summaryrefslogtreecommitdiffstats
path: root/src/lib
Commit message (Collapse)AuthorAgeFilesLines
...
* Add libkradNathaniel McCallum2013-07-1121-1/+3427
| | | | | | | | The new library libkrad provides code for the parsing of RADIUS packets as well as client implementation based around libverto. This library should be considered unstable. ticket: 7678 (new)
* Fix uninitialized variable bugsGreg Hudson2013-06-271-1/+1
| | | | | The previous few commits introduced a couple of bugs where variables could be used without being initialized. Fix them.
* Rely on module ordering for localauthGreg Hudson2013-06-271-25/+6
| | | | | | | Register built-in localauth modules in the order we want them used by default, and document accordingly. ticket: 7665
* Provide plugin module ordering guaranteesGreg Hudson2013-06-271-188/+265
| | | | | | | | Rewrite the plugin internals so that modules have a well-defined order--either the order of enable_only tags, or dynamic modules followed by the built-in modules in order of registration. ticket: 7665 (new)
* Fix spin loop reading from KDC TCP socketViktor Dukhovni2013-06-261-2/+2
| | | | | | | | | | | | In the k5_sendto code for reading from a TCP socket, detect end-of-stream when reading the length. Otherwise we can get stuck in an infinite loop of poll() and read(). [ghudson@mit.edu: commit message] ticket: 7508 target_version: 1.11.4 tags: pullup
* Fix various warningsGreg Hudson2013-06-0729-199/+89
|
* Use KDC clock skew for AS-REQ timestampsGreg Hudson2013-06-051-5/+12
| | | | | | | | | | | | | | | | Calculate request timestamps each time we encode a request, and use the adjusted current time when calculating them, including adjustments resulting from preauth-required errors early in the AS exchange. As a side effect, this reverts one of the changes in commit 37b0e55e21926c7875b7176e24e13005920915a6 (#7063); we will once again use the time adjustment from any ccache we read before the AS exchange, if we don't have a more specific adjustment from a preauth-required error. Based on a patch from Stef Walter. ticket: 7657 (new)
* Refactor AS-REQ nonce and timestamp handlingGreg Hudson2013-06-053-67/+78
| | | | | | | | | | | | Create helper functions to set the request nonce and to set the request timestamp. Don't bother picking a nonce in restart_init_creds_loop since we will just pick a new one in init_creds_step_request. Create a library-internal function to get the current time with possible adjustment from a preauth-required error. Only set ctx->request_time in one place (just before encoding each request). Remove unused parameters from stash_as_reply. Partially based on a patch from Stef Walter.
* Fix spurious clock skew caused by preauth delayGreg Hudson2013-06-021-0/+3
| | | | | | | | | | Commit 37b0e55e21926c7875b7176e24e13005920915a6 (#7063) prevented clock skew caused by preauth delay by recording the time of the initial request. However, it failed to take into account delay between requests due to prompting during preauthentication. Fix this by recording the request time for each request. ticket: 7656 (new)
* Properly handle use_master in k5_init_creds_getGreg Hudson2013-05-311-2/+4
| | | | | | | | | | | If we make multiple requests in an initial creds exchange, the krb5_sendto_kdc call in k5_init_creds_get may flip the use_master value from 0 to 1 if it detects that the response was from a master KDC. Don't turn this into a requirement for future requests during the same exchange, or we may have trouble following AS referrals. Reported by Sumit Bose. ticket: 7650
* Fix non-builtin crypto module buildsGreg Hudson2013-05-2911-24/+39
| | | | | | | Commit 4b0985f8573840838bcfa8ec1df3dcd39a3dbf15 went a bit too far in pruning the placeholder makefiles for the openssl and nss crypto modules. We need enough boilerplate to create OBJS.SH in each directory.
* Make empty passwords work via init_creds APIsGreg Hudson2013-05-274-86/+60
| | | | | | | | | | | | | | In the gak_data value used by krb5_get_as_key_password, separate the already-known password from the storage we might have allocated to put it in, so that we no longer use an empty data buffer to determine whether we know the password. This allows empty passwords to work via the API. Remove the kadm5 test which explicitly uses an empty password. Based on a patch from Stef Walter. ticket: 7642
* Add AES-NI support on LinuxGreg Hudson2013-05-242-5/+138
| | | | | | | If yasm and cpuid.h are present on a Linux i686 or x64 system, compile the modified Intel AES-NI assembly sources. In the builtin AES enc provider, check at runtime whether the CPU supports AES-NI instructions and use the assembly functions if so.
* Adjust AESNI sources for krb5 treeGreg Hudson2013-05-242-2588/+17
| | | | | Remove functions we don't need. Add macros to redefine functions with an appropriate namespace prefix.
* Add Intel AESNI assembly filesGreg Hudson2013-05-242-0/+4280
| | | | | | Add assembly files from the Intel AESNI Sample Library, version 1.2, which implement AES encryption using AES-NI instructions. Trailing whitespace was removed.
* Refactor AES, Camellia builtin enc providersGreg Hudson2013-05-242-302/+309
| | | | | | | In preparation for AES-NI support, adjust the block encryption helpers in the AES enc provider so that the cache is only touched by helpers, and reframe the CTS operations in terms of CBC operations. Change the Camellia enc provider as well for consistency.
* Simplify crypto IOV helpersGreg Hudson2013-05-2415-768/+375
| | | | | | | | Expand the concept of an IOV block state into a cursor which remembers the IOV set being iterated over, the block size, and both input and output positions. Eliminate the no-copy inline block getter for now, but provide helpers to grab contiguous chains of blocks from a cursor. Also provide an inline helper to sum the total length of an iov chain.
* Fix transited handling for GSSAPI acceptorsGreg Hudson2013-05-211-3/+5
| | | | | | | | | | | | | | | | | | The Acceptor Names project (#6855) extended krb5_rd_req so that it can accept a "matching principal" in the server parameter. If the matching principal has an empty realm, rd_req_decoded_opt attempted to do transited checking with an empty server realm. To fix this, always reset server to req->ticket->server for future processing steps if we decrypt the ticket using a keytab. decrypt_ticket replaces req->ticket->server with the principal name from the keytab entry, so we know this name is correct. Based on a bug report and patch from nalin@redhat.com. ticket: 7639 target_version: 1.11.3 tags: pullup
* Try to use best DNS search functions in dnsglue.cGreg Hudson2013-05-191-23/+45
| | | | | | | | | | Create macros to declare a DNS search handle, initialize a handle, perform a search, and destroy a handle. On OS X, use the native dns_open, dns_search, and dns_free functions, since using the res_* interfaces may not contact the correct servers. On systems with res_ninit, use res_nclose if we don't have res_ndestroy. Based on a patch by Nate Rosenblum.
* Reduce boilerplate in makefilesGreg Hudson2013-05-1657-413/+23
| | | | | | | | | Provide default values in pre.in for PROG_LIBPATH, PROG_RPATH, SHLIB_DIRS, SHLIB_RDIRS, and STOBJLISTS so that they don't have to be specified in the common case. Rename KRB5_RUN_ENV and KRB5_RUN_VARS to RUN_SETUP (already the most commonly used name) and RUN_VARS. Make sure to use DEFINES for local defines (not DEFS). Remove some other unnecessary makefile content.
* Fix windows buildBen Kaduk2013-05-162-0/+2
| | | | | Catch a few stragglers that missed the memo that k5_mutex_lock cannot fail, and sprinkle some cc-int.h as needed.
* Fix NSS crypto back end for mutex changesGreg Hudson2013-05-161-5/+2
| | | | | Adjust a stray k5_mutex_lock invocation in the NSS crypto back end after 6350fd0c909d84c00200885e722cc902049ada05.
* Assume mutex locking cannot failGreg Hudson2013-05-1422-514/+176
| | | | | | | | | | | | Locking and unlocking a non-recursive mutex is a simple memory operation and should not fail on any reasonable platform with correct usage. A pthread mutex can return EDEADLK on lock or EPERM on unlock, or EINVAL if the mutex is uninitialized, but all of these conditions would reflect serious bugs in the calling code. Change the k5_mutex_lock and k5_mutex_unlock wrappers to return void and adjust all call sites. Propagate this change through k5_cc_mutex_lock and k5_cc_mutex_unlock as well.
* Don't use "bool" for ASN.1 boolean macrosNate Rosenblum2013-05-141-2/+2
| | | | | | | | | | | | When building for IOS targets with clang, the stdbool.h header is included by default. This header includes the following C99 definition: #define bool _Bool which wrecks havoc with the DEFBOOLTYPE macro. ticket: 7525
* Rename internal Camellia symbolsGreg Hudson2013-05-131-0/+12
| | | | | | | | | | | Symbols from the NTT Camellia sources, used in the builtin crypto provider, could conflict with symbols from other libraries such as OpenSSL's libcrypto. Rename those like we rename the Gladman AES symbols. ticket: 7626 target_version: 1.11.3 tags: pullup
* fix crypto openssl hmac warningGilles Espinasse2013-05-091-1/+1
| | | | ticket: 7634
* Fix mismatched spnego_mech.c declarationsGreg Hudson2013-05-031-3/+4
| | | | | The mechglue definitions of gssint_get_der_length and friends use unsigned int for the buffer length, not OM_uint32.
* Fix link line for t_fortunaGilles Espinasse2013-05-011-1/+1
| | | | ticket: 7628
* Don't use portmapper in RPC testsGreg Hudson2013-05-014-32/+48
| | | | | | | | On many Linux systems, due to what is arguably a bug in rpcbind, the portmapper doesn't allow service registration from non-root processes. This causes the RPC tests to be frequently skipped. Modify the tests so that they don't need the portmapper, by grabbing the port number from the server process and passing it to the client.
* Disable the gssrpc expired-cred testGreg Hudson2013-05-011-2/+3
| | | | | | | | | | | | | The "expired" test in expire.exp tries to authenticate to the server process with an expired TGT (obtained using kinit -l -1m). Using an expired TGT to get an expired service cred no longer works after #6948. We could use kinit -S to get an expired service cred, but krb5_get_credentials won't return expired service cred from the cache (even before #6948). We could use time offsets to simulate clock skew between the client and server process, but that would be difficult because the test programs don't have access to the krb5_context objects used by the client or server process. Since we don't have a simple workaround, disable the test.
* Better fix for not using expired TGTs in TGS-REQsGreg Hudson2013-04-291-53/+91
| | | | | | | | | | | | We want to generate a KRB5_AP_ERR_TKT_EXPIRED code when the TGT is expired, like we would if we tried the TGT against the KCD. To make this work, separate the helpers for getting local and crossrealm cached TGTs. For a crossrealm TGT, match against the endtime, as there could be multiple entries. For a local TGT, find any match, but check if it's expired. The cache_code field is no longer needed after this change, so get rid of it. ticket: 6948
* Don't use expired TGTs in TGS-REQsNicolas Williams2013-04-261-8/+10
| | | | ticket: 6948
* Include default DIR::file ccache in collectionGreg Hudson2013-04-222-3/+41
| | | | | | | | If the context's default ccache name is a subsidiary file of a directory collection, include that single cache in the cursor walk over the DIR type. ticket: 7172
* Simplify sendto_kdc exception handlingGreg Hudson2013-04-121-83/+25
|
* Remove sendto_kdc debugging codeGreg Hudson2013-04-125-257/+2
| | | | | It's a lot of code, and trace logging should cover most of the cases where it's useful.
* Dynamically expand timeout when TCP connectsNathaniel McCallum2013-04-121-1/+27
| | | | | | | | | | | Wait ten seconds for a TCP connection to succeed or fail before moving on. During this wait time, other TCP connections will be serviced if we already initiated them, but no new TCP connections will be created and no UDP packets will be retransmitted. [ghudson@mit.edu: minor adjustments; commit message] ticket: 7604 (new)
* Use millisecond timeouts in sendto_kdc.cNathaniel McCallum2013-04-121-68/+51
| | | | | | | | | | Replace the end_time field of struct select_state with an endtime argument to cm_select_or_poll, expressed in milliseconds since the epoch. Add a helper function to get the current time in that format. Use a millisecond interval argument to service_fds for consistency. [ghudson@mit.edu: fix overflow issue in get_curtime_ms; service_fds interval argument change; log message]
* Get rid of cm.c and cm.hGreg Hudson2013-04-129-171/+137
| | | | | | | | | | | Since net-server.c now uses libverto, only sendto_kdc.c consumes cm.c. Move stuff out of cm.c and cm.h into sendto_kdc.c and get rid of them. Change the sendto_kdc callback (used by chpw.c) to receive the socket descriptor instead of the entire conn_state structure, and move the declarations into os-proto.h. struct remote_address also needs to be in os-proto.h so that trace.c and t_trace.c can use it. k5_curtime isn't needed since k5-platform.h now guarantees the presence of gettimeofday().
* Trace log with a subset of struct conn_stateGreg Hudson2013-04-124-56/+59
| | | | | | | In struct conn_state, collect together the fields for the remote address and put them in a substructure. Pass this substructure to trace logging macros instead of the entire conn_state structure, so that trace.c doesn't have to know about the whole structure.
* Tighten up fixed buffer usage in hst_realm.cGreg Hudson2013-04-101-9/+10
| | | | Avoid or notice truncations, rather than letting them happen silently.
* Allow numeric addresses as service hostnamesGreg Hudson2013-04-091-47/+66
| | | | | | | | | | | | | | | | Since krb5 1.3, krb5_get_host_realm (and therefore krb5_sname_to_principal) has refused hostnames which appear to be numeric addresses--with the exception of 1.6, which was ignoring errors from clean_hostname. In specialized environments, it may be desirable to use IP addresses in service principal names, and there's no compelling reason for us to get in the way of that. Move the numeric address check out of k5_clean_hostname into a new helper function, and simply skip the domain-based mechanisms if it returns true. Factor out the [domain_realm] search into a second new helper function to make it easier to skip. ticket: 7603 (new)
* Update hst_realm.c coding styleGreg Hudson2013-04-091-337/+236
| | | | | Bring this file up to date with current coding style. No functional changes, except some trace logs were removed.
* Initialize outpos in krb5int_utf8_normalizeGreg Hudson2013-04-091-3/+1
| | | | | | | | After k5memdup0 was slightly modified in 31124ffb81e8c0935403a9fdc169dead5ecaa777, some older versions of gcc complain about outpos being possibly used before it is initialized. This can't actually happen, but we can silence the error and also simplify how outpos is initialized.
* Avoid passing null pointers to memcpy/memcmpGreg Hudson2013-04-0815-49/+50
| | | | | | | | | | | | | | | By a strict reading of the C standard, memcpy and memcmp have undefined behavior if their pointer arguments aren't valid object pointers, even if the length argument is 0. Compilers are becoming more aggressive about breaking code with undefined behavior, so we should try to avoid it when possible. In a krb5_data object, we frequently use NULL as the data value when the length is 0. Accordingly, we should avoid copying from or comparing the data field of a length-0 krb5_data object. Add checks to our wrapper functions (like data_eq and k5_memdup) and to code which works with possibly-empty krb5_data objects. In a few places, use wrapper functions to simplify the code rather than adding checks.
* Simplify principal access within libkrb5Greg Hudson2013-04-0828-200/+144
| | | | | For conciseness, directly use fields of krb5_principal objects instead of using the accessor macros.
* Add krb5_kt_dup API and use it in two placesGreg Hudson2013-04-014-25/+18
| | | | | | | Add an API to duplicate keytab handles, mirroring krb5_cc_dup. Use it to simplify the krb5 GSS acquire_cred code. ticket: 7599 (new)
* Add support for client keytab from cred storeSimo Sorce2013-04-012-10/+44
| | | | | | | | | | | | | | | | The new credential store extensions added support for specifying a specific ccache name and also a specific keytab to be used for accepting security contexts, but did not add a way to specify a client keytab to be used in conjunction with the Keytab initiation support added also in 1.11 This patch introduces a new URN named client_keytab through which a specific client_keytab can be set when calling gss_acquire_cred_from() and Keytab Initiation will use that keytab to initialize credentials. [ghudson@mit.edu: minor C style fix] ticket: 7598 (new)
* Fix zap size in confounder checksum mk_xorkeyGreg Hudson2013-03-291-1/+1
|
* Using k5-int.h data helpers for some functionsGreg Hudson2013-03-293-21/+14
| | | | | | Use empty_data(), alloc_data(), and make_data() in some appropriate places. This has the side effect of initializing the krb5_data magic field, which can placate debugging tools.
* Clean up cksum handling in CMAC token functionsGreg Hudson2013-03-291-3/+1
| | | | | | In krb5int_dk_cmac_encrypt, cksum wasn't used. In krb5int_dk_cmac_decrypt, cksum needs to be initialized since we clean it up.
generated by cgit (git 2.34.1) at 2025-09-26 07:46:34 +0000