summaryrefslogtreecommitdiffstats
path: root/src/lib/gssapi
Commit message (Collapse)AuthorAgeFilesLines
...
* Add debug mode to gssapi_alloc.hGreg Hudson2012-08-113-23/+79
| | | | | | | | | | Because the gssalloc macros are normally equivalent to malloc and free on Unix, we cannot use the full test suite to find cases where we allocate with malloc and free with gssalloc_free or vice versa. Provide a way to test for this kind of bug (if only in a special build configuration) by supporting a DEBUG_GSSALLOC symbol, which causes the gssalloc wrappers to be deliberately incompatible with malloc and free.
* Remove gss_mechanism_extSimo Sorce2012-08-085-124/+26
| | | | | | | | This function did not serve any useful purpose. Remove it and the special case it creates; move the only function it contained to the main gss_mechanism structure where it belongs. Note that the function name is preserved so that loadable modules are not affected by this change.
* Pass the actual mech oid in creds functionsSimo Sorce2012-08-062-11/+34
| | | | | | This way the mechanism handler knows what mech type is intended. This allows plugin that implement multiple mechanisms or interposer plugins to know what they are being asked to do.
* Always consider desired_mechs empty in spnego (2)Simo Sorce2012-08-061-9/+7
| | | | | | | | Follow previous change to add_cred_from. The only case where the spnego gss_*_cred_* functions can be called with specific OIDs is if the mechglue calls spnego with the spengo oid, which we never want to loop on anyway. So always consider it as null, it's the correct behavior with current semantics.
* Reuse code to free gss_mech_info structureSimo Sorce2012-08-051-21/+4
|
* Always consider desired_mechs empty in spnegoSimo Sorce2012-08-031-18/+4
| | | | | | | The only case where the spnego gss_aquire_cred function can be called with specific OIDs is if the mechglue calls spenego with the spengo oid, which we never want to loop on anyway. So always consider it as null, it's the correct behavior with current semantics.
* Make gss_ctx_id_t truly opaqueSimo Sorce2012-08-035-6/+6
| | | | | | This allows us to still use it for type safety in the APIs while at the same time prevent code from trying to dereference internal_ctx_id by mistake.
* Fix oid set construction in gss_inquire_cred()Kevin Wasserman2012-08-021-22/+10
| | | | | | | | | | | Use gssapi calls to construct the oid sets. It is not safe on windows to use malloc to hand-construct the set and then call gss_release_oid_set() to clean it up. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> ticket: 7227 (new) tags: pullup
* Explain memory allocation policy in oid_ops.cGreg Hudson2012-08-011-0/+7
|
* Implement credential store support in spnegoSimo Sorce2012-07-202-15/+55
|
* Implement credential store support for krb5 mechSimo Sorce2012-07-206-27/+263
|
* Introduce credential store extensionsSimo Sorce2012-07-205-32/+269
| | | | | | | | | Add new APIs gss_acquire_cred_from, gss_add_cred_from, and gss_store_cred_into, which take additional argments to specify the location of the credential storage using a key-value map, where keys are interpreted by the mechanisms. ticket: 7217 (new)
* Use internal release function in oid_ops.cSimo Sorce2012-07-181-1/+1
| | | | | In the end the internal one is called in all cases, but it seem cleaner to use the internal one instead of relying on the redirection.
* In g_oid_ops.c, remove an unneeded declarationSimo Sorce2012-07-181-3/+0
| | | | The code that used it is no longer in this file.
* define USE_HEAPALLOC in gssapi_alloc.hKevin Wasserman2012-07-161-4/+7
| | | | | | | | Easier to disable for testing. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> ticket: 7211 (new)
* __func__ -> __FUNCTION__ in disp_status.cKevin Wasserman2012-07-161-4/+4
| | | | | | | | | For MSVC compatibility Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> ticket: 7208 (new) tags: pullup
* Don't use syslog / LOG_DEBUG when they don't existKevin Wasserman2012-07-161-1/+1
| | | | | | | Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> ticket: 7207 (new) tags: pullup
* Avoid mapping GSSAPI minor code on successGreg Hudson2012-07-081-1/+2
| | | | | | | | | In gssint_import_internal_name, don't map the minor code from mech->gss_duplicate_name if it returned successfully. Fixes an "unexpected non-zero minor status" error reported by SAP's gsstest when it invokes gss_canonicalize_name(). ticket: 7194 (new)
* Comment fall-throughs in iakerb switch statementGreg Hudson2012-07-021-0/+2
|
* Fix minor memory leaks in acquire_cred.cGreg Hudson2012-07-021-4/+4
|
* Add client keytab initiation supportGreg Hudson2012-07-026-223/+395
| | | | | | | | | Support acquiring GSSAPI krb5 credentials by fetching initial credentials using the client keytab. Credentials obtained this way will be stored in the default ccache or collection, and will be refreshed when they are halfway to expiring. ticket: 7189 (new)
* Get default cred only once in gss-krb5 initiatorGreg Hudson2012-07-022-42/+41
| | | | | | | | | | In the regular krb5 code path, only get a default krb5 cred for the initial token, since we don't need the cred for mutual_auth anyway. In the IAKERB mechanism, cache the default cred in iakerb_ctx_id_rec so we don't have to construct it again for each token. Also, get an IAKERB default cred, not a regular krb5 cred (a bug which is harmless now, but becomes more of a problem with keytab initiation changes).
* Rename gss-krb5 cred tgt_expire fieldGreg Hudson2012-06-277-11/+11
| | | | | | | The tgt_expire field is used to store non-TGT expiry times in a couple of cases: when the ccache has no TGT, and after we've obtained a cred for the target service. Rename it to just "expire" to be less misleading.
* Scan ccache more efficiently in gss_acquire_credGreg Hudson2012-06-271-28/+25
| | | | | Avoid rereading the ccache in order to find the impersonator config entry. Instead, check each entry as we scan through the first time.
* Simplify password storage in krb5_gss_cred_id_recGreg Hudson2012-06-275-17/+12
| | | | | The password is always zero-terminated, so we can store it as a char * instead of a krb5_data.
* Simplify acquire_cred.cGreg Hudson2012-06-221-109/+48
| | | | | | struct acquire_cred_args was used purely to pass arguments to acquire_cred (a static function), and had no advantages for that purpose over positional arguments.
* Remove orphaned KfM codeGreg Hudson2012-06-211-63/+2
|
* Fail from gss_acquire_cred if we have no credsGreg Hudson2012-06-151-0/+8
| | | | | | | | If a caller tries to acquire krb5 initiator creds with no desired name and we have no credentials in the cache collection, fail from gss_acquire_cred intead of deferring until gss_init_sec_context. ticket: 7160
* Remove big-endian gss-krb5 supportGreg Hudson2012-06-0810-100/+32
| | | | | | | | The big_endian flag in krb5_gss_ctx_id_rec is there for interoperability with a really ancient implementation which we believe is no longer in use. Get rid of it and the code to handle it. ticket: 7166 (new)
* Fix -DDEBUG compilation errorsHenry B. Hotz2012-06-041-0/+1
| | | | ticket: 7150
* Fail from gss_acquire_cred if we have no keytabGreg Hudson2012-06-031-0/+8
| | | | | | | | If a caller tries to acquire krb5 acceptor creds with no desired name and we have no keytab keys, fail from gss_acquire_cred instead of deferring until gss_accept_sec_context. ticket: 7159 (new)
* Use first mech's status in gss_acquire_credGreg Hudson2012-06-031-3/+11
| | | | | | | | | | | If we can't acquire creds for any mech in gss_acquire_cred, return the status of the first mech instead of the last mech, as it's more useful in the typical case (where the first mech is krb5 and the last mech is SPNEGO). This error reporting is not ideal when the user was expecting to use some mech other than krb5, but it's about as good as things were prior to #6894. ticket: 6973
* Export gss_mech_krb5_wrong from libgssapi_krb5Greg Hudson2012-05-221-0/+1
| | | | | | | | | | Although there are few legitimate reasons to use gss_mech_krb5_wrong, it's declared in the public header and exported in the Windows DLL. So export it from the Unix library as well. ticket: 7148 (new) target_version: 1.10.2 tags: pullup
* Don't stomp minor code in spnego_gss_acquire_credGreg Hudson2012-05-131-3/+3
| | | | | | | When spnego_gss_acquire_cred passes through a failure status from the mechglue, it overwrites the minor code with a call to gss_release_oid_set(). Use a temporary minor status for that and a related call.
* Fix up gssapi_ext.h Doxygen markup somewhatGreg Hudson2012-03-271-8/+10
| | | | | | | | * Bring formatting for gss_userok and gss_authorize_localname into conformance. * Bring parameter markup for gss_localname into conformance. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25790 dc483132-0cff-0310-8789-dd5450dbe970
* Initialize gss_get_name_attribute output buffersGreg Hudson2012-02-141-0/+8
| | | | | | | | | | | | GSS functions which accept gss_buffer_t output arguments should initialize those buffers to empty on startup (see gss_wrap, for instance). Do so for gss_get_name_attribute in the mechglue. ticket: 7089 target_version: 1.10.1 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25700 dc483132-0cff-0310-8789-dd5450dbe970
* Set display_value in krb5_gss_get_name_attributeGreg Hudson2012-02-061-1/+1
| | | | | | | | | | | | | | | | | | | | A backwards conditional in r25358 caused krb5_gss_get_name_attribute not to set display_value on success. Fix the sense of the conditional. We still don't quite correctly handle the cases where data_to_gss() fails, but those should be rare and the problem in those cases isn't severe, so it can be fixed separately. Also, value and display_value should probably be initialized to null buffers on failure, as is common with GSS interfaces. ticket: 7087 status: open target_version: 1.10.1 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25674 dc483132-0cff-0310-8789-dd5450dbe970
* Better short/long descs in gss_display_mech_attrGreg Hudson2012-02-031-1/+34
| | | | | | | | | | | | | | | RFC 5587 defines an "arc name" and a "purpose" for each mechanism attribute. gss_display_mech_attr was returning the purpose (which isn't very short) in short_desc and a null buffer in long_desc (which isn't necessarily conformant to the spec). Instead, output the arc name as the short_desc and the purpose as the long_desc. This is more useful and also more consistent with Heimdal, which outputs the arc name as short_desc and either the purpose string or an empty string for long_desc. ticket: 7085 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25668 dc483132-0cff-0310-8789-dd5450dbe970
* Don't check mech in krb5_gss_inquire_cred_by_mechGreg Hudson2012-01-311-10/+0
| | | | | | | | | | | | | | | krb5_gss_inquire_cred_by_mech checks its mech argument against two of the four mechs a krb5 cred might have (the krb5 mech and the old krb5 mech, but not the wrong Microsoft mech or the IAKERB mech), so would spuriously fail for the other two mechs. There is no reason to check the mechanism if we assume a reasonable mechglue is interpreting application gss_inquire_cred_by_mech calls, so just remove the check. ticket: 7084 target_version: 1.10.1 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25666 dc483132-0cff-0310-8789-dd5450dbe970
* Fix an unlikely memory leak in r25591Greg Hudson2011-12-271-1/+1
| | | | | | ticket: 6936 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25604 dc483132-0cff-0310-8789-dd5450dbe970
* Do mech fallback for first SPNEGO context tokenGreg Hudson2011-12-161-8/+37
| | | | | | | | | | | | | | | | When producing the first SPNEGO security context token, if the first mechanism's init_sec_context fails, fall back to a later mechanism. This fixes a regression in 1.10 for SPNEGO initiators using non-krb5 credentials. The identity selection work causes errors to be deferred from krb5's acquire_cred in some cases, which means SPNEGO doesn't see an error until it tries the krb5 init_sec_context. ticket: 6936 target_version: 1.10 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25591 dc483132-0cff-0310-8789-dd5450dbe970
* Verify acceptor's mech in SPNEGO initiatorGreg Hudson2011-12-162-78/+44
| | | | | | | | | | | | | | In spnego_gss_ctx_id_rec, store the set of negotiable mechanisms as well as the currently selected internal_mech, which becomes an alias into mech_set. In init_ctx_reselect, locate the acceptor's counter- proposal in sc->mech_set and consider the token defective if it is not found. ticket: 7053 target_version: 1.10 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25590 dc483132-0cff-0310-8789-dd5450dbe970
* Allow S4U2Proxy service tickets to be cachedGreg Hudson2011-12-071-3/+1
| | | | | | | | | | Previous to this change, the GSS code avoids caching S4U2Proxy results for fear of the memory cache growing without bound, but that seems unlikely to be a serious problem. Allow these to be cached. ticket: 7047 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25530 dc483132-0cff-0310-8789-dd5450dbe970
* Allow S4U2Proxy delegated credentials to be savedGreg Hudson2011-12-077-31/+86
| | | | | | | | | | | | | | | The initial implementation of client-side S4U2Proxy support did not allow delegated proxy credentials to be stored (gss_store_cred would error out, and gss_krb5_copy_ccache would generate a non-working cache). To make this work, we save the impersonator name in a cache config variable and in a cred structure field (replacing the proxy_cred flag), and make the default principal of the proxy cache the subject principal as the caller would expect for a regular delegated cred. ticket: 7046 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25529 dc483132-0cff-0310-8789-dd5450dbe970
* Recognize IAKERB mech in krb5_gss_display_statusGreg Hudson2011-11-211-1/+2
| | | | | | | | | | | | Minor status codes were not displaying properly when originated from the IAKERB mech, because of a safety check on mech_type. From Ralf Haferkamp <rhafer@suse.de>. ticket: 7020 target_version: 1.10 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25482 dc483132-0cff-0310-8789-dd5450dbe970
* Clean up more stuff in make cleanGreg Hudson2011-11-041-1/+1
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25437 dc483132-0cff-0310-8789-dd5450dbe970
* Make reindentTom Yu2011-10-175-6/+6
| | | | | | | Also fix pkinit_crypto_nss.c struct initializers and add parens to a ternary operator in do_as_req.c for better indentation. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25362 dc483132-0cff-0310-8789-dd5450dbe970
* Style policeGreg Hudson2011-10-171-2/+1
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25359 dc483132-0cff-0310-8789-dd5450dbe970
* gssalloc-related fixes to naming_exts.cSam Hartman2011-10-171-28/+31
| | | | | | | | | | | | | renamed kg_data_list_to_buffer_set_nocopy to data_list_buffer_set (since nocopy is no longer guaranteed). removed extra indirection to input krb5_data list. ensured input krb5_data list is always completely freed. no longer returns EINVAL when output buffer set is NULL. fixed krb5_gss_get_name_attribute to use data_to_gss. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25358 dc483132-0cff-0310-8789-dd5450dbe970
* make dependTom Yu2011-10-144-486/+508
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25344 dc483132-0cff-0310-8789-dd5450dbe970
generated by cgit (git 2.34.1) at 2025-09-26 15:10:36 +0000