krb5.git/src/lib, branch gss_cs

Add way to specify rcache when acquiring creds

2014-01-14T20:11:54+00:00

The "rcache" URN can specify a cache type and name to be used with
the credentials being acquired.

Signed-off-by: Simo Sorce

Fix uninitialized warning in client_init.c

2013-12-21T15:08:06+00:00

ticket: 7800

Allow realm in kadm5_init service names

2013-12-21T05:06:22+00:00

Previously, if you passed a service name with a realm part to a
kadm5_init function, you would get a KRB5_PARSE_MALFORMED error
because the code would internally append its own '@realm' suffix
before parsing the name.  Fix this as follows:

Change gic_iter so instead of producing a full service name, it
produces a krb5_principal which is taken from the cred it acquires.
Pass the client and full service name around as principals, rather
than strings, and use the gss_nt_krb5_principal name type to import
them in setup_gss().  Don't append a realm to the input service name;
instead, pass the input service name directly to the gic functions
(which do not need a realm in the service name and will ignore the
realm if one is present).  For the INIT_CREDS case, parse the input
service name with KRB5_PRINCIPAL_PARSE_IGNORE_REALM and then set the
realm.

ticket: 7800

Simplify libkadm5 client realm initialization

2013-12-21T05:06:22+00:00

The "realm" variable in init_any is used only to fill in the realm of
the service principal in gic_iter().  The service principal realm
should always be the realm we looked up config parameters for, so we
can supply that realm to get_init_creds() unconditionally and
eliminate the case where we use the client principal realm.

Also get rid of an outdated comment and an #if 0 block we will never
need again, and use SNPRINTF_OVERFLOW to check the snprintf result.

make depend

2013-12-21T04:13:57+00:00

Avoid keyctl purge in keyring ccache tests

2013-12-21T04:10:03+00:00

keyctl purge was added in keyutils 1.5 (released in March 2011).  Use
keyctl unlink to clean up keys instead, as it is more universal.

ticket: 7810
target_version: 1.12.1
tags: pullup

Set an error message when keyring get_princ fails

2013-12-21T04:10:03+00:00

When attempting to use a keyring cache that doesn't exist, set an error
message when we fail to read a principal name, as we do when we return
the same error code when using a file ccache.

[ghudson: removed unnecessary check for d->name nullity.]

ticket: 7809
target_version: 1.12.1
tags: pullup

Fix typo that broke 'make clean'

2013-12-20T16:06:19+00:00

Missing $

Add a test program for krb5_copy_context

2013-12-18T21:56:52+00:00

This test program isn't completely proof against the kind of mistakes
we've made with krb5_copy_context in the past, but it at least
exercises krb5_copy_context and can detect some kinds of bugs.

ticket: 7807

Fix krb5_copy_context

2013-12-18T21:56:52+00:00

krb5_copy_context has been broken since 1.8 (it broke in r22456)
because k5_copy_etypes crashes on null enctype lists.  Subsequent
additions to the context structure were not reflected in
krb5_copy_context, creating double-free bugs.  Make k5_copy_etypes
handle null input and account for all new fields in krb5_copy_context.
Reported by Arran Cudbard-Bell.

ticket: 7807 (new)
target_version: 1.12.1
tags: pullup