Include autoconf.h (either directly or via proxy) before system headers, so that feature test macros defined there can affect the system namespace. Where include order was changed, eliminate some redundant or unnecessary includes. ticket: 7961
If krb5_get_tgs_ktypes fails (due to an out-of-memory condition or an error re-reading the profile), k5_make_tgs_req will dereference a null pointer. Check the return value before dereferencing defenctypes. [ghudson@mit.edu: clarified commit message] ticket: 7952 (new) target_version: 1.12.2 tags: pullup
If krb5_encrypt_keyhelper() returns an error, the ciphertext structure may contain a non-zero length, but it will already have freed the pointer to its data, making encrypt_credencpart()'s subsequent attempt to clear and free the memory fail. Remove that logic. Based on a patch from Jatin Nansi. ticket: 7948 (new) target_version: 1.12.2 tags: pullup
After krb5_rd_req_decoded or krb5_rd_req_decoded_anyflag, the ticket (with enc_part2 if we could decrypt it) is accessible via request->ticket; there is no need to copy it. Stop using the ticket parameter of those functions. Where we need to save the ticket beyond the lifetime of the krb5_ap_req, steal the pointer before freeing the request.
Fix KDC logging to include client principal in TGS_REQ logging even during error conditions such as "Ticket expired". As long as the TGS_REQ can be decrypted and the client principal is available, it should be included in the log, regardless of other errors which might be detected. krb5_rd_req_decoded and krb5_rd_req_decoded_anyflag (not public interfaces) now leave the decrypted ticket in req->ticket->enc_part2 on success or failure, if the ticket was successfully decrypted. This does not affect the behavior of krb5_rd_req. [ghudson@mit.edu: removed extraneous change, added commit message summary and description of internal API change, fixed possible memory leak, removed comment and #if 0 code block of purely historical interest] ticket: 7910
Replace most calls to krb5_set_error_message with k5_setmsg for brevity. Leave alone plugin sources where we don't include k5-int.h (mostly PKINIT).
It wasn't being used and it added too much complexity to the error-handling functions.
Handle encoding and decoding [MS-KKDCP] proxy messages, including handling of the additional length bytes. Early versions of [MS-KKDCP] incorrectly omit that the size of the proxied message is prepended to the proxied message, as it is when we're using plain TCP, before encoding the proxy-message structure. This is fixed at least as of version 2.1 of the spec. [nalin@redhat.com: add tests] ticket: 7929
Bison 3 removed support for YYPARSE_PARAM and YYLEX_PARAM, breaking x-deltat.y. Use %parse-param and %lex-param instead. (In Bison 3 we could use just %param, but that doesn't work in 2.x.) The parameter added by %parse-param is also passed to yyerror, so adjust the macro we use to suppress yyerror accordingly. Also use "%define api.pure" instead of "%pure_parser", which was deprecated in bison 2.3b. (The correct spelling was actually "%pure-parser", and bison 3 generates a warning about the underscore spelling.) Regenerate deltat.c using the new x-deltat.y and bison 3.0.2. ticket: 7923
Adjust the internal abstractions so that decrypt_encpart is responsible for the fallback from receiving subkey to session key, and krb5_rd_cred is responsible for decoding and calling decrypt_encpart. Rename krb5_rd_cred_basic to make_cred_list since it is now only responsible for constructing the list.