in sync with
the master. To avoid delays, prod kpropd before waiting for sync and
after a completed full prop.
|
| | |
|
| | |
|
| |
|
|
|
| |
This follows the design laid out on the project page:
http://k5wiki.kerberos.org/wiki/Projects/Password_response_item
|
| | |
|
| |
|
|
|
|
|
| |
In check_cast, we want to match cast operators with or without spaces
after the closing paren, and then check for spaces after we match.
Also, per the comment, we want to match potential cast operators
followed by an open paren.
|
| |
|
|
|
|
|
|
|
| |
Fix kpropd -S -t to actually exit after processing one connection (it
was breaking out of the switch statement, not the while loop). Use
the -t when invoking kpropd from the dejagnu test framework;
previously it was unnecessary because kpropd -S -d exited after one
connection. Clear up some confusion in the kprop.exp comments about
whether kpropd is expected to exit.
|
| | |
|
| |
|
|
|
|
|
|
|
|
| |
The Camellia enctypes and cksumtypes have received IANA assignments.
Add #defines using those assignments to krb5.h, remove the CAMELLIA
conditional, and enable testing code as appropriate.
The Camellia draft has not received an RFC number yet, so there is no
Doxygen markup for the enctype and cksumtype #defines. That can be
added once the RFC number is known.
|
| | |
|
| |
|
|
|
|
|
| |
Both the Python and dejagnu iprop tests are slow since they use sleeps
to give kpropd time to do its work (although we can fix this with some
work). Since the Python tests cover the same ground as the dejagnu
tests, we don't need both.
|
| |
|
|
| |
ticket: 7374
|
| |
|
|
|
|
|
| |
Add a start_kpropd() method to K5Realm and make start_kadmind() use the
kadmind -p, -K, and -F options.
ticket: 7378
|
| |
|
|
|
|
| |
Not really: only when the KDB backend lacks a delete method. Still.
ticket: 7403
|
| |
|
|
|
|
|
| |
We absolutely do not want a parking brake on the kprop protocol as
described in the comment being removed. Instead the kprop command
should be fixed so it doesn't die on error (assuming it even still does
or ever did, neither of which I've checked).
|
| | |
|
