summaryrefslogtreecommitdiffstats
path: root/src/lib/krb5
Commit message (Collapse)AuthorAgeFilesLines
...
* Add krb5int_cc_user_set_default_nameKevin Wasserman2012-07-111-4/+54
| | | | | | | | | | | | | Set the default credential cache name for all processes for the current user. Currently implemented, for windows only, by setting HKEY_CURRENT_USER\Software\MIT\Kerberos5:ccname to the specified ccache name. This will not override the environment variable 'KRB5CCNAME'. It will override HKEY_LOCAL_MACHINE and 'indirect' registry values. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> ticket: 7199 (new) tags: pullup
* Implement switch_to for ccapiv3Kevin Wasserman2012-07-112-0/+27
| | | | | | | | | | | krb5_stdccv3_switch_to() calls cc_ccache_set_default(). krb5_stdccv3_resolve() checks for NULL or empty residual and calls cc_context_get_default_ccache_name() in those cases. Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com> ticket: 7198 (new) tags: pullup
* Automatically create DIR ccache directoriesGreg Hudson2012-07-112-2/+3
| | | | | | | | If the directory for a DIR ccache doesn't exist yet, try to create it (but not its parents) with mode 700. Exercise this in test scripts by not pre-creating directories. ticket: 7196 (new)
* Reject extra realm separators in principal namesGreg Hudson2012-07-081-0/+2
| | | | | | Commit f609e5caff410cc8f71db7d95b4da219541437db accidentally omitted the check for extra realm separators, leading to an assertion error when parsing x@y@z or similar. Restore the check.
* Remove dead codeBen Kaduk2012-07-051-11/+0
| | | | | This (hair-raising) macro is not referenced anywhere in the tree, so remove it and the associated comment.
* Fix typo in previous change to get_fq_hostnameTom Yu2012-07-031-1/+1
| | | | ticket: 7086
* Fix a minor memory leak in get_fq_hostnameArlene Berry2012-07-031-1/+3
| | | | ticket: 7086
* Resolve no-previous-prototype warning in os/cm.cBen Kaduk2012-07-021-0/+1
| | | | | | | | | | | | | | | The warning is ../../../../krb5/src/lib/krb5/os/cm.c:43: warning: no previous prototype for 'k5 _getcurtime' which occurs because int k5_getcurtime(struct timeval *tvp) is defined (and used) in cm.c but there is no forward declaration. Include the os-proto.h (internal) header which declares this function to eliminate the warning. k5_getcurtime() is the first declaration in cm.c, so there is not an ABI concern. The only other consumer of k5_getcurtime(), sendto_kdc.c, already includes os-proto.h, so this issue is purely cosmetic.
* Check sort_enctypes return value in gic_keytabGreg Hudson2012-07-021-2/+3
|
* Include all default etypes in gic_keytab requestsGreg Hudson2012-07-021-26/+30
| | | | | | | | | | | Revert 18b02f3e839c007fff54fc9b693f479b7563ec73 in the KDC. Instead, when making an initial request with a keytab, transmit the whole default_tkt_enctypes list, but sorted with the enctypes we have in the keytab first. That way the KDC should prefer enctypes which we have keys for (for both reply key and session key), but the other enctypes are still available for use as ticket session keys. ticket: 7190
* Add krb5_kt_client_default APIGreg Hudson2012-07-023-0/+48
| | | | | | | | | | | | | | | | The default client keytab is intended to be used to automatically acquire initial credentials for client applications. The current hardcoded default is a placeholder, and will likely change before 1.11. Add test framework settings to ensure that a system default client keytab doesn't interfere with tests, and to allow tests to be written to deliberately use the default client keytab. Add documentation about keytabs to the concepts section of the RST docs, and describe the default client keytab there. ticket: 7188 (new)
* Fix crash on invalid DIR ccache primary fileGreg Hudson2012-06-251-2/+2
| | | | | | | | | | If read_primary_file() fails with an error other than ENOENT, abort cache resolution rather than dereferencing a null pointer. Reported by Oliver Loch. ticket: 7185 target_version: 1.10.3 tags: pullup
* Fix config check in krb5_cccol_have_contentGreg Hudson2012-06-221-1/+1
| | | | | | | krb5_is_config_principal should be invoked on creds.server, not creds.client. ticket: 7173
* Simplify bld_princ.cGreg Hudson2012-06-211-66/+20
|
* Remove orphaned KfM codeGreg Hudson2012-06-213-61/+1
|
* Add krb5_cccol_have_content APIGreg Hudson2012-06-154-2/+50
| | | | | | | Add a new API to determine whether any krb5 credentials are available in the ccache collection. Add tests to t_cccol.py. ticket: 7173 (new)
* Remove krb5int_cc_os_default_nameGreg Hudson2012-06-111-19/+0
| | | | | krb5int_cc_os_default_name has been unused since #6955 removed the call to it in cccursor.c. Get rid of it.
* Clean up default_an_to_ln and fix a minor leakGreg Hudson2012-06-081-35/+23
| | | | | | | The default realm could be leaked if the principal had the wrong number of components. Reported by Russ Allbery. ticket: 7161
* Rename and add to etype utility functionsGreg Hudson2012-06-0710-32/+31
| | | | | | | Rename krb5int_count_etypes and krb5int_copy_etypes to have k5_ prefixes, and make them available outside of libkrb5 (but not part of the public API). Add k5_etypes_contains to search an etype list, and use it in krb5_is_permitted_enctype.
* Remove krb5_is_permitted_enctype_extGreg Hudson2012-06-071-32/+0
| | | | | It's an internal function (not in krb5.h or the libkrb5 export list) and nothing uses it.
* Don't free caller's principal in vfy_incredsGreg Hudson2012-06-061-1/+0
| | | | | | | | #7125 took out the copy of the krb5_verify_init_creds server argument but left in the corresponding free, so it was freeing a caller-owned principal. Reported by Russ Allbery. ticket: 7162
* Try to make t_trace.c output consistentGreg Hudson2012-06-063-16/+14
| | | | | | Attempt to choose tracing inputs in t_trace.c which will produce consistent output across platforms and logins. Re-enable the comparison against the reference file.
* Add control over session key enctype negotiationNicolas Williams2012-06-061-0/+1
| | | | | | | | | | | | | | | | | | | Adds a principal string attribute named "session_enctypes" which can specify what enctypes the principal supports for session keys. (For what it's worth, this actually allows one to list des-cbc-md5 as a supported session key enctype, though obviously this hardly matters now.) Add a [realms] section parameter for specifying whether to assume that principals (which lack the session_enctypes attribute) support des-cbc-crc for session keys. This allows those who still need to use allow_weak_crypto=true, for whatever reason, to start reducing the number of tickets issued with des-cbc-crc session keys to clients which still give des-cbc-crc preference in their default_tgs_enctypes list. [ghudson@mit.edu: Miscellaneous edits, cleanups, and fixes; refactored test script; documented session_enctypes attribute]
* Fix uninitialized memory errors in t_trace.cGreg Hudson2012-06-051-1/+4
|
* Disable trace test comparison for nowGreg Hudson2012-06-051-1/+2
| | | | | | The t_trace output isn't consistent from run to run. To fix "make check", disable the comparison against the reference file until we can make the output consistent.
* Fix trace log unit testGreg Hudson2012-06-042-1/+53
| | | | | | | Only use common denominator Bourne shell syntax for exporting environment variables. Don't rely on /dev/stdout working. Compare the output with a reference file to detect changes, instead of just sending it to stdout.
* Improve error message from krb5_kt_have_contentGreg Hudson2012-06-031-2/+10
|
* Add krb5_kt_have_content APIGreg Hudson2012-06-023-0/+30
| | | | | | | | | | | | | Add the krb5_kt_have_content API from Heimdal, which can be used to test whether a keytab exists and contains entries. Add tests to t_keytab.c. There is a deviation from Heimdal in the function signature. Heimdal's signature returns a krb5_boolean at the moment, because the Heimdal implementation actually returns a krb5_error_code. These are generally the same type anyway (int). ticket: 7158 (new)
* Tighten up error checking in t_keytab.cGreg Hudson2012-06-021-29/+16
| | | | | | | When checking for specific error codes, using CHECK() meant that we wouldn't properly fail if we got error code 0. Define and use a CHECK_ERR() to test for a specific error code, and define CHECK() in terms of it.
* Use correct profile var in krb5_get_tgs_ktypesGreg Hudson2012-06-011-1/+1
| | | | | | | | | | | In r21879, when we converted to using KRB5_CONF macros for profile variable names, we made a typo in krb5_get_tgs_ktypes and erroneously started using default_tkt_enctypes instead of default_tgs_enctypes for TGS requests. Fix the typo and return to the documented behavior. ticket: 7155 target_version: 1.10.3 tags: pullup
* Fix S4U user identification in preauth caseGreg Hudson2012-05-241-4/+2
| | | | | | | | | | | | | | | | | | | | | | | In 1.10, encrypted timestamp became a built-in module instead of a hardcoded padata handler. This changed the behavior of krb5_get_init_creds as invoked by s4u_identify_user such that KRB5_PREAUTH_FAILED is returned instead of the gak function's error. (Module failures are not treated as hard errors, while hardcoded padata handler errors are.) Accordingly, we should look for KRB5_PREAUTH_FAILED in s4u_identify_user. On a less harmful note, the gak function was returning a protocol error code instead of a com_err code, and the caller was testing for a different protocol error code (KDC_ERR_PREAUTH_REQUIRED) which could never be returned by krb5_get_init_creds. Clean up both of those by returning KRB5_PREAUTH_FAILED from the gak function and testing for that alone. Reported by Michael Morony. ticket: 7136 target_version: 1.10.2 tags: pullup
* Convert DEBUG_REFERRALS to TRACE_* frameworkW. Trevor King2012-05-235-68/+21
| | | | | | | | | The referrals debugging code under DEBUG_REFERRALS ceased building correctly at some point. Convert this debugging code to use the tracing framework instead, including adding new trace macros to k5-trace.h. ticket: 7151
* Add tests for trace.c formattingW. Trevor King2012-05-232-2/+259
| | | | | | This improves the previously minimal test coverage of "trace.c". ticket: 7151
* Add support for "{ptype}" trace format specifierW. Trevor King2012-05-231-0/+24
| | | | | | | Add the "{ptype}" trace format specifier, for principal name types. Also document the new option in the "k5-trace.h" comments. ticket: 7151
* Export krb5_set_trace_callback/filenameGreg Hudson2012-05-211-0/+2
| | | | | | | | | | krb5_set_trace_callback and krb5_set_trace_filename were added to krb5.h in krb5 1.9, but were mistakenly left out of the library export lists. Add them now. Reported by Russ Allbery. ticket: 7143 target_version: 1.10.2 tags: pullup
* Fix "(empty" typo in "{etypes}" handler in trace.cW. Trevor King2012-05-181-1/+1
| | | | ticket: 7137
* Fix "(null" typo in "{key}" handler in trace.cW. Trevor King2012-05-181-1/+1
| | | | ticket: 7134
* Correct the name of krb5int_trace in commentsTom Yu2012-05-171-4/+4
| | | | | | Patch from W. Trevor King. ticket: 7133
* Add missing newline to sn2princ debug messageGreg Hudson2012-05-141-1/+2
| | | | | | Patch from wking@tremily.us. ticket: 7131
* Avoid extern inline in asn1buf.hGreg Hudson2012-05-131-2/+4
| | | | | | | | Avoid using extern inline in asn1buf.h, as there are two conflicting sets of semantics (gnu89's and C99's). gcc defaults to the gnu89 semantics, which we were using, while clang defines __GNUC__ but defaults to the C99 semantics. To simplify things, use static inline instead, like we do in k5-int.h.
* Null-terminate components of parsed principalsGreg Hudson2012-05-122-11/+10
| | | | | | | | | | The rewritten krb5_parse_name didn't null-terminate components or realms of principals, while the old one did. Fix the new one to do so as well. This means KRB5_PRINCIPAL_PARSE_IGNORE_REALM allocates one byte for the realm instead of leaving it as empty_data(), so we need to free the realm in build_in_tkt_name() before copying in the client realm.
* Omit start time in common AS requestsGreg Hudson2012-05-111-5/+9
| | | | | | | | | | | | | | | | | | | MIT and Heimdal KDCs ignore the start time for non-postdated ticket requests, but AD yields an error if the start time is in the KDC's future, defeating the kdc_timesync option. Omit the start time if the caller did not specify a start time offset. This change reenables the client check for too much clock skew in the KDC reply in the non-timesync configuration. That check had been unintentionally suppressed since the introduction of the get_init_creds interfaces. Adjust the t_skew test script to expect the new error behavior. Code changes from stefw@gnome.org with slight modifications. ticket: 7130 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25864 dc483132-0cff-0310-8789-dd5450dbe970
* Avoid requiring default realm for in_tkt_serviceGreg Hudson2012-05-101-31/+17
| | | | | | | | Use the new KRB5_PRINCIPAL_PARSE_IGNORE_REALM flag when parsing in_tkt_service arguments in get_init_cred functions, since we're going to overwrite the realm anyway. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25863 dc483132-0cff-0310-8789-dd5450dbe970
* Add krb5_parse_name flag to ignore realmGreg Hudson2012-05-101-1/+5
| | | | | | | | | | The flag KRB5_PRINCIPAL_PARSE_IGNORE_REALM causes krb5_parse_name to return the principal with an empty realm whether or not a realm is present in the name. ticket: 7129 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25862 dc483132-0cff-0310-8789-dd5450dbe970
* Rewrite krb5_parse_nameGreg Hudson2012-05-101-285/+176
| | | | | | | | | krb5_parse_name started out a bit unwieldy, and has become more so with the introduction of flags. Rewrite it using two passes (allocate and fill), each broken out into its own helper, and a wrapper which handles the realm flags. git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25861 dc483132-0cff-0310-8789-dd5450dbe970
* Make password change work without default realmGreg Hudson2012-05-101-0/+5
| | | | | | | | | | | | This fix is not very general or clean, but is suitable for backporting because it is minimally invasive. A more comprehensive fix will follow. ticket: 7127 target_version: 1.10.2 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25860 dc483132-0cff-0310-8789-dd5450dbe970
* Constify get_init_creds string input paramsGreg Hudson2012-05-094-9/+9
| | | | | | | | | | | | The get_init_creds functions take read-only string input parameters for passwords and initial ticket services. Make these const char * parameters instead of just char * parameters, for caller convenience. Reported by rra@stanford.edu. ticket: 7121 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25858 dc483132-0cff-0310-8789-dd5450dbe970
* Add API to interpret changepw result stringsGreg Hudson2012-05-093-6/+176
| | | | | | | | | | | | | Active Directory returns structured policy information in the nominally UTF-8 result string field of a password change reply. Add a new API krb5_chpw_message() to convert a result string into a displayable message, interpreting policy information if present. Patch from stefw@gnome.org with changes. ticket: 7128 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25857 dc483132-0cff-0310-8789-dd5450dbe970
* Constify krb5int_utf8_normalize input parameterGreg Hudson2012-05-091-1/+1
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25856 dc483132-0cff-0310-8789-dd5450dbe970
* Improve display of error code 0 in trace outputGreg Hudson2012-05-081-1/+2
| | | | git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25853 dc483132-0cff-0310-8789-dd5450dbe970
generated by cgit (git 2.34.1) at 2025-09-29 08:54:38 +0000