summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Modernize style of kdb_log.cGreg Hudson2013-01-221-460/+292
| | | | | ulog_get_entries had an unreachable branch which was removed during de-indentation.
* Clean up iprop flow control in kdb5.cGreg Hudson2013-01-181-53/+42
| | | | | | | | | | | Add a helper predicate to determine whether to log operations. In the predicate, check if the ulog is actually mapped. Use a single cleanup label in krb5_db_put_principal. Use a cleanup label in krb5_db_delete_principal instead of releasing resources individually at each exit point. Avoid locking and unlocking the ulog if we're not logging (although it would be a no-op). Based on a patch from Nico Williams <nico@cryptonector.com>.
* Fix iprop safety net in kdb5_util loadGreg Hudson2013-01-171-2/+4
| | | | | | | | | The error message was missing a newline, and the exit behavior causes the database to be destroyed. ticket: 7370 target_version: 1.11.1 tags: pullup
* Revert previous ("Sphinx doc: consolidate...")Tom Yu2013-01-162-14/+13
| | | | | | | | This reverts commit 87634edc472cebde4a37d002b7006ed38a1b25c2. That commit is not neutral with respect to the rendering of the HTML, and causes the version built with the logo to look unacceptably disordered.
* Sphinx doc: consolidate style markup in kerb.cssZhanna Tsitkov2013-01-162-13/+14
|
* Get rid of krb5_read_realm_paramsGreg Hudson2013-01-166-251/+63
| | | | | | | Read realm parameters directly from the profile in the KDC's init_realm(), getting rid of the intermediate krb5_realm_params structure. Then get rid of krb5_realm_params and krb5_read_realm_params, since nothing else uses it.
* Remove KDC macros for realm config fieldsGreg Hudson2013-01-154-15/+9
| | | | | | Stop using macros to refer to kdc_realm_t fields, as they could conflict with structure field names for the same. Leave behind the kdc_context and tgs_server macros for now.
* Remove unused krb5_realm_params fieldsGreg Hudson2013-01-154-79/+1
| | | | | | | krb5_realm_params is only consumed by the KDC (everything else uses kadm5_config_params), so only needs to contain fields used by the KDC. Get rid of everything else. Also get rid of realm_profile, which is read in by KDC code but never used (and was never set anyway).
* Help Sphinx to diff C-types for better x-referenceZhanna Tsitkov2013-01-141-0/+4
| | | | | | In some cases Doxygen xml output does not provide accurate classification of the various C-types, thus preventing the full documentation x-referencing. Give some hints to the Doxy/RST bridge.
* Correct typo in krb5_responder_context_st descrZhanna Tsitkov2013-01-141-3/+4
| | | | responder_get_challenge() meant to be krb5_responder_get_challenge()
* Clean up style of alt_prof.cGreg Hudson2013-01-121-417/+354
| | | | | | Get rid of K&R-style function headers, format code and comments consistently according to current conventions, rename some variables using idiomatic names, and de-indent some nested control blocks.
* Flesh out responder context doxygen markupGreg Hudson2013-01-113-1/+32
|
* Use [out] more sparingly in doxygen markupGreg Hudson2013-01-111-107/+107
| | | | | | | | | In krb5.hin doxygen markup, only use [out] or [in,out] when a function changes the entire value of what the parameter points to, not when the function mutates a larger object (especially an abstract object). Also remove a couple of incorrect [in] annotations, change a few parameter descriptions to be more consistent, and fix one typo.
* Modify rst toolkit to handle "linebreak" tagZhanna Tsitkov2013-01-111-0/+3
|
* Better doxygen markup for RESPONDER_QUESTION_OTPZhanna Tsitkov2013-01-111-21/+23
| | | | | | Doxygen and, consequently, Sphinx gets confused with the KRB5_RESPONDER_QUESTION_OTP comment layout. Also, mark the output parameter of krb5_responder_set_answer().
* Fix label conflicts in Sphinx documentationZhanna Tsitkov2013-01-115-8/+8
|
* Update copyright year in prototype sourcesBen Kaduk2013-01-112-2/+2
|
* Simplify KDC host referral codeGreg Hudson2013-01-118-157/+77
| | | | | | | | | | | Remove some unnecessary optimizations to reduce code complexity. Get rid of krb5_match_config_pattern in favor of a simpler helper function in do_tgs_req_c. Get rid of KRB5_CONF_ASTERISK and just use "*" instead. Use a helper function to combine [kdcdefaults] and realm subsection values of variables, and don't bother adding leading and trailing spaces. Consistently use the names "hostbased" and "no_referral" to refer to variable values (with a "realm_" prefix for structures which currently use it).
* Test multi-value host referral variablesGreg Hudson2013-01-111-5/+5
| | | | | | host_based_services and no_host_referral are allowed to have multiple relations in each place they appear, so alter a couple of the test cases to exercise that.
* Remove manual kdc_realm testsGreg Hudson2013-01-1119-720/+0
|
* Test KDC host-based referral supportGreg Hudson2013-01-114-11/+234
| | | | | | | Test the KDC host-based referral support in t_referral.py, using a new harness to call krb5_get_credentials with a specified server name type. Also use this new harness for the #7483 regression test, to avoid relying on an undocumented kvno extension.
* Add k5test support for KDC special environmentsGreg Hudson2013-01-111-11/+15
| | | | | | Accept environment parameters in the K5Realm start_kdc and start_kadmind methods, so that krb5kdc or kadmind can be started or restarted with a modified configuration.
* Clean up k5_locate_server error handlingGreg Hudson2013-01-111-25/+10
| | | | | | | | | | | profile_get_values() cannot return success with an empty list of values, so don't bother counting them. Return 0 from locate_srv_conf_1 if no profile values exist and from dns_locate_server if we decide not to make a SRV query. Adjust k5_locate_server to match the new helper behavior, and return KRB5_REALM_UNKNOWN if neither profile nor DNS come up with any answers (not KRB5_REALM_CANT_RESOLVE, which doesn't make sense now that we're deferring KDC hostname resolution).
* Fix no_host_referral concatention in KDCGreg Hudson2013-01-111-6/+7
| | | | | | | | | | | | | If no_host_referral is set in both [kdcdefaults] and the realm subsection, we're supposed to concatenate their values. But the logic in handle_referral_params would overwrite the value with the non-concatenated realm value. Similar bugs of this nature were fixed in 639c9d0f5a7c68dc98a2a452abc05ca32443cddf (r22037) but this one was missed. ticket: 7539 (new) target_version: 1.11.1 tags: pullup
* Update the Copyright year to 2012-2013Zhanna Tsitkov2013-01-111-1/+1
|
* Get rid of adm.hGreg Hudson2013-01-106-243/+35
| | | | | | adm.h predates the ovsec kadm5 integration. It contains a bunch of obsolete defines and a redundant definition of krb5_realm_params. Get rid of it, and include <kadm5/admin.h> where we currently include it.
* Reconfigure MIT Kerb Features doc: dont use tablesZhanna Tsitkov2013-01-107-96/+100
| | | | Also, update references to the existing documents.
* make dependGreg Hudson2013-01-1077-582/+696
| | | | | Mostly this gets rid of the trailing space on line 2 after bb76891f5386526bdf91bc790c614fc9296cb5fa.
* Fold kadm5 internal policy functions into callersGreg Hudson2013-01-099-190/+9
| | | | | | | | | kadm5_create_policy and kadm5_modify_policy had _internal variants in libkadm5srv (but not libkadm5clnt) which only existed to protect the policy_refcnt field from modification over the wire. Now that policy_refcnt is no longer used, we don't need the separation. Bump the library soname since this is technically an ABI change.
* Test more policy featuresGreg Hudson2013-01-091-0/+77
| | | | | | Add tests to t_policy.py for password quality enforcement, password history (apart from the existing #7099 regression test), and for references to nonexistent policies.
* Consolidate policy tests into t_policy.pyGreg Hudson2013-01-094-77/+48
| | | | | Create a combined script for policy-related tests, and fold in the existing lockout, password history, and allowed-keysalts tests.
* Allow principals to refer to nonexistent policiesGreg Hudson2013-01-0913-664/+125
| | | | | | | | | | | | | | Stop using and maintaining the policy_refcnt field, and do not try to prevent deletion of a policy which is still referenced by principals. Instead, allow principals to refer to policy names which do not exist as policy objects; treat those principals as having no associated policy. In the kadmin client, warn if addprinc or modprinc tries to reference a policy which doesn't exist, since the server will no longer error out in this case. ticket: 7385
* Stop loading policy for pw_expiration in LDAPGreg Hudson2013-01-091-24/+0
| | | | | | | | | | | populate_krb5_db_entry() performs a subsidiary LDAP search to load the password policy, which it uses to update the pw_expiration field. This has some minimal value (it causes pw_expiration values in principals to auto-update whenever the pw_max_life field of a policy changes), but it's complicated, expensive, and inconsistent with the DB2 back end. Get rid of it. ticket: 7535 (new)
* Rename ccache configuration macrosZhanna Tsitkov2013-01-096-21/+21
| | | | | KRB5_CONF_ prefix should be used for the krb5/kdc.conf parameters. Use KRB5_CC_CONF_ prefix for cache configuration variables.
* Update release numbers, refs in feature list docZhanna Tsitkov2013-01-091-3/+3
| | | | | | At the moment the latest release number is 1.11 and the supported releases are 1.10 and 1.9. Also, update some references to the documents and fix typos.
* In MIT feature list doc update release number,refsZhanna Tsitkov2013-01-091-7/+8
|
* Error on void pointer arithmetic with gccGreg Hudson2013-01-091-1/+1
| | | | | | Add -Werror=pointer-arith to the gcc warning flags. The equivalent was added to the Solaris compiler flags in 2dc1ef4078acd7ca463a8eee2ef20de54e672f37 (r21886).
* Fix void pointer arithmetic in oid_ops.cGreg Hudson2013-01-091-1/+1
| | | | | | | | When asserting that out has advanced the expected number of bytes in generic_gss_str_to_oid, avoid adding to oid->elements, which is a void pointer. Instead subtract from out and compare. ticket: 7524
* Document "first introduced version" in conf filesZhanna Tsitkov2013-01-072-6/+10
| | | | | For the config options that were introduced starting from release 1.9, specify the release number.
* Fix various result checksNickolai Zeldovich2013-01-073-3/+3
| | | | | | | | | | | Correct three cases where the wrong expression was checked to see if an allocation function returned null. [ghudson@mit.edu: commit message, patch splitting] ticket: 7534 target_version: 1.11.1 tags: pullup
* Fix initial call to svcraw_createNickolai Zeldovich2013-01-071-0/+1
| | | | | | | | | gssrpc raw services could not work because svcraw_create did not set svcraw_private after allocating memory for it. [ghudson@mit.edu: commit message, patch splitting] ticket: 7534
* Install pkg-config data filesGreg Hudson2013-01-0412-4/+130
| | | | | | | | | | | Add seven data files for pkg-config, corresponding to the five modules supported by krb5-config. For krb5 and krb5-gssapi, we also provide mit- versions for callers desiring to distinguish between our implementation and Heimdal's. Based on a patch from Stef Walter <stefw@gnome.org>. ticket: 7529 (new)
* Move krb5-config to new src/build-tools directoryGreg Hudson2013-01-047-21/+25
| | | | | | In preparation for adding a bunch of pkg-config data files, move krb5-config into a new source tree subdirectory containing tools we provide as outputs to other build systems.
* Fix gss_str_to_oid and gss_oid_to_str edge casesGreg Hudson2013-01-014-127/+350
| | | | | | | | | | | | | Neither function correctly handled OIDs whose second arc exceeds 47 (theoretically possible if the first arc is 2). gss_str_to_oid had additional problems: it used scanf, it didn't consistently protect against read overrun if the input buffer wasn't null-terminated, and it could get confused by + or - characters in the first two arcs. Fix gss_oid_to_str and rewrite gss_str_to_oid. Also add a test program. ticket: 7524 (new)
* Fix a small memory leak in util_errmapGreg Hudson2013-01-011-12/+9
| | | | | | | | | | | Calls to gssint_mecherrmap_map_errcode would result in calling mecherror_copy with a zero-length mech OID, which would result in an OID with 0 for length and malloc(0) for elements. On platforms which return non-null from malloc(0), gssint_mecherrmap_destroy() wouldn't free the elements pointer. Avoid calling malloc(0) and don't use the length field to decide whether to free an elements pointer.
* Fix gss_str_to_oid for OIDs with zero-valued arcsLuke Howard2013-01-011-6/+6
| | | | | | | | | | | gss_str_to_oid wasn't outputting any bytes for a zero-valued arc. It should output one byte with value 0. [ghudson@mit.edu: commit message] ticket: 7523 (new) target_version: 1.11.1 tags: pullup
* Fix DPRINT in ipropd_svc.cGuillaume Rousse2013-01-011-1/+1
| | | | | | | | | | | cea0b28045b262b1098f17f17f78b2efbf89a6c1 contained an incorrect definition of DPRINT. Fix it. [ghudson@mit.edu: commit message] ticket: 7525 (new) target_version: 1.11.1 tags: pullup
* Delete timestamp_to_sfstring sprintf fallbackTom Yu2012-12-221-9/+0
| | | | | | | | | | | The final fallback for krb5_timestamp_to_sfstring() is an explicit European date-order format string passed to sprintf(). This can be confused with a conventional US date format. Because we attempt to build a strftime() replacement anyway, and we try passing some unambiguous ISO 8601 date and time formats to strftime(), remove this final fallback. ticket: 7518 (new)
* Add more formats to krb5_timestamp_to_sfstringTom Yu2012-12-221-1/+6
| | | | | | | | | | | | | krb5_timestamp_to_string() can produce ambiguous dates. The final fallback, "%d/%m/%Y %R", contains a European order date format that can be confused with a US date format. Add some additional strftime() format strings, including locale-dependent formats and some ISO 8601 formats. Remove the hardcoded strftime() format that had an ambiguous date order. ticket: 7458 target_version: 1.11 tags: pullup
* Use krb5_init_creds_context as clpreauth rockGreg Hudson2012-12-225-234/+160
| | | | | | | | | | | | | | The clpreauth rock had become a collection of alias pointers into the init_creds context structure. Get rid of it and just pass the context (suitably casted) to clpreauth modules. Simplify the signatures of k5_preauth(), k5_preauth_tryagain(), process_pa_data(), and fill_response_items() by referencing fields from the init_creds context. Since we can't use the non-nullity of rock->selected_preauth_type to determine whether to record the selected preauth type, k5_preauth now reports it in an output parameter, and get_in_tkt.c decides whether or not to record it.
generated by cgit (git 2.34.1) at 2025-09-28 12:45:51 +0000