summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* Remove redundant domain_realm mappingsBen Kaduk2013-08-123-18/+8
| | | | | | | | | | | | | | | | | | | This fixes a long-standing documentation bug where we claimed that a domain_realm mapping for a host name would not affect entries under that domain name. The code has always had the behavior where a host name mapping implies the corresponding domain name mapping, since the 1.0 release. While here, replace media-lab with csail in example files, as the media lab realm is no longer in use. Also strip port 88 from KDC specifications, and drop the harmful default_{tgs,tkt}_enctypes lines from src/util/profile/krb5.conf. Further cleanup on these files to remove defunct realms may be in order. ticket: 7690 (new) tags: pullup target_version: 1.11.4
* Fix localauth memory leakGreg Hudson2013-08-124-0/+10
| | | | | localauth modules were not freed by krb5_free_context(), causing a memory leak.
* Actually build t_enctypesTom Yu2013-08-121-4/+4
| | | | | | | | Commit 2e956074b228ff4df3b7462037ab69e4e88ffffe omitted adding a dependency to the "all" target to force the build of the t_enctypes test program. ticket: 7688
* Add trace logging for TXT lookupsGreg Hudson2013-08-126-12/+20
| | | | | | Rename krb5_try_realm_txt_rr (an internal function despite the name) and add a context parameter. Generate trace logs when we successfully look up a record and when a record is not found.
* Fix gss_krb5_set_allowable_enctypes for acceptorGreg Hudson2013-08-124-2/+383
| | | | | | | | | | | | | | | | | | | The acceptor implementation of gss_krb5_set_allowable_enctypes (added in 1.9.1) is intended to restrict the acceptor subkey negotiated by krb5_rd_req(). It uses the same approach as the initiator, calling krb5_set_default_tgs_enctypes on the context. This has the unwanted side effect of restricting the encryption key of the ticket, because krb5_decrypt_tkt_part has checked krb5_is_permitted_enctype on the ticket encryption key since 1.8. Instead, use krb5_auth_con_setpermetypes on the auth context. This list is only used for session key enctype negotiation. Also add automated tests to verify that gss_krb5_set_allowable_enctypes works as desired. ticket: 7688 (new) target_version: 1.11.4 tags: pullup
* Report KDC response sizes in trace logsGreg Hudson2013-08-072-3/+3
|
* Update config.guess and config.subBen Kaduk2013-08-072-132/+192
| | | | | | | | | | | | Copy in the latest config.guess and config.sub from upstream git master as of 2013-07-26 (revision 79c4c50fc754d742286706b4db5ed8ce2a0de925). Our previous version didn't recognize arm64. Reported as Debian bug 717840. ticket: 7683 (new) tags: pullup target_version: 1.11.4
* Correct an error in kdb.h commentsGreg Hudson2013-08-051-2/+2
| | | | | The check_policy functions return com_err codes, not protocol codes, so use a com_err constant in the example.
* Remove unused function arguments in cc_keyring.cSimo Sorce2013-08-021-172/+149
| | | | | | | The credential serialization functions do not operate on a ccache, so do not need it as an argument. [ghudson@mit.edu: clarified commit message, rewrapped shortened lines]
* Fix leak in krb5_krcc_unparse_cred on errorGreg Hudson2013-08-021-1/+3
| | | | Based on a patch from simo@redhat.com.
* Document krb5_db_iterate restriction on writingGreg Hudson2013-07-311-0/+6
|
* Don't reopen the KDB in update_princ_encryptionGreg Hudson2013-07-311-0/+12
| | | | | | | | | | kdb5_util update_princ_encryption iterates over the KDB and writes modified entries. With the DB2 back end, the first write operation has to upgrade the lock and reopen the DB, which resets the cursor state. Take out an explicit write lock before iterating to avoid this step. ticket: 7684 (new)
* Remove old comments in sendto_kdc.cRobbie Harwood (frozencemetery)2013-07-301-12/+0
| | | | | | | The commented code in question is present in set_conn_state_msg_length which is called immediately after the comments. [ghudson@mit.edu: clarified commit message]
* Remove is_udp field in sendto_kdc.c conn_stateRobbie Harwood (frozencemetery)2013-07-301-5/+1
| | | | | | | This field is redundant with addr.type. [ghudson@mit.edu: removed extraneous changes; clarified commit message]
* Add base64 functions to libkrb5support exportsRobbie Harwood (frozencemetery)2013-07-301-0/+2
| | | | | This was previously not an issue because nothing outside of libkrb5support used them.
* Don't ask empty responder questions in PKINITNalin Dahyabhai2013-07-223-9/+34
| | | | | | | | | When putting together the set of identity prompts for a responder challenge, if we don't need a PIN or password of some kind, don't ask an empty question. [ghudson@mit.edu: squashed commits, modified commit message, merged PKCS11 test with current Python script]
* Load import/export cred functions from GSS modulesSimo Sorce2013-07-211-0/+4
| | | | | | | | | | | | When the import/export credential feature was implement the related functions were added to struct gss_config, but the initialization function that dynamically loads modules was not changed to see if the plugin being loaded provided such functions. This will allow non-builtin mechanism and interposer mechanism to implement custom import/export credential extensions if they wish. ticket: 7682
* Load cred store functions from GSS modulesSimo Sorce2013-07-211-0/+4
| | | | | | | | | | | | When the credential store feature was implement the related functions were added to struct gss_config, but the initialization function that dynamically loads modules was not changed to see if the plugin being loaded provided such functions. This will allow non-builtin mechanism and interposer mechanism to implement custom credential store extensions if they wish. ticket: 7682
* Allow self-service for kadmin purgekeys RPCGreg Hudson2013-07-192-3/+7
| | | | | | | Make the purgekeys RPC allow self-service, like the chpass and chrand RPCs. ticket: 7681 (new)
* Clean up and improve PKINIT test scriptGreg Hudson2013-07-191-78/+35
| | | | | | | | | Don't create a bunch of identically configured realms; just reuse the same one. Remove a redundant assignment from the soft-pkcs11.so check. Move the pkinit_identity setting from krb5.conf to kdc.conf, since it's only used by the KDC. Add a test for trying anonymous PKINIT when it isn't configured. Check for a specific error message when testing restricted anonymous PKINIT.
* Combine PKINIT test scriptsGreg Hudson2013-07-183-44/+23
|
* Test that password preauth works without PKINITNalin Dahyabhai2013-07-171-0/+12
| | | | | | Before we test authenticated PKINIT, slip in a test to check that password-based preauthentication still works when the KDC is offering PKINIT, but the client has no PKINIT credentials.
* Teach the responder test helper about OTPNalin Dahyabhai2013-07-171-10/+50
|
* Add the error to some PKINIT NSS debug messagesNalin Dahyabhai2013-07-171-10/+14
|
* Add tests for PKINIT using responder functionalityNalin Dahyabhai2013-07-171-0/+160
| | | | | | | | | | | | | | We now also test that the PKINIT challenge looks like we expect it to look, that PKINIT fails if we don't provide a response or a prompter callback, and that PKINIT succeeds with a response provided using either the raw responder API or the PKINIT responder functions. One thing that we don't check is which specific error code we get when PKINIT fails: the OpenSSL and NSS versions return different error codes (some mixture of EIO, ENOMEM, ENOENT, and KRB5KDC_ERR_PREAUTH_FAILED) when they encounter trouble loading client credentials. ticket: 7680
* Add a helper for testing PKINIT and responder cbNalin Dahyabhai2013-07-173-4/+404
| | | | ticket: 7680
* Add non-JSON APIs for PKINIT responder itemsNalin Dahyabhai2013-07-176-0/+284
| | | | | | | | | | | | | | | | | Add wrappers for the JSON-oriented APIs for PKINIT responder items, modeled after the API we provide for OTP items: * krb5_responder_pkinit_get_challenge() returns the list of identities for which we need PINs * krb5_responder_pkinit_challenge_free() frees the structure that was returned by krb5_responder_pkinit_get_challenge() * krb5_responder_pkinit_set_answer() sets the answer to the PIN for one of the identities [ghudson@mit.edu: style cleanup; added comment pointing to main body of PKINIT module] ticket: 7680
* Support PKINIT OpenSSL deferred identity promptingNalin Dahyabhai2013-07-171-55/+159
| | | | | | | | | | | | | | | | Add a password to the set of things that we can pass to a PEM password callback and the function we use for loading PKCS12 bundles. If we're meant to defer identity prompts, just store the name of the identity which we're loading. Otherwise, if we're passed a password, use it. Otherwise, use the prompter callback. Add a password to the set of things that we can pass to the function that we use for logging in to PKCS11 tokens, too, but if we're deferring identity prompts, just return the identity name without doing anything else. If not, and we're passed a password, use that. Otherwise, try to use the prompter callback to get one. ticket: 7680
* Support PKINIT NSS deferred identity promptingNalin Dahyabhai2013-07-171-60/+252
| | | | | | | | | | | | | | | | | | The password callback which we usually supply to NSS already gets a pointer to the pkinit_identity_crypto_context structure, but it needs to be passed the name of the identity for which it's being called. If it gets a name, and it's deferring prompting, just add the identity to the list of deferred identity prompts (the password callback wouldn't have been called if its result wasn't needed), and either return NULL (as an indication that we couldn't get a password) or an empty string (a value which we know is invalid) if that's handier. Otherwise, check for a password that's been stashed for its use for that identity, and return a copy of it if one's found. If none of that works, try to use the prompter callback to ask for the password. ticket: 7680
* Pass PKINIT identity prompts to the responder cbNalin Dahyabhai2013-07-173-19/+262
| | | | | | | | | | | | | | | | | Use the list of deferred identity prompts and warnings, which we have after calling pkinit_identity_initialize(), to build a list of questions to supply to responder callbacks. Before calling pkinit_identity_prompt() to actually load identities that are protected, save any passwords and PINs which a responder callback may have supplied. Because pkinit_client_prep_questions() can be called multiple times, and we don't want to try to load all of our identities each of those times, take some steps to ensure that we only call pkinit_identity_initialize() and pkinit_identity_prompt() once per request. ticket: 7680
* Make the PKINIT NSS path also check for NULL certsNalin Dahyabhai2013-07-171-1/+6
| | | | | When called to free identity information, do what the OpenSSL-based version does, and error out if the identity information is NULL.
* Use PKCS11_MODNAME for NSS PKINIT by defaultNalin Dahyabhai2013-07-171-0/+7
| | | | | Do what the OpenSSL-using code paths do, and load PKCS11_MODNAME if no module is specified when we're told to use a PKCS11 identity.
* Add support for PKINIT deferring identity promptsNalin Dahyabhai2013-07-176-0/+226
| | | | | | | | | | | Learn to manage a list of deferred identities, for which we want to prompt for passwords or PINs, in pkinit_identity_crypto_context structures, along with their associated token flags. These are opaque outside of pkinit_crypto_openssl and pkinit_crypto_nss, so both implementations need to provide wrapper functions that can be called from elsewhere in the module to populate and query the lists. ticket: 7680
* Split pkinit_identity_initialize into two phasesNalin Dahyabhai2013-07-177-15/+97
| | | | | | | | | | | Split part of pkinit_identity_initialize() into a second piece named pkinit_identity_prompt(). Have each piece pass a new boolean flag to crypto_load_certs() to indicate if it should defer prompting for a password/PIN for client identities that require one. If the flag isn't set, then crypto_load_certs() should attempt to use a responder-supplied value, or call the prompter if there isn't one. ticket: 7680
* Fix OTP KDC module get_string error handlingGreg Hudson2013-07-171-2/+4
| | | | | | If cb->get_string returns 0 with no result in otp_edata, make sure we set retval to avoid sending an empty OTP hint. If cb->get_string returns an error code in otp_verify, avoid masking that code.
* Clarify and improve k5_json_object_setGreg Hudson2013-07-163-4/+30
| | | | | Document that k5_json_object_set can be used to overwrite an existing key, and make it possible to remove a key by setting it to NULL.
* Add kadmin support for principals without keysGreg Hudson2013-07-1511-18/+122
| | | | | | | | | Add kadmin support for "addprinc -nokey", which creates a principal with no keys, and "purgekeys -all", which deletes all keys from a principal. The KDC was modified by #7630 to support principals without keys. ticket: 7679 (new)
* Avoid allocating zero key_data structuresGreg Hudson2013-07-153-22/+22
| | | | | | | | When we allocate space for an array of key_data structures, make sure we allocate at least one, so we don't spuriously fail on platforms where malloc(0) returns NULL. Where we use malloc, use k5calloc instead. Where we use krb5_db_alloc or realloc, just allocate an extra entry.
* Fix a leak when parsing PKINIT cert SANs with NSSNalin Dahyabhai2013-07-151-0/+1
| | | | | When retrieving the list of a certificate's subjectAltName values, we weren't freeing some of the temporary memory we used.
* Fix minor leaks in klistGreg Hudson2013-07-151-3/+4
| | | | | | When walking the cache, if we skip a cred because it's a config entry, make sure to free it. Also free the result of krb5_cc_get_principal. Based on a patch from Nalin Dahyabhai.
* Don't leak PKINIT CMS signed data certs and CRLsNalin Dahyabhai2013-07-151-2/+4
| | | | | | | | The stacks of certificates and CRLs that we retrieve from CMS objects include newly-owned references to the certificates and CRLs, so when we go to free them, we need to remember to free those. [ghudson@mit.edu: minor formatting change; removed unrelated style fix]
* Don't leak the reply key's memory during PKINITNalin Dahyabhai2013-07-151-1/+3
|
* Use pipe instead of sigwait for krad testsGreg Hudson2013-07-142-27/+17
| | | | | | | | We've never used sigwait() before, and it has some problems on Solaris 10 (a nonconformant prototype by default, and experimentally it didn't seem to work correctly with _POSIX_PTHREAD_SEMANTICS defined). Use a pipe instead. Make t_daemon.py less chatty on stdout to avoid filling the pipe buffer.
* Fix minor type issues in krad testsGreg Hudson2013-07-142-2/+2
| | | | | Use unsigned char for test encodings, since the initializers use values greater than 127.
* Use k5calloc instead of k5alloc where appropriateGreg Hudson2013-07-1119-34/+36
| | | | | Wherever we use k5alloc with a multiplication in the size parameter,, use the new k5calloc helper function instead.
* Add k5calloc internal helper functionGreg Hudson2013-07-111-2/+9
| | | | | | Letting calloc() do multiplication helps avoid overflow bugs, so provide an internal k5calloc() helper which accepts both calloc arguments, and reimplement k5alloc() in terms of it.
* Fix skip logic in t_otp.pyGreg Hudson2013-07-111-7/+1
| | | | | | | Reorder (and trim) the imports in t_otp.py so that k5test is pulled in before we try to import pyrad and multiprocessing. Otherwise success() isn't defined in the case where we decide to skip the entire test script.
* Add server-side otp preauth pluginNathaniel McCallum2013-07-1111-0/+1376
| | | | | | | | | | This plugin implements the proposal for providing OTP support by proxying requests to RADIUS. Details can be found inside the provided documentation as well as on the project page. http://k5wiki.kerberos.org/wiki/Projects/OTPOverRADIUS ticket: 7678
* Add libkradNathaniel McCallum2013-07-1124-2/+3693
| | | | | | | | The new library libkrad provides code for the parsing of RADIUS packets as well as client implementation based around libverto. This library should be considered unstable. ticket: 7678 (new)
* Add test case for CVE-2013-1417Tom Yu2013-07-012-0/+14
| | | | | | ticket: 7670 (new) tags: pullup target_version: 1.11.4
generated by cgit (git 2.34.1) at 2025-09-14 04:43:51 +0000