summaryrefslogtreecommitdiffstats
path: root/src/include
Commit message (Collapse)AuthorAgeFilesLines
...
* Clarify and improve k5_json_object_setGreg Hudson2013-07-161-1/+5
| | | | | Document that k5_json_object_set can be used to overwrite an existing key, and make it possible to remove a key by setting it to NULL.
* Add k5calloc internal helper functionGreg Hudson2013-07-111-2/+9
| | | | | | Letting calloc() do multiplication helps avoid overflow bugs, so provide an internal k5calloc() helper which accepts both calloc arguments, and reimplement k5alloc() in terms of it.
* Add libkradNathaniel McCallum2013-07-112-0/+265
| | | | | | | | The new library libkrad provides code for the parsing of RADIUS packets as well as client implementation based around libverto. This library should be considered unstable. ticket: 7678 (new)
* Install localauth_plugin.hGreg Hudson2013-07-011-0/+1
| | | | | The localauth pluggable interface was added on master in February, but we neglected to install its header file.
* Install ccselect_plugin.hGreg Hudson2013-07-011-0/+1
| | | | | | | | | The ccselect pluggable interface was added in release 1.10, but we neglected to install its header file. ticket: 7671 (new) target_version: 1.11.4 tags: pullup
* Provide plugin module ordering guaranteesGreg Hudson2013-06-271-12/+2
| | | | | | | | Rewrite the plugin internals so that modules have a well-defined order--either the order of enable_only tags, or dynamic modules followed by the built-in modules in order of registration. ticket: 7665 (new)
* Build with Visual Studio 2012Ben Kaduk2013-06-251-1/+3
| | | | | | | | | | | | It's more aggressive about enforcing that keywords are not macros in C++ mode, and has bumped the MFC version to 11. Keep compatibility with older versions of Visual Studio, appropriately conditionalized. ticket: 7664 (new) tags: pullup target_version: 1.11.4
* Fix various warningsGreg Hudson2013-06-071-5/+4
|
* Clarify krb5_rd_req documentationGreg Hudson2013-05-221-9/+19
| | | | | | | | | | For the user-to-user case, document that callers should pass a server principal to krb5_rd_req. For the keytab case, more accurately document which keytab keys are tried against the ticket. ticket: 7641 (new) target_version: 1.11.3 tags: pullup
* Assume mutex locking cannot failGreg Hudson2013-05-141-14/+10
| | | | | | | | | | | | Locking and unlocking a non-recursive mutex is a simple memory operation and should not fail on any reasonable platform with correct usage. A pthread mutex can return EDEADLK on lock or EPERM on unlock, or EINVAL if the mutex is uninitialized, but all of these conditions would reflect serious bugs in the calling code. Change the k5_mutex_lock and k5_mutex_unlock wrappers to return void and adjust all call sites. Propagate this change through k5_cc_mutex_lock and k5_cc_mutex_unlock as well.
* Add kdcpreauth callback to check for client keysGreg Hudson2013-05-031-0/+8
| | | | | | | | Add a new have_client_keys callback to the kdcpreauth interface, allowing modules to efficiently check whether the client DB entry has any keys matching the request enctypes. ticket: 7630
* Add internal KDC_DIR macroGreg Hudson2013-04-291-10/+11
| | | | | Define KDC_DIR in osconf.hin and use it for paths within the KDC directory.
* Add a few comments to `PADATA types` in krb5.hinZhanna Tsitkov2013-04-181-27/+28
| | | | | Mostly, based on http://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xml
* Use macro for IANA assigned PA-AS-CHECKSUM numberZhanna Tsitkov2013-04-181-0/+1
| | | | | Replace numeric value '132' by the macro KRB5_PADATA_AS_CHECKSUM in preauth plugin.
* Get rid of cm.c and cm.hGreg Hudson2013-04-122-104/+0
| | | | | | | | | | | Since net-server.c now uses libverto, only sendto_kdc.c consumes cm.c. Move stuff out of cm.c and cm.h into sendto_kdc.c and get rid of them. Change the sendto_kdc callback (used by chpw.c) to receive the socket descriptor instead of the entire conn_state structure, and move the declarations into os-proto.h. struct remote_address also needs to be in os-proto.h so that trace.c and t_trace.c can use it. k5_curtime isn't needed since k5-platform.h now guarantees the presence of gettimeofday().
* Trace log with a subset of struct conn_stateGreg Hudson2013-04-122-31/+34
| | | | | | | In struct conn_state, collect together the fields for the remote address and put them in a substructure. Pass this substructure to trace logging macros instead of the entire conn_state structure, so that trace.c doesn't have to know about the whole structure.
* Update hst_realm.c coding styleGreg Hudson2013-04-091-10/+0
| | | | | Bring this file up to date with current coding style. No functional changes, except some trace logs were removed.
* Avoid passing null pointers to memcpy/memcmpGreg Hudson2013-04-081-7/+8
| | | | | | | | | | | | | | | By a strict reading of the C standard, memcpy and memcmp have undefined behavior if their pointer arguments aren't valid object pointers, even if the length argument is 0. Compilers are becoming more aggressive about breaking code with undefined behavior, so we should try to avoid it when possible. In a krb5_data object, we frequently use NULL as the data value when the length is 0. Accordingly, we should avoid copying from or comparing the data field of a length-0 krb5_data object. Add checks to our wrapper functions (like data_eq and k5_memdup) and to code which works with possibly-empty krb5_data objects. In a few places, use wrapper functions to simplify the code rather than adding checks.
* Add krb5_kt_dup API and use it in two placesGreg Hudson2013-04-011-0/+15
| | | | | | | Add an API to duplicate keytab handles, mirroring krb5_cc_dup. Use it to simplify the krb5 GSS acquire_cred code. ticket: 7599 (new)
* Get rid of krb5_xfreeGreg Hudson2013-03-281-3/+0
|
* Replace "First introduced" with concise "New"Zhanna Tsitkov2013-03-251-37/+37
|
* Move a bunch of stuff out of k5-int.hGreg Hudson2013-03-241-371/+0
| | | | | | | | | Move internal declarations from k5-int.h to more localized headers (like int-proto.h) where appropriate. Rename many symbols whose prototypes were moved to use the k5_ prefix instead of krb5int_. Remove some unused declarations or move them to the single source file they were needed in. Remove krb5_creds_compare since it isn't used any more.
* Get rid of krb5_{get,free}_krbhstGreg Hudson2013-03-221-2/+0
| | | | | These functions were always internal. They haven't been used since v5passwdd was eliminated in krb5 1.4.
* Get rid of osconfig.cGreg Hudson2013-03-221-3/+0
| | | | | These variables were marked as internal in 1996. Two are unused and the other is easily replaced with the macro it is initialized from.
* Remove stray include in localauth_plugin.hGreg Hudson2013-03-111-1/+0
| | | | | This unnecessary include was causing build failures on some systems by making libkrb5 sources depend on gssapi.h.
* Add localauth pluggable interfaceGreg Hudson2013-03-093-1/+153
| | | | | | | | Add a new pluggable interface for local authorization, and replace the existing krb5_aname_to_localname and krb5_kuserok implementations with implementations based on the pluggable interface. ticket: 7583 (new)
* Add krb5_free_enctypes APIGreg Hudson2013-02-272-2/+13
| | | | | | | Rename krb5_free_ktypes to krb5_free_enctypes and add it to the public API. ticket: 7584
* Fix windows buildBen Kaduk2013-02-252-2/+2
| | | | | | | | | | Catch up to the split of preauth_plugin.h into client and kdc specific portions. While here, use copy's /y flag to suppress an override-confirmation prompt (though we do not list any dependencies for this target at the moment, so no such prompt will be generated). Do not disable library finalizers for windows, erroneously disabled in 4538146e1452e0966164119cefb0804993ce6bbb.
* Modernize k5bufGreg Hudson2013-02-141-39/+36
| | | | | | Rename the krb5int_buf_ family of functions to use the k5_ prefix for brevity. Reformat some k5buf implementation code to match current practices.
* Add k5_json_array_fmt and use it in export_cred.cGreg Hudson2013-02-131-0/+18
| | | | | | Add a template-based array constructor for convenient marshalling of structured values as JSON array values. Use it to simplify export_cred.c.
* Make internal JSON functions return error codesGreg Hudson2013-02-131-17/+19
| | | | | | | | | Return error codes (0, ENOMEM, or EINVAL) from JSON support functions instead of returning results directly. This makes error handling simpler for functions which assemble JSON objects and then return a krb5_error_code values. Adjust all callers. Use shims in export_cred.c to minimize changes there; it will be redesigned internally in a subsequent commit.
* Add and use k5memdup, k5memdup0 helpersGreg Hudson2013-02-091-0/+22
| | | | | | Add k5-int.h static functions to duplicate byte ranges, optionally with a trailing zero byte, and set an error code like k5alloc does. Use them where they would shorten existing code.
* Fix iprop log reinitializationGreg Hudson2013-01-221-0/+1
| | | | | | | | | | | | | | | | If the master iprop log is reinitialized to serial number 0, slaves will need to take a full dump--but after that happens, we need to know whether the slave has taken that full dump, we we don't offering full dumps indefinitely. So, record a timestamp in kdb_last_time when we reinitialize the log header, and compare the slave timestamp to kdb_last_time whenever it has the current serial number, even if it's 0. Test this by performing a propagation with sno 0 in t_iprop.py and detecting whether kpropd gets a second UPDATE_FULL_RESYNC_NEEDED response from kadmind. ticket: 7550 (new)
* Get rid of krb5_read_realm_paramsGreg Hudson2013-01-161-9/+0
| | | | | | | Read realm parameters directly from the profile in the KDC's init_realm(), getting rid of the intermediate krb5_realm_params structure. Then get rid of krb5_realm_params and krb5_read_realm_params, since nothing else uses it.
* Correct typo in krb5_responder_context_st descrZhanna Tsitkov2013-01-141-3/+4
| | | | responder_get_challenge() meant to be krb5_responder_get_challenge()
* Flesh out responder context doxygen markupGreg Hudson2013-01-111-0/+30
|
* Use [out] more sparingly in doxygen markupGreg Hudson2013-01-111-107/+107
| | | | | | | | | In krb5.hin doxygen markup, only use [out] or [in,out] when a function changes the entire value of what the parameter points to, not when the function mutates a larger object (especially an abstract object). Also remove a couple of incorrect [in] annotations, change a few parameter descriptions to be more consistent, and fix one typo.
* Better doxygen markup for RESPONDER_QUESTION_OTPZhanna Tsitkov2013-01-111-21/+23
| | | | | | Doxygen and, consequently, Sphinx gets confused with the KRB5_RESPONDER_QUESTION_OTP comment layout. Also, mark the output parameter of krb5_responder_set_answer().
* Simplify KDC host referral codeGreg Hudson2013-01-112-2/+0
| | | | | | | | | | | Remove some unnecessary optimizations to reduce code complexity. Get rid of krb5_match_config_pattern in favor of a simpler helper function in do_tgs_req_c. Get rid of KRB5_CONF_ASTERISK and just use "*" instead. Use a helper function to combine [kdcdefaults] and realm subsection values of variables, and don't bother adding leading and trailing spaces. Consistently use the names "hostbased" and "no_referral" to refer to variable values (with a "realm_" prefix for structures which currently use it).
* Get rid of adm.hGreg Hudson2013-01-102-231/+2
| | | | | | adm.h predates the ovsec kadm5 integration. It contains a bunch of obsolete defines and a redundant definition of krb5_realm_params. Get rid of it, and include <kadm5/admin.h> where we currently include it.
* Allow principals to refer to nonexistent policiesGreg Hudson2013-01-091-1/+1
| | | | | | | | | | | | | | Stop using and maintaining the policy_refcnt field, and do not try to prevent deletion of a policy which is still referenced by principals. Instead, allow principals to refer to policy names which do not exist as policy objects; treat those principals as having no associated policy. In the kadmin client, warn if addprinc or modprinc tries to reference a policy which doesn't exist, since the server will no longer error out in this case. ticket: 7385
* Rename ccache configuration macrosZhanna Tsitkov2013-01-091-5/+5
| | | | | KRB5_CONF_ prefix should be used for the krb5/kdc.conf parameters. Use KRB5_CC_CONF_ prefix for cache configuration variables.
* Get rid of KRB5_KDB_SRV_TYPE_PASSWDGreg Hudson2012-12-202-4/+1
| | | | | | Nothing was using KRB5_KDB_SRV_TYPE_PASSWD, so get rid of it. (kpasswdd is part of kadmind and interacts with the KDB using KRB5_KDB_SRV_TYPE_ADMIN.)
* Rename internal preauth functionsGreg Hudson2012-12-191-27/+0
| | | | | | | | | | | | The preauth functions are internal to libkrb5, so use the k5_ prefix, don't use KRB5_CALLCONV, and prototype them in int-proto.h. Also remove krb5_do_preauth from the Unix libkrb5 export list. Reorder the k5_preauth() and k5_preauth_tryagain() arguments for more consistency with the clpreauth interface, and put the output padata arguments at the end. Rename any remaining uses of "kcontext" to "context" in preauth2.c.
* Make clpreauth flags function optionalGreg Hudson2012-12-191-3/+5
| | | | | | | | With one exception (KRB5_PADATA_PKINIT_KX), every padata type processed by a clpreauth module is now a real preauthentication type. Reduce the amount of boilerplate required for a clpreauth module by making the flags method optional if all of the preauth types advertised by the module are real.
* Use a proper consumer interface for clpreauthGreg Hudson2012-12-191-3/+6
| | | | | | | | In preauth2.c, use wrapper functions for calls to clpreauth functions. Get rid of the expanded-out module table, instead using a helper function to find the handle for a preauth type. Replace use counts with a list of previously processed pa types. Check for pa type conflicts when loading clpreauth modules.
* Separate clpreauth and kdcpreauth interfacesGreg Hudson2012-12-195-599/+682
| | | | | | | Since there is no overlap between the clpreauth and kdcpreauth interface declarations, there's no particular reason to combine them into one header. For backward compatibility and convenience, leave behind a preauth_plugin.h which includes both.
* Add functions to save and restore error stateGreg Hudson2012-12-191-0/+1
|
* Simplify error message retrievalGreg Hudson2012-12-191-1/+0
| | | | | | Eliminate the scratch_buf field of struct error_info and just return a non-localized constant error message if we can't allocate a copy of the real one. Also rely on a conformant strerror().
* Style cleanup for internal error handlingGreg Hudson2012-12-191-25/+17
| | | | | | | Fix style issues in kerrs.c and errors.c. Rename error handling functions to use shorter k5_ prefix. Eliminate an inoperable krb5int_set_error() call in gic_opte_alloc and convert the other call to use krb5_set_error_message().
generated by cgit (git 2.34.1) at 2025-09-28 11:39:37 +0000