summaryrefslogtreecommitdiffstats
path: root/src/lib/krb5
Commit message (Collapse)AuthorAgeFilesLines
* make dependGreg Hudson2013-03-248-739/+642
|
* Move a bunch of stuff out of k5-int.hGreg Hudson2013-03-2454-342/+453
| | | | | | | | | Move internal declarations from k5-int.h to more localized headers (like int-proto.h) where appropriate. Rename many symbols whose prototypes were moved to use the k5_ prefix instead of krb5int_. Remove some unused declarations or move them to the single source file they were needed in. Remove krb5_creds_compare since it isn't used any more.
* Get rid of krb5_{get,free}_krbhstGreg Hudson2013-03-227-210/+9
| | | | | These functions were always internal. They haven't been used since v5passwdd was eliminated in krb5 1.4.
* Get rid of osconfig.cGreg Hudson2013-03-225-50/+2
| | | | | These variables were marked as internal in 1996. Two are unused and the other is easily replaced with the macro it is initialized from.
* Fix use-before-init in two test programsGreg Hudson2013-03-152-2/+2
| | | | | | If krb5_init_context fails, use a null context for getting the error message, not a context we haven't yet initialized. Observed by David Benjamin <davidben@mit.edu> using clang.
* Remove stray include in localauth_plugin.hGreg Hudson2013-03-111-75/+35
| | | | | This unnecessary include was causing build failures on some systems by making libkrb5 sources depend on gssapi.h.
* Add localauth pluggable interfaceGreg Hudson2013-03-0911-1068/+1273
| | | | | | | | Add a new pluggable interface for local authorization, and replace the existing krb5_aname_to_localname and krb5_kuserok implementations with implementations based on the pluggable interface. ticket: 7583 (new)
* Simplify and clarify lookup_etypes_for_keytabGreg Hudson2013-03-011-27/+21
|
* Fix a memory leak in krb5_get_init_creds_keytabGreg Hudson2013-02-281-3/+11
| | | | | | | | | lookup_etypes_for_keytab was not freeing the keytab entries it iterated over. Reported by nalin@redhat.com. ticket: 7586 target_version: 1.11.2 tags: pullup
* Add krb5_free_enctypes APIGreg Hudson2013-02-273-5/+5
| | | | | | | Rename krb5_free_ktypes to krb5_free_enctypes and add it to the public API. ticket: 7584
* Add missing .gitignore entries and clean rulesGreg Hudson2013-02-272-1/+4
| | | | ticket: 7585
* Fix fd leak in DIR ccache cursor functionGreg Hudson2013-02-211-1/+1
| | | | | | | | | | If dcc_ptcursor_next reached the end of a directory, it called free() on the directory handle instead of closedir(), causing the directory fd to be leaked. Call closedir() instead. ticket: 7573 target_version: 1.11.1 tags: pullup
* Fix memory leak closing DIR ccachesGreg Hudson2013-02-201-0/+1
| | | | | | | | | | | A ccache type's close function is supposed to free the cache container as well as the type-specific data. dcc_close was not doing so, causing a small memory leak each time a ccache is created or destroyed. ticket: 7574 (new) target_version: 1.11.1 tags: pullup
* Allow multi-hop SAM-2 exchangesGreg Hudson2013-02-191-0/+5
| | | | | | | | | | | | Prior to 1.11, it was possible to do SAM-2 preauth exchanges with multiple hops by sending repeated preauth-required errors with different challenges (which is not the way multi-hop exchanges are described in RFC 6113, but it can still work). This stopped working when SAM-2 was converted to a built-in module. Make it work again. ticket: 7571 (new) target_version: 1.11.1 tags: pullup
* Convert success in krb5_chpw_result_code_stringJonathan Reams2013-02-151-0/+3
| | | | | | | | | | | | | | | Result code 0 used to be converted properly by krb5_set_password, though not krb5_change_password; this changed in 1.10 when krb5int_setpw_result_code_string was folded into krb5_chpw_result_code_string. Restore the old behavior, and make it apply to krb5_change_password as well, by making krb5_chpw_result_code_string convert result code 0. [ghudson@mit.edu: commit message] ticket: 7569 (new) target_version: 1.11.1 tags: pullup
* Modernize k5bufGreg Hudson2013-02-1410-137/+132
| | | | | | Rename the krb5int_buf_ family of functions to use the k5_ prefix for brevity. Reformat some k5buf implementation code to match current practices.
* Make internal JSON functions return error codesGreg Hudson2013-02-134-99/+84
| | | | | | | | | Return error codes (0, ENOMEM, or EINVAL) from JSON support functions instead of returning results directly. This makes error handling simpler for functions which assemble JSON objects and then return a krb5_error_code values. Adjust all callers. Use shims in export_cred.c to minimize changes there; it will be redesigned internally in a subsequent commit.
* Add and use k5memdup, k5memdup0 helpersGreg Hudson2013-02-0918-117/+54
| | | | | | Add k5-int.h static functions to duplicate byte ranges, optionally with a trailing zero byte, and set an error code like k5alloc does. Use them where they would shorten existing code.
* Simplify TGS request constructionGreg Hudson2013-02-084-171/+60
| | | | | | | Move krb5int_make_tgs_request from gc_via_tkt.c into send_tgs.c, combine it with krb5int_make_tgs_request_ext (which nothing else called), and rename the combined function to k5_make_tgs_req. Also use a typedef for the pacb callback.
* Modernize send_tgs.cGreg Hudson2013-02-081-245/+190
| | | | | Bring send_tgs.c up to date with current coding practices. No functional changes.
* Replace i_vector with cstate in auth contextGreg Hudson2013-02-076-95/+50
| | | | | Use a proper cipher state in the auth context structure, and free it when the auth context is freed. Simplify mk_priv/rd_priv accordingly.
* Desupport krb5_auth_con_setivectorGreg Hudson2013-02-071-2/+6
| | | | ticket: 7565 (new)
* Make kprop/kpropd work with RC4 session keyGreg Hudson2013-02-073-20/+19
| | | | | | | | | | In krb5_auth_con_initivector and mk_priv/rd_priv, stop assuming that the enctype's block size is the size of the cipher state. Instead, make and discard a cipher state to get the size. ticket: 7561 target_version: 1.11.1 tags: pullup
* Check for negative poll timeout in k5_sendto_kdcGreg Hudson2013-01-251-0/+4
| | | | | | ticket: 7553 target_version: 1.11.1 tags: pullup
* Clean up k5_locate_server error handlingGreg Hudson2013-01-111-25/+10
| | | | | | | | | | | profile_get_values() cannot return success with an empty list of values, so don't bother counting them. Return 0 from locate_srv_conf_1 if no profile values exist and from dns_locate_server if we decide not to make a SRV query. Adjust k5_locate_server to match the new helper behavior, and return KRB5_REALM_UNKNOWN if neither profile nor DNS come up with any answers (not KRB5_REALM_CANT_RESOLVE, which doesn't make sense now that we're deferring KDC hostname resolution).
* make dependGreg Hudson2013-01-109-20/+20
| | | | | Mostly this gets rid of the trailing space on line 2 after bb76891f5386526bdf91bc790c614fc9296cb5fa.
* Rename ccache configuration macrosZhanna Tsitkov2013-01-092-6/+6
| | | | | KRB5_CONF_ prefix should be used for the krb5/kdc.conf parameters. Use KRB5_CC_CONF_ prefix for cache configuration variables.
* Delete timestamp_to_sfstring sprintf fallbackTom Yu2012-12-221-9/+0
| | | | | | | | | | | The final fallback for krb5_timestamp_to_sfstring() is an explicit European date-order format string passed to sprintf(). This can be confused with a conventional US date format. Because we attempt to build a strftime() replacement anyway, and we try passing some unambiguous ISO 8601 date and time formats to strftime(), remove this final fallback. ticket: 7518 (new)
* Add more formats to krb5_timestamp_to_sfstringTom Yu2012-12-221-1/+6
| | | | | | | | | | | | | krb5_timestamp_to_string() can produce ambiguous dates. The final fallback, "%d/%m/%Y %R", contains a European order date format that can be confused with a US date format. Add some additional strftime() format strings, including locale-dependent formats and some ISO 8601 formats. Remove the hardcoded strftime() format that had an ambiguous date order. ticket: 7458 target_version: 1.11 tags: pullup
* Use krb5_init_creds_context as clpreauth rockGreg Hudson2012-12-225-234/+160
| | | | | | | | | | | | | | The clpreauth rock had become a collection of alias pointers into the init_creds context structure. Get rid of it and just pass the context (suitably casted) to clpreauth modules. Simplify the signatures of k5_preauth(), k5_preauth_tryagain(), process_pa_data(), and fill_response_items() by referencing fields from the init_creds context. Since we can't use the non-nullity of rock->selected_preauth_type to determine whether to record the selected preauth type, k5_preauth now reports it in an output parameter, and get_in_tkt.c decides whether or not to record it.
* Initialize ret in process_pa_dataGreg Hudson2012-12-211-1/+1
| | | | | | | If the for loop never consults any preauth modules and must_preauth is false, we might never set ret, so we need to initialize it. The bug was introduced in 5c23bce0e8d3328bb36bc85ee10cfac486b8ae9b and is detected by some versions of gcc with -O2.
* Simplify k5test.py environmentsGreg Hudson2012-12-204-64/+57
| | | | | | | | | | | | | | The initial k5test.py design, copied from the dejagnu suite, is to create config files and environments for four expected roles: client, server, master, and slave. This approach exaggerates the complexity of the common case, where the configurations don't need to vary, and limits us to having just one slave for kprop/iprop tests. Instead, create just one configuration by default, and add a special_env() method which sets up a differently configured environment for the few test cases which need one. The run_as_*() methods are collapsed into just run(), which accepts an optional argument for the environment returned by special_env().
* Pass through module errors when preauthenticatingGreg Hudson2012-12-203-18/+26
| | | | | | | | | | | | If we are responding to a KDC_ERR_PREAUTH_REQUIRED and cannot preauthenticate, report the error from the first real preauth type we tried. k5_preauth() now accepts a boolean input indicating that it must succeed on a real preauth type, instead of returning a boolean saying whether or not it did. ticket: 7517 (new)
* Rename internal preauth functionsGreg Hudson2012-12-195-103/+120
| | | | | | | | | | | | The preauth functions are internal to libkrb5, so use the k5_ prefix, don't use KRB5_CALLCONV, and prototype them in int-proto.h. Also remove krb5_do_preauth from the Unix libkrb5 export list. Reorder the k5_preauth() and k5_preauth_tryagain() arguments for more consistency with the clpreauth interface, and put the output padata arguments at the end. Rename any remaining uses of "kcontext" to "context" in preauth2.c.
* Make clpreauth flags function optionalGreg Hudson2012-12-195-28/+2
| | | | | | | | With one exception (KRB5_PADATA_PKINIT_KX), every padata type processed by a clpreauth module is now a real preauthentication type. Reduce the amount of boilerplate required for a clpreauth module by making the flags method optional if all of the preauth types advertised by the module are real.
* Use a proper consumer interface for clpreauthGreg Hudson2012-12-191-419/+359
| | | | | | | | In preauth2.c, use wrapper functions for calls to clpreauth functions. Get rid of the expanded-out module table, instead using a helper function to find the handle for a preauth type. Replace use counts with a list of previously processed pa types. Check for pa type conflicts when loading clpreauth modules.
* Separate clpreauth and kdcpreauth interfacesGreg Hudson2012-12-1913-359/+359
| | | | | | | Since there is no overlap between the clpreauth and kdcpreauth interface declarations, there's no particular reason to combine them into one header. For backward compatibility and convenience, leave behind a preauth_plugin.h which includes both.
* Save extended messages across fallback to masterGreg Hudson2012-12-192-33/+28
| | | | | | In krb5_get_init_creds_password and krb5_get_init_creds_keytab, save the extended error before retrying against the master KDC, and restore that state if returning the error from the original request.
* Add functions to save and restore error stateGreg Hudson2012-12-192-0/+37
|
* Style cleanup for internal error handlingGreg Hudson2012-12-193-38/+41
| | | | | | | Fix style issues in kerrs.c and errors.c. Rename error handling functions to use shorter k5_ prefix. Eliminate an inoperable krb5int_set_error() call in gic_opte_alloc and convert the other call to use krb5_set_error_message().
* Use an empty challenge for the password questionGreg Hudson2012-12-131-1/+1
| | | | | | | | | | | If a question's challenge is NULL, it is unnecessarily difficult for a responder callback to detect whether it was asked. So it's better to use an empty challenge when there is no challenge data to communicate. Do this for the "password" question. ticket: 7499 (new) target_version: 1.11 tags: pullup
* Build fixes for windowsBen Kaduk2012-12-051-3/+3
| | | | | | | | | | | | Add entries to OBJS and SRCS as well as STLIBOBJS. Use KRB5_CALLCONV at function definition as well as declaration. Declare missing variable in _WIN32-conditional code. ticket: 7479 (new) tags: pullup target_version: 1.11
* Avoid redundant socket cleanup in sendto_kdc.cGreg Hudson2012-11-291-4/+0
| | | | | | | | Since r25120, kill_conn() has been responsible for closing and invalidating conn->fd. In the unlikely event that the KDC sends a TCP response to us before we send a TCP request, we were cleaning up the socket again, which is useless (though also harmless). Get rid of that code.
* Fix spin-loop bug in k5_sendto_kdcGreg Hudson2012-11-291-1/+1
| | | | | | | | | | | | In the second part of the first pass over the server list, we passed the wrong list pointer to service_fds, causing it to see only a subset of the server entries corresponding to sel_state. This could cause service_fds to spin if an event is reported on an fd not in the subset. ticket: 7454 target_version: 1.10.4 tags: pullup
* Make krb5_trace_info a typedefBen Kaduk2012-11-271-2/+2
| | | | | | | | | | | | | Our doxygen-to-sphinx documentation bridge only processes typedefs and not structure definitions, since we almost universally use typedefs for our data structures. krb5_trace_info is the sole exception, so bring it into the fold. While here, flesh out the comment a bit more. ticket: 7447 tags: pullup target_version: 1.11
* Remove broken clean_hostname trace messagesGreg Hudson2012-11-251-2/+0
| | | | | | | | | | | | The trace messages in krb5int_clean_hostname were outputting the entire contents of the output buffer (mostly uninitialized garbage) into the trace log. Since these messages were essentially redundant with messages in the callers, and were arguably at too low of a level to begin with, simply remove them. ticket: 7459 (new) target_version: 1.11 tags: pullup
* Add Camellia enctypes to default enctype listsGreg Hudson2012-11-141-0/+1
| | | | | | | | | | | | Add camellia256-cts-cmas and camellia128-cts-cmac to the default permitted_enctypes, default_tkt_enctypes, and default_tgs_enctypes lists, to simplify deployment of Camellia. The new enctypes still aren't on supported_enctypes, so won't be in the set of long-term keys for principals without administrator intervention. ticket: 7446 (new) target_version: 1.11 tags: pullup
* Don't leak new fields of krb5_init_creds_contextGreg Hudson2012-10-241-0/+2
| | | | | | | | | Release the cc_config_in and cc_config_out fields of a krb5_init_creds_context when freeing the context. ticket: 7428 (new) target_version: 1.11 tags: pullup
* Don't save empty cc_config_out in ccacheGreg Hudson2012-10-241-1/+2
| | | | | | | | | | Add an internal json function to make it easier to detect if an object is empty, and use it to avoid creating a ccache config entry for preauth module config data if there isn't any to save. ticket: 7427 (new) target_version: 1.11 tags: pullup
* Revert last trace.c changeGreg Hudson2012-10-231-1/+1
| | | | The fencepost error was illusory.
generated by cgit (git 2.34.1) at 2026-01-10 20:06:21 +0000