| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
| |
Move the documentation for the [logging], [dbdefaults], and
[dbmodules] sections and the database_module tag in kdc.conf rather
than krb5.conf, now that (as of r18009, aka #3761, which went into
krb5 1.5) KDC settings can be placed in either file.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25737 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
| |
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25736 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
| |
Fix a cast to prvent signed/unsigned warning.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25735 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
| |
1. a new-line " ::" is preceded by not more then one line of text;
2. a new line does not start with a whitespace(s) and a dot
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25734 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
| |
Combine the contents of the krb_admins/appl_server directory into one
file appl_server.rst.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25733 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
| |
Combine the contents of the krb_admins/database directory into one
file database.rst.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25732 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
| |
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25731 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
r24241 (#6755) introduced a bug where if the KDC sends a LastReq entry
containing an account expiry time, we send a prompter warning for
password expiry even if there was no entry containing a password
expiry time. Typically, this results in the message "Warning: Your
password will expire in less than one hour on Thu Jan 1 12:00:00
1970".
Fix this by explicitly checking for pw_exp == 0 in warn_pw_expiry()
after we've gotten past the conditional for invoking the callback.
ticket: 7098
target_version: 1.9.4
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25730 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
|
| |
The admin keytab hasn't been needed or used by kadmind since 1.4
(except possibly by legacy admin daemons which we no longer ship).
Eliminate remaining references to it in code, test cases, and
documentation.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25729 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
| |
Move the contents of the realm_config directory into one file
realm_config.rst.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25728 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
| |
indented in the man pages.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25727 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
| |
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25726 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
| |
ticket: 7092
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25725 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
| |
Create two larger files (install_kdc.rst and install_clients.rst) and
remove the install_kdc and install_clients directories. No
significant changes to content.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25724 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
kdb_db2's ctx_iterate makes an convenience alias to dbc->db in order
to call more invoke call the DB's seq method. This alias may become
invalidated if the callback writes to the DB, since ctx_lock() may
re-open the DB in order to acquire a write lock. Fix the bug by
getting rid of the convenience alias.
Most KDB iteration operations in the code base do not write to the DB,
but kdb5_util update_princ_encryption does.
Bug discovered and diagnosed by will.fiveash@oracle.com.
ticket: 7096
target_version: 1.10.1
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25723 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
|
| |
In the application developer documentation, create a little bit of
framing for documentation about krb5 GSS mechanism behavior and
extensions, and create an initial section about how host-based service
names affect keytab principal selection.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25722 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
| |
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25721 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
| |
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25720 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The configure-time options to enable and disable IPv6 support have
been deprecated for some time, but the checks for OS support were
kept. This removes those checks, and unconditionally compiles in the
IPv6 support.
There was a configure-time test to see if the macro INET6 needed to be
defined in order to enable (visibility of) OS support for IPv6, which
was needed on an IRIX system we tested with. That check is retained,
but the revised code is untested on IRIX.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25719 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
| |
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25718 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Notable changes include:
* In the example config files, configure logging in kdc.conf rather
than krb5.conf.
* It is no longer necessary to create a dummy database on slaves
before propagating the master DB with kprop; remove that step from
the instructions.
* The admin keytab file is no longer required or used.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25717 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
| |
ticket: 7074
target_version: 1.10.1
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25716 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
| |
In various labels, correct typos, remove the redundant "_label"
suffix, and avoid overabbreviating.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25715 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
| |
Give each command and config file a reference label, and change many
uses of command names and config file names to be references.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25714 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
| |
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25713 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Without substantially changing the content, reformat RST
documentation sources, normalizing:
* Whitespace: four-space indentation where indentation is arbitrary;
no trailing whitespace or tabs. Two spaces after sentence periods.
* 70-column fill where lines can be wrapped (outside tables, mostly)
* Section header underlines: = for page titles, - for sections, ~ and
then # for subsections. Underlines exactly as long as titles. No
trailing punctuation in titles.
* Bullet lists: * for top-level bullets, - for sub-bullets. No
indentation of the list bullets relative to the surrounding content.
* Inline markup: italics for words representing variable text,
boldface for config keywords and command option names, monospaced
text for examples, pathnames. No adornment for command names and
filenames.
* Man page subcommands: subsection header for the subcommand, indented
command synposis, then non-indented description and option list.
* Man page command synopses: newline in source before each option. All
parts of synopsis at same indentation level. (Ideally we'd want a
hanging indent to the length of the command name, but RST doesn't
seem to support that.)
* Feedback links: in a separate section at the end. (This will need
to be revisited as it affects some multi-level tables of contents.)
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25712 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
|
|
|
| |
Fail during configure time if the configure script can't locate the
"ar" program, instead of producing a delayed failure during build time
by running the "false" command. Some Solaris releases have ar in
/usr/ccs/bin, which is not in the default path for some users.
ticket: 7094
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25711 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- set_string, get_strings, del_string
- rename_principal
- get_privs
- purgekeys
- lock/unlock
- list_requests
- quit
Also, some minor formatting fixes.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25710 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
| |
ticket: 7092
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25706 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
| |
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25705 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
In the kadmin protocol, make the access controls for
get_strings/set_string mirror those of get_principal/modify_principal.
Previously, anyone with global list privileges could get or modify
string attributes on any principal. The impact of this depends on how
generous the kadmind acl is with list permission and whether string
attributes are used in a deployment (nothing in the core code uses
them yet).
CVSSv2 vector: AV:N/AC:M/Au:S/C:P/I:P/A:N/E:H/RL:O/RC:C
ticket: 7093
target_version: 1.10.1
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25704 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
RFC 4120 defines the EncryptedData kvno field as an integer in the
range of unsigned 32-bit numbers. Windows encodes and decodes the
field as a signed 32-bit integer. Historically we do the same in our
encoder in 1.6 and prior, and in our decoder through 1.10. (Actually,
our decoder through 1.10 decoded the value as a long and then cast the
result to unsigned int, so it would accept positive values >= 2^31 on
64-bit platforms but not on 32-bit platforms.)
kvno values that large (or negative) are only likely to appear in the
context of Windows read-only domain controllers. So do what Windows
does instead of what RFC 4120 says.
ticket: 7092
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25703 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
| |
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25702 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
| |
An expression in decode_sequence_of was incorrectly parenthesized,
resulting in addition to a void pointer. Also avoid repeating the
expression.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25701 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
|
|
|
|
| |
GSS functions which accept gss_buffer_t output arguments should
initialize those buffers to empty on startup (see gss_wrap, for
instance). Do so for gss_get_name_attribute in the mechglue.
ticket: 7089
target_version: 1.10.1
tags: pullup
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25700 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
| |
Since we're not yet at the point of having an ASN.1 compiler for our
ASN.1 encoder, create a document explaining how to write macro
invocations for type descriptors from an ASN.1 module.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25699 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
| |
Remove the length field of taginfo, and change the internal ASN.1
encoder interfaces to return length separately from tag info.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25698 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
| |
r25695 left behind a dangling reference to the asn1_make object; get
rid of it.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25697 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
| |
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25696 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
|
|
| |
Get rid of a whole bunch of ASN.1 decoder infrastructure now that
we're using the data-driven decoder for everything. Define taginfo in
asn1_encode.h since asn1_get.h is going away. Rewrite split_der() to
use get_tag() since it still had an unintended dependency on the
previous generation of decoder infrastructure.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25695 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
|
| |
Create a special type to plug authdata types from authdata and make
krb5int_get_authdata_containee_types use it. Add a test case for it
as well. Move krb5_decode_ticket (a trivial wrapper) into
asn1_k_encode.c so that krb5_decode.c is empty.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25694 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Add a general ASN.1 decoder implementation in asn1_encode.c using the
same data structures as the encoder (augmented where necessary), and
use it to define decoder functions in asn1_k_encode.c. Add a boolean
type to atype_info, as it is needed for the pa_pac_req decoder. For
the moment, just #if out the old decoder functions; they and their
support code can be cleaned up later after a a few remaining utility
functions are addressed.
Changes to encoder and decoder interfaces are minimized, but there are
two small ones. ldap_seqof_key_data has a kvno field added, and some
of the decoder logic is pushed up into the caller. The safe_with_body
decoder now outputs an allocated krb5_data * instead of a krb5_data
with aliases into the input buffer.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25693 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
|
|
|
| |
Create a new atype_optional with a function pointer to decide whether
the type is present in the C object. For simple cases, sequences just
reference the optional version of a type. For more complex cases (such
as when the presence of the usec field of a sequence depends on whether
the timestamp is set), we define a predicate on the structure object
and nest the field type inside the optional type.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25692 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
| |
Make style changes in preparation for the table-driven decoder. No
functional changes.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25691 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
| |
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25690 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The PKINIT client code doesn't use decode_krb5_pa_pk_as_rep_draft9,
which is fortunate because it doesn't work (see issue #7072).
Instead, it passes both kinds of PKINIT replies through
decode_krb5_pa_pk_as_rep, then decodes the un-enveloped CMS data in
alternative 1 (encKeyPack) as either an RFC or draft9 ReplyKeyPack.
So, remove the unused broken pa_pk_as_rep_draft9 decoder.
For pa_pk_as_req_draft9, we only use two of the fields on encode and
only one of those on decode. So, get rid of the unused fields and
the krb5_trusted_ca structure, and reduce the encoder and decoder
sequences to the minimum necessary fields.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25689 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
| |
asn1_make.c contained a variety of utility functions, most of which we
no longer needed. Fold make_tag into asn1_encode.c and get rid of
asn1_make.c and asn1_make.h.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25688 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
|
| |
atype_primitive is used for only two types (KerberosTime and
KerberosFlags), which doesn't justify the machinery. Turn those types
into atype_fn types and get rid of atype_primitive.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25687 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
| |
Union fields always have an offset of 0 relative to the union base,
so we just need tag types for them, not DEFFIELDs.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25686 dc483132-0cff-0310-8789-dd5450dbe970
|
|
|
|
|
|
|
| |
Also, if decode_krb5_ap_rep_enc_part doesn't return the expected error
code in krb5_decode_test, exit with nonzero status.
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25685 dc483132-0cff-0310-8789-dd5450dbe970
|