summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Disconnect the texinfo users guide from the buildBen Kaduk2012-10-151-1/+1
| | | | | | | | | | | | | | | | | | Its content has been migrated to or superseded by the krb_users reST documentation. The texinfo document attempted to have a general introduction to Kerberos, but it is not quite suitable for the target audience of the user's guide and will be rewritten. A few portions of the texinfo document are simply no longer relevant and do not need to be migrated. In particular: The krb5-appl utilities are out of scope for this document, as they have been moved to a separate repository. Coverage of ksu may be brought back at a later time, though. The Kerberos Glossary will be expanded and handled separately. ticket: 7408
* Set pointers to NULL after freeing themZhanna Tsitkov2012-10-152-0/+2
|
* Bump libkdb5 API and DAL versionsGreg Hudson2012-10-152-3/+3
| | | | | | We made two sets of incompatible changes to the DAL and libkdb5 API during development for 1.11 (master key list simplification and policy extensions), so increment the appropriate version numbers.
* Wait for correct message in t_iprop.pyGreg Hudson2012-10-151-2/+1
| | | | | | | | | The message "Got incremental updates from the master" precedes actually replaying the updates on the slave. Instead look for "Incremental updates:" (the statistics message), which happens just after the updates are replayed. Also, we don't need to import time now that we're not sleeping.
* Add a -C flag to klist to also show config entriesNalin Dahyabhai2012-10-152-12/+60
|
* Use hex escaping for non-printable trace dataNalin Dahyabhai2012-10-151-3/+42
| | | | | | When adding {str}, {lenstr}, or {data} to trace output, scan for bytes which might be non-printable, and add them as hex-escaped versions of themselves if any are found.
* Export krb5_cc_move()Nalin Dahyabhai2012-10-152-0/+2
|
* Correct type mismatches for get_as_key callbacksNalin Dahyabhai2012-10-152-2/+4
|
* Handle anonymous-as-signed-data-with-no-signersNalin Dahyabhai2012-10-151-27/+28
| | | | | Update to generate and consume signed-data with no signer-info, which we need for anonymous PKINIT.
* Make sure that pkinit_octetstring_hkdf() inits NSSNalin Dahyabhai2012-10-151-0/+15
| | | | | Create an NSS context for use when performing KDF, so that the tests, which call into the function directly, will work.
* Don't try to free an uninitialized keyblockNalin Dahyabhai2012-10-151-2/+0
|
* Sanity-check loading keys and certs from PEM filesNalin Dahyabhai2012-10-151-0/+15
| | | | | Print a debug message if we're unable to locate the matching private key for a certificate when we've just loaded both of them from PEM files.
* Reset the prompt_types list after calling prompterNalin Dahyabhai2012-10-151-0/+1
| | | | | Reset the prompt_types list immediately after the prompter callback returns, as is done everywhere else.
* Add responder support to preauth_otpNathaniel McCallum2012-10-155-18/+707
|
* Migrate to non-destructive tokeninfo selectionNathaniel McCallum2012-10-151-148/+191
|
* Move forward tokeninfo filteringNathaniel McCallum2012-10-151-63/+81
|
* Move pa_data encoding into a separate functionNathaniel McCallum2012-10-151-39/+45
|
* Eliminate races in t_iprop.pyGreg Hudson2012-10-131-15/+31
| | | | | | | | | | | | | After we start kpropd, read about the initial full dump before making changes on the master. Avoid prodding kpropd for this read (by shifting responsibility for the initial prod to the caller) since kpropd doesn't sleep before its first request. When waiting for sync, note whether we got a full propagation and match that up with our expectations. Use a long polling interval so kpropd doesn't wake up on its own and confuse the test script with an extra incremental update.
* Don't use void * arithmetic in interposed_oidGreg Hudson2012-10-131-1/+2
|
* Make t_iprop.py faster and more robustGreg Hudson2012-10-123-32/+80
| | | | | | | | | | | | | | | Catch SIGUSR1 in iprop-mode kpropd so that we can use it to interrupt sleeps and make kpropd do an iprop request immediately. In k5test.py, add prod_kpropd and read_from_kpropd methods to allow test scripts to send a SIGUSR1 to kpropd and to read its stdout/stderr output; also allow the test script to specify additional arguments when starting kpropd. In t_iprop.py, start kpropd with -d and, instead of sleeping, read kpropd output until we see an indication that kpropd is in sync with the master. To avoid delays, prod kpropd before waiting for sync and after a completed full prop.
* Fix a couple of typosNalin Dahyabhai2012-10-121-2/+2
|
* Add responder support to preauth_encts/preauth_ecNathaniel McCallum2012-10-122-0/+26
|
* Add responder support to get_as_key()Nathaniel McCallum2012-10-129-9/+70
| | | | | This follows the design laid out on the project page: http://k5wiki.kerberos.org/wiki/Projects/Password_response_item
* Allow null inputs to response item functionsNathaniel McCallum2012-10-121-2/+14
|
* Remove unused texinfo sourcesBen Kaduk2012-10-1210-6233/+0
| | | | | | | | Now that the admin guide make rules are removed, quite a few of the texinfo sources are not referenced from anywhere and can be safely removed. ticket: 7408
* Remove make glue for texinfo admin guideBen Kaduk2012-10-121-30/+1
| | | | | | Towards removing the texinfo docs entirely. ticket: 7408
* Disconnect the texinfo admin guide from the buildBen Kaduk2012-10-121-1/+1
| | | | | | | | | | | | | | | | | Its content has been migrated to or superseded by the reST documentation, essentially entirely in krb_admins. A few portions of the texinfo document are simply no longer relevant and do not need to be migrated. In particular: Information about reporting bugs lives on k5wiki.kerberos.org. General Kerberos concepts/introduction will be elsewhere in the tree. We do not need to document the time zones accepted by kadmin. We do not need a table of the various error codes and strings in our formal documentation. A complete description of the layout of our source tree is not useful or relevant to most Kerberos administrators. ticket: 7408
* Fix cast regexp in C style checkerGreg Hudson2012-10-111-1/+1
| | | | | | | In check_cast, we want to match cast operators with or without spaces after the closing paren, and then check for spaces after we match. Also, per the comment, we want to match potential cast operators followed by an open paren.
* Improve the ktadd and ktremove synopsesBen Kaduk2012-10-111-3/+4
| | | | | | | Mention the options on the synopsis line, and do not imply that the principal argument(s) for ktadd are optional. reST line blocks are needed to keep the two forms of ktadd on separate lines.
* Fix ordered list styleBen Kaduk2012-10-111-0/+22
| | | | | | | Sphynx outputs class information that corresponds to its generated basic.css, which we do not include. This results in all lists, even nested lists, using arabic numerals. Import the class properties into kerb.css for now.
* Fix copy/paste errors in dbadminBen Kaduk2012-10-111-4/+4
| | | | | | We should include the stashsrvpw content in that section, not the list content. Likewise, the list_policy content instead of the destroy_policy content.
* Update kdb5_util example outputBen Kaduk2012-10-111-2/+4
| | | | | | This text has not caught up with changes to the utility itself. As a side effect, our output text box is narrower and does not have to scroll on as many browser windows.
* Wordsmith kdb5_util stash -fBen Kaduk2012-10-111-1/+2
| | | | | | | The keyfile worth overriding is the one in kdc.conf. Though using stash -f would override kdb5_util's -sf argument, there is no reason to pass both flags to the same invocation. In any case, the "at startup" language is not really correct.
* Remove pronoun referent ambiguityBen Kaduk2012-10-111-2/+2
| | | | The policy must be unused, not the delete_policy command.
* Move cross-realm info to the cross-realm sectionBen Kaduk2012-10-111-16/+10
| | | | | | | | It's really not appropriate for the "examples" subsection of "Adding, modifying and deleting principals". While here, update the enctype recommendation for cross-realm principals to something that does not include weak crypto.
* Normalize format of kadmin option descriptionsBen Kaduk2012-10-101-27/+28
| | | | | Start with a capital letter and end with a full stop, making the description a sentence (or at least close to one).
* Correct kadm5.acl synopsisBen Kaduk2012-10-101-1/+1
| | | | | | The target principal and restrictions arguments are not orthogonal; a target principal argument must be given in order for a restriction list to be supplied.
* Make the kadm5.acl example saneBen Kaduk2012-10-101-9/+10
| | | | | | | | | It is an eggregious security violation to give all admin principals admin rights and then give all null instances permission to change the password of the associated admin instance. While here, don't assume that admin and root are the only non-null instances, and correct the formatting of an entry with restrictions.
* kadm5.acl line order is importantBen Kaduk2012-10-101-2/+2
| | | | Make it a special note in the documentation to help it stand out.
* Wordsmith in kadm5_acl.rstBen Kaduk2012-10-101-2/+2
| | | | Grammar fixup and avoid jargon.
* Fix slow kprop dejagnu testGreg Hudson2012-10-103-6/+4
| | | | | | | | | Fix kpropd -S -t to actually exit after processing one connection (it was breaking out of the switch statement, not the while loop). Use the -t when invoking kpropd from the dejagnu test framework; previously it was unnecessary because kpropd -S -d exited after one connection. Clear up some confusion in the kprop.exp comments about whether kpropd is expected to exit.
* Wordsmith SRV records for KDCsBen Kaduk2012-10-101-5/+6
| | | | | Tweak the wording a bit to be more clear and avoid using multiple words deriving from the stem "use" in close succession.
* Document TXT records for realm lookupBen Kaduk2012-10-101-1/+22
| | | | | | | | | Even though they are subject to vulnerabilities via DNS spoofing and we accordingly don't recommend their use, we do have the code to use them. Just as we document dns_lookup_realm in krb5.conf(5), document them here. ticket: 7407
* Fix argument order when calling the responderNathaniel McCallum2012-10-101-2/+2
|
* Remove unused texinfo sourcesBen Kaduk2012-10-103-2461/+1
| | | | | | | | Now that the install guide make rules are removed, nothing references build.texinfo or install.texinfo any more (other than the tgz target, which is updated accordingly). ticket: 7408
* Remove make glue for texinfo install guideBen Kaduk2012-10-101-30/+1
| | | | | | Towards removing the texinfo docs entirely. ticket: 7408
* Disconnect texinfo install guide from the buildBen Kaduk2012-10-101-1/+1
| | | | | | | | | | | | | | | | | Its content has been migrated to or superseded by the RST documentation, split amongst krb_build and various sections of krb_admins. A few portions of the texinfo document are simply no longer relevant and do not need to be migrated. In particular: It's 2012; we don't need to specify that we require a C89 compiler. It's 2012; it will be easy to get enough disk to build krb5. The KADM5 tests are part of 'make check' and don't need separate documentation. Shared library support is not limited to "a few operating systems". We do not need to document incompatibilities with ancient/dead OSes. kadmind4 and v5passwdd are no longer relevant. ticket: 7408
* Add section on updating from single-DESBen Kaduk2012-10-093-1/+132
| | | | | | | | | | | | | There are, unfortunately, still some single-DES deployments out there. Try to help them along by documenting a procedure for migrating to stronger crypto. The texinfo install guide had a section on "upgrading", but it was not really suitable for direct import into a RST document. For one, it gave a high profile to the on-disk incompatibilities in upgrades to 1.1 and 1.2. It also was driven at upgrading *to* triple-des (or RC4), which are something of a dead-end. This new text attempts to be more general and applicable to today's environment.
* Add a kdb5_util examples for old KDC upgradesBen Kaduk2012-10-091-0/+20
| | | | | | | | | | | | It's a slightly less-contrived use case of the utility than the other example, which reads more like a usage statement. Give a motivating sentence before each example, and note that this new example is not needed in the general upgrade case. The need to dump/load for upgrades prior to 1.2 was documented in the texinfo install guide, but not in any RST sources until now. ticket: 7407
* De-conditionalize Camellia codeGreg Hudson2012-10-0930-221/+42
| | | | | | | | | | The Camellia enctypes and cksumtypes have received IANA assignments. Add #defines using those assignments to krb5.h, remove the CAMELLIA conditional, and enable testing code as appropriate. The Camellia draft has not received an RFC number yet, so there is no Doxygen markup for the enctype and cksumtype #defines. That can be added once the RFC number is known.
generated by cgit (git 2.34.1) at 2025-09-28 13:28:10 +0000