summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* Make t_iprop.py faster and more robustGreg Hudson2012-10-123-32/+80
| | | | | | | | | | | | | | | Catch SIGUSR1 in iprop-mode kpropd so that we can use it to interrupt sleeps and make kpropd do an iprop request immediately. In k5test.py, add prod_kpropd and read_from_kpropd methods to allow test scripts to send a SIGUSR1 to kpropd and to read its stdout/stderr output; also allow the test script to specify additional arguments when starting kpropd. In t_iprop.py, start kpropd with -d and, instead of sleeping, read kpropd output until we see an indication that kpropd is in sync with the master. To avoid delays, prod kpropd before waiting for sync and after a completed full prop.
* Fix a couple of typosNalin Dahyabhai2012-10-121-2/+2
|
* Add responder support to preauth_encts/preauth_ecNathaniel McCallum2012-10-122-0/+26
|
* Add responder support to get_as_key()Nathaniel McCallum2012-10-129-9/+70
| | | | | This follows the design laid out on the project page: http://k5wiki.kerberos.org/wiki/Projects/Password_response_item
* Allow null inputs to response item functionsNathaniel McCallum2012-10-121-2/+14
|
* Fix cast regexp in C style checkerGreg Hudson2012-10-111-1/+1
| | | | | | | In check_cast, we want to match cast operators with or without spaces after the closing paren, and then check for spaces after we match. Also, per the comment, we want to match potential cast operators followed by an open paren.
* Fix slow kprop dejagnu testGreg Hudson2012-10-103-6/+4
| | | | | | | | | Fix kpropd -S -t to actually exit after processing one connection (it was breaking out of the switch statement, not the while loop). Use the -t when invoking kpropd from the dejagnu test framework; previously it was unnecessary because kpropd -S -d exited after one connection. Clear up some confusion in the kprop.exp comments about whether kpropd is expected to exit.
* Fix argument order when calling the responderNathaniel McCallum2012-10-101-2/+2
|
* De-conditionalize Camellia codeGreg Hudson2012-10-0930-221/+42
| | | | | | | | | | The Camellia enctypes and cksumtypes have received IANA assignments. Add #defines using those assignments to krb5.h, remove the CAMELLIA conditional, and enable testing code as appropriate. The Camellia draft has not received an RFC number yet, so there is no Doxygen markup for the enctype and cksumtype #defines. That can be added once the RFC number is known.
* Untabify preauth_sam2.cGreg Hudson2012-10-081-17/+17
|
* Remove iprop dejagnu testGreg Hudson2012-10-081-236/+0
| | | | | | | Both the Python and dejagnu iprop tests are slow since they use sleeps to give kpropd time to do its work (although we can fix this with some work). Since the Python tests cover the same ground as the dejagnu tests, we don't need both.
* Import and complete Greg Hudson's iprop testNicolas Williams2012-10-082-0/+140
| | | | ticket: 7374
* Prep k5test.py for iprop (add start_kpropd(), ...)Nicolas Williams2012-10-081-6/+42
| | | | | | | Add a start_kpropd() method to K5Realm and make start_kadmind() use the kadmind -p, -K, and -F options. ticket: 7378
* krb5_db_delete_principal() can fail to unlock ulogNicolas Williams2012-10-081-1/+3
| | | | | | Not really: only when the KDB backend lacks a delete method. Still. ticket: 7403
* Remove an old, incorrect comment in kpropd.cNicolas Williams2012-10-081-9/+0
| | | | | | | We absolutely do not want a parking brake on the kprop protocol as described in the comment being removed. Instead the kprop command should be fixed so it doesn't die on error (assuming it even still does or ever did, neither of which I've checked).
* Send kpropd debug msgs to stderrNicolas Williams2012-10-081-4/+5
|
* Fix a minor race in kdb5_util loadNicolas Williams2012-10-053-37/+65
| | | | | | | | | | | | | | | | | | | If a kdb5_util load gets killed between rename()ing the new KDB file into place and resetting the iprop ulog then the ulog can reflect the pre-load state, which will almost certainly be incorrect. This matters because we want to impose a timeout on full resyncs in kpropd when iprop dictates that a full resync is needed, and the simplest timeout scheme involves signaling the kdb5_util load process. But also, we want no such races in general. The fix is simple: re-initialize the ulog before renaming the new KDB file into place, then proceed as usual. If the ulog is not properly updated at the end of the load it will at least always result in subsequent iprop get updates operations always indicating that a full resync is required. ticket: 7399
* Make kadmind iprop never return UPDATE_BUSYNicolas Williams2012-10-051-11/+1
| | | | | | | | | | | | | | | Currently kadmind allows slaves to poll for updates as often as they like, but not within 10s of the last update. This means that iprop will appear to fail to synchronize the KDC at any site whose master KDC processes at least one write transaction every 10 seconds consistently. The original intention must have been to throttle iprop clients (slave KDCs) that poll too often. But UPDATE_BUSY as implemented is not that, and implementing a throttle would be difficult (requires keeping state in a table) and mostly useless (admins can manage their poll timers just fine without a throttle in kadmind). ticket: 7369
* Remove MAX_ULOGENTRIESNicolas Williams2012-10-052-4/+1
| | | | | | | | | | | If a master KDC uses only a 64-bit libkadm5srv then there is no reason to impose any limit on ulog size: the practical maximum will be given by the filesystem and available storage space. Even when using a 32-bit libkadm5srv the maximum practical ulog size will be found easily enough when mmap() fails. ticket: 7368
* Add -R option to kproplog to force full resyncsNicolas Williams2012-10-051-4/+25
| | | | ticket: 7375
* Fix policy refcount corruption race in dumpNicolas Williams2012-10-051-10/+10
| | | | ticket: 7384
* Sync iprop header in kdb5_util dumpNicolas Williams2012-10-051-0/+10
| | | | [ghudson@mit.edu: split out from previous commit]
* kdb5_util load needs iprop safety netNicolas Williams2012-10-051-15/+36
| | | | ticket: 7370
* Deprecate kpropd -S optionNicolas Williams2012-10-051-1/+12
| | | | ticket: 7376
* Add -p, -F, -K options to kadmindNicolas Williams2012-10-052-14/+34
| | | | | | | | | | | | New options: -p path-to-kdb5_util -K path-to-kprop -F dump-file These are needed for testing without first having to install. ticket: 7372
* ipropd_svc.c DPRINT improvementsNicolas Williams2012-10-051-13/+34
| | | | Make DPRINT a varargs macro and add some new debug prints.
* Fix kdb5_util dump raceNicolas Williams2012-10-052-34/+32
| | | | ticket: 7377
* Cleanup dump_db()Nicolas Williams2012-10-051-20/+14
|
* Use a single global dump for iprop full syncsNicolas Williams2012-10-055-89/+215
| | | | | | | | | | | | | | | | | | | | | | | | | | Use a global dump (the default dump file) for full syncs for iprop. When a slave asks for a fullsync we kprop the existing global dump to it if that is good enough, else we dump the DB and send the new global dump. Before this change kadmind would run kdb5_util dump -i... each time a slave asked for a full dump. This was done in a sub-process, thankfully, but it was still a waste of time and storage (e.g., if one has a huge KDB). Also, long dump times might cause a slave to give up (the timeout for this is now configurable). But since iprop dumps bear a serial number and timestamp and since slaves will resync from that point forward, it doesn't matter if the dump we send a slave is fresh as long as it is fresh enough (i.e., that its sno and timestamp are in the ulog). Also: - Rename dumps into place instead of unlink, create, write (but we still keep the dump ok files as lock files and as a method of signaling to kprop that the dump is complete). ticket: 7371
* Improve kpropd debug and syslog outputNicolas Williams2012-10-051-39/+123
| | | | | | | Add additional debug output and syslogs. Remove "kpropd:" from syslogs. Always call openlog(). Clean up C style of a few messages. [ghudson@mit.edu: split and combine commits; commit message]
* Improve kpropd behavior in iprop modeNicolas Williams2012-10-054-222/+181
| | | | | | | | | | | | | | | | | | | | | | - Make kpropd in iprop mode fork a child to listen for kprops from the master. The child writes progress and outcome reports to the parent for each kprop. This fixes a race between asking for a full resync and setting up a listener socket for it. - Add runonce (-t) for kpropd do_standalone() too. - Add a new iprop parameter: iprop_resync_timeout. kpropd will keep asking for incremental updates while waiting for a full resync to finish, and will re-request a full resync if kadmind continues to indicate that one is needed after this timeout passes since the previous full resync was requested. - Allow polling intervals less than 10 seconds. [ghudson@mit.edu: split out debug output changes; note polling interval change in commit message] ticket: 7373
* Add Python scripts to check for C style issuesGreg Hudson2012-10-042-0/+450
| | | | | | | | | | | util/cstyle-file.py checks a file for C style issues and displays line-by-line output. It is not terribly sophisticated, and can probably be improved upon (e.g. by doing an emacs batch-reindent of the file and checking for differences in indentation). util/cstyle.py produces diffs using git, runs the file checker on each modified C source file in each diff, and displays the output lines attribute to the diff.
* GENC should always export composite namesLuke Howard2012-10-032-10/+12
| | | | | | | | | | | RFC 6680 requires that gss_export_name_composite begin the output token with 04 02. So we must produce a composite token even if the name has no authdata, and be able to consume a composite token with no authdata attributes. [ghudson@mit.edu: expanded commit message] ticket: 7400 (new)
* Add SPI calls to import objects by mech oidSimo Sorce2012-10-026-17/+85
| | | | | | | | | | An interposer mech needs to be able to handle multiple mechanisms. When importing a mech token for a name, cred, or context, the interposer mech needs to know the mech type of the token being imported. To make this work, add SPI calls which accept a mech type argument. [ghudson@mit.edu: Stylistic changes, commit squashing, commit message]
* Use interposer mechanisms in mechglue functionsSimo Sorce2012-10-0214-112/+183
| | | | | | | | | | Wherever a GSSAPI mechglue function accepts a mech OID from the caller, use gssint_select_mech_type() to choose the mechanism to use. Wherever a mechglue function outputs a mech OID to the caller, use gssint_get_public_oid() or gssint_make_public_oid_set() to expose the public mech OID. [ghudson@mit.edu: Stylistic changes, commit squashing, commit message]
* Add primitives for using interposed mechanismsSimo Sorce2012-10-022-4/+152
| | | | | | | | | | Add gssint_select_mechanism() to determine what mechanism to use for a caller-specified OID, gssint_get_public_oid() to determine what mechanism to expose to the caller, and gssint_make_public_oid_set to translate an array of mech OIDs into a set of public OIDs. In gssint_get_mechanism(), match interposed OIDs as well as real ones. [ghudson@mit.edu: Stylistic changes, commit squashing, commit message]
* Add support for loading interposer modulesSimo Sorce2012-10-022-24/+247
| | | | | | | | | | | | Extend the syntax of the gss mech config file to allow a module type delimited by triangle brackets. If the module type is "interposer", flag the mechanism entry as being an interposer mechanism. A module marked as an interposer is loaded immediately (so it can interpose a built-in mechanism) and produces a list of OIDs to interpose. Interposer mechanisms are not exposed to applications. [ghudson@mit.edu: Stylistic changes, commit squashing, commit message]
* Cache TGS-REPs tooTom Yu2012-09-271-1/+1
| | | | | | | | | | Changes in r25660 inadvertently failed to insert TGS-REPs into the lookaside cache. Call finish_dispatch_cache() at the end of dispatch() to handle this case. ticket: 7388 (new) target_version: 1.10.4 tags: pullup
* Add version info for ccapiserver.exeBen Kaduk2012-09-272-2/+14
| | | | | | | | | Executables and shared libraries should have a file version, so that the upgrade process works as expected. ticket: 7386 (new) tags: pullup target_version: 1.10.4
* Fix typoBen Kaduk2012-09-271-1/+1
| | | | | | | | | | Actually expand the OUTPRE variable instead of just using a literal string. ticket: 7387 (new) subject: Windows build leaves (OUTPRE)/krb5ccNN.res in ccapi/lib/win/srctmp tags: pullup target_version: 1.10.4
* Remove some dead Makefile codeBen Kaduk2012-09-252-30/+0
| | | | | FILES is unused in util/{ss,et}/Makefile.in; some other unused variables were nearby.
* Remove kerbsrc.winBen Kaduk2012-09-253-75/+11
| | | | | | | | | | | | | | | | It has been unloved and broken repeatedly for many years, requiring updating of several variables whenever new directories are added and similar tedia. It was originally intended to avoid the need for Unix utilities on Windows, but Microsoft provides the Utilities and SDK for UNIX-based Applications which is enough rope to do a native build. Leave behind a warning message to anyone who does try to build the target. Clean up some now-unused infrastructure in the build system. ticket: 7367 (new)
* Remove kerbsrc-ntBen Kaduk2012-09-241-8/+0
| | | | | | NT is long-gone; we don't need to keep a special-case error message around telling people not to use it. Clean out the unneeded code from the Makefile.in
* Remove kerbsrc83Ben Kaduk2012-09-241-9/+0
| | | | | | | It's been a long time since systems were limited to 8.3 format for file names. No one should be thinking to try and build this target, and if they do, we don't need a custom error message anymore. Clean out the unneeded code from the Makefile.in.
* Update FILES and WINFILES for kerbsrc.zipBen Kaduk2012-09-241-3/+8
| | | | | | | | | | | | Note that windows/wshelper/* was removed from the list, as it doesn't exist. The kerbsrc.zip target is slated for removal, but attempt to make it more correct before removing it should it need to be revived. Submitted by: Blaine Elzey blaine.elzey at alcatel-lucent.com ticket: 7364 (new)
* Do not add empty dir to the include search listBen Kaduk2012-09-241-1/+1
| | | | | | windows/leashdll/include contains only a krb4 directory. We have a dubious need for the latter through AFSroutines.c, but the former can be eliminated.
* Update windows/READMEBen Kaduk2012-09-241-99/+92
| | | | | | | | | | | | | | | | | The build instructions have changed somewhat, as have the requirements for a build environment. The default behavior for KRB5_CONFIG and KRB5CCNAME has also changed. Attempt to remove mention of overly specific Windows versions that are now quite old when the behavior persists in newer versions of Windows. Document the usage of DNS by default and the reduced need for a large krb5.ini file. Talk a little more about the LSA cache. The kerbsrc.win target is no longer supported. ticket: 7363 (new) target_version: 1.10.4 tags: pullup
* Fix t_s4u2proxy_krb5 cleanupGreg Hudson2012-09-241-1/+3
| | | | | | | Unlike most GSS test programs, t_s4u2proxy_krb5 uses a cleanup handler, so we have to be careful to initialize everything we clean up--particularly service2_name, which is initialized after a possible goto. Also, remember to release acceptor_name.
* Fix typoBen Kaduk2012-09-241-2/+2
|
* Export more krb5_rc symbols on WindowsGreg Hudson2012-09-211-0/+3
| | | | | krb5_rc_resolve_full, krb5_rc_resolve_get_name, and krb5_rc_resolve_get_type are also now used in the krb5 mech.
generated by cgit (git 2.34.1) at 2025-09-27 03:00:03 +0000